joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x436b99
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x436baa
cmp eax, 2
je 0x436c20
jmp 0x436c4d
push 0xbbf966b4
push dword [0x4491e8]
call fcn.0043bc60
add esp, 8
test eax, eax
je 0x436beb
mov ecx, dword [esi]
test ecx, ecx
je 0x436c18
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x436bf4
cmp dword [esp + 4], 0
je 0x436bf4
mov dword [esi + 4], 3
jmp 0x436c18
mov dword [esi + 4], 1
jmp 0x436c4d
lea eax, [esp + 0xc]
push eax
call fcn.0043c4d0
add esp, 4
test al, al
je 0x436c18
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x436c15
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x436c4d
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x451210]
call fcn.0043bc60
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x436ce4
mov ecx, dword [esi]
mov dword [esp + 4], 0xb8bbba85
mov word [esp + 8], 0
mov eax, 7
mov edx, 0x20
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 0x39
mov ebx, eax
and ebx, 6
or ebx, esi
xor bl, byte [esp + eax - 3]
xor bl, 0x39
add bl, 0x65
mov byte [esp + eax - 3], bl
inc eax
dec edx
cmp eax, 0xd
jne 0x436c70
mov eax, dword [esp + 4]
mov edx, dword [0x4491f4]
test edx, edx
je 0x436ce4
xor esi, esi
mov ebx, dword [0x4491f8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x436cc0
inc esi
cmp edx, esi
jne 0x436cb0
jmp 0x436ce4
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x436ce4
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 0x14
push edx
push dword [0x4491fc]
call fcn.00438f20
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x438e80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x445e00]

Function at 0x43a3d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x43a440
mov ecx, ebx
shr ecx, 2
mov eax, ebp
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, edx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
test bl, 1
je 0x43a5be
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x43a5be
mov dword [esp], 0x60676665
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
mov edx, eax
and edx, 1
mov edi, eax
and edi, 0xfffffffe
add edi, 0xff319399
xor edi, edx
lea edi, [edi + edx*2]
mov ebp, edi
and ebp, ecx
add ebp, ebp
mov edx, ebp
xor edx, edi
not edi
and edi, ebp
add edi, edi
sub edx, edi
add edx, ecx
mov ecx, edx
and ecx, 2
xor edx, 2
lea ecx, [edx + ecx*2]
inc cl
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x43a450
mov eax, dword [esp]
mov ecx, dword [0x4491f4]
test ecx, ecx
je 0x43a4c0
xor edx, edx
mov edi, dword [0x4491f8]
mov ebp, dword [esp + 0x20]
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x43a4c6
inc edx
cmp ecx, edx
jne 0x43a4b0
jmp 0x43a4f0
mov ebp, dword [esp + 0x20]
jmp 0x43a4f0
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43a4f0
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1c
push ecx
push dword [0x4491fc]
call fcn.00438f20
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x24]
js 0x43a5be
push 0x732f71fd
push dword [0x451210]
call fcn.0043bc60
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp + 4], 0x60676665
xor edx, edx
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 4]
mov edi, edx
and edi, 1
mov ebx, edx
and ebx, 0xfffffffe
add ebx, 0xff319399
xor ebx, edi
lea ebx, [ebx + edi*2]
mov ebp, ebx
and ebp, esi
add ebp, ebp
mov edi, ebp
xor edi, ebx
not ebx
and ebx, ebp
add ebx, ebx
sub edi, ebx
add edi, esi
mov esi, edi
and esi, 2
xor edi, 2
lea ebx, [edi + esi*2]
inc bl
mov byte [esp + edx + 4], bl
inc edx
cmp edx, 4
jne 0x43a530
mov edx, dword [0x4491f4]
test edx, edx
je 0x43a5be
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x4491f8]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43a5a0
inc edi
cmp edx, edi
jne 0x43a590
jmp 0x43a5be
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43a5be
push ecx
push 4
push edx
push dword [0x4491fc]
mov esi, eax
call fcn.00438f20
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b750
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 4], 0xc9cacb1c
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx + 4]
mov esi, eax
and esi, 2
mov edi, edx
xor edi, 0x3b3fc3f5
lea ebp, [esi + edi]
add esi, edi
add esi, 0x9fc3ca3e
mov edi, esi
and edi, ecx
lea ebx, [ecx + ebp]
add ebx, 0x9fc3ca3e
add edi, edi
sub ebx, edi
mov edi, 0x603c35c1
sub edi, ebp
or ebx, edi
not ebx
add ebx, ebx
mov ebp, ebx
not ebp
and ebp, esi
and ebx, edi
sub ebx, ebp
mov esi, ecx
not esi
and esi, ebx
not ebx
and ebx, ecx
sub ebx, esi
inc bl
mov byte [esp + edx + 4], bl
inc edx
add eax, 2
cmp edx, 4
jne case.default.0x43b7e1
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x20], 0
sete cl
jmp dword [ecx*4 + 0x446848]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp], 0
mov esi, dword [edx]
xor eax, eax
cmp esi, edx
setne al
mov dword [esp + 8], edx
jmp dword [eax*4 + 0x446860]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov bh, 0x43
add byte [ecx + 0x10043b8], ah
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add al, ch
mov bh, 0x43
add byte [edi + 0x270043b8], ah
mov eax, 0xb8100043
inc ebx
add byte [0x100043b8], bh
mov eax, 0xb8920043
inc ebx
add byte [edi + 0x170043b8], ah
mov eax, 0xb8d00043
inc ebx
add al, dl
mov eax, 0xb8d00043
inc ebx
add dh, dl
mov eax, 0xb9200043
inc ebx
add ah, bl
mov eax, 0xb9200043
inc ebx
add byte [eax - 0x47], ch
inc ebx
add byte [ecx - 0x47], bh
inc ebx
add byte [ebx - 0x47], bh
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ebx - 0x47], bh
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [ebx - 0x46], al
inc ebx
add ch, ah
mov ecx, 0xba200043
inc ebx
add byte [esi], ch
mov edx, 0xb9d70043
inc ebx
add byte [ebx - 0x46], al
inc ebx
add byte [edx - 0x46], ah
inc ebx
add byte [edi - 0x46], dl
inc ebx
add byte [eax - 0x46], ah
inc ebx
add byte [eax - 0x46], ah
inc ebx
add byte [edx - 0x46], ah
inc ebx
add byte [eax - 0x46], ah
inc ebx
add byte [edx], al
mov ebx, 0xbae80043
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add al, ch
mov edx, 0xbb000043
inc ebx
add byte [eax], al
mov ebx, 0xbb000043
inc ebx
add byte [edx], al
mov ebx, 0xbb800043
inc ebx
add byte [eax], dh
mov ebx, 0xbb400043
inc ebx
add byte [eax - 0x45], al
inc ebx
add byte [eax - 0x45], al
inc ebx
add byte [edx - 0x45], al
inc ebx
add byte [ecx - 0x45], dl
inc ebx
add byte [eax - 0x45], ah
inc ebx
add byte [eax + 0x6c0043bb], al
mov ebx, 0xbb700043
inc ebx
add byte [eax - 0x45], dh
inc ebx
add byte [eax - 0x45], dh
inc ebx
add byte [edx - 0x45], dh
inc ebx
add al, bl
Function at 0x43bb90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x1f1e1968
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x3a
xor dl, byte [esp + eax]
add dl, 0xde
mov byte [esp + eax], dl
inc eax
cmp eax, 8
jne case.default.0x43bbd1
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x446948]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [0x44699c]
mov edi, dword [edx]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x446980]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov ecx, dword [case.0x43bbd1.7]
nop
nop
nop
nop
nop
nop
jmp ecx
add esp, 8
pop esi
pop edi
pop ebx
ret
mov ebx, 0xbc3e0043
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [esi], bh
mov esp, 0x10043
add byte [eax], al
push eax
mov esp, -1135607741
inc ebx
add byte [edx - 0x44], dl
inc ebx
add byte [eax - 0x44], dl
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx - 0x44], bl
inc ebx
add byte [edx - 0x44], dl
inc ebx
add byte [esp + edi*4], bl
inc ebx
add byte [eax], al
mov esp, 0xbc300043
inc ebx
add byte [eax], dh
mov esp, 0xbc300043
inc ebx
add byte [eax], dh
mov esp, 0xbc320043
inc ebx
add byte [edx - 0x44], dl
inc ebx
add byte [esp + edi*4], cl
inc ebx
add bl, ah
Function at 0x43c520
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43c530
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x43c54b
mov eax, 0xffffffff
jmp 0x43c54e
add eax, 0xa
push eax
call fcn.004082d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43c591
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43c580
mov word [ecx], 0
lea ecx, [edi*2 + 8]
mov word [esp + 8], cx
lea ecx, [edi*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x60676665
mov ecx, 0xff319399
mov edx, 0x66
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0xce6c67]
mov edi, ecx
or edi, esi
not esi
or esi, edx
lea ebx, [esi + edi]
add edi, esi
inc edi
lea ebp, [ebx*2 + 2]
mov esi, ebp
and esi, 4
mov ebx, edi
xor ebx, 2
add ebx, esi
and ebp, 2
and edi, 1
and ebx, 0xfe
or ebx, edi
xor ebx, 1
add ebx, ebp
mov byte [esp + ecx + 0xce6c67], bl
inc ecx
dec edx
cmp ecx, 0xff31939d
jne 0x43c600
mov esi, dword [esp]
mov ecx, dword [0x4491f4]
test ecx, ecx
je 0x43c6cf
xor edx, edx
mov edi, dword [0x4491f8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xbb9b186e
je 0x43c68a
mov ebx, edx
and ebx, 1
xor edx, 1
lea edx, [edx + ebx*2]
cmp edx, ecx
jb 0x43c670
jmp 0x43c6cf
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43c6cf
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x4491fc]
mov edi, eax
call fcn.00438f20
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.004082e0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c6f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43c700
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43c71b
mov eax, 0xffffffff
jmp 0x43c71e
add eax, 0xa
push eax
call fcn.004082d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x43c761
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x43c750
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov ebx, esi
xor ebx, 2
imul ebx, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x60676665
mov ecx, 0xff319399
mov edx, 0x66
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0xce6c67]
mov ebx, ecx
or ebx, esi
not esi
or esi, edx
lea edi, [esi + ebx]
lea ebp, [esi + ebx]
inc ebp
lea esi, [edi*2 + 2]
mov edi, esi
and edi, 4
mov ebx, ebp
xor ebx, 2
add ebx, edi
and esi, 2
and ebp, 1
and ebx, 0xfe
or ebx, ebp
xor ebx, 1
add ebx, esi
mov byte [esp + ecx + 0xce6c67], bl
inc ecx
dec edx
cmp ecx, 0xff31939d
jne 0x43c7e0
mov esi, dword [esp]
mov ecx, dword [0x4491f4]
test ecx, ecx
je 0x43c897
xor edx, edx
mov ebx, dword [0x4491f8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x43c860
inc edx
cmp ecx, edx
jne 0x43c850
jmp 0x43c897
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43c897
mov edx, esp
lea esi, [esp + 0x10]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x4491fc]
mov edi, eax
call fcn.00438f20
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.004082e0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov edi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43c8d0
mov esi, eax
sar esi, 1
and eax, 8
mov ebx, esi
xor ebx, 4
add ebx, eax
mov ecx, esi
and ecx, 1
mov eax, ebx
or eax, 1
add eax, ecx
jns 0x43c8fe
mov eax, 0xffffffff
jmp 0x43c900
add eax, eax
push eax
call fcn.004082d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp + 4], eax
mov ecx, eax
add ecx, 8
movzx edx, word [edi]
test dx, dx
je 0x43c941
add edi, 2
mov word [ecx], dx
add ecx, 2
movzx edx, word [edi]
add edi, 2
test dx, dx
jne 0x43c930
mov word [ecx], 0
mov ecx, ebx
or ecx, 2
and esi, 2
imul ecx, esi
and ebx, 0xfffd
xor esi, 2
imul esi, ebx
lea edx, [ecx + esi]
mov word [esp + 8], dx
add ecx, esi
add ecx, 2
mov word [esp + 0xa], cx
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x60676665
mov ecx, 0xff319399
mov eax, 0x66
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0xce6c8f]
mov edi, ecx
or edi, esi
not esi
or esi, eax
lea ebx, [esi + edi]
add edi, esi
inc edi
lea edx, [ebx*2 + 2]
mov esi, edx
and esi, 4
mov ebx, edi
xor ebx, 2
add ebx, esi
and edi, 1
and ebx, 0xfe
or ebx, edi
and edx, 2
xor ebx, 1
add ebx, edx
mov byte [esp + ecx + 0xce6c8f], bl
inc ecx
dec eax
cmp ecx, 0xff31939d
jne 0x43c9c0
mov esi, dword [esp + 0x28]
mov ecx, dword [0x4491f4]
test ecx, ecx
je 0x43ca65
xor edx, edx
mov edi, dword [0x4491f8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x50dc24c7
je 0x43ca40
inc edx
cmp ecx, edx
jne 0x43ca30
jmp 0x43ca65
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43ca65
lea eax, [esp + 0x28]
lea edx, [esp + 0x10]
push eax
push edx
push 8
push ecx
push dword [0x4491fc]
call fcn.00438f20
add esp, 0x14
mov esi, eax
push dword [esp + 4]
call fcn.004082e0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43ca7e
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ca90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp], 0x60676665
mov eax, 0xff319399
mov edx, 0x66
nop
nop
nop
movzx ecx, byte [esp + eax + 0xce6c67]
mov esi, eax
or esi, ecx
not ecx
or ecx, edx
lea ebx, [ecx + esi]
add esi, ecx
inc esi
lea edi, [ebx*2 + 2]
mov ecx, edi
and ecx, 4
mov ebx, esi
xor ebx, 2
add ebx, ecx
and esi, 1
and ebx, 0xfe
or ebx, esi
and edi, 2
xor ebx, 1
add ebx, edi
mov byte [esp + eax + 0xce6c67], bl
inc eax
dec edx
cmp eax, 0xff31939d
jne 0x43cab0
mov eax, dword [esp]
mov ecx, dword [0x4491f4]
test ecx, ecx
je 0x43cb58
xor edx, edx
mov esi, dword [0x4491f8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x7cde1e50
je 0x43cb30
inc edx
cmp ecx, edx
jne 0x43cb20
jmp 0x43cb58
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43cb58
mov eax, esp
lea edx, [esp + 0x1c]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 0x14
push ecx
push dword [0x4491fc]
call fcn.00438f20
add esp, 0x20
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x43cb65
mov ecx, dword [esp + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43cb74
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cb80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x28]
mov dword [esp + 4], 0x60676665
mov eax, 0xff319399
mov ebx, 0x66
nop
nop
nop
movzx ecx, byte [esp + eax + 0xce6c6b]
mov esi, eax
or esi, ecx
not ecx
or ecx, ebx
lea edi, [ecx + esi]
add esi, ecx
inc esi
lea ebp, [edi*2 + 2]
mov edi, ebp
and edi, 4
mov ecx, esi
xor ecx, 2
add ecx, edi
and ebp, 2
and esi, 1
and ecx, 0xfe
or ecx, esi
xor ecx, 1
add ecx, ebp
mov byte [esp + eax + 0xce6c6b], cl
inc eax
dec ebx
cmp eax, 0xff31939d
jne 0x43cba0
mov eax, dword [esp + 4]
mov ecx, dword [0x4491f4]
test ecx, ecx
je 0x43cc51
xor esi, esi
mov edi, dword [0x4491f8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xc81e0bf6
je 0x43cc20
inc esi
cmp ecx, esi
jne 0x43cc10
jmp 0x43cc51
mov ebx, dword [edi + esi*8 + 4]
cmp ebx, eax
je 0x43cc51
lea eax, [esp + 4]
push 0
push 0
push edx
push dword [esp + 0x30]
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x4491fc]
call fcn.00438f20
add esp, 0x30
cmp eax, 0x103
jne 0x43cd19
mov dword [esp], 0x60676665
mov eax, 0xff319399
mov ecx, 0x66
nop
nop
nop
movzx edx, byte [esp + eax + 0xce6c67]
mov esi, eax
or esi, edx
not edx
or edx, ecx
lea edi, [edx + esi]
add esi, edx
inc esi
lea edi, [edi*2 + 2]
mov ebx, edi
and ebx, 4
mov edx, esi
xor edx, 2
add edx, ebx
and edi, 2
and esi, 1
and edx, 0xfe
or edx, esi
xor edx, 1
add edx, edi
mov byte [esp + eax + 0xce6c67], dl
inc eax
dec ecx
cmp eax, 0xff31939d
jne 0x43cc70
mov eax, dword [esp]
mov ecx, dword [0x4491f4]
test ecx, ecx
je 0x43cd11
xor edx, edx
mov esi, dword [0x4491f8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x4e66b5a3
je 0x43ccf0
inc edx
cmp ecx, edx
jne 0x43cce0
jmp 0x43cd11
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43cd11
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x4491fc]
call fcn.00438f20
add esp, 0x18
test eax, eax
js 0x43cd19
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x43cd30
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43cd2e
mov ecx, dword [esp + 8]
mov dword [edx], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cd40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x28]
mov dword [esp + 4], 0x60676665
mov eax, 0xff319399
mov ebx, 0x66
nop
nop
nop
movzx ecx, byte [esp + eax + 0xce6c6b]
mov esi, eax
or esi, ecx
not ecx
or ecx, ebx
lea edi, [ecx + esi]
add esi, ecx
inc esi
lea ebp, [edi*2 + 2]
mov edi, ebp
and edi, 4
mov ecx, esi
xor ecx, 2
add ecx, edi
and ebp, 2
and esi, 1
and ecx, 0xfe
or ecx, esi
xor ecx, 1
add ecx, ebp
mov byte [esp + eax + 0xce6c6b], cl
inc eax
dec ebx
cmp eax, 0xff31939d
jne 0x43cd60
mov eax, dword [esp + 4]
mov ecx, dword [0x4491f4]
test ecx, ecx
je 0x43ce11
xor esi, esi
mov edi, dword [0x4491f8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x7e66a1b5
je 0x43cde0
inc esi
cmp ecx, esi
jne 0x43cdd0
jmp 0x43ce11
mov ebx, dword [edi + esi*8 + 4]
cmp ebx, eax
je 0x43ce11
lea eax, [esp + 4]
push 0
push 0
push edx
push dword [esp + 0x30]
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x4491fc]
call fcn.00438f20
add esp, 0x30
cmp eax, 0x103
jne 0x43ced9
mov dword [esp], 0x60676665
mov eax, 0xff319399
mov ecx, 0x66
nop
nop
nop
movzx edx, byte [esp + eax + 0xce6c67]
mov esi, eax
or esi, edx
not edx
or edx, ecx
lea edi, [edx + esi]
add esi, edx
inc esi
lea edi, [edi*2 + 2]
mov ebx, edi
and ebx, 4
mov edx, esi
xor edx, 2
add edx, ebx
and edi, 2
and esi, 1
and edx, 0xfe
or edx, esi
xor edx, 1
add edx, edi
mov byte [esp + eax + 0xce6c67], dl
inc eax
dec ecx
cmp eax, 0xff31939d
jne 0x43ce30
mov eax, dword [esp]
mov ecx, dword [0x4491f4]
test ecx, ecx
je 0x43ced1
xor edx, edx
mov esi, dword [0x4491f8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x4e66b5a3
je 0x43ceb0
inc edx
cmp ecx, edx
jne 0x43cea0
jmp 0x43ced1
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43ced1
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x4491fc]
call fcn.00438f20
add esp, 0x18
test eax, eax
js 0x43ced9
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x43cee7
mov ecx, dword [esp + 8]
mov dword [edx], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x38]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x43cf10
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 4], bx
add ebx, 2
mov word [esp + 6], bx
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0x60676665
mov eax, 0xff319399
mov edi, 0x66
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xce6c67]
mov ebx, eax
or ebx, ecx
not ecx
or ecx, edi
lea ebp, [ecx + ebx]
add ecx, ebx
inc ecx
lea edx, [ebp*2 + 2]
mov ebp, edx
and ebp, 4
mov ebx, ecx
xor ebx, 2
add ebx, ebp
and edx, 2
and ecx, 1
and ebx, 0xfe
or ebx, ecx
xor ebx, 1
add ebx, edx
mov byte [esp + eax + 0xce6c67], bl
inc eax
dec edi
cmp eax, 0xff31939d
jne 0x43cf80
mov eax, dword [esp]
mov edi, dword [0x4491f4]
test edi, edi
je 0x43d027
xor ecx, ecx
mov ebx, dword [0x4491f8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + ecx*8], 0x2df48de6
je 0x43d000
inc ecx
cmp edi, ecx
jne 0x43cff0
jmp 0x43d027
mov edi, dword [ebx + ecx*8 + 4]
cmp edi, eax
je 0x43d027
lea eax, [esp + 0xc]
push esi
push eax
push dword [esp + 0x48]
push dword [esp + 0x48]
push 0x10
push edi
push dword [0x4491fc]
call fcn.00438f20
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret