joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x10c0
call fcn.0040c440
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41d8a0
sar esi, 1
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44fa0c]
mov ebx, dword [esp + 0x2c]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41d8d4
mov eax, 0xffffffff
jmp 0x41d8d7
lea eax, [ebx + ebx]
push eax
call fcn.0040c4e0
add esp, 4
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov dword [esp + 0x1c], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44fa0c]
mov eax, dword [esp + 0x2c]
mov ecx, eax
and ecx, 0xd
xor eax, 0xd
lea eax, [eax + ecx*2]
test eax, eax
js 0x41d911
add eax, eax
mov edi, eax
push edi
call fcn.0040c4e0
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0xbc], 0x61d267c0
mov dword [esp + 0xc0], 0x5def63c3
mov dword [esp + 0xc4], 0x59be5fd0
mov dword [esp + 0xc8], 0x55c55bf6
mov dword [esp + 0xcc], 0x51db57c6
mov dword [esp + 0xd0], 0x4dc353cb
mov dword [esp + 0xd4], 0x494e4fda
mov dword [esp + 0xd8], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0xbc]
mov esi, eax
and esi, 0x32
mov edi, ecx
xor edi, 0x99
add edi, esi
lea ebx, [edx + edx]
not ebx
add ebx, edx
xor ebx, edx
and ebx, edi
xor ebx, edx
add bl, 3
mov byte [esp + ecx + 0xbc], bl
inc ecx
add eax, 2
cmp ecx, 0x20
jne 0x41d980
mov eax, dword [esp + 0x14]
movzx ecx, word [eax]
mov edi, dword [esp + 4]
mov eax, edi
test cx, cx
je 0x41d9f1
mov eax, dword [esp + 0x14]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d9e0
mov word [eax], 0
movzx ecx, word [esp + 0xbc]
test cx, cx
je 0x41da21
lea edx, [esp + 0xbe]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41da10
mov word [eax], 0
lea eax, [esp + 0x50]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00443740
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44a7a4]
Function at 0x422b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x422b50
sar ebp, 1
lea eax, [esp + 8]
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x44fa0c]
mov edi, dword [esp + 8]
test edi, edi
jns 0x422b7f
mov eax, 0xffffffff
jmp 0x422b82
lea eax, [edi + edi]
push eax
call fcn.0040c4e0
add esp, 4
mov esi, eax
lea eax, [esp + 8]
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x44fa0c]
lea ebx, [esp + 0xc]
push ebx
push esi
call fcn.00443920
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44ab0c]
Function at 0x4270b0
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x74
mov eax, dword [0x44fa0c]
mov dword [esp], 0x21f227db
mov dword [esp + 4], 0x3d9f2391
mov dword [esp + 8], 0x398a3f9f
mov dword [esp + 0xc], 0x358a3bfb
mov dword [esp + 0x10], 0x31ea3784
mov dword [esp + 0x14], 0xdbe3393
mov dword [esp + 0x18], 0x9f10faf
mov dword [esp + 0x1c], 0xb08
xor ecx, ecx
xor edx, edx
nop
mov esi, ecx
and esi, 0x12
mov ebx, edx
xor ebx, 0xc9
add ebx, esi
xor bl, byte [esp + edx]
add bl, 0x13
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 0x20
jne 0x427100
lea edi, [esp + 0x54]
mov ecx, esp
push edi
push 0
push 0
push 0xe
push ecx
push 0
call eax
mov ebx, dword [esp + 0x54]
test ebx, ebx
jns 0x427142
mov eax, 0xffffffff
jmp 0x427145
lea eax, [ebx + ebx]
push eax
call fcn.0040c4e0
add esp, 4
mov esi, eax
mov eax, dword [0x44fa0c]
mov dword [esp], 0x4fb2496d
mov dword [esp + 4], 0x43a54ddf
mov dword [esp + 8], 0x47da41a1
mov dword [esp + 0xc], 0x7bea4585
mov dword [esp + 0x10], 0x7fba79e8
mov dword [esp + 0x14], 0x73e67d9d
mov dword [esp + 0x18], 0x77537191
mov word [esp + 0x1c], 0x7574
mov dword [esp + 0x1e], 0
mov byte [esp + 0x22], 0
mov ecx, 0x7c6f9692
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x7c6f9692]
xor edx, ecx
mov ebp, edx
not ebp
add edx, 0x25
and ebp, 1
or edx, 1
add edx, ebp
mov byte [esp + ecx - 0x7c6f9692], dl
inc ecx
cmp ecx, 0x7c6f96b5
jne 0x4271b0
push edi
push ebx
push esi
push 0xe
lea ecx, [esp + 0x10]
push ecx
push 0
call eax
mov eax, dword [esp + 0x54]
mov ecx, eax
add ecx, 9
jns 0x4271f9
mov eax, 0xffffffff
jmp 0x427200
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040c4e0
add esp, 4
mov dword [esp + 0x50], eax
mov dword [esp], 0xd98adba8
mov dword [esp + 4], 0xddbbdfbf
mov dword [esp + 8], 0xd1b5d3a1
mov dword [esp + 0xc], 0xd5add7a9
mov dword [esp + 0x10], 0xe9eaeba1
mov byte [esp + 0x14], 0
mov eax, 0x2981c94f
nop
nop
movzx edx, byte [esp + eax - 0x2981c94f]
lea ecx, [eax - 0x2981c900]
and ecx, edx
mov edi, ecx
and edi, 2
mov ebx, ecx
or ebx, 0xfffffffd
inc ebx
mov ebp, ecx
and ebp, 0x7d
imul ebp, ebx
or ecx, 2
imul ecx, edi
add ebp, edx
sub ebp, ecx
lea ecx, [eax + ebp]
lea edx, [eax + ebp]
add edx, 0xffffff80
and edx, 0x74
or ecx, 0x74
add ecx, edx
inc cl
mov byte [esp + eax - 0x2981c94f], cl
inc eax
cmp eax, 0x2981c964
jne 0x427240
movzx ecx, word [esi]
mov edi, dword [esp + 0x50]
mov eax, edi
test cx, cx
je 0x4272c1
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4272b0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4272f1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4272e0
mov word [eax], 0
lea eax, [esp + 0x70]
push eax
push edi
call fcn.00443920
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b284]
Function at 0x42cde0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x7c
mov eax, dword [0x44fa0c]
mov dword [esp + 0x24], 0x99559bb7
mov dword [esp + 0x28], 0xa556a768
mov dword [esp + 0x2c], 0xa14da368
mov dword [esp + 0x30], 0xad41af5c
mov dword [esp + 0x34], 0xa94eab87
mov dword [esp + 0x38], 0xb547b77a
mov dword [esp + 0x3c], 0xb159b348
mov dword [esp + 0x40], 0xbd51bf40
mov dword [esp + 0x44], 0xb98fbb50
mov dword [esp + 0x48], 0x45a2478d
mov dword [esp + 0x4c], 0x41a943b9
mov dword [esp + 0x50], 0x4db34fbd
mov dword [esp + 0x54], 0x49bb4bbb
mov dword [esp + 0x58], 0x556457ba
mov dword [esp + 0x5c], 0x51a153ac
mov dword [esp + 0x60], 0x5d5e5fa4
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0x5b
xor dl, byte [esp + ecx + 0x24]
add dl, 0x39
mov byte [esp + ecx + 0x24], dl
inc ecx
cmp ecx, 0x40
jne 0x42ce70
lea esi, [esp + 0x78]
lea ecx, [esp + 0x24]
push esi
push 0
push 0
push 0x1f
push ecx
push 0
call eax
mov edi, dword [esp + 0x78]
test edi, edi
jns 0x42cea9
mov eax, 0xffffffff
jmp 0x42ceac
lea eax, [edi + edi]
push eax
call fcn.0040c4e0
add esp, 4
mov dword [esp + 0x70], eax
mov eax, dword [0x44fa0c]
mov dword [esp + 0x24], 0xc105c72b
mov dword [esp + 0x28], 0xcd52c350
mov dword [esp + 0x2c], 0xc96dcf00
mov dword [esp + 0x30], 0xb569cb54
mov dword [esp + 0x34], 0xb112b75b
mov dword [esp + 0x38], 0xbd23b306
mov dword [esp + 0x3c], 0xb911bf20
mov dword [esp + 0x40], 0xa519bb28
mov dword [esp + 0x44], 0xa173a708
mov dword [esp + 0x48], 0xad06a375
mov dword [esp + 0x4c], 0xa901af31
mov dword [esp + 0x50], 0x9537ab35
mov dword [esp + 0x54], 0x9107973f
mov dword [esp + 0x58], 0x9d449306
mov dword [esp + 0x5c], 0x99099f04
mov dword [esp + 0x60], 0x859a9b0c
mov word [esp + 0x64], 0
mov ecx, 0x9fecfb31
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0x601304f3]
mov edx, ecx
and edx, ebx
add edx, edx
add ebx, ecx
mov ebp, edx
xor ebp, ebx
not edx
and edx, ebx
add edx, edx
sub edx, ebp
mov ebx, 1
sub ebx, edx
mov ebp, 0xf5
sub ebp, edx
and edx, 1
and ebx, 1
and ebp, 0xfe
or ebp, ebx
xor ebp, 0xfe
lea edx, [edx*2]
add edx, ebp
mov byte [esp + ecx + 0x601304f3], dl
inc ecx
cmp ecx, 0x9fecfb73
jne 0x42cf50
push esi
push edi
mov esi, dword [esp + 0x78]
push esi
push 0x1f
lea ecx, [esp + 0x34]
push ecx
push 0
call eax
lea eax, [esp + 0x20]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00443740
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44bd48]
Function at 0x434e40
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x434fb7
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
jmp 0x434e80
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
jmp 0x434e94
cmp edi, 0
setne al
jmp 0x434e9c
xor ebx, ebx
test al, 1
jne 0x434ea7
jmp 0x434faf
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
jmp 0x434eb7
mov dword [esp], ebp
call fcn.0041cf50
jmp 0x434ec1
cmp eax, 0
setne cl
jmp 0x434ec9
xor ebx, ebx
test cl, 1
jne 0x434ed5
jmp 0x434fa3
mov cl, byte [esp + 0xc]
mov byte [esp + 0x10], cl
mov byte [esp + 0x14], 0xc9
mov byte [esp + 0x15], 0x33
mov byte [esp + 0x16], 0x2d
mov byte [esp + 0x17], 0x31
mov byte [esp + 0x18], 0x22
mov byte [esp + 0x19], 0x32
mov byte [esp + 0x1a], 0x21
mov byte [esp + 0x1b], 0x3f
mov byte [esp + 0x1c], 0x20
mov byte [esp + 0x1d], 0xf9
mov byte [esp + 0x1e], 0x32
mov byte [esp + 0x1f], 0x31
mov byte [esp + 0x20], 0x34
mov byte [esp + 0x21], 0x8b
mov ecx, 0xe
mov byte [esp + ecx + 0x14], 0
add ecx, 1
cmp ecx, 0x12
jne 0x434f28
xor esi, esi
cmp esi, 0x12
jae 0x434f83
movzx edx, byte [esp + esi + 0x14]
mov ebx, 0x18993e5e
sub ebx, esi
and ebx, 0x1ad149f5
mov ecx, esi
add ecx, 0xa766c1a1
and ecx, 0xe52eb60a
xor edx, 0x1ad149f5
or ecx, ebx
mov ebx, edx
and ebx, ecx
shl ebx, 1
add edx, ecx
sub edx, ebx
add dl, 0xdb
mov byte [esp + esi + 0x14], dl
mov ecx, esi
shl ecx, 1
and ecx, 2
xor esi, 1
add esi, ecx
jmp 0x434f37
lea edx, [esp + 0x14]
mov ecx, dword [esp + 0x3c]
mov dword [esp], edx
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
call fcn.0040cf40
sub esp, 0xc
mov bl, al
and bl, 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x434fb7
and bl, 1
movzx eax, bl
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x434e9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x434fb7
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
jmp 0x434e80
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
jmp 0x434e94
cmp edi, 0
setne al
jmp 0x434e9c
xor ebx, ebx
test al, 1
jne 0x434ea7
jmp 0x434faf
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
jmp 0x434eb7
mov dword [esp], ebp
call fcn.0041cf50
jmp 0x434ec1
cmp eax, 0
setne cl
jmp 0x434ec9
xor ebx, ebx
test cl, 1
jne 0x434ed5
jmp 0x434fa3
mov cl, byte [esp + 0xc]
mov byte [esp + 0x10], cl
mov byte [esp + 0x14], 0xc9
mov byte [esp + 0x15], 0x33
mov byte [esp + 0x16], 0x2d
mov byte [esp + 0x17], 0x31
mov byte [esp + 0x18], 0x22
mov byte [esp + 0x19], 0x32
mov byte [esp + 0x1a], 0x21
mov byte [esp + 0x1b], 0x3f
mov byte [esp + 0x1c], 0x20
mov byte [esp + 0x1d], 0xf9
mov byte [esp + 0x1e], 0x32
mov byte [esp + 0x1f], 0x31
mov byte [esp + 0x20], 0x34
mov byte [esp + 0x21], 0x8b
mov ecx, 0xe
mov byte [esp + ecx + 0x14], 0
add ecx, 1
cmp ecx, 0x12
jne 0x434f28
xor esi, esi
cmp esi, 0x12
jae 0x434f83
movzx edx, byte [esp + esi + 0x14]
mov ebx, 0x18993e5e
sub ebx, esi
and ebx, 0x1ad149f5
mov ecx, esi
add ecx, 0xa766c1a1
and ecx, 0xe52eb60a
xor edx, 0x1ad149f5
or ecx, ebx
mov ebx, edx
and ebx, ecx
shl ebx, 1
add edx, ecx
sub edx, ebx
add dl, 0xdb
mov byte [esp + esi + 0x14], dl
mov ecx, esi
shl ecx, 1
and ecx, 2
xor esi, 1
add esi, ecx
jmp 0x434f37
lea edx, [esp + 0x14]
mov ecx, dword [esp + 0x3c]
mov dword [esp], edx
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
call fcn.0040cf40
sub esp, 0xc
mov bl, al
and bl, 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x434fb7
and bl, 1
movzx eax, bl
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439ac0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa8
mov edi, dword [ebp + 8]
mov eax, dword [0x44fa0c]
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x63d16185
mov dword [esp + 0x10], 0x67f565ed
mov dword [esp + 0x14], 0x5bff59cc
mov dword [esp + 0x18], 0x5f9a5dc1
mov dword [esp + 0x1c], 0x53cb51c2
mov dword [esp + 0x20], 0x57f355c2
mov dword [esp + 0x24], 0x4b4a49ad
mov dword [esp + 0x28], 0
mov ecx, 0xb9b59518
mov eax, 0x464a6ae7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0x464a6af4]
mov edx, eax
and edx, 0x42020a81
mov esi, ecx
and esi, 0x99b1803e
or esi, edx
xor esi, ebx
mov edx, esi
and edx, 0xd23280f5
xor edx, 0x94308074
and esi, 0x9810a0a
xor esi, 0x41f00
sub esi, edx
mov edx, esi
and edx, 7
xor esi, 0x87
lea edx, [esi + edx*2]
add dl, 0xf6
mov byte [esp + ecx + 0x464a6af4], dl
inc ecx
dec eax
cmp ecx, 0xb9b59538
jne 0x439b30
lea eax, [esp + 0x68]
lea esi, [esp + 0x94]
lea ecx, [esp + 0xc]
push eax
push 8
push esi
push 0xd
push ecx
push 0
call dword [esp + 0x1c]
shr eax, 0x1f
jmp dword [eax*4 + 0x44d000]
Function at 0x43d3e0
Capabilities:
Encode data using xor

Disassembly:
push eax
mov eax, dword [esp + 8]
mov dword [esp], 0x21262774
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0x39
xor dl, byte [esp + ecx]
add dl, 0xe3
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 4
jne 0x43d3f0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x457a2c]
pop ecx
ret

Function at 0x43d420
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44d630]

Function at 0x43d4b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], 0
mov dword [esp], 0x989b9a9d
mov word [esp + 4], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 2
mov edx, ecx
xor edx, 0x21
add edx, esi
add dl, 0x3a
xor dl, byte [esp + ecx]
add dl, 0x39
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 6
jne 0x43d4e0
mov edi, dword [esp]
mov eax, dword [0x44fa10]
test eax, eax
je 0x43d556
xor ecx, ecx
mov edx, dword [0x44fa14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xc85f7986
je 0x43d530
inc ecx
cmp eax, ecx
jne 0x43d520
jmp 0x43d556
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43d556
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x44fa18]
push eax
call fcn.00440700
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43d675
push dword [esp + 0xc]
call fcn.0043d3e0
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], ecx
mov dword [esp], 0x989b9a9d
mov word [esp + 4], 0
xor edx, edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 2
mov ecx, edi
xor ecx, 0x21
add ecx, esi
add cl, 0x3a
xor cl, byte [esp + edi]
add cl, 0x39
mov byte [esp + edi], cl
inc edi
add edx, 2
cmp edi, 6
jne 0x43d590
mov edi, dword [esp]
mov edx, dword [0x44fa10]
test edx, edx
je 0x43d60c
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x44fa14]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0xc85f7986
je 0x43d5e2
inc ebp
cmp edx, ebp
jne 0x43d5d0
mov ebp, ecx
jmp 0x43d60c
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
mov ebp, ecx
je 0x43d60c
push 0
push dword [esp + 0xc]
push eax
push 5
push 4
push dword [0x44fa18]
push edx
mov esi, eax
call fcn.00440700
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43d66c
mov dword [esp + 8], ebp
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43d645
add edi, 2
cmp si, bp
je 0x43d630
cmp si, bp
je 0x43d657
mov esi, dword [ecx]
test esi, esi
jne 0x43d620
mov edi, 0xc0000225
jmp 0x43d66c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 8]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043d420
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43d6b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43d770
xor eax, eax
cmp dword [ecx], 0
jne 0x43d7a0
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x989b9a9d
mov word [esp + 4], 0
xor eax, eax
xor esi, esi
nop
nop
nop
mov edi, eax
and edi, 2
mov ebx, esi
xor ebx, 0x21
add ebx, edi
add bl, 0x3a
xor bl, byte [esp + esi]
add bl, 0x39
mov byte [esp + esi], bl
inc esi
add eax, 2
cmp esi, 6
jne 0x43d720
mov eax, dword [esp]
mov esi, dword [0x44fa10]
test esi, esi
je 0x43d7a0
xor edi, edi
mov ebx, dword [0x44fa14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3ba5404
je 0x43d7a9
inc edi
cmp esi, edi
jne 0x43d760
jmp 0x43d7a0
mov dword [esp + 8], 0x5f9e9990
lea eax, [esp + 8]
xor ecx, ecx
xor edx, edx
mov ebx, edx
and bl, 0xfc
add bl, cl
xor bl, byte [eax]
xor bl, 0x1a
add bl, 0x7e
mov byte [eax], bl
inc eax
add edx, 2
inc cl
cmp edx, 8
jne 0x43d780
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43d7a0
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44fa18]
push esi
call fcn.00440700
add esp, 0x1c
jmp 0x43d7a0

Function at 0x43d7e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43d88a
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x989b9a9d
mov word [esp + 4], 0
xor edx, edx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, edx
and edi, 2
mov ebx, esi
xor ebx, 0x21
add ebx, edi
add bl, 0x3a
xor bl, byte [esp + esi]
add bl, 0x39
mov byte [esp + esi], bl
inc esi
add edx, 2
cmp esi, 6
jne 0x43d810
mov edx, dword [0x44fa10]
test edx, edx
je 0x43d87e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44fa14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43d860
inc edi
cmp edx, edi
jne 0x43d850
jmp 0x43d87e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43d87e
push eax
push 1
push dword [0x44fa18]
push edx
mov esi, ecx
call fcn.00440700
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43d890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 8], 0
je 0x43d910
mov edx, dword [ecx]
test edx, edx
je 0x43d910
mov dword [esp + 4], 0x989b9a9d
mov word [esp + 8], 0
xor eax, eax
xor esi, esi
nop
nop
nop
nop
nop
mov edi, eax
and edi, 2
mov ebx, esi
xor ebx, 0x21
add ebx, edi
add bl, 0x3a
xor bl, byte [esp + esi + 4]
add bl, 0x39
mov byte [esp + esi + 4], bl
inc esi
add eax, 2
cmp esi, 6
jne 0x43d8c0
mov eax, dword [esp + 4]
mov ebx, dword [0x44fa10]
test ebx, ebx
je 0x43d970
xor edi, edi
mov esi, dword [0x44fa14]
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edi*8], 0xdef797a3
je 0x43d94f
inc edi
cmp ebx, edi
jne 0x43d900
jmp 0x43d970
mov dword [esp + 4], 0xdf1e1910
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x3a
xor cl, byte [esp + eax + 4]
add cl, 0xde
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 7
jne 0x43d930
mov eax, dword [esp + 4]
jmp 0x43dadb
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
je 0x43d970
push dword [ebp + 8]
push edx
push 2
push dword [0x44fa18]
push esi
mov esi, ecx
call fcn.00440700
mov ecx, esi
add esp, 0x14
mov edi, dword [ebp + 0xc]
cmp edi, 1
mov esi, dword [ebp + 0x10]
mov edx, esi
sbb edx, 0
jl 0x43da35
cmp eax, 0xc000010a
jne 0x43da35
mov edx, 0xffffd8f0
mov eax, edi
mul edx
sub edx, edi
imul esi, esi, 0xffffd8f0
add esi, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov edx, dword [ecx]
mov dword [esp + 4], 0x989b9a9d
mov word [esp + 8], 0
xor eax, eax
xor esi, esi
nop
mov edi, eax
and edi, 2
mov ebx, esi
xor ebx, 0x21
add ebx, edi
add bl, 0x3a
xor bl, byte [esp + esi + 4]
add bl, 0x39
mov byte [esp + esi + 4], bl
inc esi
add eax, 2
cmp esi, 6
jne 0x43d9c0
mov eax, dword [esp + 4]
mov esi, dword [0x44fa10]
test esi, esi
je 0x43da35
xor edi, edi
mov ebx, dword [0x44fa14]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x53f09cfa
je 0x43da10
inc edi
cmp esi, edi
jne 0x43da00
jmp 0x43da35
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43da35
lea eax, [esp + 0x10]
push eax
push 0
push edx
push 3
push dword [0x44fa18]
push esi
mov esi, ecx
call fcn.00440700
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43dadb
mov edx, dword [ecx]
test edx, edx
je 0x43dadb
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x989b9a9d
mov word [esp + 8], 0
xor edx, edx
xor edi, edi
nop
nop
mov esi, edx
and esi, 2
mov ebx, edi
xor ebx, 0x21
add ebx, esi
add bl, 0x3a
xor bl, byte [esp + edi + 4]
add bl, 0x39
mov byte [esp + edi + 4], bl
inc edi
add edx, 2
cmp edi, 6
jne 0x43da60
mov esi, dword [0x44fa10]
test esi, esi
je 0x43dad5
mov edx, dword [esp + 4]
xor ebx, ebx
mov edi, dword [0x44fa14]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebx*8], 0x7e776f1
je 0x43dab0
inc ebx
cmp esi, ebx
jne 0x43daa0
jmp 0x43dad5
mov esi, dword [edi + ebx*8 + 4]
cmp esi, edx
je 0x43dad5
push dword [esp + 0xc]
push 1
push dword [0x44fa18]
push esi
mov esi, ecx
mov edi, eax
call fcn.00440700
mov eax, edi
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc