joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a6d0
Capabilities:
Encode data using xor
Get elevation service for chromium-based browsers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xaa8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41a6f0
sar esi, 1
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44f3c4]
mov ebx, dword [esp + 0x28]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41a724
mov eax, 0xffffffff
jmp 0x41a727
lea eax, [ebx + ebx]
push eax
call fcn.0040c690
add esp, 4
lea ecx, [esp + 0x28]
push ecx
push ebx
mov dword [esp + 0x20], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x44f3c4]
mov eax, dword [esp + 0x28]
mov ecx, eax
add ecx, 0xd
js 0x41a759
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c690
add esp, 4
mov esi, eax
mov dword [esp + 0x1f8], 0xe926eb38
mov dword [esp + 0x1fc], 0xed1bef0f
mov dword [esp + 0x200], 0xf1d2f318
mov dword [esp + 0x204], 0xf51df72a
mov dword [esp + 0x208], 0xf90ffb02
mov dword [esp + 0x20c], 0xfd0fff17
mov dword [esp + 0x210], 0x8182830e
mov word [esp + 0x214], 0
mov byte [esp + 0x216], 0
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x48]
cmp eax, 0x1e
ja 0x41a831
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x48]
movzx ecx, byte [esp + ecx + 0x1f8]
mov edx, eax
xor edx, 0x91409d27
and eax, 0x11409d27
lea eax, [edx + eax*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x698], edx
mov eax, dword [esp + 0x698]
add al, 0x3d
mov ecx, dword [esp + 0x48]
mov byte [esp + ecx + 0x1f8], al
inc dword [esp + 0x48]
mov eax, dword [esp + 0x48]
cmp eax, 0x1f
jb 0x41a7e0
mov eax, dword [esp + 0x18]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x41a861
mov eax, dword [esp + 0x18]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a850
mov word [eax], 0
movzx ecx, word [esp + 0x1f8]
test cx, cx
je 0x41a891
lea edx, [esp + 0x1fa]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a880
mov word [eax], 0
lea eax, [esp + 0x638]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00443030
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x449ffc]

Function at 0x41d3b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
xor eax, eax
cmp dword [esp + 0xa8], 0
setne al
xor edx, edx
mov dword [esp + 0x68], 0
xor ecx, ecx
jmp dword [eax*4 + 0x44a194]
Function at 0x41f050
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x40]
mov ebx, 0xfffffffe
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x41f060
sar ebx, 1
lea eax, [esp + 4]
push eax
push 0
push 0
push ebx
push edi
push 0
call dword [0x44f3c4]
mov ebp, dword [esp + 4]
test ebp, ebp
jns 0x41f08f
mov eax, 0xffffffff
jmp 0x41f096
lea eax, [ebp*2]
push eax
call fcn.0040c690
add esp, 4
mov esi, eax
lea eax, [esp + 4]
push eax
push ebp
push esi
push ebx
push edi
push 0
call dword [0x44f3c4]
lea edi, [esp + 0x14]
push edi
push esi
call fcn.00443200
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44a320]
Function at 0x420d70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
mov ecx, 0xfffffffe
nop
cmp word [edi + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x420d80
mov eax, ecx
sar eax, 1
and ecx, 0x12
xor eax, 9
add eax, ecx
jns 0x420da0
mov eax, 0xffffffff
jmp 0x420da2
add eax, eax
push eax
call fcn.0040c690
add esp, 4
mov esi, eax
mov dword [esp + 4], 0xb927bbe8
mov dword [esp + 8], 0xbd31bf23
mov dword [esp + 0xc], 0xb1e0b3e8
mov dword [esp + 0x10], 0xb5d0b7d4
mov word [esp + 0x14], 0xabb4
mov dword [esp + 0x16], 0
mov word [esp + 0x1a], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x17
ja 0x420e39
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0xa684289f
and eax, 0x2684289f
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0xe5
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x18
jb 0x420e00
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x420e61
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x420e50
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x420e91
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x420e80
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.00443200
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x44a410]
Function at 0x427410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [esp + 4]
call fcn.00427430
add esp, 4
test al, al
je 0x427d10
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
xor edi, edi
mov eax, 0x20219
mov ecx, 1
jmp dword [ecx*4 + 0x44b364]
Function at 0x42bd70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x42bdca
cmp edi, 1
je 0x42bdca
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x42bda1
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x42bda0
cmp ecx, 0x20
je 0x42bda0
cmp ecx, 0x2b
mov edx, edi
je 0x42bdc0
cmp ecx, 0x2d
jne 0x42bddf
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x42bde4
xor edi, edi
test eax, eax
je 0x42bf9d
mov dword [eax], 0x16
jmp 0x42bf9d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x42be0d
cmp edx, 0x10
jne 0x42be25
cmp byte [ebx], 0x30
jne 0x42be06
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x42be27
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x42be27
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x42be80
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x42bf38
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x42bea7
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x42bf68
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x42bf68
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x42be60
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x42bef0
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x42bef9
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x42bf1d
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x42bf4d
test bl, bl
jne 0x42bf4d
mov ebx, dword [esp + 0x10]
jmp 0x42be73
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x42be55
mov esi, edi
test bl, bl
jne 0x42bf5b
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x42be55
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42bf76
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x42bf84
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x42bf94
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x42bf9d
cmp byte [esp + 3], 0
jne 0x42bf9d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433810
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x433973
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
jmp 0x433850
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
cmp edi, 0
setne al
jmp 0x43386a
xor ebx, ebx
test al, 1
jne 0x433875
jmp 0x43396d
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov esi, eax
mov dword [esp], esi
call fcn.0040c7c0
mov ebp, eax
cmp ebp, 0
setne al
jmp 0x433895
xor ebx, ebx
test al, 1
jne 0x4338a0
jmp 0x43395f
mov al, byte [esp + 0x10]
mov byte [esp + 0x14], al
mov byte [esp + 0x18], 0x23
mov byte [esp + 0x19], 0x1d
mov byte [esp + 0x1a], 0x1b
mov byte [esp + 0x1b], 0x13
mov byte [esp + 0x1c], 6
mov byte [esp + 0x1d], 0x1a
mov byte [esp + 0x1e], 7
mov byte [esp + 0x1f], 0x15
mov byte [esp + 0x20], 0x1c
mov byte [esp + 0x21], 0xc7
mov byte [esp + 0x22], 0xe
mov byte [esp + 0x23], 0x73
mov byte [esp + 0x24], 8
mov byte [esp + 0x25], 0xfd
mov eax, 0xe
mov byte [esp + eax + 0x18], 0
add eax, 1
cmp eax, 0x14
jne 0x4338f3
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x14
jae 0x43393d
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.004363c0
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x18], al
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0x433908
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
call fcn.0040d220
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x43395f
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x43396d
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c770
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0xc
mov eax, dword [esp + 0x14]
mov dword [esp + 4], 0xc3c2c190
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 3
ja 0x43c7cb
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, ecx
xor esi, 0x3f693fd0
and ecx, 0x3f693fd0
lea ecx, [esi + ecx*2]
xor ecx, edx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 8]
add cl, 0xf0
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 4
jb 0x43c790
mov ecx, dword [esp + 4]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x4573e4]
add esp, 0xc
pop esi
ret

Function at 0x43c7f0
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44d088]
Function at 0x43c8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x14151617
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x43c918
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
lea edx, [eax + eax]
and edx, 0x5e887478
mov esi, eax
not esi
or esi, 0x2f443a3c
add esi, eax
sub eax, edx
lea eax, [eax + esi*2]
add eax, 0xaf443a3e
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xd4
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x43c8d0
mov edi, dword [esp + 4]
mov eax, dword [0x44f3c8]
test eax, eax
je 0x43c966
xor ecx, ecx
mov edx, dword [0x44f3cc]
nop
nop
nop
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x43c940
inc ecx
cmp eax, ecx
jne 0x43c930
jmp 0x43c966
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43c966
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x44f3d0]
push eax
call fcn.0043f830
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43caa5
mov dword [esp + 0x10], ebx
push dword [esp + 8]
call fcn.0043c770
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp + 4], 0x14151617
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 3
ja 0x43c9ea
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
lea edi, [edx + edx]
and edi, 0x5e887478
mov ebx, edx
not ebx
or ebx, 0x2f443a3c
add ebx, edx
sub edx, edi
lea edx, [edx + ebx*2]
add edx, 0xaf443a3e
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 0xd4
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 4
jb 0x43c9a0
mov edi, dword [esp + 4]
mov edx, dword [0x44f3c8]
test edx, edx
je 0x43ca36
xor ebx, ebx
mov ebp, dword [0x44f3cc]
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x43ca11
inc ebx
cmp edx, ebx
jne 0x43ca00
jmp 0x43ca36
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x43ca36
push 0
push ecx
push eax
push 5
push 4
push dword [0x44f3d0]
push edx
mov esi, eax
call fcn.0043f830
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43ca9c
mov ecx, dword [esp + 0x28]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x43ca75
add ebx, 2
cmp bp, si
je 0x43ca60
cmp bp, si
je 0x43ca87
mov ebx, dword [edx]
test ebx, ebx
jne 0x43ca50
mov edi, 0xc0000225
jmp 0x43ca9c
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043c7f0
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43cae0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x2c
mov edx, dword [ecx + 8]
test edx, edx
je 0x43cbd0
xor eax, eax
cmp dword [ecx], 0
jne 0x43cc3e
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], edx
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x14151617
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x43cb9b
mov eax, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
lea esi, [eax + eax]
and esi, 0x5e887478
mov edi, eax
not edi
or edi, 0x2f443a3c
add edi, eax
sub eax, esi
lea eax, [eax + edi*2]
add eax, 0xaf443a3e
xor eax, edx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xd4
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x43cb50
mov eax, dword [esp + 8]
mov esi, dword [0x44f3c8]
test esi, esi
je 0x43cc3e
mov edx, dword [esp + 0x3c]
xor edi, edi
mov ebx, dword [0x44f3cc]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x43cc47
inc edi
cmp esi, edi
jne 0x43cbc0
jmp 0x43cc3e
mov dword [esp + 0x14], 0xf7b68980
mov dword [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43cc3a
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x14]
mov edx, eax
xor edx, 0x5a7555de
and eax, 0xda7555de
lea eax, [edx + eax*2]
lea edx, [eax + ecx]
and eax, ecx
mov ecx, edx
not ecx
and ecx, eax
add ecx, eax
not eax
and eax, edx
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xaa
mov ecx, dword [esp]
mov byte [esp + ecx + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x43cbf0
mov eax, dword [esp + 0x14]
add esp, 0x2c
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43cc3e
lea eax, [esp + 0xc]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44f3d0]
push esi
call fcn.0043f830
add esp, 0x1c
jmp 0x43cc3e
Function at 0x43cc80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43cd4a
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 4], 0x14151617
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 3
ja 0x43ccfa
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
lea edi, [edx + edx]
and edi, 0x5e887478
mov ebx, edx
not ebx
or ebx, 0x2f443a3c
add ebx, edx
sub edx, edi
lea edx, [edx + ebx*2]
add edx, 0xaf443a3e
xor edx, esi
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
add dl, 0xd4
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 4
jb 0x43ccb0
mov edx, dword [0x44f3c8]
test edx, edx
je 0x43cd3e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44f3cc]
cmp dword [ebx + edi*8], 0x625b6034
je 0x43cd20
inc edi
cmp edx, edi
jne 0x43cd10
jmp 0x43cd3e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43cd3e
push eax
push 1
push dword [0x44f3d0]
push edx
mov esi, ecx
call fcn.0043f830
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 0xc
pop esi
pop edi
pop ebx
ret
Function at 0x43cd50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
cmp dword [ecx + 8], 0
je 0x43ce16
mov edx, dword [ecx]
test edx, edx
je 0x43ce16
mov dword [esp], 0x14151617
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x43cddc
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp + 4]
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax]
lea edi, [esi + esi]
and edi, 0x5e887478
mov ebx, esi
not ebx
or ebx, 0x2f443a3c
add ebx, esi
sub esi, edi
lea esi, [esi + ebx*2]
add esi, 0xaf443a3e
xor esi, eax
mov dword [esp + 8], esi
mov eax, dword [esp + 8]
add al, 0xd4
mov esi, dword [esp + 4]
mov byte [esp + esi], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x43cd90
mov edi, dword [ebp + 0x10]
mov eax, dword [esp]
mov ebx, dword [0x44f3c8]
test ebx, ebx
je 0x43ce9b
xor edi, edi
mov esi, dword [0x44f3cc]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edi*8], 0xc766965c
je 0x43ce77
inc edi
cmp ebx, edi
jne 0x43ce00
mov edi, dword [ebp + 0x10]
jmp 0x43ce9b
mov dword [esp + 8], 0x97d6c9c0
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43ce6e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xe2fe3eae
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x9a
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x43ce40
mov eax, dword [esp + 8]
jmp 0x43cf92
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
mov edi, dword [ebp + 0x10]
je 0x43ce9b
push dword [ebp + 8]
push edx
push 2
push dword [0x44f3d0]
push esi
mov esi, ecx
call fcn.0043f830
mov ecx, esi
add esp, 0x14
mov esi, dword [ebp + 0xc]
cmp esi, 1
mov edx, edi
sbb edx, 0
jl 0x43cf85
cmp eax, 0xc000010a
jne 0x43cf85
mov edx, 0xffffd8f0
mov eax, esi
mul edx
sub edx, esi
imul esi, edi, 0xffffd8f0
add esi, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov edx, dword [ecx]
mov dword [esp + 0x10], 0x14151617
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x43cf39
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x10]
lea edi, [esi + esi]
and edi, 0x5e887478
mov ebx, esi
not ebx
or ebx, 0x2f443a3c
add ebx, esi
sub esi, edi
lea esi, [esi + ebx*2]
add esi, 0xaf443a3e
xor esi, eax
mov dword [esp + 4], esi
mov eax, dword [esp + 4]
add al, 0xd4
mov esi, dword [esp]
mov byte [esp + esi + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x43cef0
mov eax, dword [esp + 0x10]
mov esi, dword [0x44f3c8]
test esi, esi
je 0x43cf85
xor edi, edi
mov ebx, dword [0x44f3cc]
nop
cmp dword [ebx + edi*8], 0x7e28bda7
je 0x43cf60
inc edi
cmp esi, edi
jne 0x43cf50
jmp 0x43cf85
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43cf85
lea eax, [esp + 8]
push eax
push 0
push edx
push 3
push dword [0x44f3d0]
push esi
mov esi, ecx
call fcn.0043f830
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43cf92
mov esi, eax
call fcn.0043cc80
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43cfa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43d037
push 0xfb1631b0
push dword [0x44f3bc]
call fcn.004425e0
add esp, 8
test eax, eax
je 0x43cffd
mov ecx, dword [esi]
test ecx, ecx
je 0x43d034
mov dword [esp + 8], 0
lea edx, [esp + 8]
push edx
push ecx
call eax
test eax, eax
je 0x43d013
cmp dword [esp + 8], 0
je 0x43d013
mov dword [esi + 4], 3
jmp 0x43d034
mov ecx, edi
mov edi, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 0xc], eax
jmp 0x43d0f7
mov eax, esp
push eax
call fcn.00442e10
add esp, 4
test al, al
je 0x43d034
mov eax, dword [esp]
mov ecx, 2
cmp eax, 3
je 0x43d031
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, edi
mov edx, dword [esi]
mov dword [esp + 0xc], edx
mov edi, ebx
cmp eax, 2
jne 0x43d0f7
mov dword [esp + 4], 0x14151617
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x43d0b8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
lea esi, [eax + eax]
and esi, 0x5e887478
mov ebx, eax
not ebx
or ebx, 0x2f443a3c
add ebx, eax
sub eax, esi
lea eax, [eax + ebx*2]
add eax, 0xaf443a3e
xor eax, edx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0xd4
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x43d070
mov eax, dword [esp + 4]
mov edx, dword [0x44f3c8]
test edx, edx
je 0x43d1a4
xor esi, esi
mov ebx, dword [0x44f3cc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x495ce5ca
je 0x43d180
inc esi
cmp edx, esi
jne 0x43d0e0
jmp 0x43d1a4
mov dword [esp + 4], 0x14151617
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x43d158
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
lea esi, [eax + eax]
and esi, 0x5e887478
mov ebx, eax
not ebx
or ebx, 0x2f443a3c
add ebx, eax
sub eax, esi
lea eax, [eax + ebx*2]
add eax, 0xaf443a3e
xor eax, edx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0xd4
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x43d110
mov eax, dword [esp + 4]
mov edx, dword [0x44f3c8]
test edx, edx
je 0x43d1a4
xor esi, esi
mov ebx, dword [0x44f3cc]
nop
nop
cmp dword [ebx + esi*8], 0x1b788dcf
je 0x43d180
inc esi
cmp edx, esi
jne 0x43d170
jmp 0x43d1a4
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43d1a4
push dword [esp + 0x30]
push ecx
push edi
push ebp
push dword [esp + 0x1c]
push 5
push dword [0x44f3d0]
push edx
call fcn.0043f830
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10