joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4355c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.0043aee0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4440cc]

Function at 0x435880
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.0043b7c0
add esp, 0x14
test eax, eax
js 0x4359e3
lea ebx, [esp + 8]
lea eax, [esp + 0xc]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.0043bce0
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x43591c
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 8]
mov ecx, eax
inc ecx
jns 0x4358ea
mov eax, 0xffffffff
jmp 0x4358f1
lea eax, [eax*2 + 2]
push eax
call fcn.00408000
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x14]
call fcn.0043c450
add esp, 0x14
test eax, eax
jns 0x43591c
push esi
call fcn.00408010
add esp, 4
xor esi, esi
mov eax, dword [esp + 4]
mov dword [esp], 0x2b2c2d2e
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [edi + 0x69]
mov edx, 0x16
sub edx, edi
and edx, 0x14
and ecx, 0x6b
or ecx, edx
xor cl, byte [esp + edi]
xor cl, 0x14
add cl, 0xb8
mov byte [esp + edi], cl
mov edx, edi
xor edx, 0xfffffffe
mov ecx, edi
or ecx, 1
and ecx, edx
mov edx, ecx
and edx, 2
or ecx, 2
imul ecx, edx
xor edx, 2
mov ebx, edi
and ebx, 1
neg ebx
and ebx, edx
xor edi, 0xfdb51599
add edi, ecx
add edi, ebx
add edi, 0x24aea68
cmp edi, 4
jb 0x435930
mov ecx, dword [0x447604]
test ecx, ecx
je 0x4359ca
mov edx, dword [esp]
xor edi, edi
mov ebx, dword [0x447608]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb430e561
je 0x4359b0
inc edi
cmp ecx, edi
jne 0x4359a0
jmp 0x4359ca
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x4359ca
push eax
push 4
push ecx
push dword [0x44760c]
call fcn.00439030
add esp, 0x10
test esi, esi
jne 0x4359e5
mov eax, esp
push eax
call fcn.0043ac90
add esp, 4
test al, al
je 0x4359e3
cmp dword [esp], 1
je 0x4359e5
xor esi, esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4378c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x43798a
xor eax, eax
cmp dword [ecx], 0
jne 0x4379ba
mov ebp, dword [esp + 0x38]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x2b2c2d2e
mov eax, 0x6648b569
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x6648b569]
mov ebx, edx
and ebx, eax
add bl, bl
sub dl, bl
movzx edx, dl
add edx, eax
add dl, 0xb8
mov byte [esp + eax - 0x6648b569], dl
inc eax
cmp eax, 0x6648b56d
jne 0x437930
mov eax, dword [esp]
mov esi, dword [0x447604]
test esi, esi
je 0x4379ba
xor edi, edi
mov ebx, dword [0x447608]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xf62c6d34
je 0x4379c4
mov edx, edi
and edx, 1
xor edi, 1
lea edi, [edi + edx*2]
cmp edi, esi
jb 0x437970
jmp 0x4379ba
mov dword [esp + 4], 0x3b7a7970
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xb8
xor cl, byte [esp + eax + 4]
add cl, 0x40
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 4
jne 0x4379a0
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x4379ba
lea eax, [esp + 0x1c]
lea edx, [esp + 4]
push eax
push edx
push ebp
push ecx
push 0x10
push esi
push dword [0x44760c]
call fcn.00439030
add esp, 0x1c
jmp 0x4379ba
Function at 0x438a40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 2], 0x69fc67c8
mov dword [esp + 6], 0x6dc06bce
mov dword [esp + 0xa], 0x513e6fc2
mov dword [esp + 0xe], 0x55f853f6
mov dword [esp + 0x12], 0x595857fa
mov eax, 0x56
mov ecx, 0x29
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0x32
mov edx, eax
and edx, 0x4d
or edx, esi
xor dl, byte [esp + eax - 0x54]
xor dl, 0xb2
add dl, 0x50
mov byte [esp + eax - 0x54], dl
inc eax
dec ecx
cmp eax, 0x6a
jne 0x438a80
lea esi, [esp + 2]
push esi
call fcn.0043a470
add esp, 4
mov dword [0x44f620], eax
xor ecx, ecx
test eax, eax
sete cl
mov ecx, dword [ecx*4 + 0x4442c0]
mov edx, 0x54dfd7c7
xor edx, dword [0x4442c8]
add ecx, edx
inc ecx
xor ebx, ebx
jmp ecx

Function at 0x439b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov edi, dword [esp + 0x50]
movzx eax, word [edi]
mov dword [esp + 0x10], 0x77762f39
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xd4
xor dl, byte [esp + ecx + 0x10]
add dl, 0x60
mov byte [esp + ecx + 0x10], dl
inc ecx
cmp ecx, 4
jne 0x439b90
xor ecx, ecx
cmp dword [esp + 0x10], eax
setne cl
mov eax, dword [ecx*4 + 0x444848]
mov ecx, dword [str.n_y]
mov edx, ecx
and edx, 0xf97442f8
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0x868bbd08
xor ebx, ebx
jmp eax

Function at 0x43a440
Capabilities:
Encode data using xor

Disassembly:
push eax
mov dword [esp], 0x77767504
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xd4
xor cl, byte [esp + eax]
add cl, 0x60
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x43a450
mov eax, dword [esp]
mov eax, dword fs:[eax]
pop ecx
ret

Function at 0x43a7f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x3c]
movzx eax, word [esi]
mov dword [esp + 8], 0x66658e9e
mov ecx, 0xd0e07fbb
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x2f1f804d]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0x28
mov byte [esp + ecx + 0x2f1f804d], dl
inc ecx
cmp ecx, 0xd0e07fbf
jne 0x43a810
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x444e30]
Function at 0x43ace0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov eax, 0xfffffffe
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43acf0
mov edi, eax
sar edi, 1
lea esi, [edi + 4]
and eax, 2
mov ecx, esi
xor ecx, 1
add ecx, eax
jns 0x43ad15
mov ecx, 0xffffffff
jmp 0x43ad17
add ecx, ecx
push ecx
call fcn.00408000
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp], eax
mov ecx, eax
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43ad61
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43ad50
mov word [ecx], 0
mov eax, 3
sub eax, edi
and eax, 2
mov ecx, esi
and ecx, 0xfffd
imul ecx, eax
and edi, 2
or esi, 2
imul esi, edi
lea eax, [esi + ecx]
mov word [esp + 0xc], ax
lea eax, [esi + ecx]
add eax, 2
mov word [esp + 0xe], ax
mov eax, dword [esp]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0x40
lea eax, [esp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], 0x54555657
mov ecx, 0x48578125
mov eax, 0x90af024a
movzx esi, byte [esp + ecx - 0x48578121]
mov edx, eax
and edx, 0x102f0006
mov edi, ecx
xor edi, 0x93ff443
add edi, edx
mov edx, edi
and edx, esi
lea ebx, [edi + esi]
not ebx
lea ebx, [ebx + edx*2]
and ebx, edi
mov edx, ebx
and edx, 2
mov ebp, ebx
or ebx, 2
imul ebx, edx
xor edx, 2
and ebp, 0x51ff757d
imul ebp, edx
sub ebx, edi
mov edx, 0x1419eff
sub edx, ebx
sub edx, ebp
lea edi, [ebx + ebp]
add edi, 0xfebe6200
and edx, esi
not esi
and esi, edi
sub edx, esi
add dl, 0xc0
mov byte [esp + ecx - 0x48578121], dl
inc ecx
add eax, 2
cmp ecx, 0x48578129
jne 0x43ade0
mov esi, dword [esp + 4]
mov ecx, dword [0x447604]
test ecx, ecx
je 0x43aec3
xor eax, eax
mov edx, dword [0x447608]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + eax*8], 0x5f7891a5
je 0x43ae80
inc eax
cmp ecx, eax
jne 0x43ae70
jmp 0x43aec3
mov ecx, dword [edx + eax*8 + 4]
cmp ecx, esi
je 0x43aec3
lea esi, [esp + 4]
lea edx, [esp + 0x14]
push 0
push 0
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push dword [esp + 0x6c]
push 0
push esi
push edx
push dword [esp + 0x6c]
push dword [esp + 0x6c]
push 0x2c
push ecx
push dword [0x44760c]
call fcn.00439030
add esp, 0x38
mov esi, eax
push dword [esp]
call fcn.00408010
add esp, 4
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43aee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov eax, 0xfffffffe
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43aef0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43af0b
mov eax, 0xffffffff
jmp 0x43af0e
add eax, 0xa
push eax
call fcn.00408000
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov dword [esp], eax
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x43af51
add ebx, 2
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x43af40
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 0xc], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xe], cx
mov eax, dword [esp]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], 0x54555657
mov ecx, 0x48578125
mov eax, 0x90af024a
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x48578121]
mov edi, eax
and edi, 0x102f0006
mov ebx, ecx
xor ebx, 0x93ff443
add ebx, edi
mov edi, ebx
and edi, esi
lea ebp, [ebx + esi]
not ebp
lea ebp, [ebp + edi*2]
and ebp, ebx
mov edx, ebp
and edx, 2
mov edi, ebp
or ebp, 2
imul ebp, edx
xor edx, 2
and edi, 0x51ff757d
imul edi, edx
sub ebp, ebx
mov ebx, 0x1419eff
sub ebx, ebp
sub ebx, edi
lea edx, [edi + ebp]
add edx, 0xfebe6200
and ebx, esi
not esi
and esi, edx
sub ebx, esi
add bl, 0xc0
mov byte [esp + ecx - 0x48578121], bl
inc ecx
add eax, 2
cmp ecx, 0x48578129
jne 0x43afd0
mov esi, dword [esp + 4]
mov ecx, dword [0x447604]
test ecx, ecx
je 0x43b0a5
xor edx, edx
mov edi, dword [0x447608]
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x75935cf9
je 0x43b070
inc edx
cmp ecx, edx
jne 0x43b060
jmp 0x43b0a5
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43b0a5
lea eax, [esp + 4]
lea edx, [esp + 0x14]
push dword [esp + 0x50]
push dword [esp + 0x50]
push eax
push edx
push dword [esp + 0x58]
push dword [esp + 0x58]
push 0x18
push ecx
push dword [0x44760c]
call fcn.00439030
add esp, 0x24
mov esi, eax
push dword [esp]
call fcn.00408010
add esp, 4
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b0c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43b0e0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x43b0fb
mov eax, 0xffffffff
jmp 0x43b0fe
add eax, 0xa
push eax
call fcn.00408000
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp], eax
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43b141
add esi, 2
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43b130
mov word [ecx], 0
lea eax, [ebx*2 + 8]
mov word [esp + 8], ax
lea eax, [ebx*2 + 0xa]
mov word [esp + 0xa], ax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x54555657
mov ecx, 0x48578125
mov edx, 0x90af024a
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 4], edx
movzx esi, byte [esp + ecx - 0x485780fd]
mov edx, dword [esp + 4]
and edx, 0x102f0006
mov ebx, ecx
xor ebx, 0x93ff443
add ebx, edx
mov edx, ebx
and edx, esi
lea edi, [ebx + esi]
not edi
lea edi, [edi + edx*2]
and edi, ebx
mov eax, edi
and eax, 2
mov edx, edi
or edi, 2
imul edi, eax
xor eax, 2
and edx, 0x51ff757d
imul edx, eax
sub edi, ebx
mov ebx, 0x1419eff
sub ebx, edi
sub ebx, edx
lea eax, [edi + edx]
add eax, 0xfebe6200
mov edx, dword [esp + 4]
and ebx, esi
not esi
and esi, eax
sub ebx, esi
add bl, 0xc0
mov byte [esp + ecx - 0x485780fd], bl
inc ecx
add edx, 2
cmp ecx, 0x48578129
jne 0x43b1b0
mov esi, dword [esp + 0x28]
mov ecx, dword [0x447604]
test ecx, ecx
je 0x43b285
xor eax, eax
mov edx, dword [0x447608]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + eax*8], 0xcaa82e26
je 0x43b260
inc eax
cmp ecx, eax
jne 0x43b250
jmp 0x43b285
mov eax, dword [edx + eax*8 + 4]
cmp eax, esi
je 0x43b285
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push ecx
push edx
push 8
push eax
push dword [0x44760c]
call fcn.00439030
add esp, 0x14
mov esi, eax
push dword [esp]
call fcn.00408010
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43b29d
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b2b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0x54555657
mov ecx, 0x48578125
mov esi, 0x90af024a
nop
nop
mov dword [esp + 4], esi
movzx ebx, byte [esp + ecx - 0x4857811d]
mov esi, dword [esp + 4]
and esi, 0x102f0006
mov eax, ecx
xor eax, 0x93ff443
add eax, esi
mov esi, eax
and esi, ebx
lea edi, [eax + ebx]
not edi
lea esi, [edi + esi*2]
and esi, eax
mov edx, esi
and edx, 2
mov edi, esi
or esi, 2
imul esi, edx
xor edx, 2
and edi, 0x51ff757d
imul edi, edx
sub esi, eax
mov eax, 0x1419eff
sub eax, esi
sub eax, edi
lea edx, [esi + edi]
add edx, 0xfebe6200
mov esi, dword [esp + 4]
and eax, ebx
not ebx
and ebx, edx
sub eax, ebx
add al, 0xc0
mov byte [esp + ecx - 0x4857811d], al
inc ecx
add esi, 2
cmp ecx, 0x48578129
jne 0x43b2d0
mov eax, dword [esp + 8]
mov ecx, dword [0x447604]
test ecx, ecx
je 0x43b3aa
xor edx, edx
mov esi, dword [0x447608]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xa269eeef
je 0x43b380
inc edx
cmp ecx, edx
jne 0x43b370
jmp 0x43b3aa
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43b3aa
lea eax, [esp + 8]
lea edx, [esp + 0x24]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 0x14
push ecx
push dword [0x44760c]
call fcn.00439030
add esp, 0x20
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x43b3b7
mov ecx, dword [esp + 0x10]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43b3c6
cmp byte [esp + 0x1d], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b3d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 4], 0x54555657
mov edi, 0x48578125
mov ebx, 0x90af024a
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + edi - 0x48578121]
mov ecx, ebx
and ecx, 0x102f0006
mov eax, edi
xor eax, 0x93ff443
add eax, ecx
mov ecx, eax
and ecx, ebp
lea esi, [eax + ebp]
not esi
lea esi, [esi + ecx*2]
and esi, eax
mov edx, esi
and edx, 2
mov ecx, esi
or esi, 2
imul esi, edx
xor edx, 2
and ecx, 0x51ff757d
imul ecx, edx
sub esi, eax
mov eax, 0x1419eff
sub eax, esi
sub eax, ecx
add ecx, esi
add ecx, 0xfebe6200
and eax, ebp
not ebp
and ebp, ecx
sub eax, ebp
add al, 0xc0
mov byte [esp + edi - 0x48578121], al
inc edi
add ebx, 2
cmp edi, 0x48578129
jne 0x43b3f0
mov eax, dword [esp + 4]
mov esi, dword [0x447604]
test esi, esi
je 0x43b4c4
xor ecx, ecx
mov edi, dword [0x447608]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ecx*8], 0xe88ddea1
je 0x43b490
inc ecx
cmp esi, ecx
jne 0x43b480
jmp 0x43b4c4
mov edi, dword [edi + ecx*8 + 4]
cmp edi, eax
je 0x43b4c4
lea eax, [esp + 4]
push 0
push 0
push dword [esp + 0x30]
push dword [esp + 0x30]
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push edi
push dword [0x44760c]
call fcn.00439030
add esp, 0x30
cmp eax, 0x103
jne 0x43b5a9
mov dword [esp], 0x54555657
mov eax, 0x48578125
mov ebp, 0x90af024a
movzx edx, byte [esp + eax - 0x48578125]
mov ecx, ebp
and ecx, 0x102f0006
mov edi, eax
xor edi, 0x93ff443
add edi, ecx
mov ecx, edi
and ecx, edx
lea esi, [edi + edx]
not esi
lea esi, [esi + ecx*2]
and esi, edi
mov ecx, esi
and ecx, 2
mov ebx, esi
or esi, 2
imul esi, ecx
xor ecx, 2
and ebx, 0x51ff757d
imul ebx, ecx
sub esi, edi
mov ecx, 0x1419eff
sub ecx, esi
sub ecx, ebx
add esi, ebx
add esi, 0xfebe6200
and ecx, edx
not edx
and edx, esi
sub ecx, edx
add cl, 0xc0
mov byte [esp + eax - 0x48578125], cl
inc eax
add ebp, 2
cmp eax, 0x48578129
jne 0x43b4e0
mov eax, dword [esp]
mov ecx, dword [0x447604]
test ecx, ecx
je 0x43b5a1
xor edx, edx
mov esi, dword [0x447608]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xa67d73aa
je 0x43b580
inc edx
cmp ecx, edx
jne 0x43b570
jmp 0x43b5a1
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43b5a1
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x44760c]
call fcn.00439030
add esp, 0x18
test eax, eax
js 0x43b5a9
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x43b5c0
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43b5be
mov ecx, dword [esp + 8]
mov dword [edx], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b5d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 4], 0x54555657
mov edi, 0x48578125
mov ebx, 0x90af024a
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + edi - 0x48578121]
mov ecx, ebx
and ecx, 0x102f0006
mov eax, edi
xor eax, 0x93ff443
add eax, ecx
mov ecx, eax
and ecx, ebp
lea esi, [eax + ebp]
not esi
lea esi, [esi + ecx*2]
and esi, eax
mov edx, esi
and edx, 2
mov ecx, esi
or esi, 2
imul esi, edx
xor edx, 2
and ecx, 0x51ff757d
imul ecx, edx
sub esi, eax
mov eax, 0x1419eff
sub eax, esi
sub eax, ecx
add ecx, esi
add ecx, 0xfebe6200
and eax, ebp
not ebp
and ebp, ecx
sub eax, ebp
add al, 0xc0
mov byte [esp + edi - 0x48578121], al
inc edi
add ebx, 2
cmp edi, 0x48578129
jne 0x43b5f0
mov eax, dword [esp + 4]
mov esi, dword [0x447604]
test esi, esi
je 0x43b6c4
xor ecx, ecx
mov edi, dword [0x447608]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ecx*8], 0x88822328
je 0x43b690
inc ecx
cmp esi, ecx
jne 0x43b680
jmp 0x43b6c4
mov edi, dword [edi + ecx*8 + 4]
cmp edi, eax
je 0x43b6c4
lea eax, [esp + 4]
push 0
push 0
push dword [esp + 0x30]
push dword [esp + 0x30]
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push edi
push dword [0x44760c]
call fcn.00439030
add esp, 0x30
cmp eax, 0x103
jne 0x43b7a9
mov dword [esp], 0x54555657
mov eax, 0x48578125
mov ebp, 0x90af024a
movzx edx, byte [esp + eax - 0x48578125]
mov ecx, ebp
and ecx, 0x102f0006
mov edi, eax
xor edi, 0x93ff443
add edi, ecx
mov ecx, edi
and ecx, edx
lea esi, [edi + edx]
not esi
lea esi, [esi + ecx*2]
and esi, edi
mov ecx, esi
and ecx, 2
mov ebx, esi
or esi, 2
imul esi, ecx
xor ecx, 2
and ebx, 0x51ff757d
imul ebx, ecx
sub esi, edi
mov ecx, 0x1419eff
sub ecx, esi
sub ecx, ebx
add esi, ebx
add esi, 0xfebe6200
and ecx, edx
not edx
and edx, esi
sub ecx, edx
add cl, 0xc0
mov byte [esp + eax - 0x48578125], cl
inc eax
add ebp, 2
cmp eax, 0x48578129
jne 0x43b6e0
mov eax, dword [esp]
mov ecx, dword [0x447604]
test ecx, ecx
je 0x43b7a1
xor edx, edx
mov esi, dword [0x447608]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xa67d73aa
je 0x43b780
inc edx
cmp ecx, edx
jne 0x43b770
jmp 0x43b7a1
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43b7a1
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x44760c]
call fcn.00439030
add esp, 0x18
test eax, eax
js 0x43b7a9
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x43b7b7
mov ecx, dword [esp + 8]
mov dword [edx], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b7c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x38]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x43b7e0
sar ebx, 1
mov ecx, ebx
and ecx, 0xfffd
mov edx, ebx
and edx, 2
or ebx, 2
imul ebx, edx
xor edx, 2
imul edx, ecx
lea ecx, [edx + ebx]
mov word [esp + 4], cx
lea ecx, [edx + ebx]
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0x54555657
mov esi, 0x48578125
mov edi, 0x90af024a
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi - 0x48578125]
mov eax, edi
and eax, 0x102f0006
mov ebp, esi
xor ebp, 0x93ff443
add ebp, eax
mov eax, ebp
and eax, ebx
lea ecx, [ebx + ebp]
not ecx
lea ecx, [ecx + eax*2]
and ecx, ebp
mov eax, ecx
and eax, 2
mov edx, ecx
or ecx, 2
imul ecx, eax
xor eax, 2
and edx, 0x51ff757d
imul edx, eax
sub ecx, ebp
mov eax, 0x1419eff
sub eax, ecx
sub eax, edx
add ecx, edx
add ecx, 0xfebe6200
and eax, ebx
not ebx
and ebx, ecx
sub eax, ebx
add al, 0xc0
mov byte [esp + esi - 0x48578125], al
inc esi
add edi, 2
cmp esi, 0x48578129
jne 0x43b860
mov eax, dword [esp]
mov ecx, dword [0x447604]
test ecx, ecx
je 0x43b92a
xor edx, edx
mov esi, dword [0x447608]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xb7847e1b
je 0x43b900
inc edx
cmp ecx, edx
jne 0x43b8f0
jmp 0x43b92a
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43b92a
lea eax, [esp + 0xc]
push dword [esp + 0x44]
push eax
push dword [esp + 0x48]
push dword [esp + 0x48]
push 0x10
push ecx
push dword [0x44760c]
call fcn.00439030
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10006590
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c61e8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x1010d03c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
mov eax, 0x1010da40
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], eax
nop
mov esi, dword [eax]
lea ecx, [ebp - 0x2c]
push edx
call fcn.10006950
push 1
push 0x100e94b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.10005970
mov ecx, esi
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x100065f6
sub ecx, edi
sar ecx, 1
push ecx
push esi
mov ecx, eax
call fcn.10005970
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 0
cmovae eax, dword [ebp - 0x2c]
push 0x8000000
push 3
push 0
push 7
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 4
push 0x1000
push 0x100000
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x10006696
push 0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
push 0x100000
push esi
push edi
call ebx
test eax, eax
je 0x10006681
cmp dword [ebp - 0x30], 0
jbe 0x10006681
push 0
lea eax, [ebp - 0x30]
push eax
push 0x100000
push esi
push edi
call ebx
test eax, eax
jne 0x10006668
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x100066d3
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100066c9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006709
push edx
push ecx
call fcn.1009441c
add esp, 8
mov eax, dword [ebp - 0x34]
add eax, 4
mov dword [ebp - 0x34], eax
cmp eax, 0x1010da6c
je 0x100066eb
mov edx, dword [ebp - 0x38]
jmp 0x100065d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10093f25
mov esp, ebp
pop ebp
ret 4
call fcn.1009ba34
int3