joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424bd0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ecx, dword [esp + 0x30]
mov eax, 0xfffffffe
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x424be0
cmp eax, 0xffffffed
jge 0x424bf7
mov eax, 0xffffffff
jmp 0x424bfa
add eax, 0x12
push eax
call fcn.0040cb10
add esp, 4
mov dword [esp], eax
mov dword [esp + 4], 0xe319e10c
mov dword [esp + 8], 0xe76fe501
mov dword [esp + 0xc], 0xfbc4f9cc
mov dword [esp + 0x10], 0xff1cfd18
mov word [esp + 0x14], 0xf1f0
mov dword [esp + 0x16], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 4]
mov ebx, eax
and ebx, 0x18
xor ebx, 0x1cc25858
mov ecx, eax
and ecx, 7
sub ecx, ebx
mov ebx, ecx
and ebx, edx
mov esi, ebx
and esi, 0xfffffffd
mov edi, ebx
and edi, 2
mov ebp, ebx
or ebp, 0xfd
inc ebp
imul ebp, esi
or ebx, 2
imul ebx, edi
sub ebp, ebx
add ecx, edx
add ecx, ebp
add cl, 0xb8
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 0x16
jne 0x424c40
mov edx, dword [esp + 0x30]
movzx ecx, word [edx]
mov esi, dword [esp]
mov eax, esi
test cx, cx
je 0x424cb1
add edx, 2
mov eax, esi
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424ca0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x424ce1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424cd0
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.00445210
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x44cea0]

Function at 0x424d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov ebp, dword [esp + 0x5c]
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
movzx eax, byte [esp + 0x60]
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x30], al
test ebp, ebp
setg cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x44cfa0]
Function at 0x4278d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0xb1cd8fab
mov dword [esp + 8], 0xb522b320
mov dword [esp + 0xc], 0xb9d5b7f0
mov dword [esp + 0x10], 0xbdd9bb2c
mov dword [esp + 0x14], 0xa1c2bf9b
mov dword [esp + 0x18], 0xa5caa3d4
mov dword [esp + 0x1c], 0xa9c8a733
mov dword [esp + 0x20], 0xadcdabcc
mov dword [esp + 0x24], 0xd1ccaf3e
mov dword [esp + 0x28], 0xd540d3bb
mov dword [esp + 0x2c], 0xd9aad7b0
mov dword [esp + 0x30], 0xdd48dba8
mov dword [esp + 0x34], 0xc1b8df4d
mov dword [esp + 0x38], 0xc5aec3ab
mov dword [esp + 0x3c], 0xc953c7a3
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0xcbc8
mov byte [esp + 0x44], 0
mov ecx, 0x1d
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x19]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0x6f
mov byte [esp + ecx - 0x19], dl
inc ecx
cmp ecx, 0x5e
jne 0x427970
lea ebx, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov ebp, esp
push ebp
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x452160]
mov edi, dword [esp]
test edi, edi
jns 0x4279d5
mov eax, 0xffffffff
jmp 0x4279d8
lea eax, [edi + edi]
push eax
call fcn.0040cb10
add esp, 4
mov esi, eax
push ebp
push edi
push eax
push 0x1e
push ebx
push 0
call dword [0x452160]
mov dword [esp + 4], 0xf35af1ac
mov dword [esp + 8], 0xff48fd41
mov dword [esp + 0xc], 0xfb57f954
mov dword [esp + 0x10], 0xc764c576
mov dword [esp + 0x14], 0xc370c169
mov dword [esp + 0x18], 0xcfcecd60
mov eax, 0x100d4954
mov ebx, 0xab
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x100d4950]
lea edx, [eax - 0x806a500]
mov ebp, eax
and ebp, edi
mov ecx, ebx
and ecx, edi
xor edx, edi
add edx, edi
not edx
add edx, ecx
or edx, ebp
mov cl, 0x5b
sub cl, dl
mov byte [esp + eax - 0x100d4950], cl
inc eax
dec ebx
cmp eax, 0x100d496c
jne 0x427a30
mov edi, dword [esp + 0x9c]
lea ebx, [esp + 4]
jmp dword [0x44d550]

Function at 0x427ac0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x21e8
call fcn.0040ca70
mov dword [esp + 0xde8], 0xe154e740
mov dword [esp + 0xdec], 0xdd5be35f
mov dword [esp + 0xdf0], 0xd973df67
mov dword [esp + 0xdf4], 0xd568db74
mov dword [esp + 0xdf8], 0xd172d77f
mov dword [esp + 0xdfc], 0xcd7fd37f
mov dword [esp + 0xe00], 0xc97ccf73
mov word [esp + 0xe04], 0xcbc8
mov dword [esp + 0xe06], 0
mov byte [esp + 0xe0a], 0
mov eax, 0x6df702d9
nop
nop
nop
movzx ecx, byte [esp + eax - 0x6df6f4f1]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xc3
mov byte [esp + eax - 0x6df6f4f1], cl
inc eax
cmp eax, 0x6df702fc
jne 0x427b40
lea eax, [esp + 0x30]
lea ecx, [esp + 0xde8]
push 0
push 0
push 0x20019
push eax
mov dword [esp + 0x14], ecx
push ecx
call fcn.004456e0
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0x44d564]
Function at 0x42b070
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.0042b090
add esp, 4
test al, al
je 0x42b770
mov al, 1
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe0
push eax
push eax
mov dword [ebp - 0xac], esp
sub esp, 8
mov dword [ebp - 0x98], esp
sub esp, 0x24
mov dword [ebp - 0x9c], esp
mov dword [ebp - 0xec], 0x29b82beb
mov dword [ebp - 0xe8], 0x2dba2fbd
mov dword [ebp - 0xe4], 0xd13ed3cb
mov dword [ebp - 0xe0], 0xd526d73c
mov dword [ebp - 0xdc], 0xd94edb33
mov dword [ebp - 0xd8], 0xdddedf30
mov eax, 0x2d21c77
mov ecx, 0x88
nop
nop
nop
nop
movzx esi, byte [ebp + eax - 0x2d21d63]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
mov esi, 1
sub esi, edx
mov edi, 0x53
sub edi, edx
and edi, 0xfe
or esi, 0xfe
xor esi, edi
and edx, 1
lea edx, [esi + edx*2]
mov byte [ebp + eax - 0x2d21d63], dl
inc eax
dec ecx
cmp eax, 0x2d21c8f
jne 0x42b7e0
mov dword [ebp - 0x7c], 0x13601174
mov dword [ebp - 0x78], 0x1f511d51
mov dword [ebp - 0x74], 0x1b691951
mov dword [ebp - 0x70], 0x7740578
mov dword [ebp - 0x6c], 0x3660179
mov dword [ebp - 0x68], 0xf4f0d79
mov dword [ebp - 0x64], 0xb42094b
mov dword [ebp - 0x60], 0x3740357d
mov dword [ebp - 0x5c], 0x3356317d
mov dword [ebp - 0x58], 0x3f493d4f
mov dword [ebp - 0x54], 0x3b463976
mov dword [ebp - 0x50], 0x2767255b
mov dword [ebp - 0x4c], 0x236f2152
mov dword [ebp - 0x48], 0x2f502d48
mov dword [ebp - 0x44], 0x2bbe2949
mov dword [ebp - 0x40], 0x573b55ca
mov dword [ebp - 0x3c], 0x53215134
mov dword [ebp - 0x38], 0x5f335dc0
mov dword [ebp - 0x34], 0x5bcf5939
mov word [ebp - 0x30], 0x4544
mov word [ebp - 0x2a], 0
mov dword [ebp - 0x2e], 0
lea ebx, [ebp - 0x7c]
mov ecx, 0xd9dfffb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx]
mov esi, ecx
or esi, edx
lea edi, [ecx - 0xd9dff00]
and edi, edx
mov edx, edi
not edx
lea eax, [edi + edx*2]
mov dword [ebp - 0x10], eax
mov eax, 0xfffffffe
sub eax, dword [ebp - 0x10]
lea edx, [edi + edx*2]
inc edx
mov edi, esi
not edi
and edx, edi
xor eax, esi
add edx, esi
add edx, eax
mov eax, 0xe9
sub eax, edx
not edx
and edx, 1
or eax, 1
xor eax, edx
lea eax, [eax + edx*2]
mov byte [ebx], al
inc ebx
dec ecx
cmp ecx, 0xd9dffa7
jne 0x42b8d0
lea eax, [ebp - 0xec]
lea ecx, [ebp - 0x7c]
push eax
push ecx
call fcn.0043b720
add esp, 8
mov esi, eax
xor ecx, ecx
test esi, esi
sete cl
xor eax, eax
jmp dword [ecx*4 + 0x44de98]
Function at 0x42db80
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc4
mov dword [esp + 0x20], 0xfcf092d
mov dword [esp + 0x24], 0x3f20dfc
mov dword [esp + 0x28], 0x7e701c4
mov dword [esp + 0x2c], 0x1bfb05f0
mov dword [esp + 0x30], 0x1ff2193d
mov dword [esp + 0x34], 0x13e11dce
mov dword [esp + 0x38], 0x17f311e4
mov dword [esp + 0x3c], 0x2bcb15e4
mov dword [esp + 0x40], 0x2f1129cc
mov dword [esp + 0x44], 0x23ce2d13
mov dword [esp + 0x48], 0x27c321d7
mov dword [esp + 0x4c], 0x3bcd25d3
mov dword [esp + 0x50], 0x3fcd39c1
mov dword [esp + 0x54], 0x33003dce
mov dword [esp + 0x58], 0x37cb31b8
mov dword [esp + 0x5c], 0xcbca35c8
lea ebp, [esp + 0x60]
mov byte [esp + 0x60], 0
mov esi, 0xc2
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + esi - 0xa2]
mov ebx, edx
and ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xfd
mul cl
mov ecx, eax
add cl, dl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0x36
mov byte [esp + esi - 0xa2], al
inc esi
cmp esi, 0x103
jne 0x42dc20
lea esi, [esp + 0x84]
lea eax, [esp + 0x20]
mov edi, esi
mov ecx, 0x10
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xc4]
xor ecx, ecx
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
lea edi, [esp + 0x80]
push edi
push 0
push 0
push 0x1f
push esi
push 0
call dword [0x452160]
mov ebp, dword [esp + 0x80]
test ebp, ebp
jns 0x42dcb2
mov eax, 0xffffffff
jmp 0x42dcb9
lea eax, [ebp*2]
push eax
call fcn.0040cb10
add esp, 4
push edi
push ebp
mov ebx, eax
push eax
push 0x1f
push esi
push 0
call dword [0x452160]
lea eax, [esp + 0x1c]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00445090
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44e180]
Function at 0x435de0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x435f8c
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov esi, eax
jmp 0x435e32
jmp 0x435e34
xor ebx, ebx
cmp esi, 0
je 0x435f84
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov edi, eax
mov dword [esp], edi
call fcn.00431e40
mov ebp, eax
cmp ebp, 0
setne al
xor ebx, ebx
test al, 1
jne 0x435e68
jmp 0x435f78
mov ebx, ebp
add ebx, 1
mov dword [esp], ebx
call fcn.0040cb10
mov dword [esp + 0x24], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], edi
call fcn.00431eb0
mov al, byte [esp + 0x1c]
mov byte [esp + 0x20], al
mov byte [esp + 0xc], 0xe7
mov byte [esp + 0xd], 0x8d
mov byte [esp + 0xe], 0x8f
mov byte [esp + 0xf], 0x87
mov byte [esp + 0x10], 0x8a
mov byte [esp + 0x11], 0x86
mov byte [esp + 0x12], 0xf3
mov byte [esp + 0x13], 0x9d
mov byte [esp + 0x14], 0x8c
mov byte [esp + 0x15], 0xc3
mov byte [esp + 0x16], 0x82
mov byte [esp + 0x17], 0x87
mov byte [esp + 0x18], 0x80
mov byte [esp + 0x19], 0xd
mov eax, 0xe
mov byte [esp + eax + 0xc], 0
add eax, 1
cmp eax, 0x10
jne 0x435edc
jmp 0x435eeb
xor eax, eax
jmp 0x435eef
cmp eax, 0x10
jae 0x435f34
movzx edx, byte [esp + eax + 0xc]
mov edi, 0x9d51d039
sub edi, eax
or edi, edx
mov ecx, 0x39
sub ecx, eax
and ecx, edx
xor edi, 0xffffffff
or ecx, edi
mov edi, ecx
shl edi, 1
and edi, 0x42
xor ecx, 0x12991121
mov edx, ecx
add edx, edi
shl ecx, 1
and ecx, 2
xor edx, 1
add edx, ecx
mov byte [esp + eax + 0xc], dl
add eax, 1
jmp 0x435eef
jmp 0x435f36
jmp 0x435f38
lea eax, [esp + 0xc]
mov ecx, dword [esp + 0x3c]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov dword [esp + 8], ebp
call fcn.0040d680
sub esp, 0xc
mov bl, al
jmp 0x435f5b
and bl, 1
jmp 0x435f60
jmp 0x435f62
jmp 0x435f64
jmp 0x435f66
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.0040cb20
jmp 0x435f74
jmp 0x435f76
jmp 0x435f78
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x435f8c
and bl, 1
movzx eax, bl
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ab80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp], 0xc0c7c6c5
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
and ecx, 1
mov edx, eax
and edx, 6
xor edx, 0x2f
sub ecx, edx
xor cl, byte [esp + eax]
add cl, 0xeb
mov byte [esp + eax], cl
inc eax
cmp eax, 6
jne 0x43aba0
mov eax, dword [esp]
mov ecx, dword [0x452164]
test ecx, ecx
je 0x43ac12
xor edx, edx
mov esi, dword [0x452168]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xd518dba1
je 0x43abf0
inc edx
cmp ecx, edx
jne 0x43abe0
jmp 0x43ac12
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43ac12
lea eax, [esp + 0xc]
push eax
push 8
push 0xffffffffffffffff
push 3
push dword [0x45216c]
push ecx
call fcn.00442160
add esp, 0x18
xor ebx, ebx
test eax, eax
js 0x43ad0e
mov ecx, dword [esp + 0xc]
mov dword [esp], 0xc0c7c6c5
mov word [esp + 4], 0
nop
nop
mov eax, ebx
and eax, 1
mov edx, ebx
and edx, 6
xor edx, 0x2f
sub eax, edx
xor al, byte [esp + ebx]
add al, 0xeb
mov byte [esp + ebx], al
inc ebx
cmp ebx, 6
jne 0x43ac30
mov eax, dword [esp]
mov edx, dword [0x452164]
test edx, edx
je 0x43ac8c
xor esi, esi
mov edi, dword [0x452168]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xd1a85eee
je 0x43ac80
inc esi
cmp edx, esi
jne 0x43ac70
jmp 0x43ac8c
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
jne 0x43ad17
mov dword [esp], 0xc0c7c6c5
mov word [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
mov ebx, edx
and ebx, 1
mov esi, edx
and esi, 6
xor esi, 0x2f
sub ebx, esi
xor bl, byte [esp + edx]
add bl, 0xeb
mov byte [esp + edx], bl
inc edx
cmp edx, 6
jne 0x43aca0
test eax, eax
setns bl
mov eax, dword [0x452164]
test eax, eax
je 0x43ad0a
mov edx, dword [esp]
xor esi, esi
mov edi, dword [0x452168]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x7e776f1
je 0x43acf0
inc esi
cmp eax, esi
jne 0x43ace0
jmp 0x43ad0a
mov eax, dword [edi + esi*8 + 4]
cmp eax, edx
je 0x43ad0a
push ecx
push 1
push dword [0x45216c]
push eax
call fcn.00442160
add esp, 0x10
and bl, byte [esp + 0xb]
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
ret
mov eax, esp
lea esi, [esp + 0x10]
push eax
push 4
push esi
push 0x14
push ecx
push 5
push dword [0x45216c]
push edx
call fcn.00442160
add esp, 0x20
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0x10], 0
setne byte [esp + 0xb]
jmp 0x43ac8c

Function at 0x43b4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x18]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.00445090
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44f5a0]
Function at 0x43b720
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.004456e0
add esp, 0x14
test eax, eax
js 0x43b856
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00445ad0
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x43b7ba
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x43b788
mov eax, 0xffffffff
jmp 0x43b78f
lea eax, [eax*2 + 2]
push eax
call fcn.0040cb10
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00446090
add esp, 0x14
test eax, eax
jns 0x43b7ba
push esi
call fcn.0040cb20
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0xc0c7c6c5
mov word [esp + 8], 0
nop
nop
nop
nop
mov ecx, edi
and ecx, 1
mov edx, edi
and edx, 6
xor edx, 0x2f
sub ecx, edx
xor cl, byte [esp + edi + 4]
add cl, 0xeb
mov byte [esp + edi + 4], cl
inc edi
cmp edi, 6
jne 0x43b7d0
mov ecx, dword [0x452164]
test ecx, ecx
je 0x43b83a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x452168]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43b820
inc edi
cmp ecx, edi
jne 0x43b810
jmp 0x43b83a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43b83a
push eax
push 1
push dword [0x45216c]
push ecx
call fcn.00442160
add esp, 0x10
test esi, esi
jne 0x43b858
lea eax, [esp + 4]
push eax
call fcn.00444eb0
add esp, 4
test al, al
je 0x43b856
cmp dword [esp + 4], 1
je 0x43b858
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ea00
Capabilities:
Encode data using xor

Disassembly:
push eax
mov eax, dword [esp + 8]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44fac8]
Function at 0x43ea60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, ecx
mov dword [esp + 8], 0
mov dword [esp], 0xc0c7c6c5
mov word [esp + 4], 0
mov eax, 0x1e0e2d1
mov ecx, 0xaa1f1d2e
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x1e0e2d1]
mov edi, ecx
and edi, 0xaa1f0c21
mov edx, eax
and edx, 0x1c0029e
or edx, edi
xor edx, esi
mov esi, edx
xor esi, 0xfe3fec61
mov edi, edx
xor edi, 0x535b8274
and edi, esi
mov esi, edi
and esi, 0xfd
mov ebp, edi
and ebp, 2
or edi, 2
imul edi, ebp
xor ebp, 2
imul ebp, esi
xor edx, 0x8b
add edx, edi
add edx, ebp
inc dl
mov byte [esp + eax - 0x1e0e2d1], dl
inc eax
dec ecx
cmp eax, 0x1e0e2d7
jne 0x43ea90
mov edi, dword [esp]
mov eax, dword [0x452164]
test eax, eax
je 0x43eb46
xor ecx, ecx
mov edx, dword [0x452168]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xc85f7986
je 0x43eb20
inc ecx
cmp eax, ecx
jne 0x43eb10
jmp 0x43eb46
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43eb46
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x45216c]
push eax
call fcn.00442160
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43ecb6
mov dword [esp + 0xc], ebx
push dword [esp + 8]
call fcn.0043e990
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp + 0x10], ecx
mov dword [esp], 0xc0c7c6c5
mov word [esp + 4], 0
mov ebp, 0x1e0e2d1
mov ecx, 0xaa1f1d2e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ebp - 0x1e0e2d1]
mov edi, ecx
and edi, 0xaa1f0c21
mov edx, ebp
and edx, 0x1c0029e
or edx, edi
xor edx, esi
mov edi, edx
xor edi, 0xfe3fec61
mov esi, edx
xor esi, 0x535b8274
and esi, edi
mov edi, esi
and edi, 0xfd
mov ebx, esi
and ebx, 2
or esi, 2
imul esi, ebx
xor ebx, 2
imul ebx, edi
xor edx, 0x8b
add edx, esi
add edx, ebx
inc dl
mov byte [esp + ebp - 0x1e0e2d1], dl
inc ebp
dec ecx
cmp ebp, 0x1e0e2d7
jne 0x43eb90
mov edi, dword [esp]
mov edx, dword [0x452164]
test edx, edx
je 0x43ec21
xor esi, esi
mov ebp, dword [0x452168]
mov ebx, dword [esp + 0xc]
nop
nop
nop
cmp dword [ebp + esi*8], 0xc85f7986
je 0x43ec27
inc esi
cmp edx, esi
jne 0x43ec10
jmp 0x43ec4f
mov ebx, dword [esp + 0xc]
jmp 0x43ec4f
mov edx, dword [ebp + esi*8 + 4]
cmp edx, edi
je 0x43ec4f
push 0
push dword [esp + 0x14]
push eax
push 5
push 4
push dword [0x45216c]
push edx
mov esi, eax
call fcn.00442160
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43ecad
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [edx + esi]
mov ebp, dword [esp + 0x28]
movzx ebp, word [ebp + esi]
test di, di
je 0x43ec8a
add esi, 2
cmp di, bp
je 0x43ec70
cmp di, bp
je 0x43ec9c
mov esi, dword [ecx]
test esi, esi
jne 0x43ec60
mov edi, 0xc0000225
jmp 0x43ecad
mov edx, dword [ecx + 0x44]
mov dword [ebx + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [ebx + 0xc], ecx
xor edi, edi
push eax
call fcn.0043ea00
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43ecf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43edf0
xor eax, eax
cmp dword [ecx], 0
jne 0x43ee3b
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xc0c7c6c5
mov word [esp + 4], 0
mov eax, 0x1e0e2d1
mov esi, 0xaa1f1d2e
movzx edi, byte [esp + eax - 0x1e0e2d1]
mov ebp, esi
and ebp, 0xaa1f0c21
mov ebx, eax
and ebx, 0x1c0029e
or ebx, ebp
xor ebx, edi
mov ebp, ebx
xor ebp, 0xfe3fec61
mov edi, ebx
xor edi, 0x535b8274
and edi, ebp
mov ebp, edi
and ebp, 0xfd
mov edx, edi
and edx, 2
or edi, 2
imul edi, edx
xor edx, 2
imul edx, ebp
xor ebx, 0x8b
add ebx, edi
add ebx, edx
inc bl
mov byte [esp + eax - 0x1e0e2d1], bl
inc eax
dec esi
cmp eax, 0x1e0e2d7
jne 0x43ed60
mov eax, dword [esp]
mov esi, dword [0x452164]
test esi, esi
je 0x43ee3b
xor edi, edi
mov ebx, dword [0x452168]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3ba5404
je 0x43ee45
inc edi
cmp esi, edi
jne 0x43ede0
jmp 0x43ee3b
mov dword [esp + 8], 0xf3323138
mov word [esp + 0xc], 0
mov eax, 0x3c4b2ab4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x3c4b2aac]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x7c
mov byte [esp + eax - 0x3c4b2aac], cl
inc eax
cmp eax, 0x3c4b2aba
jne 0x43ee10
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43ee3b
lea eax, [esp + 0x20]
lea edx, [esp + 8]
push eax
push edx
push dword [esp + 0x44]
push ecx
push 4
push dword [0x45216c]
push esi
call fcn.00442160
add esp, 0x1c
jmp 0x43ee3b

Function at 0x43ee80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43ef6e
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp], 0xc0c7c6c5
mov word [esp + 4], 0
mov edx, 0x1e0e2d1
mov esi, 0xaa1f1d2e
nop
nop
nop
movzx edi, byte [esp + edx - 0x1e0e2d1]
mov ebp, esi
and ebp, 0xaa1f0c21
mov ebx, edx
and ebx, 0x1c0029e
or ebx, ebp
xor ebx, edi
mov ebp, ebx
xor ebp, 0xfe3fec61
mov edi, ebx
xor edi, 0x535b8274
and edi, ebp
mov ebp, edi
and ebp, 0xfd
mov eax, edi
and eax, 2
or edi, 2
imul edi, eax
xor eax, 2
imul eax, ebp
xor ebx, 0x8b
add ebx, edi
add ebx, eax
inc bl
mov byte [esp + edx - 0x1e0e2d1], bl
inc edx
dec esi
cmp edx, 0x1e0e2d7
jne 0x43eeb0
mov edx, dword [0x452164]
test edx, edx
je 0x43ef61
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x452168]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43ef40
inc edi
cmp edx, edi
jne 0x43ef30
jmp 0x43ef61
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43ef61
push dword [esp + 8]
push 1
push dword [0x45216c]
push edx
mov esi, ecx
call fcn.00442160
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret