joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417280
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x2c]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x417290
cmp eax, 0xffffffed
jge 0x4172a7
mov eax, 0xffffffff
jmp 0x4172aa
add eax, 0x12
push eax
call fcn.00408f60
add esp, 4
mov esi, eax
mov dword [esp + 4], 0x39af3b98
mov dword [esp + 8], 0x25a12793
mov dword [esp + 0xc], 0x21f023f8
mov dword [esp + 0x10], 0x2d802f8c
mov dword [esp + 0x14], 0x2b2c
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x13
ja 0x41731e
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0x91bf38cb
xor eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add al, 9
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x14
jb 0x4172f0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x417341
add edi, 2
mov eax, esi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x417330
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x417371
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417360
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.00437360
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x43dde8]
Function at 0x41d770
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.0041d790
add esp, 4
test al, al
je 0x41de60
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0x9c
xor ebx, ebx
mov eax, 0x20219
mov ecx, 1
lea edi, [esp + 0x7e]
jmp dword [ecx*4 + 0x43ebe8]
Function at 0x42a340
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
call fcn.004178d0
push eax
mov esi, esp
jmp 0x42a353
jmp 0x42a355
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x42a369
cmp eax, 0
setne al
jmp 0x42a371
xor ebx, ebx
test al, 1
jne 0x42a37c
jmp 0x42a4ad
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, 0
setne al
jmp 0x42a3b0
jmp 0x42a3b2
jmp 0x42a3b4
xor ebx, ebx
test al, 1
jne 0x42a3bf
jmp 0x42a4a5
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
call fcn.00409070
add esp, 4
mov edx, eax
xor ebx, ebx
cmp edx, 0
je 0x42a499
mov al, byte [esi]
mov byte [ebp - 0x14], al
mov byte [ebp - 0x28], 0x21
mov byte [ebp - 0x27], 7
mov byte [ebp - 0x26], 5
mov byte [ebp - 0x25], 0x19
mov byte [ebp - 0x24], 0xe
mov byte [ebp - 0x23], 0x1e
mov byte [ebp - 0x22], 9
mov byte [ebp - 0x21], 0x1b
mov byte [ebp - 0x20], 8
mov byte [ebp - 0x1f], 0xc1
mov byte [ebp - 0x1e], 6
mov byte [ebp - 0x1d], 9
mov byte [ebp - 0x1c], 4
mov byte [ebp - 0x1b], 0xf7
mov eax, 0xe
mov byte [ebp + eax - 0x28], 0
add eax, 1
cmp eax, 0x13
jne 0x42a42b
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x13
jae 0x42a478
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0x28]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov esi, edx
call fcn.0042a840
mov edx, esi
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [ebp + ecx - 0x28], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x42a43f
lea eax, [ebp - 0x28]
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.00409910
mov bl, al
and bl, 1
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42a4ad
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42f380
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x42f3a0
mov dword [esp + 4], 0x764a74e1
mov byte [esp + 8], 0
mov dword [esp], 0
mov esi, dword [esp]
cmp esi, 4
ja 0x42f400
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
add esi, 0xf6b65113
xor esi, edi
mov dword [esp + 0xc], esi
mov ebx, dword [esp + 0xc]
add bl, 0xa1
mov esi, dword [esp]
mov byte [esp + esi + 4], bl
inc dword [esp]
mov esi, dword [esp]
cmp esi, 5
jb 0x42f3d0
test edx, edx
je 0x42f46e
sar edx, 1
mov esi, dword [esp + 4]
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x42f431
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x42f420
cmp edi, 3
jb 0x42f46e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x42f440
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42f480
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 4], 0xe0e7e6e5
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x42f4e9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
and edx, 0x11c40b59
xor eax, 0x11c40b59
lea eax, [eax + edx*2]
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x43
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x42f4b0
mov eax, dword [esp + 4]
mov ecx, dword [0x442de0]
test ecx, ecx
je 0x42f532
xor edx, edx
mov esi, dword [0x442de4]
nop
cmp dword [esi + edx*8], 0x716b6a2
je 0x42f510
inc edx
cmp ecx, edx
jne 0x42f500
jmp 0x42f532
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x42f532
lea eax, [esp + 0x14]
push eax
push 8
push 0xffffffffffffffff
push 3
push dword [0x442de8]
push ecx
call fcn.00435090
add esp, 0x18
test eax, eax
js 0x42f5c0
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], 0xe0e7e6e5
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x42f599
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
and esi, 0x11c40b59
xor eax, 0x11c40b59
lea eax, [eax + esi*2]
xor eax, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x43
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x42f560
mov eax, dword [esp + 4]
mov edx, dword [0x442de0]
test edx, edx
je 0x42f5ef
xor esi, esi
mov edi, dword [0x442de4]
nop
cmp dword [edi + esi*8], 0x7d006057
je 0x42f5c7
inc esi
cmp edx, esi
jne 0x42f5b0
jmp 0x42f5ef
xor ebx, ebx
jmp 0x42f69e
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x42f5ef
lea eax, [esp + 4]
lea esi, [esp + 0x18]
push eax
push 4
push esi
push 0x14
push ecx
push 5
push dword [0x442de8]
push edx
call fcn.00435090
add esp, 0x20
cmp dword [esp + 0x18], 0
setne byte [esp + 0xf]
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], 0xe0e7e6e5
mov word [esp + 8], 0
test eax, eax
setns bl
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x42f659
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
and esi, 0x11c40b59
xor eax, 0x11c40b59
lea eax, [eax + esi*2]
xor eax, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x43
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x42f620
mov eax, dword [0x442de0]
test eax, eax
je 0x42f69a
mov edx, dword [esp + 4]
xor esi, esi
mov edi, dword [0x442de4]
nop
nop
cmp dword [edi + esi*8], 0x625b6034
je 0x42f680
inc esi
cmp eax, esi
jne 0x42f670
jmp 0x42f69a
mov eax, dword [edi + esi*8 + 4]
cmp eax, edx
je 0x42f69a
push ecx
push 1
push dword [0x442de8]
push eax
call fcn.00435090
add esp, 0x10
and bl, byte [esp + 0xf]
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
ret
Function at 0x433110
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov dword [esp + 4], 0x1060734
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43315e
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0xee1a2ac1
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x3b
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x433130
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
push ecx
push 0
push dword [eax + 0x18]
call dword [0x44ae00]
add esp, 0x10
ret

Function at 0x433180
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x440c8c]
Function at 0x433210
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x484b4a4d
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43326e
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0x5eea0bf3
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x41
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x433240
mov edi, dword [esp + 4]
mov eax, dword [0x442de0]
test eax, eax
je 0x4332c6
xor ecx, ecx
mov edx, dword [0x442de4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x4332a0
inc ecx
cmp eax, ecx
jne 0x433290
jmp 0x4332c6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x4332c6
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x442de8]
push eax
call fcn.00435090
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x433405
mov dword [esp + 0x14], esi
push dword [esp + 0xc]
call fcn.00433110
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x484b4a4d
mov byte [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 4
ja 0x433340
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0x5eea0bf3
xor edx, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 0x41
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 5
jb 0x433310
mov edi, dword [esp + 4]
mov edx, dword [0x442de0]
test edx, edx
je 0x433396
xor ebx, ebx
mov ebp, dword [0x442de4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x433371
inc ebx
cmp edx, ebx
jne 0x433360
jmp 0x433396
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x433396
push 0
push ecx
push eax
push 5
push 4
push dword [0x442de8]
push edx
mov esi, eax
call fcn.00435090
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x4333fc
mov ecx, dword [esp + 0x2c]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x4333d5
add ebx, 2
cmp bp, si
je 0x4333c0
cmp bp, si
je 0x4333e7
mov ebx, dword [edx]
test ebx, ebx
jne 0x4333b0
mov edi, 0xc0000225
jmp 0x4333fc
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x14]
mov dword [esi + 4], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 8], ecx
xor edi, edi
push eax
call fcn.00433180
add esp, 4
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x433440
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ecx + 4]
test edx, edx
je 0x433524
xor eax, eax
cmp dword [ecx], 0
jne 0x433592
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], edx
mov eax, dword [ecx + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x484b4a4d
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x4334ee
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
add eax, 0x5eea0bf3
xor eax, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
add al, 0x41
mov edx, dword [esp]
mov byte [esp + edx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x4334c0
mov eax, dword [esp + 0xc]
mov esi, dword [0x442de0]
test esi, esi
je 0x433592
mov edx, dword [esp + 0x40]
xor edi, edi
mov ebx, dword [0x442de4]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x43359b
inc edi
cmp esi, edi
jne 0x433510
jmp 0x433592
mov dword [esp + 0x14], 0x97564940
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x43358e
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x14]
mov edx, eax
and edx, 0x5d7886e
xor eax, 0x85d7886e
lea eax, [eax + edx*2]
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xda
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 7
jb 0x433550
mov eax, dword [esp + 0x14]
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x433592
lea eax, [esp + 4]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x442de8]
push esi
call fcn.00435090
add esp, 0x1c
jmp 0x433592

Function at 0x4335d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x433691
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x484b4a4d
mov byte [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 4
ja 0x433630
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0x5eea0bf3
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 0x41
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 5
jb 0x433600
mov edx, dword [0x442de0]
test edx, edx
je 0x43367e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x442de4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x433660
inc edi
cmp edx, edi
jne 0x433650
jmp 0x43367e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43367e
push eax
push 1
push dword [0x442de8]
push edx
mov esi, ecx
call fcn.00435090
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
mov dword [ecx + 4], 0
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x4336a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 4], 0
je 0x433743
mov edx, dword [ecx]
test edx, edx
je 0x433743
mov dword [esp + 0x14], 0x484b4a4d
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43370e
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 0x14]
add eax, 0x5eea0bf3
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0x41
mov esi, dword [esp]
mov byte [esp + esi + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x4336e0
mov edi, dword [ebp + 0x10]
mov eax, dword [esp + 0x14]
mov ebx, dword [0x442de0]
test ebx, ebx
je 0x4337bd
xor edi, edi
mov esi, dword [0x442de4]
nop
nop
nop
nop
nop
cmp dword [esi + edi*8], 0xc766965c
je 0x433799
inc edi
cmp ebx, edi
jne 0x433730
mov edi, dword [ebp + 0x10]
jmp 0x4337bd
mov dword [esp], 0x296a6b6c
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 3
ja 0x433791
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx]
add eax, 0x8b876e97
xor eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 0xd
mov ecx, dword [esp + 8]
mov byte [esp + ecx], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 4
jb 0x433760
mov eax, dword [esp]
jmp 0x4338b2
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
mov edi, dword [ebp + 0x10]
je 0x4337bd
push dword [ebp + 8]
push edx
push 2
push dword [0x442de8]
push esi
mov esi, ecx
call fcn.00435090
mov ecx, esi
add esp, 0x14
mov esi, dword [ebp + 0xc]
cmp esi, 1
mov edx, edi
sbb edx, 0
jl 0x4338a5
cmp eax, 0xc000010a
jne 0x4338a5
mov edx, 0xffffd8f0
mov eax, esi
mul edx
sub edx, esi
imul esi, edi, 0xffffd8f0
add esi, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov edx, dword [ecx]
mov dword [esp + 0x14], 0x484b4a4d
mov byte [esp + 0x18], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x433851
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov esi, dword [esp + 4]
movzx esi, byte [esp + esi + 0x14]
add eax, 0x5eea0bf3
xor eax, esi
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x41
mov esi, dword [esp + 4]
mov byte [esp + esi + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x433820
mov eax, dword [esp + 0x14]
mov esi, dword [0x442de0]
test esi, esi
je 0x4338a5
xor edi, edi
mov ebx, dword [0x442de4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e28bda7
je 0x433880
inc edi
cmp esi, edi
jne 0x433870
jmp 0x4338a5
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x4338a5
lea eax, [esp + 8]
push eax
push 0
push edx
push 3
push dword [0x442de8]
push esi
mov esi, ecx
call fcn.00435090
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x4338b2
mov esi, eax
call fcn.004335d0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4338c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edx, dword [esp + 0x34]
mov ecx, dword [ecx]
mov dword [esp + 4], 0x484b4a4d
mov byte [esp + 8], 0
test edx, edx
jne 0x4338e2
lea edx, [esp + 0x10]
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43392e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add eax, 0x5eea0bf3
xor eax, esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x41
mov esi, dword [esp]
mov byte [esp + esi + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x433900
mov eax, dword [esp + 4]
mov ebp, dword [0x442de0]
test ebp, ebp
je 0x433984
mov ebx, dword [esp + 0x30]
xor esi, esi
mov edi, dword [0x442de4]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x3baba5e0
je 0x433960
inc esi
cmp ebp, esi
jne 0x433950
jmp 0x433984
mov ebp, dword [edi + esi*8 + 4]
cmp ebp, eax
je 0x433984
push edx
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push ecx
push 5
push dword [0x442de8]
push ebp
call fcn.00435090
add esp, 0x20
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x434420
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov dword [esp + 0x38], 0xff6af96a
mov dword [esp + 0x3c], 0xe30efd18
mov dword [esp + 0x40], 0xe734e10c
mov dword [esp + 0x44], 0xeb06e500
mov dword [esp + 0x48], 0xefeee904
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x13
ja 0x434493
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x38]
add eax, 0xe20712aa
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0xae
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x38], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x14
jb 0x434460
lea eax, [esp + 0x38]
push eax
call fcn.004360d0
add esp, 4
mov dword [0x44adf8], eax
mov dword [esp + 0x34], 0x7fef8ac8
test eax, eax
je 0x4344b9
mov dword [esp + 0x34], 0xd6c6fb7a
mov edi, 0xcd514a0a
xor eax, eax
cmp edi, 0x17b21c0e
setl al
mov dword [esp + 0x30], ecx
jmp dword [eax*4 + 0x440cb4]

Function at 0x434fd0
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x440edc]
Function at 0x4360d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 8], 0x57564938
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43612e
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x85d7886e
xor eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add al, 0xda
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x436100
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x30], 0
sete cl
jmp dword [ecx*4 + 0x4415f0]
mov edx, dword [eax + 0xc]
mov esi, dword [edx + 0xc]
add edx, 0xc
mov edi, dword [0x44160c]
mov dword [esp + 4], 0
mov ebx, dword [0x441640]
xor eax, eax
cmp esi, edx
setne al
mov dword [esp + 0x10], edx
jmp dword [eax*4 + 0x4415f8]
mov ecx, dword [esi + 0x30]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp edi
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4363e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], 0x90a0b3c
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43643e
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add eax, 0x2cf9bd83
xor eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x71
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x436410
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x441690]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x441698]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x441698]
mov edi, 1
jmp dword [edi*4 + 0x4416a8]
mov esi, dword [esi]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x441698]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x4416a0]
mov eax, dword [esi + 0x30]
xor edi, edi
jmp dword [edi*4 + 0x4416a8]
add esp, 0x10
pop esi
pop edi
pop ebx
ret