joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405cb0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x405dc2
mov esi, dword [esp + 0x28]
test esi, esi
je 0x405dc2
cmp dword [esp + 0x2c], 0
je 0x405dc2
push esi
call fcn.0040d910
add esp, 4
test eax, eax
je 0x405d1a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x405d21
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x405d00
jmp 0x405d23
mov ebx, 0x1505
jmp 0x405d23
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x405dca
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405d87
call fcn.00406a40
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x405dc2
push ecx
call fcn.0040d910
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x405e3d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405de8
inc edi
dec esi
je 0x405d3c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405d41
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405de0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040d910
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405de0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040d930
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405de0
mov eax, 0xffffffff
jmp 0x405dc2
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405e58
inc edi
dec esi
je 0x405d82
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405d87
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405e50
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040d910
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405e50
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040d930
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405e50
jmp 0x405d87
Function at 0x406790
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x40697a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x40697a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x40697a
cmp dword [ecx], 0
jne 0x40697a
push esi
call fcn.0040d910
add esp, 4
test eax, eax
je 0x4067fa
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x406801
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x4067e0
jmp 0x406803
mov edi, 0x1505
jmp 0x406803
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x4068d4
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x406861
call fcn.00406a40
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x40697a
push esi
call fcn.0040d910
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00406990
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040d910
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x448008]
add esp, 4
test eax, eax
je 0x406975
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040d700
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x40697a
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4068f8
inc ebx
dec edx
je 0x40681c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x406821
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x4068f0
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040d910
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x4068f0
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040d930
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x4068f0
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00405860
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x4068c9
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407a30
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x407be6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x407bdf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x407ac6
mov eax, dword [esp + 4]
sub eax, dword [esp]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ecx
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, edi
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub ecx, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
sub esi, dword [esp + 4]
mov ebx, 0x15b0
je 0x407bdf
xor edx, edx
cmp ebx, 8
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
jb 0x407b48
and ebx, 0x1ff8
mov dword [esp], ebx
xor eax, eax
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
mov eax, ecx
and eax, esi
xor ecx, esi
movzx ebx, byte [ebp + edx + 6]
add ebx, esi
add ecx, ebx
movzx edi, byte [ebp + edx + 7]
add edi, ebx
mov ebx, dword [esp + 4]
add ecx, edi
lea ecx, [ecx + eax*2]
lea eax, [edx + 8]
add edx, 0xf
cmp edx, ebx
jb 0x407ae0
add ebp, eax
mov esi, dword [esp + 8]
mov edx, dword [esp]
mov eax, edx
sub eax, ebx
jae 0x407a8d
mov dword [esp + 0xc], eax
mov eax, ebx
and eax, 3
mov dword [esp], edx
je 0x407b8f
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x407b70
mov eax, dword [esp]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x407a80
jmp 0x407b9e
mov eax, edx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x407a80
mov ebx, dword [esp + 4]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x407bb0
jmp 0x407a80
shl ecx, 0x10
or ecx, edi
jmp 0x407beb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x410f70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x440
mov eax, dword [0x44e564]
mov dword [esp + 0x40], 0x33a53185
mov dword [esp + 0x44], 0x2fb72da6
mov dword [esp + 0x48], 0x2bbe29bc
mov dword [esp + 0x4c], 0x27712585
mov dword [esp + 0x50], 0x2374216d
mov dword [esp + 0x54], 0x1f7e1d4c
mov dword [esp + 0x58], 0x1bb51940
mov dword [esp + 0x5c], 0x1780158d
mov dword [esp + 0x60], 0x1385118c
mov dword [esp + 0x64], 0xf9d0d83
mov dword [esp + 0x68], 0xbbc0968
mov dword [esp + 0x6c], 0x76605a8
mov dword [esp + 0x70], 0x3520151
mov dword [esp + 0x74], 0x7f2e7d2a
mov dword [esp + 0x78], 0x7b1a7933
mov dword [esp + 0x7c], 0x77ef75db
mov dword [esp + 0x80], 0x733c71e6
mov dword [esp + 0x84], 0x6f256d20
mov dword [esp + 0x88], 0x6be26908
mov dword [esp + 0x8c], 0x672a652a
mov dword [esp + 0x90], 0x63026139
mov dword [esp + 0x94], 0x5fce5d1d
mov dword [esp + 0x98], 0x5bce59c8
mov dword [esp + 0x9c], 0x57f955c9
mov dword [esp + 0xa0], 0x53f051cd
mov dword [esp + 0xa4], 0x4fd74df7
mov dword [esp + 0xa8], 0x4b1d49c4
mov dword [esp + 0xac], 0x47154509
mov dword [esp + 0xb0], 0x4314410f
mov dword [esp + 0xb4], 0xbff0bdef
mov dword [esp + 0xb8], 0xbbe2b9d8
mov dword [esp + 0xbc], 0xb70eb50f
mov dword [esp + 0xc0], 0xb307b11c
mov dword [esp + 0xc4], 0xaffaad18
mov dword [esp + 0xc8], 0xab3ea9c8
mov dword [esp + 0xcc], 0xa73da53d
mov dword [esp + 0xd0], 0xa3c2a13d
mov dword [esp + 0xd4], 0x9f039d23
mov dword [esp + 0xd8], 0x9b01993b
mov dword [esp + 0xdc], 0x97cf9503
mov dword [esp + 0xe0], 0x93d191f0
mov dword [esp + 0xe4], 0x8f1c8d14
mov dword [esp + 0xe8], 0x8b1f891f
mov dword [esp + 0xec], 0x87d18519
mov dword [esp + 0xf0], 0x83d381d1
mov dword [esp + 0xf4], 0xffa8fdb5
mov dword [esp + 0xf8], 0xfbacf9a8
mov dword [esp + 0xfc], 0xf7a0f5a4
mov dword [esp + 0x100], 0xf392f1a0
mov dword [esp + 0x104], 0xef4fed5f
mov dword [esp + 0x108], 0xeb4be976
mov dword [esp + 0x10c], 0xe77fe576
mov dword [esp + 0x110], 0xe3afe1b7
mov dword [esp + 0x114], 0xdf91dd8f
mov dword [esp + 0x118], 0xdb89d98e
mov dword [esp + 0x11c], 0xd7d6d59a
mov word [esp + 0x120], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xe1
ja 0x411225
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x40]
mov esi, ecx
not esi
or esi, 0x1dbf960c
add esi, ecx
xor ecx, 0x1dbf960c
lea ecx, [ecx + esi*2]
add ecx, 2
xor ecx, edx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 8]
add cl, 0xc4
mov edx, dword [esp]
mov byte [esp + edx + 0x40], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xe2
jb 0x4111e0
mov ebx, dword [esp + 0x46c]
mov ebp, dword [esp + 0x468]
lea edi, [esp + 0x40]
push 0
push 0
push 0
push 0
push edi
call eax
xor ecx, ecx
mov dword [esp + 0x3c], eax
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449160]
Function at 0x4136f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x150
mov word [esp + 0x58], 0xf153
mov dword [esp + 0x5a], 0
mov word [esp + 0x5e], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 7
ja 0x413774
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x58]
mov edx, eax
xor edx, 0x157e41d4
and eax, 0x157e41d4
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0xc4], eax
mov eax, dword [esp + 0xc4]
add al, 0xdc
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x58], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 8
jb 0x413730
lea edi, [esp + 0x58]
push edi
push dword [ebp + 8]
call fcn.004052d0
add esp, 8
mov esi, eax
xor ecx, ecx
test eax, eax
sete cl
xor ebx, ebx
xor eax, eax
jmp dword [ecx*4 + 0x449a5c]
Function at 0x43a3c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + ebx], 0
lea ebx, [ebx + 2]
jne 0x43a3e0
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x727270e3
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x43a449
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0xd459e94
and eax, 0xd459e94
lea eax, [esi + eax*2]
xor eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 0x1c
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x43a410
cmp ebx, 2
je 0x43a467
lea eax, [ebx - 2]
mov esi, eax
sar esi, 1
mov edi, dword [esp + 4]
mov edx, edi
not edx
test al, 2
mov dword [esp + 0x10], edx
jne 0x43a46e
jmp 0x43a499
mov eax, ebp
jmp 0x43a500
dec esi
mov ecx, dword [esp + 0x2c]
movzx eax, word [ecx]
add ecx, 2
mov dword [esp + 8], ecx
xor eax, ebp
mov ebp, eax
not ebp
and ebp, edi
mov ecx, eax
and ecx, edx
imul ecx, ebp
mov ebp, eax
and ebp, edi
or eax, edi
imul eax, ebp
add eax, ecx
mov ebp, eax
cmp ebx, 4
mov ecx, dword [esp + 8]
je 0x43a500
xor ebx, ebx
mov eax, ebp
mov dword [esp + 0xc], esi
nop
nop
nop
nop
nop
nop
movzx ebp, word [ecx + ebx*2]
xor ebp, eax
mov eax, ebp
not eax
and eax, edi
mov edx, ebp
mov esi, ecx
mov ecx, dword [esp + 0x10]
and edx, ecx
imul edx, eax
mov eax, ebp
and eax, edi
or ebp, edi
imul ebp, eax
add ebp, edx
movzx eax, word [esi + ebx*2 + 2]
xor eax, ebp
mov edx, eax
not edx
and edx, edi
mov ebp, eax
and ebp, ecx
mov ecx, esi
imul ebp, edx
mov edx, eax
and edx, edi
or eax, edi
imul eax, edx
mov esi, dword [esp + 0xc]
add eax, ebp
add ebx, 2
cmp esi, ebx
jne 0x43a4b0
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e070
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 0x9f9e99a8
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43e0e3
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0xa364ecda
and eax, 0x2364ecda
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov ecx, eax
xor ecx, 0x42
and eax, 0x3d
add eax, eax
sub eax, ecx
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x43e0a0
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
mov edi, dword [eax + 0x18]
mov ebx, dword [0x4578c8]
jmp dword [0x44d424]
Function at 0x43e1d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x6c6d6e3a
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43e239
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0x4d26f498
and eax, 0xcd26f498
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x43e200
mov edi, dword [esp + 4]
mov eax, dword [0x44f8ac]
test eax, eax
je 0x43e286
xor ecx, ecx
mov edx, dword [0x44f8b0]
nop
nop
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x43e260
inc ecx
cmp eax, ecx
jne 0x43e250
jmp 0x43e286
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43e286
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x44f8b4]
push eax
call fcn.00440ec0
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43e3d5
mov dword [esp + 0x14], esi
push dword [esp + 0xc]
call fcn.0043e070
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x6c6d6e3a
mov word [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 5
ja 0x43e30b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0x4d26f498
and edx, 0xcd26f498
lea edx, [edi + edx*2]
xor edx, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 8
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 6
jb 0x43e2d0
mov edi, dword [esp + 4]
mov edx, dword [0x44f8ac]
test edx, edx
je 0x43e366
xor ebx, ebx
mov ebp, dword [0x44f8b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x43e341
inc ebx
cmp edx, ebx
jne 0x43e330
jmp 0x43e366
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x43e366
push 0
push ecx
push eax
push 5
push 4
push dword [0x44f8b4]
push edx
mov esi, eax
call fcn.00440ec0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43e3cc
mov ecx, dword [esp + 0x2c]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x43e3a5
add ebx, 2
cmp bp, si
je 0x43e390
cmp bp, si
je 0x43e3b7
mov ebx, dword [edx]
test ebx, ebx
jne 0x43e380
mov edi, 0xc0000225
jmp 0x43e3cc
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x14]
mov dword [esi + 8], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043e120
add esp, 4
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43e410
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ecx + 8]
test edx, edx
je 0x43e500
xor eax, eax
cmp dword [ecx], 0
jne 0x43e562
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], edx
mov eax, dword [ecx + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x6c6d6e3a
mov word [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43e4c9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
mov esi, eax
xor esi, 0x4d26f498
and eax, 0xcd26f498
lea eax, [esi + eax*2]
xor eax, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
add al, 8
mov edx, dword [esp]
mov byte [esp + edx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x43e490
mov eax, dword [esp + 0xc]
mov esi, dword [0x44f8ac]
test esi, esi
je 0x43e562
mov edx, dword [esp + 0x40]
xor edi, edi
mov ebx, dword [0x44f8b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x43e56b
inc edi
cmp esi, edi
jne 0x43e4f0
jmp 0x43e562
mov dword [esp + 0x14], 0xf18e8f84
mov byte [esp + 0x18], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x43e55e
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x14]
mov edx, eax
xor edx, 0xe730f2dd
and eax, 0xe730f2dd
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xaf
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x43e520
mov eax, dword [esp + 0x14]
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43e562
lea eax, [esp + 4]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44f8b4]
push esi
call fcn.00440ec0
add esp, 0x1c
jmp 0x43e562

Function at 0x43e5b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43e67a
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x6c6d6e3a
mov word [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 5
ja 0x43e61b
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0x4d26f498
and edx, 0xcd26f498
lea edx, [edi + edx*2]
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 8
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 6
jb 0x43e5e0
mov edx, dword [0x44f8ac]
test edx, edx
je 0x43e66e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44f8b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x43e650
inc edi
cmp edx, edi
jne 0x43e640
jmp 0x43e66e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43e66e
push eax
push 1
push dword [0x44f8b4]
push edx
mov esi, ecx
call fcn.00440ec0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x43e680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 8], 0
je 0x43e736
mov edx, dword [ecx]
test edx, edx
je 0x43e736
mov dword [esp + 0x14], 0x6c6d6e3a
mov word [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43e6f9
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 0x14]
mov edi, eax
xor edi, 0x4d26f498
and eax, 0xcd26f498
lea eax, [edi + eax*2]
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 8
mov esi, dword [esp]
mov byte [esp + esi + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x43e6c0
mov edi, dword [ebp + 0x10]
mov eax, dword [esp + 0x14]
mov ebx, dword [0x44f8ac]
test ebx, ebx
je 0x43e7c5
xor edi, edi
mov esi, dword [0x44f8b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edi*8], 0xc766965c
je 0x43e7a1
inc edi
cmp ebx, edi
jne 0x43e720
mov edi, dword [ebp + 0x10]
jmp 0x43e7c5
mov dword [esp], 0x19dadbdc
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 3
ja 0x43e799
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx]
mov edx, eax
xor edx, 0x1afe544f
and eax, 0x1afe544f
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, eax
not ecx
and ecx, 0x8b
and eax, 0x74
sub eax, ecx
mov ecx, dword [esp + 8]
mov byte [esp + ecx], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 4
jb 0x43e750
mov eax, dword [esp]
jmp 0x43e8c2
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
mov edi, dword [ebp + 0x10]
je 0x43e7c5
push dword [ebp + 8]
push edx
push 2
push dword [0x44f8b4]
push esi
mov esi, ecx
call fcn.00440ec0
mov ecx, esi
add esp, 0x14
mov esi, dword [ebp + 0xc]
cmp esi, 1
mov edx, edi
sbb edx, 0
jl 0x43e8b5
cmp eax, 0xc000010a
jne 0x43e8b5
mov edx, 0xffffd8f0
mov eax, esi
mul edx
sub edx, esi
imul esi, edi, 0xffffd8f0
add esi, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov edx, dword [ecx]
mov dword [esp + 0x14], 0x6c6d6e3a
mov word [esp + 0x18], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x43e85c
nop
nop
mov eax, dword [esp + 4]
mov esi, dword [esp + 4]
movzx esi, byte [esp + esi + 0x14]
mov edi, eax
xor edi, 0x4d26f498
and eax, 0xcd26f498
lea eax, [edi + eax*2]
xor eax, esi
mov dword [esp], eax
mov eax, dword [esp]
add al, 8
mov esi, dword [esp + 4]
mov byte [esp + esi + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 6
jb 0x43e820
mov eax, dword [esp + 0x14]
mov esi, dword [0x44f8ac]
test esi, esi
je 0x43e8b5
xor edi, edi
mov ebx, dword [0x44f8b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e28bda7
je 0x43e890
inc edi
cmp esi, edi
jne 0x43e880
jmp 0x43e8b5
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43e8b5
lea eax, [esp + 8]
push eax
push 0
push edx
push 3
push dword [0x44f8b4]
push esi
mov esi, ecx
call fcn.00440ec0
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43e8c2
mov esi, eax
call fcn.0043e5b0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc