joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e6d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x10], 0xf358f187
mov dword [esp + 0x14], 0xff49fd4f
mov dword [esp + 0x18], 0xfbfaf94e
mov word [esp + 0x1c], 0
mov byte [esp + 0x1e], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x10]
lea ecx, [eax - 0x52cd782c]
mov edi, 0xb
sub edi, eax
and edi, 0x12
mov edx, ecx
and edx, 0xed
or edx, edi
xor edx, ecx
xor edx, 0xed
and edx, esi
xor edx, ecx
mov ecx, edx
and ecx, 0x5b
xor edx, 0xdb
lea ecx, [edx + ecx*2]
inc cl
mov byte [esp + eax + 0x10], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0xf
jb 0x41e710
mov dword [esp + 0x28], 0x51ba4fa4
mov dword [esp + 0x2c], 0x55a253a4
mov dword [esp + 0x30], 0x5967576e
mov dword [esp + 0x34], 0x5db65b69
mov dword [esp + 0x38], 0x61bb5fad
mov dword [esp + 0x3c], 0x658e6383
mov dword [esp + 0x40], 0x6997678c
mov dword [esp + 0x44], 0x6d9e6b9d
mov dword [esp + 0x48], 0x716e6f56
mov eax, 0xd
mov ecx, 0xf2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x1b]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0xbf
mov byte [esp + eax + 0x1b], dl
inc eax
dec ecx
cmp eax, 0x31
jne 0x41e7c0
movzx ecx, word [esp + 0x28]
lea eax, [esp + 0x15c]
test cx, cx
je 0x41e813
lea edx, [esp + 0x2a]
mov esi, dword [ebp + 0x10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e800
jmp 0x41e816
mov esi, dword [ebp + 0x10]
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x41e841
lea edx, [esi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e830
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x41e871
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e860
mov word [eax], 0
mov edi, dword [ebx]
mov dword [esp + 0x28], 0x9d98983e
mov byte [esp + 0x2c], 0x20
mov dword [esp + 0x2d], 0
mov byte [esp + 0x31], 0
mov eax, 0xeb1c35c9
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x14e3ca5f]
xor ecx, eax
mov edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
add cl, 0x12
mov byte [esp + eax + 0x14e3ca5f], cl
inc eax
cmp eax, 0xeb1c35d3
jne 0x41e8a0
movzx eax, byte [esp + 0x28]
test al, al
je 0x41e8eb
lea ecx, [esp + 0x29]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41e8e0
mov byte [edi], 0
lea eax, [esp + 0x144]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x15c]
push eax
push ecx
push edx
call fcn.0040b770
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x448d1c]
mov ecx, 0xc8894039
xor ecx, dword [0x448d24]
add eax, ecx
inc eax
jmp eax
Function at 0x424560
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x424570
cmp eax, 0xffffffed
jge 0x424587
mov eax, 0xffffffff
jmp 0x42458a
add eax, 0x12
push eax
call fcn.00408810
add esp, 4
mov esi, eax
mov dword [esp], 0x39af3b98
mov dword [esp + 4], 0x25a12793
mov dword [esp + 8], 0x21702378
mov dword [esp + 0xc], 0x2d802f8c
mov word [esp + 0x10], 0x2b2c
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
mov eax, 0x5c79610b
nop
nop
nop
movzx ecx, byte [esp + eax - 0x5c79610b]
xor ecx, eax
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
add cl, 0xc8
mov byte [esp + eax - 0x5c79610b], cl
inc eax
cmp eax, 0x5c796122
jne 0x4245d0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x424621
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x424610
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x424651
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424640
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00441e80
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x4491a8]

Function at 0x427220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x21ec
call fcn.004086f0
push eax
sub esp, 0x20
mov dword [ebp - 0x68], esp
mov dword [ebp - 0x1df8], 0xe95ceb58
mov dword [ebp - 0x1df4], 0xeda7efa3
mov dword [ebp - 0x1df0], 0xd167d3a3
mov dword [ebp - 0x1dec], 0xd560d764
mov dword [ebp - 0x1de8], 0xd966db6b
mov dword [ebp - 0x1de4], 0xdd6bdf63
mov dword [ebp - 0x1de0], 0xc174c397
mov word [ebp - 0x1ddc], 0xc7c0
mov dword [ebp - 0x1dda], 0
mov byte [ebp - 0x1dd6], 0
mov eax, 0x40272ad7
mov ecx, 0xbfd8d528
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebp + eax - 0x402748cf]
mov edi, ecx
and edi, esi
mov edx, eax
xor edx, esi
sub edx, edi
or esi, eax
add edx, ecx
and edx, esi
mov esi, edx
and esi, 1
or edx, 1
add edx, esi
add dl, 0xcc
mov byte [ebp + eax - 0x402748cf], dl
inc eax
dec ecx
cmp eax, 0x40272afa
jne 0x4272a0
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x1df8]
push 0
push 0
push 0x20019
push eax
mov esi, ecx
push ecx
call fcn.00442460
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0x449784]
Function at 0x42a080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [esp + 4]
call fcn.00429a30
add esp, 4
test al, al
je 0x42a080
mov al, 1
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe8
push eax
mov dword [ebp - 0x38], esp
sub esp, 0x28
mov dword [ebp - 0x98], esp
sub esp, 8
mov dword [ebp - 0xac], esp
sub esp, 8
mov dword [ebp - 0xb4], esp
sub esp, 8
mov dword [ebp - 0x40], esp
sub esp, 0x24
mov edi, esp
mov dword [ebp - 0xf4], 0x29b82b6b
mov dword [ebp - 0xf0], 0x2dba2fbd
mov dword [ebp - 0xec], 0x513e534b
mov dword [ebp - 0xe8], 0x5526573c
mov dword [ebp - 0xe4], 0x59ce5b33
mov dword [ebp - 0xe0], 0x5d5e5f30
mov byte [ebp - 0xdc], 0
xor ecx, ecx
mov eax, ecx
nop
nop
nop
movzx esi, byte [ebp + ecx - 0xf4]
lea edx, [esi + esi]
not edx
add edx, esi
lea ebx, [ecx + 0x37]
or ebx, esi
not esi
and esi, edx
mov edx, 0xc8
sub edx, ecx
or edx, esi
and ebx, edx
add bl, 0xed
mov byte [ebp + ecx - 0xf4], bl
mov edx, ecx
xor eax, 1
add eax, ecx
and ecx, 1
and edx, 0x1e
add eax, ecx
sub eax, edx
mov ecx, eax
cmp eax, 0x19
jb 0x42a100
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x94], 0x297c2b78
mov dword [ebp - 0x90], 0x2d672f63
mov dword [ebp - 0x8c], 0x31673363
mov dword [ebp - 0x88], 0x35603764
mov dword [ebp - 0x84], 0x39663b6b
mov dword [ebp - 0x80], 0x3d793f6b
mov dword [ebp - 0x7c], 0x14a0379
mov dword [ebp - 0x78], 0x554074f
mov dword [ebp - 0x74], 0x9560b4f
mov dword [ebp - 0x70], 0xd5f0f5d
mov dword [ebp - 0x6c], 0x11461346
mov dword [ebp - 0x68], 0x15511749
mov dword [ebp - 0x64], 0x19511b42
mov dword [ebp - 0x60], 0x1d441f44
mov dword [ebp - 0x5c], 0x61ce63bb
mov dword [ebp - 0x58], 0x65cd67da
mov dword [ebp - 0x54], 0x693f6b38
mov dword [ebp - 0x50], 0x6dc56fdc
mov dword [ebp - 0x4c], 0x71c173cb
mov word [ebp - 0x48], 0x7770
mov byte [ebp - 0x44], 0
mov word [ebp - 0x46], 0
mov eax, 7
mov ecx, pe_nt_image_headers32
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0x8b
mov edx, eax
and edx, 0x74
or edx, esi
xor dl, byte [ebp + eax - 0x9b]
xor dl, 0x8b
add dl, 0x5d
mov byte [ebp + eax - 0x9b], dl
inc eax
dec ecx
cmp eax, 0x58
jne case.default.0x42a249
lea ebx, [ebp - 0xf4]
lea edi, [ebp - 0x94]
push ebx
push edi
call fcn.0043ac70
add esp, 8
mov esi, eax
xor eax, eax
test esi, esi
sete al
jmp dword [eax*4 + 0x449fc8]
mov byte [0xa2790042], al
inc edx
add byte [ebx + 0x42], bh
add byte [eax + 0x430042a3], bl
movsb byte es:[edi], byte [esi]
inc edx
add byte [ebx + 0x620042a3], ch
Function at 0x42a08c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.00429a30
add esp, 4
test al, al
je 0x42a080
mov al, 1
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe8
push eax
mov dword [ebp - 0x38], esp
sub esp, 0x28
mov dword [ebp - 0x98], esp
sub esp, 8
mov dword [ebp - 0xac], esp
sub esp, 8
mov dword [ebp - 0xb4], esp
sub esp, 8
mov dword [ebp - 0x40], esp
sub esp, 0x24
mov edi, esp
mov dword [ebp - 0xf4], 0x29b82b6b
mov dword [ebp - 0xf0], 0x2dba2fbd
mov dword [ebp - 0xec], 0x513e534b
mov dword [ebp - 0xe8], 0x5526573c
mov dword [ebp - 0xe4], 0x59ce5b33
mov dword [ebp - 0xe0], 0x5d5e5f30
mov byte [ebp - 0xdc], 0
xor ecx, ecx
mov eax, ecx
nop
nop
nop
movzx esi, byte [ebp + ecx - 0xf4]
lea edx, [esi + esi]
not edx
add edx, esi
lea ebx, [ecx + 0x37]
or ebx, esi
not esi
and esi, edx
mov edx, 0xc8
sub edx, ecx
or edx, esi
and ebx, edx
add bl, 0xed
mov byte [ebp + ecx - 0xf4], bl
mov edx, ecx
xor eax, 1
add eax, ecx
and ecx, 1
and edx, 0x1e
add eax, ecx
sub eax, edx
mov ecx, eax
cmp eax, 0x19
jb 0x42a100
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x94], 0x297c2b78
mov dword [ebp - 0x90], 0x2d672f63
mov dword [ebp - 0x8c], 0x31673363
mov dword [ebp - 0x88], 0x35603764
mov dword [ebp - 0x84], 0x39663b6b
mov dword [ebp - 0x80], 0x3d793f6b
mov dword [ebp - 0x7c], 0x14a0379
mov dword [ebp - 0x78], 0x554074f
mov dword [ebp - 0x74], 0x9560b4f
mov dword [ebp - 0x70], 0xd5f0f5d
mov dword [ebp - 0x6c], 0x11461346
mov dword [ebp - 0x68], 0x15511749
mov dword [ebp - 0x64], 0x19511b42
mov dword [ebp - 0x60], 0x1d441f44
mov dword [ebp - 0x5c], 0x61ce63bb
mov dword [ebp - 0x58], 0x65cd67da
mov dword [ebp - 0x54], 0x693f6b38
mov dword [ebp - 0x50], 0x6dc56fdc
mov dword [ebp - 0x4c], 0x71c173cb
mov word [ebp - 0x48], 0x7770
mov byte [ebp - 0x44], 0
mov word [ebp - 0x46], 0
mov eax, 7
mov ecx, pe_nt_image_headers32
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0x8b
mov edx, eax
and edx, 0x74
or edx, esi
xor dl, byte [ebp + eax - 0x9b]
xor dl, 0x8b
add dl, 0x5d
mov byte [ebp + eax - 0x9b], dl
inc eax
dec ecx
cmp eax, 0x58
jne case.default.0x42a249
lea ebx, [ebp - 0xf4]
lea edi, [ebp - 0x94]
push ebx
push edi
call fcn.0043ac70
add esp, 8
mov esi, eax
xor eax, eax
test esi, esi
sete al
jmp dword [eax*4 + 0x449fc8]
mov byte [0xa2790042], al
inc edx
add byte [ebx + 0x42], bh
add byte [eax + 0x430042a3], bl
movsb byte es:[edi], byte [esi]
inc edx
add byte [ebx + 0x620042a3], ch

Function at 0x42a37c
Capabilities:
Copy file

Disassembly:
push esi
call fcn.00408820
add esp, 4
xor eax, eax
mov esi, dword [ebp - 0x1c]
cmp word [esi], 0x2a
sete al
jmp dword [eax*4 + 0x449fd8]

Function at 0x42a398
Capabilities:
Copy file
Encode data using xor

Disassembly:
xor eax, eax
mov esi, dword [ebp - 0x1c]
cmp word [esi], 0x2a
sete al
jmp dword [eax*4 + 0x449fd8]

Function at 0x42a4e9
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 0x14], ebx
not eax
shr eax, 0x1f
xor ebx, ebx
xor esi, esi
jmp dword [eax*4 + 0x44a000]

Function at 0x42adf0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp esi, ebx
sete al
jmp dword [eax*4 + 0x44a058]
Function at 0x42c430
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc0
mov dword [esp + 0x1c], 0x7f3f795d
mov dword [esp + 0x20], 0x63f27dec
mov dword [esp + 0x24], 0x67076124
mov dword [esp + 0x28], 0x6b0b65f0
mov dword [esp + 0x2c], 0x6f12694d
mov dword [esp + 0x30], 0x93016d1e
mov dword [esp + 0x34], 0x97f39104
mov dword [esp + 0x38], 0x9bfb9504
mov dword [esp + 0x3c], 0x9fb199fc
mov dword [esp + 0x40], 0x83fe9db3
mov dword [esp + 0x44], 0x87e38117
mov dword [esp + 0x48], 0x8b1d8513
mov dword [esp + 0x4c], 0x8f1d89e1
mov dword [esp + 0x50], 0xb3e08d1e
mov dword [esp + 0x54], 0xb7dbb128
mov dword [esp + 0x58], 0xbbbab5d8
lea eax, [esp + 0x5c]
mov word [esp + 0x5c], 0
mov byte [esp + 0x5e], 0
mov ecx, 0x6a
nop
movzx edx, byte [esp + ecx - 0x4e]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0xee
mov byte [esp + ecx - 0x4e], dl
inc ecx
cmp ecx, 0xad
jne 0x42c4d0
lea ebp, [esp + 0x80]
lea edx, [esp + 0x1c]
mov edi, ebp
mov ecx, 0x10
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xc0]
xor ebx, ebx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x7c]
push esi
push 0
push 0
push 0x1f
push ebp
push 0
call dword [0x44f2b0]
mov dword [esp + 0x1c], 0xb7760967
mov word [esp + 0x20], 0
nop
nop
nop
mov ecx, ebx
add cl, 0x3e
xor cl, byte [esp + ebx + 0x1c]
add cl, 0xca
mov byte [esp + ebx + 0x1c], cl
inc ebx
cmp ebx, 6
jne case.default.0x42c55f
xor ecx, ecx
cmp eax, dword [esp + 0x1c]
setne cl
jmp dword [ecx*4 + 0x44a2f0]
mov edi, dword [esp + 0x7c]
test edi, edi
jns 0x42c588
mov eax, 0xffffffff
jmp 0x42c58b
xor ebx, ebx
jmp dword [0x44a300]
lea eax, [edi + edi]
push eax
call fcn.00408810
add esp, 4
push esi
mov esi, eax
push edi
push eax
push 0x1f
push ebp
push 0
call dword [0x44f2b0]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44a308]
jmp dword [0x44a318]
mov eax, dword [0x44a450]
nop
nop
nop
nop
nop
jmp eax
Function at 0x439e40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x439e60
mov dword [esp], 0x968a94e1
mov byte [esp + 4], 0
xor esi, esi
xor edi, edi
nop
nop
nop
nop
nop
mov ebp, esi
and ebp, 6
mov ebx, edi
xor ebx, 0xe3
add ebx, ebp
xor bl, byte [esp + edi]
add bl, 0x91
mov byte [esp + edi], bl
inc edi
add esi, 2
cmp edi, 5
jne 0x439e80
test edx, edx
je 0x439f0e
mov esi, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x439ed1
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x439ec0
cmp edi, 3
jb 0x439f0e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x439ee0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c9d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x18]
mov dword [esp], 0x83828170
mov byte [esp + 4], 0
mov ecx, 0xcc67b2e0
mov edx, 0x33984d1f
movzx esi, byte [esp + ecx + 0x33984d20]
mov edi, edx
or edi, esi
mov ebx, edi
sub ebx, esi
add ebx, ecx
and ebx, edi
mov esi, 0x1f9819e
sub esi, ebx
mov edi, esi
and edi, 1
xor esi, 1
lea ebx, [esi + edi*2]
mov byte [esp + ecx + 0x33984d20], bl
inc ecx
dec edx
cmp ecx, 0xcc67b2e5
jne 0x43c9f0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x4572d8]
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x43ca40
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44bbb0]
Function at 0x43cd70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43ce50
xor eax, eax
cmp dword [ecx], 0
jne 0x43ce93
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xc8cbcacd
mov word [esp + 4], 0
mov eax, 0x3678be33
nop
nop
movzx esi, byte [esp + eax - 0x3678be33]
mov edi, eax
and edi, esi
add edi, edi
sub esi, edi
add esi, eax
mov edi, esi
xor edi, 0xe46233df
and esi, 0x1b9dcc20
add esi, esi
sub esi, edi
mov edi, esi
and edi, 0x5f
xor esi, 0xdf
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + eax - 0x3678be33], bl
inc eax
cmp eax, 0x3678be39
jne 0x43cde0
mov eax, dword [esp]
mov esi, dword [0x44f2b4]
test esi, esi
je 0x43ce93
xor edi, edi
mov ebx, dword [0x44f2b8]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43ce9c
inc edi
cmp esi, edi
jne 0x43ce40
jmp 0x43ce93
mov dword [esp + 8], 0xbf7e7970
mov byte [esp + 0xc], 0
mov eax, 0x6a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x62]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xee
mov byte [esp + eax - 0x62], cl
inc eax
cmp eax, 0x6f
jne 0x43ce70
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43ce93
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44f2bc]
call fcn.0043f4a0
add esp, 0x1c
jmp 0x43ce93

Function at 0x43ced0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43cfa5
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xc8cbcacd
mov word [esp + 4], 0
mov edx, 0x3678be33
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0x3678be33]
mov edi, edx
and edi, esi
add edi, edi
sub esi, edi
add esi, edx
mov edi, esi
xor edi, 0xe46233df
and esi, 0x1b9dcc20
add esi, esi
sub esi, edi
mov edi, esi
and edi, 0x5f
xor esi, 0xdf
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + edx - 0x3678be33], bl
inc edx
cmp edx, 0x3678be39
jne 0x43cf00
mov edx, dword [0x44f2b4]
test edx, edx
je 0x43cf98
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44f2b8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43cf7a
mov ebp, edi
and ebp, 1
xor edi, 1
lea edi, [edi + ebp*2]
cmp edi, edx
jb 0x43cf60
jmp 0x43cf98
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43cf98
push eax
push 4
push edx
push dword [0x44f2bc]
mov esi, ecx
call fcn.0043f4a0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cfb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
cmp dword [ecx + 8], 0
je 0x43d063
mov edx, dword [ecx]
test edx, edx
je 0x43d063
mov edi, dword [ebp + 0x10]
mov dword [esp], 0xc8cbcacd
mov word [esp + 4], 0
mov eax, 0x3678be33
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x3678be33]
mov esi, eax
and esi, ebx
add esi, esi
sub ebx, esi
add ebx, eax
mov esi, ebx
xor esi, 0xe46233df
and ebx, 0x1b9dcc20
add ebx, ebx
sub ebx, esi
mov esi, ebx
and esi, 0x5f
xor ebx, 0xdf
lea ebx, [ebx + esi*2]
inc bl
mov byte [esp + eax - 0x3678be33], bl
inc eax
cmp eax, 0x3678be39
jne 0x43cff0
mov eax, dword [esp]
mov ebx, dword [0x44f2b4]
test ebx, ebx
je 0x43d0e1
xor edi, edi
mov esi, dword [0x44f2b8]
nop
nop
nop
nop
cmp dword [esi + edi*8], 0xaf0e0c2e
je 0x43d0bd
inc edi
cmp ebx, edi
jne 0x43d050
mov edi, dword [ebp + 0x10]
jmp 0x43d0e1
mov dword [esp], 0x6126273c
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x80a76fc9
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x7f589037]
xor ecx, eax
lea edx, [ecx + 0x7cbad112]
mov esi, edx
and esi, 0x16
xor edx, 0x16
lea edx, [edx + esi*2]
and ecx, 1
or edx, 1
add edx, ecx
add dl, 0xea
mov byte [esp + eax + 0x7f589037], dl
inc eax
cmp eax, 0x80a76fd0
jne 0x43d080
mov eax, dword [esp]
jmp 0x43d1d2
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
mov edi, dword [ebp + 0x10]
je 0x43d0e1
push dword [ebp + 8]
push edx
push 8
push esi
push dword [0x44f2bc]
mov esi, ecx
call fcn.0043f4a0
mov ecx, esi
add esp, 0x14
mov esi, dword [ebp + 0xc]
cmp esi, 1
mov edx, edi
sbb edx, 0
jl 0x43d1c5
cmp eax, 0xc000010a
jne 0x43d1c5
mov edx, 0xffffd8f0
mov eax, esi
mul edx
sub edx, esi
imul esi, edi, 0xffffd8f0
add esi, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov edx, dword [ecx]
mov dword [esp], 0xc8cbcacd
mov word [esp + 4], 0
mov eax, 0x3678be33
nop
nop
nop
movzx esi, byte [esp + eax - 0x3678be33]
mov edi, eax
and edi, esi
add edi, edi
sub esi, edi
add esi, eax
mov edi, esi
xor edi, 0xe46233df
and esi, 0x1b9dcc20
add esi, esi
sub esi, edi
mov edi, esi
and edi, 0x5f
xor esi, 0xdf
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + eax - 0x3678be33], bl
inc eax
cmp eax, 0x3678be39
jne 0x43d130
mov eax, dword [esp]
mov esi, dword [0x44f2b4]
test esi, esi
je 0x43d1c5
xor edi, edi
mov ebx, dword [0x44f2b8]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x4c697c35
je 0x43d1a0
inc edi
cmp esi, edi
jne 0x43d190
jmp 0x43d1c5
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43d1c5
lea eax, [esp + 8]
push eax
push 0
push edx
push 0xc
push esi
push dword [0x44f2bc]
mov esi, ecx
call fcn.0043f4a0
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43d1d2
mov esi, eax
call fcn.0043ced0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43d1e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
mov ecx, dword [ecx]
mov dword [esp], 0xc8cbcacd
mov word [esp + 4], 0
mov eax, 0x3678be33
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + eax - 0x3678be33]
mov edx, eax
and edx, ebp
add edx, edx
sub ebp, edx
add ebp, eax
mov edx, ebp
xor edx, 0xe46233df
and ebp, 0x1b9dcc20
add ebp, ebp
sub ebp, edx
mov edx, ebp
and edx, 0x5f
xor ebp, 0xdf
lea edx, [edx*2]
add edx, ebp
inc dl
mov byte [esp + eax - 0x3678be33], dl
inc eax
cmp eax, 0x3678be39
jne 0x43d210
test ebx, ebx
jne 0x43d261
lea ebx, [esp + 8]
mov eax, dword [esp]
mov ebp, dword [0x44f2b4]
test ebp, ebp
je 0x43d2b4
xor edx, edx
mov esi, dword [0x44f2b8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe6c7f7c6
je 0x43d290
inc edx
cmp ebp, edx
jne 0x43d280
jmp 0x43d2b4
mov ebp, dword [esi + edx*8 + 4]
cmp ebp, eax
je 0x43d2b4
push ebx
push dword [esp + 0x2c]
push edi
push dword [esp + 0x2c]
push ecx
push 0x14
push ebp
push dword [0x44f2bc]
call fcn.0043f4a0
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10