joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4243e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, dword [esp + 0x54]
mov ebp, dword [esp + 0x4c]
mov edi, dword [esp + 0x48]
movzx eax, byte [esp + 0x58]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], esi
mov byte [esp + 0x28], al
test esi, esi
setg cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x449b38]

Function at 0x4273c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0x296d2b4f
mov dword [esp + 8], 0x2d9e2f98
mov dword [esp + 0xc], 0x31953368
mov dword [esp + 0x10], 0x35913784
mov dword [esp + 0x14], 0x39663b5f
mov dword [esp + 0x18], 0x3d963f6c
mov dword [esp + 0x1c], 0x1b00387
mov dword [esp + 0x20], 0x5ad07a4
mov dword [esp + 0x24], 0x9ac0bb2
mov dword [esp + 0x28], 0xdb80fa7
mov dword [esp + 0x2c], 0x114e13a8
mov dword [esp + 0x30], 0x15a01740
mov dword [esp + 0x34], 0x19b01ba5
mov dword [esp + 0x38], 0x1db21fb7
mov dword [esp + 0x3c], 0x61d763b7
lea eax, [esp + 0x40]
mov word [esp + 0x40], 0x6760
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 7
xor dl, byte [esp + ecx + 4]
add dl, 0xdd
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 0x44
jne 0x427460
lea ebx, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, esp
push edi
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x44e800]
mov ebp, dword [esp]
test ebp, ebp
jns 0x4274bc
mov eax, 0xffffffff
jmp 0x4274c3
lea eax, [ebp*2]
push eax
call fcn.0040c8e0
add esp, 4
mov esi, eax
push edi
push ebp
push eax
push 0x1e
push ebx
push 0
call dword [0x44e800]
mov dword [esp + 4], 0x11861f68
mov dword [esp + 8], 0x158c1387
mov dword [esp + 0xc], 0x9711770
mov dword [esp + 0x10], 0xd680b9a
mov dword [esp + 0x14], 0x19c0f97
mov dword [esp + 0x18], 0x5020364
mov word [esp + 0x1c], 0
mov byte [esp + 0x1e], 0
mov eax, 0x4bbf8f05
mov ecx, 0xb44070fa
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x4bbf8f01]
mov edx, ebx
not edx
mov edi, edx
shl edi, 0x1f
sub edi, edx
sub edi, edx
sub edi, ebx
add edi, 0x7ffffffe
or edi, ecx
lea ebp, [ebx + ebx]
not ebp
add ebp, ebx
and ebx, 0xffffffc1
and ebp, 0x9440603e
or ebp, ebx
xor ebp, eax
xor ebp, 0x200010c1
and edx, eax
or edx, ebp
and edx, edi
mov edi, 0x854234e5
sub edi, edx
mov ebx, edi
mov edx, edi
xor edx, 1
add edx, edi
and edi, 1
and ebx, 0xfe
sub edx, ebx
add edx, edi
mov byte [esp + eax - 0x4bbf8f01], dl
inc eax
dec ecx
cmp eax, 0x4bbf8f20
jne 0x427530
push 0
push 0
lea eax, [esp + 0xc]
push eax
push esi
push dword [esp + 0xac]
call fcn.00423110
add esp, 0x14
jmp dword [0x44a21c]
Function at 0x4275e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x21e8
call fcn.0040c840
mov dword [esp + 0x11e8], 0x8fd88924
mov dword [esp + 0x11ec], 0x83d98dc9
mov dword [esp + 0x11f0], 0x87d181d9
mov dword [esp + 0x11f4], 0x9bcc85d0
mov dword [esp + 0x11f8], 0x9f329931
mov dword [esp + 0x11fc], 0x93c59dc9
mov dword [esp + 0x1200], 0x97c091d5
mov word [esp + 0x1204], 0x9594
mov dword [esp + 0x1206], 0
mov word [esp + 0x120a], 0
mov eax, 0x382b1f22
mov ecx, 0xd4e0dd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x382b0d3a]
mov edi, ecx
and edi, 0xc0004f
mov edx, eax
and edx, 0x382b0f30
or edx, edi
xor edx, esi
xor edx, 0xc0c0104f
add edx, 0x27286455
mov esi, edx
xor esi, 0x4c
and edx, 0x33
add edx, edx
sub edx, esi
add dl, 0x4d
mov byte [esp + eax - 0x382b0d3a], dl
inc eax
dec ecx
cmp eax, 0x382b1f46
jne 0x427670
lea eax, [esp + 0x30]
lea ebp, [esp + 0x11e8]
push 0
push 0
push 0x20019
push eax
push ebp
call fcn.004426a0
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0x44a224]
Function at 0x42b0c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
add ecx, 2
cmp word [eax], 0
jne case.0x42a752.3
mov ecx, eax
and ecx, ebx
not eax
and eax, esi
sub ecx, eax
lea eax, [ecx + 0x26]
cmp ecx, 0xffffffd9
jge 0x42b0e2
mov eax, 0xffffffff
push eax
call fcn.0040c8e0
add esp, 4
mov dword [esp + 0x14], 0x3f993984
mov dword [esp + 0x18], 0x23b03daf
mov dword [esp + 0x1c], 0x278f218a
mov dword [esp + 0x20], 0x2b96258f
mov dword [esp + 0x24], 0x2fbd298f
mov dword [esp + 0x28], 0x13b82dbe
mov dword [esp + 0x2c], 0x17bd11b9
mov dword [esp + 0x30], 0x1b8015c6
mov dword [esp + 0x34], 0x1fb419bc
mov word [esp + 0x38], 0x1d1c
mov dword [esp + 0x3a], 0
mov ecx, 0xca
mov ebp, 0x35
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0xb6]
mov edx, ebp
xor edx, ecx
and edx, edi
xor edx, ecx
add dl, 0xe
mov byte [esp + ecx - 0xb6], dl
inc ecx
dec ebp
cmp ecx, 0xf4
jne 0x42b150
movzx ecx, word [esi]
test cx, cx
je 0x42b191
lea edx, [esi + 2]
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x42b180
mov word [eax], 0
movzx ecx, word [esp + 0x14]
test cx, cx
je 0x42b1c1
lea edx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x42b1b0
mov word [eax], 0
mov ecx, esi
Function at 0x42b91e
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov ecx, eax
and ecx, 0x1b
mov edx, eax
xor edx, 0x5b
lea ecx, [edx + ecx*2]
xor cl, byte [esp + eax + 0x14]
add cl, 0x39
mov byte [esp + eax + 0x14], cl
inc eax
cmp eax, 0x2d
jne 0x42b920
xor eax, eax
jmp dword [0x44ab18]
Function at 0x42cd60
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xcc
mov dword [esp + 0x18], 0xe1a5e7bb
mov dword [esp + 0x1c], 0xdd72e370
mov dword [esp + 0x20], 0xd97ddf60
mov dword [esp + 0x24], 0xd579db54
mov dword [esp + 0x28], 0xd172d78b
mov dword [esp + 0x2c], 0xcd43d366
mov dword [esp + 0x30], 0xc951cf40
mov dword [esp + 0x34], 0xc569cb58
mov dword [esp + 0x38], 0xc193c758
mov dword [esp + 0x3c], 0x3d66c395
mov dword [esp + 0x40], 0x39a13fb1
mov dword [esp + 0x44], 0x35b73bb5
mov dword [esp + 0x48], 0x31a737af
mov dword [esp + 0x4c], 0x2d6433a6
mov dword [esp + 0x50], 0x29b92fa4
mov dword [esp + 0x54], 0x252a2bbc
lea eax, [esp + 0x58]
mov word [esp + 0x58], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xd9
xor dl, byte [esp + ecx + 0x18]
add dl, 0xc3
mov byte [esp + ecx + 0x18], dl
inc ecx
cmp ecx, 0x42
jne 0x42ce00
lea ebx, [esp + 0x8c]
lea edx, [esp + 0x18]
mov ecx, 0x10
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xcc]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x88]
push esi
push 0
push 0
push 0x1f
push ebx
push 0
call dword [0x44e800]
mov edi, dword [esp + 0x88]
test edi, edi
jns 0x42ce65
mov eax, 0xffffffff
jmp 0x42ce68
lea eax, [edi + edi]
push eax
call fcn.0040c8e0
add esp, 4
mov ebp, eax
push esi
push edi
push eax
push 0x1f
push ebx
push 0
call dword [0x44e800]
lea eax, [esp + 0x70]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.00442040
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44adf0]
Function at 0x434760
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
jmp 0x43477b
jmp 0x43477d
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x43478e
jmp 0x434900
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
xor ebx, ebx
cmp edi, 0
je 0x4348fa
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.00430db0
mov esi, eax
cmp esi, 0
setne al
jmp 0x4347e5
jmp 0x4347e7
jmp 0x4347e9
xor ebx, ebx
test al, 1
jne 0x4347f4
jmp 0x4348ec
mov ebx, esi
and ebx, 1
mov eax, esi
or eax, 1
add ebx, eax
mov dword [esp], ebx
call fcn.0040c8e0
jmp 0x43480a
mov dword [esp + 0x24], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
call fcn.004299b0
mov al, byte [esp + 0x1c]
mov byte [esp + 0x20], al
mov byte [esp + 0xc], 3
mov byte [esp + 0xd], 0x6d
mov byte [esp + 0xe], 0x6b
mov byte [esp + 0xf], 0x53
mov byte [esp + 0x10], 0x66
mov byte [esp + 0x11], 0x6a
mov byte [esp + 0x12], 0x67
mov byte [esp + 0x13], 0x55
mov byte [esp + 0x14], 0x6c
mov byte [esp + 0x15], 0x27
mov byte [esp + 0x16], 0x5e
mov byte [esp + 0x17], 0x53
mov byte [esp + 0x18], 0x58
mov byte [esp + 0x19], 0xcd
mov eax, 0xe
mov byte [esp + eax + 0xc], 0
add eax, 1
cmp eax, 0x10
jne 0x434871
jmp 0x434880
jmp 0x434882
xor eax, eax
jmp 0x434886
cmp eax, 0x10
jae 0x4348bc
movzx ebx, byte [esp + eax + 0xc]
mov ecx, 0xcf
sub ecx, eax
or ecx, ebx
mov edx, 0xcf
sub edx, eax
mov ebp, 0xcf
sub ebp, eax
or edx, ebp
and edx, ebx
xor ecx, 0xffffffff
or edx, ecx
add dl, 0x10
mov byte [esp + eax + 0xc], dl
add eax, 1
jmp 0x434886
lea eax, [esp + 0xc]
mov ecx, dword [esp + 0x3c]
mov dword [esp], eax
mov ebp, dword [esp + 0x24]
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
call fcn.0040d450
sub esp, 0xc
mov bl, al
and bl, 1
mov dword [esp], ebp
call fcn.0040c8f0
jmp 0x4348ea
jmp 0x4348ec
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x4348fa
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.004426a0
add esp, 0x14
test eax, eax
js 0x439e33
lea ebx, [esp + 8]
lea eax, [esp + 0xc]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.00442a50
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x439d9c
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 8]
mov ecx, eax
inc ecx
jns 0x439d6a
mov eax, 0xffffffff
jmp 0x439d71
lea eax, [eax*2 + 2]
push eax
call fcn.0040c8e0
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x14]
call fcn.00443000
add esp, 0x14
test eax, eax
jns 0x439d9c
push esi
call fcn.0040c8f0
add esp, 4
xor esi, esi
mov eax, dword [esp + 4]
mov dword [esp], 0x54554a4b
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov ebx, edi
and ebx, 4
mov edx, ecx
xor edx, 0x6e
add edx, ebx
xor dl, byte [esp + ecx]
add dl, 0xda
mov byte [esp + ecx], dl
inc ecx
add edi, 2
cmp ecx, 4
jne 0x439db0
mov ecx, dword [0x44e804]
test ecx, ecx
je 0x439e1a
mov edx, dword [esp]
xor edi, edi
mov ebx, dword [0x44e808]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x439e00
inc edi
cmp ecx, edi
jne 0x439df0
jmp 0x439e1a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x439e1a
push eax
push 1
push ecx
push dword [0x44e80c]
call fcn.0043eb30
add esp, 0x10
test esi, esi
jne 0x439e35
mov eax, esp
push eax
call fcn.00441e50
add esp, 4
test al, al
je 0x439e33
cmp dword [esp], 1
je 0x439e35
xor esi, esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ba50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0xf7f609d8
mov dword [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x7e
xor dl, byte [esp + ecx]
add dl, 0x8a
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 8
jne 0x43ba70
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x456828]
mov ecx, dword [0x44c4a4]
nop
nop
nop
nop
jmp ecx

Function at 0x43bac0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44c4bc]
Function at 0x43bb40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, ecx
mov dword [esp + 8], 0
mov dword [esp], 0x54554a4b
mov eax, 0x6e
mov ecx, 0x11
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x6e]
mov edi, eax
and edi, esi
mov ebp, ecx
and ebp, 0x14
mov edx, eax
and edx, 0x6b
or edx, ebp
xor edx, 0x14
or edx, esi
xor edx, edi
add dl, 0xda
mov byte [esp + eax - 0x6e], dl
inc eax
dec ecx
cmp eax, 0x72
jne 0x43bb70
mov edi, dword [esp]
mov eax, dword [0x44e804]
test eax, eax
je 0x43bbe6
xor ecx, ecx
mov edx, dword [0x44e808]
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x43bbc0
inc ecx
cmp eax, ecx
jne 0x43bbb0
jmp 0x43bbe6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43bbe6
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push eax
push dword [0x44e80c]
call fcn.0043eb30
add esp, 0x1c
mov edi, eax
mov dword [esp], 0xf13e3f38
mov dword [esp + 4], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
mov ebp, eax
and ebp, 0xa
mov edx, ecx
xor edx, 0x3dcca3b5
add edx, ebp
xor edx, esi
mov esi, edx
and esi, 0x38
xor esi, 0x2300838
mov ebp, edx
and ebp, 0x314403c7
sub ebp, esi
add ebp, 0xcb00cd76
mov esi, ebp
and esi, 0x38
xor ebp, 0x38
lea esi, [esi*2]
add esi, ebp
and edx, 1
and esi, 0xfe
or esi, edx
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 8
jne 0x43bc00
cmp edi, dword [esp]
jne 0x43bd76
mov dword [esp + 0x10], ebx
push dword [esp + 8]
call fcn.0043ba50
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp], 0x54554a4b
mov esi, 0x6e
mov ebx, 0x11
movzx ebp, byte [esp + esi - 0x6e]
mov ecx, esi
and ecx, ebp
mov edi, ebx
and edi, 0x14
mov edx, esi
and edx, 0x6b
or edx, edi
xor edx, 0x14
or edx, ebp
xor edx, ecx
add dl, 0xda
mov byte [esp + esi - 0x6e], dl
inc esi
dec ebx
cmp esi, 0x72
jne 0x43bc90
mov edi, dword [esp]
mov edx, dword [0x44e804]
test edx, edx
mov ebx, dword [esp + 0x10]
je 0x43bd18
xor ebp, ebp
mov esi, dword [0x44e808]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x43bcf0
inc ebp
cmp edx, ebp
jne 0x43bce0
jmp 0x43bd18
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x43bd18
push 0
push dword [esp + 0x10]
push eax
push 5
push 4
push edx
push dword [0x44e80c]
mov esi, eax
call fcn.0043eb30
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43bd6d
mov esi, dword [eax]
mov ecx, eax
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
mov ebp, dword [esp + 0x28]
movzx ebp, word [ebp + edi]
test si, si
je 0x43bd4a
add edi, 2
cmp si, bp
je 0x43bd30
cmp si, bp
je 0x43bd5c
mov esi, dword [ecx]
test esi, esi
jne 0x43bd20
mov edi, 0xc0000225
jmp 0x43bd6d
mov edx, dword [ecx + 0x44]
mov dword [ebx + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [ebx + 0xc], ecx
xor edi, edi
push eax
call fcn.0043bac0
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43bdc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x43be80
xor eax, eax
cmp dword [ecx], 0
jne 0x43bed2
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x54554a4b
mov eax, 0x6e
mov edx, 0x11
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x6e]
mov ebp, eax
and ebp, edi
mov esi, edx
and esi, 0x14
mov ebx, eax
and ebx, 0x6b
or ebx, esi
xor ebx, 0x14
or ebx, edi
xor ebx, ebp
add bl, 0xda
mov byte [esp + eax - 0x6e], bl
inc eax
dec edx
cmp eax, 0x72
jne 0x43be30
mov eax, dword [esp]
mov esi, dword [0x44e804]
test esi, esi
je 0x43bed2
xor edi, edi
mov ebx, dword [0x44e808]
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x43bedc
inc edi
cmp esi, edi
jne 0x43be70
jmp 0x43bed2
mov dword [esp + 4], 0xf13e3f24
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov eax, 0x6b1cbfb5
mov ecx, 0x4a
nop
nop
movzx edx, byte [esp + eax - 0x6b1cbfb1]
mov esi, ecx
xor esi, eax
and esi, edx
xor esi, eax
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
add dl, 0x76
mov byte [esp + eax - 0x6b1cbfb1], dl
inc eax
dec ecx
cmp eax, 0x6b1cbfbc
jne 0x43bea0
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43bed2
lea eax, [esp + 0x1c]
lea edx, [esp + 4]
push eax
push edx
push dword [esp + 0x40]
push ecx
push 4
push esi
push dword [0x44e80c]
call fcn.0043eb30
add esp, 0x1c
jmp 0x43bed2

Function at 0x43bf20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43bfce
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], 0x54554a4b
mov edx, 0x6e
mov eax, 0x11
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx - 0x6e]
mov ebp, edx
and ebp, edi
mov esi, eax
and esi, 0x14
mov ebx, edx
and ebx, 0x6b
or ebx, esi
xor ebx, 0x14
or ebx, edi
xor ebx, ebp
add bl, 0xda
mov byte [esp + edx - 0x6e], bl
inc edx
dec eax
cmp edx, 0x72
jne 0x43bf50
mov edx, dword [0x44e804]
test edx, edx
je 0x43bfc1
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44e808]
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43bfa0
inc edi
cmp edx, edi
jne 0x43bf90
jmp 0x43bfc1
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43bfc1
push dword [esp + 4]
push 1
push edx
push dword [0x44e80c]
mov esi, ecx
call fcn.0043eb30
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c2a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ebx, dword [esp + 0x24]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43c32c
push 0xbbf966b4
push dword [0x44e7f8]
call fcn.00441720
add esp, 8
test eax, eax
je 0x43c2f1
mov ecx, dword [esi]
test ecx, ecx
je 0x43c329
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43c305
cmp dword [esp], 0
je 0x43c305
mov dword [esi + 4], 3
jmp 0x43c329
mov ecx, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 4], eax
jmp 0x43c3b3
lea eax, [esp + 8]
push eax
call fcn.00441e50
add esp, 4
test al, al
je 0x43c329
mov eax, dword [esp + 8]
mov ecx, 2
cmp eax, 3
je 0x43c326
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 4], ecx
mov ecx, ebx
cmp eax, 2
jne 0x43c3b3
mov dword [esp], 0x54554a4b
mov eax, 0x6e
mov edi, 0x11
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x6e]
mov ebp, eax
and ebp, esi
mov edx, edi
and edx, 0x14
mov ebx, eax
and ebx, 0x6b
or ebx, edx
xor ebx, 0x14
or ebx, esi
xor ebx, ebp
add bl, 0xda
mov byte [esp + eax - 0x6e], bl
inc eax
dec edi
cmp eax, 0x72
jne 0x43c350
mov eax, dword [esp]
mov edx, dword [0x44e804]
test edx, edx
je 0x43c44a
xor esi, esi
mov ebx, dword [0x44e808]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xc3cdc4a6
je 0x43c420
inc esi
cmp edx, esi
jne 0x43c3a0
jmp 0x43c44a
mov dword [esp], 0x54554a4b
mov eax, 0x6e
mov edx, 0x11
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x6e]
mov edi, eax
and edi, esi
mov ebp, edx
and ebp, 0x14
mov ebx, eax
and ebx, 0x6b
or ebx, ebp
xor ebx, 0x14
or ebx, esi
xor ebx, edi
add bl, 0xda
mov byte [esp + eax - 0x6e], bl
inc eax
dec edx
cmp eax, 0x72
jne 0x43c3d0
mov eax, dword [esp]
mov edx, dword [0x44e804]
test edx, edx
je 0x43c44a
xor esi, esi
mov ebx, dword [0x44e808]
nop
cmp dword [ebx + esi*8], 0xae6e2b0b
je 0x43c420
inc esi
cmp edx, esi
jne 0x43c410
jmp 0x43c44a
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43c44a
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x14]
push 5
push edx
push dword [0x44e80c]
call fcn.0043eb30
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43c800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43c819
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43c82a
cmp eax, 2
je 0x43c8a0
jmp 0x43c8cd
push 0xbbf966b4
push dword [0x44e7f8]
call fcn.00441720
add esp, 8
test eax, eax
je 0x43c86b
mov ecx, dword [esi]
test ecx, ecx
je 0x43c898
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43c874
cmp dword [esp + 4], 0
je 0x43c874
mov dword [esi + 4], 3
jmp 0x43c898
mov dword [esi + 4], 1
jmp 0x43c8cd
lea eax, [esp + 0xc]
push eax
call fcn.00441e50
add esp, 4
test al, al
je 0x43c898
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43c895
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43c8cd
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x456820]
call fcn.00441720
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43c967
mov eax, dword [esi]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x54554a4b
mov esi, 0x6e
mov ecx, 0x11
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi - 0x6a]
mov edx, ecx
and edx, 0x14
mov eax, esi
and eax, 0x6b
or eax, edx
mov edx, esi
and edx, ebx
xor eax, 0x14
or eax, ebx
xor eax, edx
add al, 0xda
mov byte [esp + esi - 0x6a], al
inc esi
dec ecx
cmp esi, 0x72
jne 0x43c8f0
mov eax, dword [esp + 4]
mov edx, dword [0x44e804]
test edx, edx
je 0x43c967
xor esi, esi
mov ebx, dword [0x44e808]
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x43c940
inc esi
cmp edx, esi
jne 0x43c930
jmp 0x43c967
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43c967
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x18]
push 5
push edx
push dword [0x44e80c]
call fcn.0043eb30
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x43f94b
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, dword [esp + 0x38]
movzx eax, word [ebx]
mov dword [esp], 0x717ed5a3
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x15
xor dl, byte [esp + ecx]
add dl, 0x97
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 4
jne case.default.0x43f980
mov ecx, dword [esp]
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
jmp dword [edx*4 + 0x44cdcc]
mov esi, dword [ebx + 0x3c]
xor eax, eax
mov ecx, dword [ebx + esi]
mov dword [esp], 0x21265854
mov byte [esp + 4], 0
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0xb9
xor dl, byte [esp + eax]
add dl, 0x63
mov byte [esp + eax], dl
inc eax
cmp eax, 5
jne case.default.0x43f9be
xor edx, edx
cmp ecx, dword [esp]
setne dl
xor eax, eax
jmp dword [edx*4 + 0x44cdd4]
mov edi, dword [ebx + esi + 0x78]
cmp dword [ebx + esi + 0x7c], 0
sete al
test edi, edi
sete cl
or cl, al
movzx eax, cl
jmp dword [eax*4 + 0x44cddc]
mov eax, dword [ebx + edi + 0x20]
add eax, ebx
mov dword [esp + 0x20], eax
mov eax, dword [ebx + edi + 0x24]
add eax, ebx
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + edi + 0x1c]
add eax, ebx
mov dword [esp + 0x18], eax
mov esi, dword [0x44e808]
xor eax, eax
test esi, esi
sete al
mov dword [esp + 0xc], edi
jmp dword [eax*4 + 0x44cdf4]
mov ecx, dword [case.0x43f9be.0]
xor eax, eax
nop
nop
nop
jmp ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret