joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420ff0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x421000
cmp eax, 0xffffffed
jge 0x421017
mov eax, 0xffffffff
jmp 0x42101a
add eax, 0x12
push eax
call fcn.0040c8e0
add esp, 4
mov esi, eax
mov dword [esp + 4], 0x1781197c
mov dword [esp + 8], 0x139b1589
mov dword [esp + 0xc], 0xf5c115c
mov dword [esp + 0x10], 0xb940d90
mov word [esp + 0x14], 0x908
mov dword [esp + 0x16], 0
mov word [esp + 0x1a], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x17
ja 0x4210a9
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0x42a0706
and eax, 0x42a0706
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0xe2
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x18
jb 0x421070
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x4210d1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4210c0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x421101
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4210f0
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.004426c0
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x449338]

Function at 0x421720
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov ebp, dword [esp + 0x64]
mov edi, dword [esp + 0x5c]
mov esi, dword [esp + 0x58]
mov eax, dword [esp + 0x50]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x6c]
movzx ecx, byte [esp + 0x68]
mov dword [esp + 0x30], ebp
mov byte [esp + 0x34], cl
mov dword [esp + 0x38], eax
test ebp, ebp
setg al
and al, cl
movzx eax, al
jmp dword [eax*4 + 0x449474]
Function at 0x427820
Capabilities:
Contain obfuscated stackstrings
Copy file
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.00427840
add esp, 4
test al, al
je 0x4280a0
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xa4
lea ebp, [esp + 0x76]
mov dword [esp + 0x1c], 0
mov eax, 0x20219
mov ecx, 1
jmp dword [ecx*4 + 0x44a3a8]
Function at 0x42c950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x42c9aa
cmp edi, 1
je 0x42c9aa
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x42c981
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x42c980
cmp ecx, 0x20
je 0x42c980
cmp ecx, 0x2b
mov edx, edi
je 0x42c9a0
cmp ecx, 0x2d
jne 0x42c9bf
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x42c9c4
xor edi, edi
test eax, eax
je 0x42cb7d
mov dword [eax], 0x16
jmp 0x42cb7d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x42c9ed
cmp edx, 0x10
jne 0x42ca05
cmp byte [ebx], 0x30
jne 0x42c9e6
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x42ca07
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x42ca07
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x42ca60
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x42cb18
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x42ca87
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x42cb48
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x42cb48
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x42ca40
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x42cad0
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x42cad9
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x42cafd
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x42cb2d
test bl, bl
jne 0x42cb2d
mov ebx, dword [esp + 0x10]
jmp 0x42ca53
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x42ca35
mov esi, edi
test bl, bl
jne 0x42cb3b
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x42ca35
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42cb56
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x42cb64
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x42cb74
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x42cb7d
cmp byte [esp + 3], 0
jne 0x42cb7d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x431430
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2f8
mov dword [esp + 0x2dc], 0x44aee8
mov dword [esp + 0x74], 0
lea eax, [esp + 0x74]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x446070
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x446080
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x2d8], eax
mov eax, dword [esp + 0x2dc]
mov ecx, dword [esp + 0x2d8]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x2d4], 0x44aef0
mov dword [esp + 0x2cc], 0x44aef8
mov dword [esp + 0x2c4], 0x44af00
mov dword [esp + 0x2bc], 0x44af08
mov dword [esp + 0x2b4], 0x44af10
mov dword [esp + 0x2ac], 0x44a830
mov dword [esp + 0x2a8], 0x8f
mov dword [esp + 0x2a4], 0x44af18
mov dword [esp + 0x29c], 0x44a830
mov dword [esp + 0x298], 0x92
mov dword [esp + 0x294], 0x44a830
mov dword [esp + 0x290], 0x92
mov dword [esp + 0x28c], 0x44af20
mov dword [esp + 0x284], 0x44af28
mov dword [esp + 0x27c], 0x44af30
mov dword [esp + 0x274], 0x44af38
mov dword [esp + 0x26c], 0x44af40
mov dword [esp + 0x264], 0x44af48
mov dword [esp + 0x25c], 0x44af50
mov dword [esp + 0x254], 0x44af58
mov dword [esp + 0x24c], 0x44a830
mov dword [esp + 0x248], 0x9b
mov dword [esp + 0x244], 0x44af60
mov dword [esp + 0x23c], 0x44a830
mov dword [esp + 0x238], 0x9d
mov dword [esp + 0x234], 0x44a830
mov dword [esp + 0x230], 0x9e
mov dword [esp + 0x22c], 0x44af68
mov dword [esp + 0x224], 0x44af70
mov dword [esp + 0x21c], 0x44a830
mov dword [esp + 0x218], 0xa1
mov dword [esp + 0x214], 0x44af78
mov dword [esp + 0x20c], 0x44a830
mov dword [esp + 0x208], 0xa3
mov dword [esp + 0x204], 0x44a830
mov dword [esp + 0x200], 0xa4
mov dword [esp + 0x1fc], 0x44a830
mov dword [esp + 0x1f8], 0xa5
mov dword [esp + 0x1f4], 0x44af80
mov dword [esp + 0x1ec], 0x44a830
mov dword [esp + 0x1e8], 0xa7
mov dword [esp + 0x1e4], 0x44a830
mov dword [esp + 0x1e0], 0xa8
mov dword [esp + 0x1dc], 0x44a830
mov dword [esp + 0x1d8], 0xa9
mov dword [esp + 0x1d4], 0x44af88
mov dword [esp + 0x1cc], 0x44af90
mov dword [esp + 0x1c4], 0x44a830
mov dword [esp + 0x1c0], 0xac
mov dword [esp + 0x1bc], 0x44af98
mov dword [esp + 0x1b4], 0x44afa0
mov dword [esp + 0x1ac], 0x44a830
mov dword [esp + 0x1a8], 0x8b
mov dword [esp + 0x1a4], 0x44a830
mov dword [esp + 0x1a0], 0x93
mov dword [esp + 0x19c], 0x44a830
mov dword [esp + 0x198], 0x96
mov dword [esp + 0x194], 0x44a830
mov dword [esp + 0x190], 0x99
mov dword [esp + 0x18c], 0x44a830
mov dword [esp + 0x188], 0x9f
mov dword [esp + 0x184], 0x44a830
mov dword [esp + 0x180], 0xaa
mov dword [esp + 0x17c], 0x44a830
mov dword [esp + 0x178], 0xad
xor esi, esi
jmp eax
Function at 0x432e40
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
jmp 0x432e5b
jmp 0x432e5d
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x432e6e
jmp 0x432fab
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
jmp 0x432e8a
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
cmp edi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x432ead
jmp 0x432fa3
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov esi, eax
mov dword [esp], esi
call fcn.0040ca20
mov ebp, eax
jmp 0x432ec7
cmp ebp, 0
setne al
xor ebx, ebx
test al, 1
jne 0x432ed8
jmp 0x432f97
mov al, byte [esp + 0x10]
mov byte [esp + 0x14], al
mov byte [esp + 0x18], 0xf1
mov byte [esp + 0x19], 0xdf
mov byte [esp + 0x1a], 0xdd
mov byte [esp + 0x1b], 0xd9
mov byte [esp + 0x1c], 0xd6
mov byte [esp + 0x1d], 0xd6
mov byte [esp + 0x1e], 0xd9
mov byte [esp + 0x1f], 0xcb
mov byte [esp + 0x20], 0xd8
mov byte [esp + 0x21], 0x11
mov byte [esp + 0x22], 0xce
mov byte [esp + 0x23], 0xc9
mov byte [esp + 0x24], 0xcc
mov byte [esp + 0x25], 0xbf
mov eax, 0xe
mov byte [esp + eax + 0x18], 0
add eax, 1
cmp eax, 0x12
jne 0x432f2b
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x12
jae 0x432f75
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00435560
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x18], al
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0x432f40
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
call fcn.0040d4b0
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x432f97
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x432fab
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43bc30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov dword [esp + 4], 0x171619c8
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43bc99
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0x8f9924c6
and eax, 0xf9924c6
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x22
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x43bc60
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
push ecx
push 0
push dword [eax + 0x18]
call dword [0x456388]
add esp, 0x10
ret

Function at 0x43bcc0
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44be34]
Function at 0x43c0a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ecx + 8]
test edx, edx
je 0x43c1c7
xor eax, eax
cmp dword [ecx], 0
jne 0x43c24d
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], edx
mov eax, dword [ecx + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x14151617
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43c188
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0xc]
lea esi, [edx + edx]
and esi, 0xee4e8f8
mov edi, edx
sub edi, esi
mov esi, edx
xor esi, 0x788d8b83
or edx, 0x772747c
and edx, esi
lea esi, [edi + edx*2]
lea edx, [edi + edx*2]
add edx, 0x8772747c
add esi, eax
add esi, 0x8772747c
and edx, eax
mov eax, esi
xor eax, edx
add eax, edx
not edx
and edx, esi
add edx, edx
sub edx, eax
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x2c]
add al, 0x94
mov edx, dword [esp]
mov byte [esp + edx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x43c120
mov eax, dword [esp + 0xc]
mov esi, dword [0x44e36c]
test esi, esi
je 0x43c24d
mov edx, dword [esp + 0x40]
xor edi, edi
mov ebx, dword [0x44e370]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x43c256
inc edi
cmp esi, edi
jne 0x43c1b0
jmp 0x43c24d
mov dword [esp + 0x14], 0xd3929198
mov dword [esp + 0x18], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 7
ja 0x43c249
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x14]
mov edx, eax
xor edx, 0x8d0b8ce4
and eax, 0xd0b8ce4
lea eax, [edx + eax*2]
lea edx, [eax + ecx]
and eax, ecx
mov ecx, edx
xor ecx, eax
add ecx, eax
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov ecx, eax
xor ecx, 0x74
and eax, 0xb
add eax, eax
sub eax, ecx
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 8
jb 0x43c1f0
mov eax, dword [esp + 0x14]
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43c24d
lea eax, [esp + 4]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44e374]
push esi
call fcn.0043eec0
add esp, 0x1c
jmp 0x43c24d
Function at 0x43c290
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43c38a
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x14151617
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 6
ja 0x43c339
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
lea edi, [esi + esi]
and edi, 0xee4e8f8
mov ebx, esi
sub ebx, edi
mov edi, esi
xor edi, 0x788d8b83
or esi, 0x772747c
and esi, edi
lea edi, [ebx + esi*2]
lea esi, [ebx + esi*2]
add esi, 0x8772747c
add edi, edx
add edi, 0x8772747c
and esi, edx
mov edx, edi
xor edx, esi
add edx, esi
not esi
and esi, edi
add esi, esi
sub esi, edx
mov dword [esp + 0xc], esi
mov edx, dword [esp + 0xc]
add dl, 0x94
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 7
jb 0x43c2d0
mov edx, dword [0x44e36c]
test edx, edx
je 0x43c37e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44e370]
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x43c360
inc edi
cmp edx, edi
jne 0x43c350
jmp 0x43c37e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43c37e
push eax
push 1
push dword [0x44e374]
push edx
mov esi, ecx
call fcn.0043eec0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x43c660
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43c6f8
push 0xfb1631b0
push dword [0x44e360]
call fcn.00441bf0
add esp, 8
test eax, eax
je 0x43c6bd
mov ecx, dword [esi]
test ecx, ecx
je 0x43c6f5
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43c6d1
cmp dword [esp + 4], 0
je 0x43c6d1
mov dword [esi + 4], 3
jmp 0x43c6f5
mov ecx, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 0x10], eax
jmp 0x43c7d7
lea eax, [esp + 0xc]
push eax
call fcn.00442280
add esp, 4
test al, al
je 0x43c6f5
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43c6f2
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebx
cmp eax, 2
jne 0x43c7d7
mov dword [esp + 4], 0x14151617
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43c798
nop
nop
nop
nop
mov edx, dword [esp]
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
lea esi, [edx + edx]
and esi, 0xee4e8f8
mov ebx, edx
sub ebx, esi
mov esi, edx
xor esi, 0x788d8b83
or edx, 0x772747c
and edx, esi
lea esi, [ebx + edx*2]
lea edx, [ebx + edx*2]
add edx, 0x8772747c
add esi, eax
add esi, 0x8772747c
and edx, eax
mov eax, esi
xor eax, edx
add eax, edx
not edx
and edx, esi
add edx, edx
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
add al, 0x94
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x43c730
mov eax, dword [esp + 4]
mov edx, dword [0x44e36c]
test edx, edx
je 0x43c8b4
xor esi, esi
mov ebx, dword [0x44e370]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x495ce5ca
je 0x43c890
inc esi
cmp edx, esi
jne 0x43c7c0
jmp 0x43c8b4
mov dword [esp + 4], 0x14151617
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43c868
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
lea esi, [edx + edx]
and esi, 0xee4e8f8
mov ebx, edx
sub ebx, esi
mov esi, edx
xor esi, 0x788d8b83
or edx, 0x772747c
and edx, esi
lea esi, [ebx + edx*2]
lea edx, [ebx + edx*2]
add edx, 0x8772747c
add esi, eax
add esi, 0x8772747c
and edx, eax
mov eax, esi
xor eax, edx
add eax, edx
not edx
and edx, esi
add edx, edx
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
add al, 0x94
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x43c800
mov eax, dword [esp + 4]
mov edx, dword [0x44e36c]
test edx, edx
je 0x43c8b4
xor esi, esi
mov ebx, dword [0x44e370]
nop
nop
cmp dword [ebx + esi*8], 0x1b788dcf
je 0x43c890
inc esi
cmp edx, esi
jne 0x43c880
jmp 0x43c8b4
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43c8b4
push dword [esp + 0x34]
push ecx
push edi
push ebp
push dword [esp + 0x20]
push 5
push dword [0x44e374]
push edx
call fcn.0043eec0
add esp, 0x20
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43cc50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43cc69
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43cc7a
cmp eax, 2
je 0x43ccf0
jmp 0x43cd1d
push 0xfb1631b0
push dword [0x44e360]
call fcn.00441bf0
add esp, 8
test eax, eax
je 0x43ccbb
mov ecx, dword [esi]
test ecx, ecx
je 0x43cce8
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43ccc4
cmp dword [esp + 4], 0
je 0x43ccc4
mov dword [esi + 4], 3
jmp 0x43cce8
mov dword [esi + 4], 1
jmp 0x43cd1d
lea eax, [esp + 0xc]
push eax
call fcn.00442280
add esp, 4
test al, al
je 0x43cce8
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43cce5
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43cd1d
mov ebx, dword [ebp + 0x18]
push 0xc95dc39
push dword [0x456380]
call fcn.00441bf0
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43ce04
mov ecx, dword [esi]
mov dword [esp + 4], 0x14151617
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43cdb8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
lea esi, [edx + edx]
and esi, 0xee4e8f8
mov ebx, edx
sub ebx, esi
mov esi, edx
xor esi, 0x788d8b83
or edx, 0x772747c
and edx, esi
lea esi, [ebx + edx*2]
lea edx, [ebx + edx*2]
add edx, 0x8772747c
add esi, eax
add esi, 0x8772747c
and edx, eax
mov eax, esi
xor eax, edx
add eax, edx
not edx
and edx, esi
add edx, edx
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
add al, 0x94
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x43cd50
mov eax, dword [esp + 4]
mov edx, dword [0x44e36c]
test edx, edx
je 0x43ce04
xor esi, esi
mov ebx, dword [0x44e370]
nop
nop
cmp dword [ebx + esi*8], 0x3baba5e0
je 0x43cde0
inc esi
cmp edx, esi
jne 0x43cdd0
jmp 0x43ce04
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43ce04
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x44e374]
push edx
call fcn.0043eec0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x43dc90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x6c
mov dword [esp + 0x54], 0xc356c1ae
mov dword [esp + 0x58], 0xc7aac5a0
mov dword [esp + 0x5c], 0xcbe4c9a4
mov dword [esp + 0x60], 0xcfa2cda8
mov dword [esp + 0x64], 0xf3f2f19c
mov word [esp + 0x68], 0
mov byte [esp + 0x6a], 0
mov dword [esp + 0x34], 0
mov eax, dword [esp + 0x34]
cmp eax, 0x16
ja 0x43dd1e
nop
nop
nop
nop
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x34]
movzx ecx, byte [esp + ecx + 0x54]
mov edx, eax
xor edx, 0xd63a22d0
and eax, 0xd63a22d0
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0xf0
mov ecx, dword [esp + 0x34]
mov byte [esp + ecx + 0x54], al
inc dword [esp + 0x34]
mov eax, dword [esp + 0x34]
cmp eax, 0x17
jb 0x43dce0
lea eax, [esp + 0x54]
push eax
call fcn.00441530
add esp, 4
mov dword [0x456380], eax
mov dword [esp + 0x30], 0xcc42a308
test eax, eax
je 0x43dd44
mov dword [esp + 0x30], 0xfb0972c0
mov edi, 0x9111fb2f
xor eax, eax
cmp edi, 0xd87b3b02
setl al
mov eax, dword [eax*4 + 0x44be8c]
mov ecx, 0xa1d0eca8
xor ecx, dword [str._n_]
add eax, ecx
inc eax
jmp eax

Function at 0x43edf0
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0xc
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44c2e8]
Function at 0x43ffe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x3c]
movzx eax, word [ebp]
mov dword [esp + 4], 0x1065d53
mov byte [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x44005c
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, ecx
xor esi, 0x7437fa01
and ecx, 0xf437fa01
lea ecx, [esi + ecx*2]
lea esi, [ecx + edx]
and ecx, edx
mov edx, esi
not edx
and edx, ecx
add edx, ecx
not ecx
and ecx, esi
sub ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
add cl, 0xfb
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x440010
xor ecx, ecx
cmp dword [esp + 4], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44c8d0]
jmp dword [0x44c8d8]
mov ebx, dword [ebp + 0x3c]
mov ecx, dword [ebp + ebx]
mov dword [esp + 4], 0xf7f6c4b8
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 6
ja 0x4402e2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
not edi
or edi, 0x5dc36c7e
add edi, edx
xor edx, 0xddc36c7e
lea edx, [edx + edi*2]
add edx, 2
xor edx, esi
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x14]
add dl, 0x8a
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 7
jb 0x4402a0
jmp dword [0x44c8e4]
mov dword [esp + 4], 0xf7f6c4b8
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja case.0x440067.2
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
not edx
or edx, 0x5dc36c7e
add edx, eax
xor eax, 0xddc36c7e
lea eax, [eax + edx*2]
add eax, 2
xor eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 0x8a
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x440310
jmp case.0x440067.2
mov ecx, dword [0x44c9cc]
nop
nop
nop
nop
nop
nop
nop
jmp ecx