joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4249b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebp, dword [esp + 0x58]
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
movzx eax, byte [esp + 0x5c]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebp
mov byte [esp + 0x2c], al
test ebp, ebp
setg cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x44ac20]
Function at 0x426f80
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x70
mov eax, dword [0x44f530]
mov dword [esp], 0x89de8bf7
mov dword [esp + 4], 0x853b8739
mov dword [esp + 8], 0x8136833b
mov dword [esp + 0xc], 0x9d2e9fdf
mov dword [esp + 0x10], 0x99c69b2c
mov dword [esp + 0x14], 0x951a9727
mov dword [esp + 0x18], 0x91e9932b
mov word [esp + 0x1c], 0xef90
mov dword [esp + 0x1e], 0
mov word [esp + 0x22], 0
xor ecx, ecx
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
mov edx, ecx
and edx, 3
xor edx, 0x781e7b83
mov edi, ecx
and edi, 0x3c
sub edx, edi
add edx, 0x59
mov ebx, edx
or ebx, esi
and edx, esi
not ebx
add ebx, edx
add bl, 0x51
mov byte [esp + ecx], bl
inc ecx
cmp ecx, 0x24
jne 0x426fe0
lea edx, [esp + 0x50]
mov ecx, esp
push edx
push 0
push 0
push 0xe
push ecx
push 0
call eax
mov edi, dword [esp + 0x50]
test edi, edi
jns 0x427030
mov eax, 0xffffffff
jmp 0x427033
lea eax, [edi + edi]
push eax
call fcn.0040ce10
add esp, 4
mov dword [esp + 0x54], eax
mov esi, dword [0x44f530]
mov dword [esp], 0xcfb2c9ed
mov dword [esp + 4], 0xc3a5cd5f
mov dword [esp + 8], 0xc75ac1a1
mov dword [esp + 0xc], 0xfb6ac585
mov dword [esp + 0x10], 0xffbaf968
mov dword [esp + 0x14], 0xf366fd9d
mov dword [esp + 0x18], 0xf7d3f191
mov dword [esp + 0x1c], 0xf5f4
mov ebp, 0xd2
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ebp - 0xd2]
mov edx, ebx
and edx, ebp
mov eax, edx
or al, 0xfd
inc al
mov ecx, edx
and cl, 0xfd
mul cl
mov ecx, eax
add cl, bl
mov eax, edx
shr al, 1
and al, 1
or dl, 2
mul dl
add al, al
sub cl, al
movzx eax, cl
add eax, ebp
add al, 0xe6
mov byte [esp + ebp - 0xd2], al
inc ebp
cmp ebp, 0xf2
jne 0x427090
lea eax, [esp + 0x50]
push eax
push edi
mov ebx, dword [esp + 0x5c]
push ebx
push 0xe
lea eax, [esp + 0x10]
push eax
push 0
call esi
mov eax, dword [esp + 0x50]
mov ecx, eax
add ecx, 9
jns 0x4270fb
mov eax, 0xffffffff
jmp 0x427102
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040ce10
add esp, 4
mov edi, eax
mov dword [esp], 0x79ca7ba8
mov dword [esp + 4], 0x7ddb7fdf
mov dword [esp + 8], 0x71d573e1
mov dword [esp + 0xc], 0x75ed77e9
mov dword [esp + 0x10], 0x696a6be1
mov word [esp + 0x14], 0
mov eax, 0xac534c3f
movzx ecx, byte [esp + eax + 0x53acb3c1]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xc5
mov byte [esp + eax + 0x53acb3c1], cl
inc eax
cmp eax, 0xac534c55
jne 0x427140
movzx ecx, word [ebx]
mov eax, edi
test cx, cx
je 0x427191
lea edx, [ebx + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x427180
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4271c1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4271b0
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.00443de0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b204]
Function at 0x4278f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x2200
call fcn.0040cd70
mov dword [esp + 0x1200], 0xcf78c964
mov dword [esp + 0x1204], 0xc379cd09
mov dword [esp + 0x1208], 0xc771c179
mov dword [esp + 0x120c], 0xbb0cc570
mov dword [esp + 0x1210], 0xbf12b911
mov dword [esp + 0x1214], 0xb305bd09
mov dword [esp + 0x1218], 0xb700b175
mov word [esp + 0x121c], 0xb5b4
mov dword [esp + 0x121e], 0
mov byte [esp + 0x1222], 0
mov eax, 0x5528f4b2
mov ecx, 0x4d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x5528e2b2]
mov esi, ecx
xor esi, eax
and esi, edx
xor esi, eax
mov edx, esi
and edx, 5
xor esi, 0x85
lea edx, [esi + edx*2]
inc dl
mov byte [esp + eax - 0x5528e2b2], dl
inc eax
dec ecx
cmp eax, 0x5528f4d5
jne 0x427980
lea eax, [esp + 0x34]
lea ebp, [esp + 0x1200]
push 0
push 0
push 0x20019
push eax
push ebp
call fcn.00444270
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0x44b284]

Function at 0x429610
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x84c
mov dword [esp], 0
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0x200
mov eax, 1
mov dword [esp + 4], 0
jmp dword [eax*4 + 0x44b914]

Function at 0x429fd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx ecx, word [esi]
mov eax, ebp
test cx, cx
je 0x42a126
mov edx, dword [esp + 0x18]
mov eax, ebp
dec edx
je 0x42a126
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x42a020
lea ecx, [eax + 1]
mov byte [eax], bl
jmp 0x42a0c0
cmp ebx, 0x7ff
ja 0x42a050
cmp edx, 2
jb 0x42a050
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [eax + 2]
mov byte [eax + 1], bl
jmp 0x42a0c0
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x42a0e8
cmp edx, 4
jb 0x42a0e8
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea edi, [ebx + ecx]
add edi, 0xfca02400
mov ebx, edi
shr ebx, 0x12
or bl, 0xf0
mov byte [eax], bl
mov ebx, edi
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [eax + 1], bl
shr edi, 6
mov ebx, edi
not ebx
or ebx, 0x3f
add ebx, edi
add bl, 0x81
mov byte [eax + 2], bl
mov bl, 0x3f
sub bl, cl
or bl, 0xc0
xor bl, 0x7f
lea ecx, [eax + 4]
mov byte [eax + 3], bl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, ecx
sub ebx, eax
mov eax, edx
not eax
and eax, ebx
not ebx
and ebx, edx
sub ebx, eax
mov esi, edi
mov eax, ecx
mov edx, ebx
movzx ecx, word [esi]
test cx, cx
je 0x42a126
test edx, edx
jne 0x42a000
jmp 0x42a126
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x42a0f7
mov esi, edi
jmp 0x42a0d6
cmp edx, 3
jb 0x42a122
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [eax + 3]
mov byte [eax + 2], bl
jmp 0x42a0c0
mov ecx, eax
jmp 0x42a0c0
mov byte [eax], 0
sub eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42a470
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.0042a490
add esp, 4
test al, al
je 0x42ab90
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xb0
mov dword [esp + 0x88], 0x13841159
mov dword [esp + 0x8c], 0x1f821d8f
mov dword [esp + 0x90], 0x1b8e1979
mov dword [esp + 0x94], 0x7760590
mov dword [esp + 0x98], 0x39e0161
mov dword [esp + 0x9c], 0xf0e0d64
mov word [esp + 0xa0], 0
mov eax, 5
mov ecx, 0xfb
movzx esi, byte [esp + eax + 0x83]
mov edx, esi
not edx
mov edi, edx
or edi, 0x2c
add esi, edi
inc esi
mov edi, ecx
and edi, 0xd3
mov ebx, ecx
or ebx, 0x2c
add ebx, eax
or ebx, edi
and edx, 0xd3
or edx, esi
xor edx, ebx
add dl, 0xec
mov byte [esp + eax + 0x83], dl
inc eax
dec ecx
cmp eax, 0x1f
jne 0x42abf0
mov dword [esp + 0x14], 0x93209134
mov dword [esp + 0x18], 0x9fd19dd1
mov dword [esp + 0x1c], 0x9b2999d1
mov dword [esp + 0x20], 0x87348538
mov dword [esp + 0x24], 0x83268139
mov dword [esp + 0x28], 0x8fcf8d39
mov dword [esp + 0x2c], 0x8bc289cb
mov dword [esp + 0x30], 0xf740f5bd
mov dword [esp + 0x34], 0xf356f1bd
mov dword [esp + 0x38], 0xff49fd4f
mov dword [esp + 0x3c], 0xfb46f9b6
mov dword [esp + 0x40], 0xe7a7e55b
mov dword [esp + 0x44], 0xe3afe152
mov dword [esp + 0x48], 0xef50ed48
mov dword [esp + 0x4c], 0xeb7ee949
mov dword [esp + 0x50], 0xd77bd54a
mov dword [esp + 0x54], 0xd361d174
mov dword [esp + 0x58], 0xdf73dd40
mov dword [esp + 0x5c], 0xdb4fd979
mov dword [esp + 0x60], 0xc5c4
mov eax, 0x73bc13a4
mov ecx, 0x45b
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x73bc1390]
mov edx, edi
not edx
or edx, 0x2ac55ab7
lea esi, [edi + edx]
inc esi
and edi, 0x48
xor edi, 0xd53aa548
mov edx, ecx
and edx, 0x548
mov ebx, eax
xor ebx, 0xd53aa548
or ebx, edx
mov edx, edi
xor edx, esi
not esi
and esi, edi
add edx, edi
sub edx, esi
xor edx, ebx
mov esi, edx
xor esi, 0x35
and edx, 0x4a
add edx, edx
sub edx, esi
inc dl
mov byte [esp + eax - 0x73bc1390], dl
inc eax
dec ecx
cmp eax, 0x73bc13f4
jne 0x42ace0
lea ecx, [esp + 0x88]
lea eax, [esp + 0x14]
push ecx
push eax
call fcn.0043b970
add esp, 8
mov esi, eax
xor eax, eax
test esi, esi
sete al
jmp dword [eax*4 + 0x44ba84]
Function at 0x4348e0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x318
mov dword [esp + 0x2ec], 0x44c630
mov dword [esp + 0x8c], 0
lea eax, [esp + 0x8c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x446aa0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x446ab0
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x2e8], eax
mov eax, dword [esp + 0x2ec]
mov ecx, dword [esp + 0x2e8]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x2e4], 0x44c638
mov dword [esp + 0x2dc], 0x44be60
mov dword [esp + 0x2d8], 0xaa
mov dword [esp + 0x2d4], 0x44c640
mov dword [esp + 0x2cc], 0x44c648
mov dword [esp + 0x2c4], 0x44be60
mov dword [esp + 0x2c0], 0xad
mov dword [esp + 0x2bc], 0x44be60
mov dword [esp + 0x2b8], 0xae
mov dword [esp + 0x2b4], 0x44c650
mov dword [esp + 0x2ac], 0x44c658
mov dword [esp + 0x2a4], 0x44be60
mov dword [esp + 0x2a0], 0xb1
mov dword [esp + 0x29c], 0x44c660
mov dword [esp + 0x294], 0x44be60
mov dword [esp + 0x290], 0xb4
mov dword [esp + 0x28c], 0x44be60
mov dword [esp + 0x288], 0xb4
mov dword [esp + 0x284], 0x44c668
mov dword [esp + 0x27c], 0x44c670
mov dword [esp + 0x274], 0x44c678
mov dword [esp + 0x26c], 0x44c680
mov dword [esp + 0x264], 0x44c688
mov dword [esp + 0x25c], 0x44c690
mov dword [esp + 0x254], 0x44be60
mov dword [esp + 0x250], 0xbb
mov dword [esp + 0x24c], 0x44c698
mov dword [esp + 0x244], 0x44be60
mov dword [esp + 0x240], 0xbd
mov dword [esp + 0x23c], 0x44c6a0
mov dword [esp + 0x234], 0x44c6a8
mov dword [esp + 0x22c], 0x44c6b0
mov dword [esp + 0x224], 0x44be60
mov dword [esp + 0x220], 0xc1
mov dword [esp + 0x21c], 0x44be60
mov dword [esp + 0x218], 0xc2
mov dword [esp + 0x214], 0x44be60
mov dword [esp + 0x210], 0xc3
mov dword [esp + 0x20c], 0x44c6b8
mov dword [esp + 0x204], 0x44c6c0
mov dword [esp + 0x1fc], 0x44c6c8
mov dword [esp + 0x1f4], 0x44c6d0
mov dword [esp + 0x1ec], 0x44c6d8
mov dword [esp + 0x1e4], 0x44be60
mov dword [esp + 0x1e0], 0xc9
mov dword [esp + 0x1dc], 0x44be60
mov dword [esp + 0x1d8], 0xca
mov dword [esp + 0x1d4], 0x44be60
mov dword [esp + 0x1d0], 0xcb
mov dword [esp + 0x1cc], 0x44be60
mov dword [esp + 0x1c8], 0xcc
mov dword [esp + 0x1c4], 0x44c6e0
mov dword [esp + 0x1bc], 0x44c6e8
mov dword [esp + 0x1b4], 0x44be60
mov dword [esp + 0x1b0], 0xcf
mov dword [esp + 0x1ac], 0x44be60
mov dword [esp + 0x1a8], 0xd0
mov dword [esp + 0x1a4], 0x44c6f0
mov dword [esp + 0x19c], 0x44c6f8
mov dword [esp + 0x194], 0x44c700
mov dword [esp + 0x18c], 0x44c708
mov dword [esp + 0x184], 0x44be60
mov dword [esp + 0x180], 0xab
mov dword [esp + 0x17c], 0x44be60
mov dword [esp + 0x178], 0xb5
mov dword [esp + 0x174], 0x44be60
mov dword [esp + 0x170], 0xb8
mov dword [esp + 0x16c], 0x44be60
mov dword [esp + 0x168], 0xbf
mov dword [esp + 0x164], 0x44be60
mov dword [esp + 0x160], 0xc7
mov dword [esp + 0x15c], 0x44be60
mov dword [esp + 0x158], 0xcd
mov dword [esp + 0x154], 0x44be60
mov dword [esp + 0x150], 0xd1
mov dword [esp + 0x14c], 0x44be60
mov dword [esp + 0x148], 0xd4
xor esi, esi
jmp eax
Function at 0x436350
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
call fcn.0040e6d0
sub esp, 0x14
mov esi, esp
push eax
mov edi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x436389
jmp 0x4364ba
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x4363c5
jmp 0x4364b2
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x14], eax
mov dword [esp], eax
call fcn.0040cf20
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x4364a3
jmp 0x4363f2
mov cl, byte [edi]
mov byte [ebp - 0x10], cl
mov byte [esi], 0xa1
mov byte [esi + 1], 0x47
mov byte [esi + 2], 0x45
mov byte [esi + 3], 0x79
mov byte [esi + 4], 0x4e
mov byte [esi + 5], 0x7e
mov byte [esi + 6], 0x49
mov byte [esi + 7], 0x7b
mov byte [esi + 8], 0x48
mov byte [esi + 9], 0x81
mov byte [esi + 0xa], 0x46
mov byte [esi + 0xb], 0x49
mov byte [esi + 0xc], 0x44
mov byte [esi + 0xd], 0xd7
mov ecx, 0xe
mov byte [esi + ecx], 0
add ecx, 1
cmp ecx, 0x14
jne 0x436433
xor ecx, ecx
cmp ecx, 0x14
jae 0x43647d
movzx edi, byte [esi + ecx]
mov ebx, ecx
xor ebx, 0x2bf3e7a9
mov edx, ecx
shl edx, 1
and edx, 0xa81830ac
sub edx, ebx
xor edx, edi
mov edi, edx
xor edi, 0xb4
shl edx, 1
and edx, 0x96
sub edx, edi
add dl, 1
mov byte [esi + ecx], dl
add ecx, 1
jmp 0x436441
jmp 0x43647f
jmp 0x436481
jmp 0x436483
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.0040d960
mov bl, al
and bl, 1
jmp 0x4364a3
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4364ba
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ac80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x43aca0
mov dword [esp], 0x2060499
mov esi, esp
mov edi, 0x2996787e
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esi]
mov ebp, edi
and ebp, 0x29140827
xor ebx, 0x2f7d8fa7
mov ecx, ebx
and ecx, ebp
add ebx, ebp
add ecx, ecx
sub ebx, ecx
add bl, 0x7b
mov byte [esi], bl
inc esi
dec edi
cmp edi, 0x2996787a
jne 0x43acc0
test edx, edx
je 0x43ad6e
mov esi, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x43ad28
mov ebp, eax
mov ecx, dword [esp + 0x18]
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x43ad10
cmp edi, 3
jae 0x43ad31
jmp 0x43ad6e
mov ecx, dword [esp + 0x18]
cmp edi, 3
jb 0x43ad6e
mov ebx, ecx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edi*2]
xor ecx, eax
imul ecx, esi
movzx eax, word [ebx + edi*2 + 2]
xor eax, ecx
imul eax, esi
movzx ecx, word [ebx + edi*2 + 4]
xor ecx, eax
imul ecx, esi
movzx eax, word [ebx + edi*2 + 6]
xor eax, ecx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x43ad40
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b970
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00444270
add esp, 0x14
test eax, eax
js 0x43baa6
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00444620
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0x43ba0a
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x43b9d8
mov eax, 0xffffffff
jmp 0x43b9df
lea eax, [eax*2 + 2]
push eax
call fcn.0040ce10
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00444bc0
add esp, 0x14
test eax, eax
jns 0x43ba0a
push esi
call fcn.0040ce20
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x80b0a0d
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebx
add cl, 0x43
xor cl, byte [esp + ebx + 4]
add cl, 0xb1
mov byte [esp + ebx + 4], cl
inc ebx
cmp ebx, 7
jne 0x43ba30
mov ecx, dword [0x44f534]
test ecx, ecx
je 0x43ba8a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44f538]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43ba70
inc edi
cmp ecx, edi
jne 0x43ba60
jmp 0x43ba8a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43ba8a
push eax
push 1
push dword [0x44f53c]
push ecx
call fcn.00440f10
add esp, 0x10
test esi, esi
jne 0x43baa8
lea eax, [esp + 4]
push eax
call fcn.00443a90
add esp, 4
test al, al
je 0x43baa6
cmp dword [esp + 4], 1
je 0x43baa8
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e690
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x18]
mov dword [esp], 0x3f3e3968
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x8a
xor cl, byte [esp + eax]
add cl, 0x4e
mov byte [esp + eax], cl
inc eax
cmp eax, 6
jne 0x43e6b0

Function at 0x43e710
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x18]

Function at 0x43e9c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edx, dword [ecx + 8]
test edx, edx
je 0x43eaa0
xor eax, eax
cmp dword [ecx], 0
jne 0x43eaf1
mov esi, dword [esp + 0x3c]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], edx
mov ebp, ecx
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x80b0a0d
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov edi, 0x43
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edi - 0x43]
mov ebx, ecx
and ebx, edi
mov eax, ebx
or al, 0xfd
inc al
mov edx, ebx
and dl, 0x4d
mul dl
mov edx, eax
add dl, cl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub dl, al
movzx eax, dl
add eax, edi
add al, 0xb1
mov byte [esp + edi - 0x43], al
inc edi
cmp edi, 0x4a
jne 0x43ea40
mov eax, dword [esp]
mov ecx, dword [0x44f534]
test ecx, ecx
je 0x43eaf1
xor edx, edx
mov edi, dword [0x44f538]
nop
cmp dword [edi + edx*8], 0x3ba5404
je 0x43eafb
inc edx
cmp ecx, edx
jne 0x43ea90
jmp 0x43eaf1
mov dword [esp + 8], 0x17d6c9c0
mov dword [esp + 0xc], 0
mov eax, 0x756f574e
mov ecx, 0xa90a8b1
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x756f5746]
mov esi, edx
and esi, eax
add esi, esi
mov ebx, esi
xor ebx, eax
and esi, ecx
add esi, esi
sub ebx, esi
add bl, dl
add bl, 0x7a
mov byte [esp + eax - 0x756f5746], bl
inc eax
dec ecx
cmp eax, 0x756f5756
jne 0x43eac0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov edx, dword [edi + edx*8 + 4]
cmp edx, eax
je 0x43eaf1
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
push ecx
push esi
push ebp
push 4
push dword [0x44f53c]
push edx
call fcn.00440f10
add esp, 0x1c
jmp 0x43eaf1
Function at 0x43ec00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 8], ecx
cmp dword [ecx + 8], 0
je 0x43ecb0
mov eax, dword [esp + 8]
mov edi, dword [eax]
test edi, edi
je 0x43ecb0
mov dword [esp], 0x80b0a0d
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ebx, 0x43
movzx esi, byte [esp + ebx - 0x43]
mov edx, esi
and edx, ebx
mov eax, edx
or al, 0xfd
inc al
mov ecx, edx
and cl, 0x4d
mul cl
mov ecx, eax
mov eax, esi
add cl, al
mov eax, edx
shr al, 1
and al, 1
or dl, 2
mul dl
add al, al
sub cl, al
movzx eax, cl
add eax, ebx
add al, 0xb1
mov byte [esp + ebx - 0x43], al
inc ebx
cmp ebx, 0x4a
jne 0x43ec40
mov eax, dword [esp]
mov ecx, dword [0x44f534]
test ecx, ecx
je 0x43ed2d
xor edx, edx
mov ebx, dword [0x44f538]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0xdef797a3
je 0x43ed10
inc edx
cmp ecx, edx
jne 0x43eca0
jmp 0x43ed2d
mov dword [esp], 0xc90a0b14
mov eax, 0x4a0111fc
mov ecx, 0x4a0111fc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x4a0111fc]
mov esi, eax
or esi, edx
lea edi, [esi + esi]
not edi
add edi, esi
and edx, eax
or edx, edi
mov esi, edx
and esi, 0x70
xor edx, 0xf0
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx - 0x4a0111fc], dl
inc ecx
dec eax
cmp ecx, 0x4a011200
jne 0x43ecd0
mov eax, dword [esp]
jmp 0x43ee52
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x43ed2d
push dword [ebp + 8]
push edi
push 2
push dword [0x44f53c]
push ecx
call fcn.00440f10
add esp, 0x14
cmp dword [ebp + 0xc], 1
mov ecx, dword [ebp + 0x10]
sbb ecx, 0
jl 0x43ee41
cmp eax, 0xc000010a
jne 0x43ee41
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
and ecx, 0x270f
mov edi, ebx
and edi, 0xffffd8f0
mov eax, edi
xor eax, 0xffffd8f0
mov esi, dword [ebp + 0x10]
not esi
imul esi, ecx
mul ecx
mov dword [esp + 0xc], eax
mov ecx, edx
add ecx, esi
or ebx, 0xffffd8f0
mov eax, ebx
mul edi
mov esi, dword [ebp + 0x10]
imul esi, ebx
add edx, esi
sub edx, edi
add eax, dword [esp + 0xc]
adc edx, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 8]
mov esi, dword [eax]
mov dword [esp], 0x80b0a0d
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov edi, 0x43
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edi - 0x43]
mov ecx, ebx
and ecx, edi
mov eax, ecx
or al, 0xfd
inc al
mov edx, ecx
and dl, 0x4d
mul dl
mov edx, eax
add dl, bl
mov eax, ecx
shr al, 1
and al, 1
or cl, 2
mul cl
add al, al
sub dl, al
movzx eax, dl
add eax, edi
add al, 0xb1
mov byte [esp + edi - 0x43], al
inc edi
cmp edi, 0x4a
jne 0x43edc0
mov eax, dword [esp]
mov ecx, dword [0x44f534]
test ecx, ecx
je 0x43ee41
xor edx, edx
mov edi, dword [0x44f538]
nop
cmp dword [edi + edx*8], 0x53f09cfa
je 0x43ee20
inc edx
cmp ecx, edx
jne 0x43ee10
jmp 0x43ee41
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43ee41
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 3
push dword [0x44f53c]
push ecx
call fcn.00440f10
add esp, 0x18
test eax, eax
js 0x43ee52
mov ecx, dword [esp + 8]
mov esi, eax
call fcn.0043eb40
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x440e80
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44d7c8]

Function at 0x441810
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
movzx eax, word [ebx]
mov dword [esp + 4], 0x514e9583
mov word [esp + 8], 0
mov ecx, 0xe366058d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x1c99fa77]
xor edx, ecx
lea esi, [edx + edx]
mov edi, esi
and edi, 0x7c
xor edx, 0x3e
add edx, edi
and esi, 2
xor edx, 1
add edx, esi
mov byte [esp + ecx + 0x1c99fa77], dl
inc ecx
cmp ecx, 0xe3660593
jne 0x441840
xor ecx, ecx
cmp dword [esp + 4], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44dbfc]