joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f830
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.004139c0
sub esp, 0x14
mov edi, esp
push eax
mov esi, esp
jmp 0x42f848
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x42f85c
cmp eax, 0
setne al
jmp 0x42f864
xor ebx, ebx
test al, 1
jne 0x42f86f
jmp 0x42f9d5
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x42f88b
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
jmp 0x42f89d
xor ebx, ebx
cmp eax, 0
je 0x42f9cd
mov dword [ebp - 0x1c], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.0042a780
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x42f9be
mov dword [ebp - 0x18], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.00408420
sub esp, 8
mov dword [ebp - 0x14], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00422650
add esp, 0xc
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0x83
mov byte [edi + 1], 0xad
mov byte [edi + 2], 0xab
mov byte [edi + 3], 0xd3
mov byte [edi + 4], 0xa6
mov byte [edi + 5], 0xaa
mov byte [edi + 6], 0xa7
mov byte [edi + 7], 0xd5
mov byte [edi + 8], 0xac
mov byte [edi + 9], 0x67
mov byte [edi + 0xa], 0xde
mov byte [edi + 0xb], 0xd3
mov byte [edi + 0xc], 0xd8
mov byte [edi + 0xd], 0x4d
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x11
jne 0x42f948
xor eax, eax
cmp eax, 0x11
jae 0x42f988
mov dl, byte [edi + eax]
mov esi, eax
shl esi, 1
and esi, 0x20
mov ebx, eax
xor ebx, 0x90
add ebx, esi
mov ecx, dword [ebp + 8]
xor bl, dl
add bl, 0x30
mov byte [edi + eax], bl
mov edx, eax
shl edx, 1
and edx, 2
xor eax, 1
add eax, edx
jmp 0x42f956
sub esp, 0xc
mov dword [esp], edi
mov esi, dword [ebp - 0x14]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
call fcn.00409220
mov bl, al
and bl, 1
jmp 0x42f9a8
jmp 0x42f9aa
sub esp, 4
mov dword [esp], esi
call fcn.00408430
add esp, 4
jmp 0x42f9ba
jmp 0x42f9bc
jmp 0x42f9be
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42f9d5
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x434cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 8]
push eax
push eax
mov ebx, esp
sub esp, 0x10
mov esi, esp
lea ecx, [ebp - 0x20]
push 0x68
push 7
push 0x100080
push ecx
push eax
call fcn.0043d140
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446874]

Function at 0x434fe0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.0043d8b0
add esp, 0x14
test eax, eax
js 0x43512f
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.0043dcf0
add esp, 0x24
mov ecx, eax
xor eax, eax
test ecx, ecx
js 0x43507a
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x435044
mov eax, 0xffffffff
jmp 0x43504b
lea eax, [eax*2 + 2]
push eax
call fcn.00408420
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebx
push dword [esp + 0x10]
call fcn.0043e320
add esp, 0x14
test eax, eax
js 0x43506f
mov eax, esi
jmp 0x43507a
push esi
call fcn.00408430
add esp, 4
xor eax, eax
mov ecx, dword [esp]
mov dword [esp + 4], 0x20272625
mov byte [esp + 8], 0
mov edx, 0xdc89
mov esi, 0xfffe4776
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx - 0xdc85]
mov ebx, esi
xor ebx, edx
and ebx, edi
xor ebx, edx
mov edi, ebx
and edi, 0x52
xor ebx, 0x52
lea ebx, [ebx + edi*2]
inc bl
mov byte [esp + edx - 0xdc85], bl
inc edx
dec esi
cmp edx, 0xdc8e
jne 0x4350a0
mov edx, dword [0x44a3a4]
test edx, edx
je 0x43511e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44a3a8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x435100
inc edi
cmp edx, edi
jne 0x4350f0
jmp 0x43511e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43511e
push ecx
push 4
push edx
push dword [0x44a3ac]
mov esi, eax
call fcn.00439600
mov eax, esi
add esp, 0x10
test eax, eax
jne 0x435131
lea eax, [esp + 4]
push eax
call fcn.0043cf20
add esp, 4
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
ret
Function at 0x436c80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0xb18e8fdc
mov byte [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x9d
xor dl, byte [esp + ecx]
add dl, 0xef
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 5
jne 0x436ca0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x4523c8]
mov ecx, dword [0x446bd8]
nop
nop
nop
nop
jmp ecx
Function at 0x436dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
and edx, 2
mov esi, ecx
xor esi, edx
and edx, ecx
xor esi, 0x89
lea edx, [esi + edx*2]
xor dl, byte [esp + ecx]
add dl, 0x53
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 5
jne 0x436df0
mov edi, dword [esp]
mov eax, dword [0x44a3a4]
test eax, eax
je 0x436e66
xor ecx, ecx
mov edx, dword [0x44a3a8]
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x436e40
inc ecx
cmp eax, ecx
jne 0x436e30
jmp 0x436e66
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x436e66
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x44a3ac]
call fcn.00439600
add esp, 0x1c
mov edi, eax
mov dword [esp], 0xf18e8f88
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
mov ecx, 0xf02532a2
sub ecx, eax
or ecx, edx
mov esi, 0xa2
sub esi, eax
and esi, edx
not ecx
or ecx, esi
mov edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
add cl, 0x2e
mov byte [esp + eax], cl
mov ecx, eax
not ecx
or ecx, 1
add ecx, eax
xor eax, 1
lea eax, [eax + ecx*2]
add eax, 2
cmp eax, 8
jb 0x436e80
cmp edi, dword [esp]
jne 0x436fe5
mov dword [esp + 0x10], ebp
push dword [esp + 8]
call fcn.00436c80
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor edx, edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 2
mov ebp, edi
xor ebp, esi
and esi, edi
xor ebp, 0x89
lea ecx, [esi*2]
add ecx, ebp
xor cl, byte [esp + edi]
add cl, 0x53
mov byte [esp + edi], cl
inc edi
add edx, 2
cmp edi, 5
jne 0x436f00
mov edi, dword [esp]
mov edx, dword [0x44a3a4]
test edx, edx
je 0x436f88
xor ebp, ebp
mov esi, dword [0x44a3a8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x436f60
inc ebp
cmp edx, ebp
jne 0x436f50
jmp 0x436f88
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x436f88
push 0
push dword [esp + 0x10]
push eax
push 5
push 0x10
push edx
push dword [0x44a3ac]
mov esi, eax
call fcn.00439600
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x436fdc
mov esi, dword [eax]
mov ecx, eax
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x436fb5
add edi, 2
cmp si, bp
je 0x436fa0
cmp si, bp
je 0x436fc7
mov esi, dword [ecx]
test esi, esi
jne 0x436f90
mov edi, 0xc0000225
jmp 0x436fdc
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.00436ce0
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x437020
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x4370e0
xor eax, eax
cmp dword [ecx], 0
jne 0x437135
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor eax, eax
xor esi, esi
nop
nop
nop
nop
nop
mov edi, eax
and edi, 2
mov ebx, esi
xor ebx, edi
and edi, esi
xor ebx, 0x89
lea ebx, [ebx + edi*2]
xor bl, byte [esp + esi]
add bl, 0x53
mov byte [esp + esi], bl
inc esi
add eax, 2
cmp esi, 5
jne 0x437090
mov eax, dword [esp]
mov esi, dword [0x44a3a4]
test esi, esi
je 0x437135
xor edi, edi
mov ebx, dword [0x44a3a8]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x43713e
inc edi
cmp esi, edi
jne 0x4370d0
jmp 0x437135
mov dword [esp + 8], 0x490a0b14
mov eax, 0xd34910c3
mov ecx, 0x3c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x2cb6ef45]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
mov esi, edx
xor esi, 0xd0
and edx, 0x2f
add edx, edx
sub edx, esi
inc dl
mov byte [esp + eax + 0x2cb6ef45], dl
inc eax
dec ecx
cmp eax, 0xd34910c7
jne 0x437100
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x437135
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44a3ac]
call fcn.00439600
add esp, 0x1c
jmp 0x437135

Function at 0x437170
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43720a
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor edx, edx
xor esi, esi
mov edi, edx
and edi, 2
mov ebx, esi
xor ebx, edi
and edi, esi
xor ebx, 0x89
lea ebx, [ebx + edi*2]
xor bl, byte [esp + esi]
add bl, 0x53
mov byte [esp + esi], bl
inc esi
add edx, 2
cmp esi, 5
jne 0x437190
mov edx, dword [0x44a3a4]
test edx, edx
je 0x4371fe
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44a3a8]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x4371e0
inc edi
cmp edx, edi
jne 0x4371d0
jmp 0x4371fe
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x4371fe
push eax
push 4
push edx
push dword [0x44a3ac]
mov esi, ecx
call fcn.00439600
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x4377d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x4377e9
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x4377fa
cmp eax, 2
je 0x437870
jmp 0x43789d
push 0xbbf966b4
push dword [0x44a398]
call fcn.0043c760
add esp, 8
test eax, eax
je 0x43783b
mov ecx, dword [esi]
test ecx, ecx
je 0x437868
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x437844
cmp dword [esp + 4], 0
je 0x437844
mov dword [esi + 4], 3
jmp 0x437868
mov dword [esi + 4], 1
jmp 0x43789d
lea eax, [esp + 0xc]
push eax
call fcn.0043cf20
add esp, 4
test al, al
je 0x437868
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x437865
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43789d
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x4523c0]
call fcn.0043c760
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x437924
mov ecx, dword [esi]
mov dword [esp + 4], 0x20272625
mov byte [esp + 8], 0
xor eax, eax
xor edx, edx
mov esi, eax
and esi, 2
mov ebx, edx
xor ebx, esi
and esi, edx
xor ebx, 0x89
lea ebx, [ebx + esi*2]
xor bl, byte [esp + edx + 4]
add bl, 0x53
mov byte [esp + edx + 4], bl
inc edx
add eax, 2
cmp edx, 5
jne 0x4378b0
mov eax, dword [esp + 4]
mov edx, dword [0x44a3a4]
test edx, edx
je 0x437924
xor esi, esi
mov ebx, dword [0x44a3a8]
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x437900
inc esi
cmp edx, esi
jne 0x4378f0
jmp 0x437924
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x437924
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 0x14
push edx
push dword [0x44a3ac]
call fcn.00439600
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x4387c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x40
mov dword [esp + 0x28], 0x73ce71c6
mov dword [esp + 0x2c], 0x7fca7dd0
mov dword [esp + 0x30], 0x7b8c79cc
mov dword [esp + 0x34], 0x47f245e8
mov dword [esp + 0x38], 0x434241f4
mov byte [esp + 0x3c], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x28]
mov esi, eax
and esi, 0x28
mov edi, ecx
xor edi, 0x35a41a14
add edi, esi
mov esi, edi
or esi, edx
not edx
or edi, edx
sub edx, edi
add edx, esi
add dl, 0x9c
mov byte [esp + ecx + 0x28], dl
inc ecx
add eax, 2
cmp ecx, 0x15
jne 0x438800
lea eax, [esp + 0x28]
push eax
call fcn.0043c270
add esp, 4
mov dword [0x4523c0], eax
mov dword [esp + 0x24], 0x14c218a1
test eax, eax
je 0x438856
mov dword [esp + 0x24], 0xe16a9b65
mov edi, 0x18acaaa9
xor eax, eax
cmp edi, 0xf5b103ce
setl al
mov eax, dword [eax*4 + 0x446c34]
mov ecx, 0x233c8acd
xor ecx, dword [0x446c3c]
add eax, ecx
inc eax
jmp eax

Function at 0x439550
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x446f30]
Function at 0x43ad30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x43ada2
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, edx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x43af7e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x43af7e
mov dword [esp], 0x3c3d3a3b
mov word [esp + 4], 0
mov ebp, 0x5c8a
mov ecx, 0xffff2375
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ebp - 0x5c8a]
mov edi, ecx
and edi, 0xf544012a
mov eax, ebp
and eax, 0x4815
or eax, edi
xor edx, 0xf54495aa
mov edi, edx
and edi, eax
add edi, edi
sub eax, edi
lea edi, [eax + edx]
add edx, eax
add edx, 0xfffbb14d
mov eax, edx
and eax, 1
and edi, 1
and edx, 0xfe
or edx, edi
xor edi, 1
or edi, eax
lea eax, [edx + edi*2]
mov byte [esp + ebp - 0x5c8a], al
inc ebp
dec ecx
cmp ebp, 0x5c90
jne 0x43adc0
mov eax, dword [esp]
mov ecx, dword [0x44a3a4]
test ecx, ecx
je 0x43ae50
xor edx, edx
mov edi, dword [0x44a3a8]
mov ebp, dword [esp + 0x20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x43ae56
inc edx
cmp ecx, edx
jne 0x43ae40
jmp 0x43ae80
mov ebp, dword [esp + 0x20]
jmp 0x43ae80
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43ae80
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1c
push ecx
push dword [0x44a3ac]
call fcn.00439600
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x24]
js 0x43af7e
push 0x732f71fd
push dword [0x4523c0]
call fcn.0043c760
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x3c3d3a3b
mov word [esp + 4], 0
mov edx, 0x5c8a
mov esi, 0xffff2375
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx - 0x5c8a]
mov ebx, esi
and ebx, 0xf544012a
mov ebp, edx
and ebp, 0x4815
or ebp, ebx
xor edi, 0xf54495aa
mov ebx, edi
and ebx, ebp
add ebx, ebx
sub ebp, ebx
lea ebx, [edi + ebp]
add edi, ebp
add edi, 0xfffbb14d
mov ebp, edi
and ebp, 1
and ebx, 1
and edi, 0xfe
or edi, ebx
xor ebx, 1
or ebx, ebp
lea ebx, [edi + ebx*2]
mov byte [esp + edx - 0x5c8a], bl
inc edx
dec esi
cmp edx, 0x5c90
jne 0x43aed0
mov edx, dword [0x44a3a4]
test edx, edx
je 0x43af7e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44a3a8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43af60
inc edi
cmp edx, edi
jne 0x43af50
jmp 0x43af7e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43af7e
push ecx
push 4
push edx
push dword [0x44a3ac]
mov esi, eax
call fcn.00439600
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c270
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 0xc], 0xc9cacb1c
mov word [esp + 0x10], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x33
xor cl, byte [esp + eax + 0xc]
inc cl
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 6
jne case.default.0x43c2b6
mov eax, dword [esp + 0xc]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x30], 0
sete cl
jmp dword [ecx*4 + 0x447a64]
mov ecx, dword [eax + 0xc]
add ecx, 0xc
mov esi, dword [0x447a88]
mov dword [esp], 0
mov eax, dword [0x447a9c]
mov dword [esp + 0x18], eax
mov edx, dword [ecx]
xor eax, eax
mov dword [esp + 0x14], ecx
cmp edx, ecx
setne al
jmp dword [eax*4 + 0x447a6c]
mov dword [esp + 8], edx
mov ebp, dword [edx + 0x30]
xor eax, eax
test ebp, ebp
setne al
mov dword [esp + 4], 1
mov ecx, dword [esp + 0x30]
mov edx, ebp
jmp dword [eax*4 + 0x447a74]
mov ecx, dword [esp + 0x30]
mov edx, ebp
jmp esi
movzx eax, word [ecx]
lea edi, [eax - 0x41]
cmp di, 0x1a
jae 0x43c337
or eax, 0x20
movzx edi, word [edx]
lea ebx, [edi - 0x41]
cmp bx, 0x1a
jae 0x43c346
or edi, 0x20
test ax, ax
je 0x43c320
add edx, 2
add ecx, 2
cmp ax, di
je case.0x43c2b6.4
jmp 0x43c320
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
jmp dword [eax*4 + 0x447aa4]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43c690
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0xb9babbd4
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
lea esi, [eax + 0x6ddb039f]
xor esi, edx
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
add dl, 0xe4
mov byte [esp + eax], dl
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 6
jb case.default.0x43c6ea
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x447b44]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x447b4c]
mov eax, dword [esi + 0x28]
xor edi, edi
jmp dword [edi*4 + 0x447b5c]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x447b54]
mov edi, 1
jmp dword [edi*4 + 0x447b5c]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43c760
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
movzx eax, word [ebp]
mov dword [esp], 0x999afdcf
mov dword [esp + 4], 0
xor edx, edx
movzx ecx, byte [esp + edx]
mov esi, edx
and esi, 1
mov edi, edx
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, esi
or esi, 2
imul esi, edi
mov edi, edx
xor edi, 0xdc9b
add edi, ebx
add edi, esi
xor edi, ecx
mov ecx, edi
and ecx, 1
xor edi, 1
lea ecx, [edi + ecx*2]
add cl, 0xf8
mov byte [esp + edx], cl
inc edx
cmp edx, 8
jne case.default.0x43c7cb
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x447b64]
mov edx, dword [ebp + 0x3c]
mov eax, dword [ebp + edx]
mov dword [esp], 0xd7d68498
mov word [esp + 4], 0
mov ecx, 0xae969cce
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x51696332]
xor esi, ecx
add esi, 0x970eeff9
mov edi, esi
and edi, 1
xor esi, 1
lea ebx, [esi + edi*2]
mov byte [esp + ecx + 0x51696332], bl
inc ecx
cmp ecx, 0xae969cd4
jne 0x43c7f0
mov ecx, dword [esp]
mov esi, dword [case.0x43c7cb.4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp esi
xor ebx, ebx
cmp eax, ecx
setne bl
xor eax, eax
jmp dword [ebx*4 + 0x447b7c]
mov esi, dword [ebp + edx + 0x7c]
mov edx, dword [ebp + edx + 0x78]
test esi, esi
sete al
test edx, edx
sete cl
or cl, al
movzx eax, cl
jmp dword [eax*4 + 0x447b84]
mov dword [esp + 0x14], esi
mov eax, dword [ebp + edx + 0x20]
add eax, ebp
mov dword [esp + 0x28], eax
mov eax, dword [ebp + edx + 0x24]
add eax, ebp
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + edx + 0x1c]
add eax, ebp
mov dword [esp + 0x18], eax
mov esi, dword [ebp + edx + 0x18]
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x24], esi
cmp ecx, esi
setb al
mov dword [esp + 0x20], 1
jmp dword [eax*4 + 0x447b9c]
mov ecx, dword [case.0x43c7cb.0]
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c832
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
movzx eax, word [ebp]
mov dword [esp], 0x999afdcf
mov dword [esp + 4], 0
xor edx, edx
movzx ecx, byte [esp + edx]
mov esi, edx
and esi, 1
mov edi, edx
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, esi
or esi, 2
imul esi, edi
mov edi, edx
xor edi, 0xdc9b
add edi, ebx
add edi, esi
xor edi, ecx
mov ecx, edi
and ecx, 1
xor edi, 1
lea ecx, [edi + ecx*2]
add cl, 0xf8
mov byte [esp + edx], cl
inc edx
cmp edx, 8
jne case.default.0x43c7cb
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x447b64]
mov edx, dword [ebp + 0x3c]
mov eax, dword [ebp + edx]
mov dword [esp], 0xd7d68498
mov word [esp + 4], 0
mov ecx, 0xae969cce
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x51696332]
xor esi, ecx
add esi, 0x970eeff9
mov edi, esi
and edi, 1
xor esi, 1
lea ebx, [esi + edi*2]
mov byte [esp + ecx + 0x51696332], bl
inc ecx
cmp ecx, 0xae969cd4
jne 0x43c7f0
mov ecx, dword [esp]
mov esi, dword [case.0x43c7cb.4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp esi
xor ebx, ebx
cmp eax, ecx
setne bl
xor eax, eax
jmp dword [ebx*4 + 0x447b7c]
mov esi, dword [ebp + edx + 0x7c]
mov edx, dword [ebp + edx + 0x78]
test esi, esi
sete al
test edx, edx
sete cl
or cl, al
movzx eax, cl
jmp dword [eax*4 + 0x447b84]
mov dword [esp + 0x14], esi
mov eax, dword [ebp + edx + 0x20]
add eax, ebp
mov dword [esp + 0x28], eax
mov eax, dword [ebp + edx + 0x24]
add eax, ebp
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + edx + 0x1c]
add eax, ebp
mov dword [esp + 0x18], eax
mov esi, dword [ebp + edx + 0x18]
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x24], esi
cmp ecx, esi
setb al
mov dword [esp + 0x20], 1
jmp dword [eax*4 + 0x447b9c]
mov ecx, dword [case.0x43c7cb.0]
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret