joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a8a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x448798]
Function at 0x43a960
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp], 0xc0c7c6c5
mov byte [esp + 4], 0
mov eax, 0x63e41a51
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x63e41a51]
xor ecx, eax
mov edx, ecx
not edx
and edx, 0x96
and ecx, 0x69
sub ecx, edx
inc cl
mov byte [esp + eax - 0x63e41a51], cl
inc eax
cmp eax, 0x63e41a56
jne 0x43a990
mov ebp, dword [esp]
mov eax, dword [0x44be30]
test eax, eax
je 0x43aa06
xor ecx, ecx
mov edx, dword [0x44be34]
nop
nop
cmp dword [edx + ecx*8], 0x61813e67
je 0x43a9e0
inc ecx
cmp eax, ecx
jne 0x43a9d0
jmp 0x43aa06
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebp
je 0x43aa06
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x44be38]
call fcn.0043c860
add esp, 0x1c
mov ebp, eax
mov dword [esp], 0xb372714c
mov eax, 0x15eec96c
mov ecx, 0x93
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x15eec96c]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
mov esi, edx
or esi, 0xe2
and edx, 0xe2
add edx, esi
add dl, 2
mov byte [esp + eax - 0x15eec96c], dl
inc eax
dec ecx
cmp eax, 0x15eec970
jne 0x43aa20
cmp ebp, dword [esp]
jne 0x43abb4
mov dword [esp + 0x10], edi
push dword [esp + 8]
call fcn.0043a800
add esp, 4
mov ebp, dword [esp + 8]
mov dword [esp], 0xc0c7c6c5
mov byte [esp + 4], 0
mov edx, 0x63e41a51
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx - 0x63e41a51]
xor ecx, edx
mov esi, ecx
not esi
and esi, 0x96
and ecx, 0x69
sub ecx, esi
inc cl
mov byte [esp + edx - 0x63e41a51], cl
inc edx
cmp edx, 0x63e41a56
jne 0x43aa90
mov edi, dword [esp]
mov edx, dword [0x44be30]
test edx, edx
je 0x43ab05
xor ecx, ecx
mov esi, dword [0x44be34]
cmp dword [esi + ecx*8], 0x61813e67
je 0x43aae0
inc ecx
cmp edx, ecx
jne 0x43aad0
jmp 0x43ab05
mov edx, dword [esi + ecx*8 + 4]
cmp edx, edi
je 0x43ab05
push 0
push ebp
push eax
push 5
push 0x10
push edx
push dword [0x44be38]
mov esi, eax
call fcn.0043c860
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
mov ebp, edi
js 0x43abab
mov dword [esp], 0xb3f2f32d
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0xac
mov esi, 0x53
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0xac]
mov edx, esi
xor edx, ecx
and edx, edi
xor edx, ecx
add dl, 0xa4
mov byte [esp + ecx - 0xac], dl
inc ecx
dec esi
cmp ecx, 0xb3
jne 0x43ab30
mov ecx, dword [esp]
mov dword [esp + 0xc], ecx
mov esi, dword [eax]
mov ecx, eax
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + ebp]
movzx edi, word [ebx + ebp]
test si, si
je 0x43ab85
add ebp, 2
cmp si, di
je 0x43ab70
cmp si, di
je 0x43ab96
mov esi, dword [ecx]
test esi, esi
jne 0x43ab60
mov ebp, dword [esp + 0xc]
jmp 0x43abab
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor ebp, ebp
push eax
call fcn.0043a8a0
add esp, 4
mov eax, ebp
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43abe0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43aca0
xor eax, eax
cmp dword [ecx], 0
jne 0x43ace0
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xc0c7c6c5
mov byte [esp + 4], 0
mov eax, 0x63e41a51
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x63e41a51]
xor ebx, eax
mov esi, ebx
not esi
and esi, 0x96
and ebx, 0x69
sub ebx, esi
inc bl
mov byte [esp + eax - 0x63e41a51], bl
inc eax
cmp eax, 0x63e41a56
jne 0x43ac50
mov eax, dword [esp]
mov esi, dword [0x44be30]
test esi, esi
je 0x43ace0
xor edi, edi
mov ebx, dword [0x44be34]
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43ace9
inc edi
cmp esi, edi
jne 0x43ac90
jmp 0x43ace0
mov dword [esp + 8], 0x33727178
mov byte [esp + 0xc], 0
lea eax, [esp + 8]
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
and bl, 0xf8
add bl, cl
xor bl, byte [eax]
xor bl, 0x14
add bl, 0x9c
mov byte [eax], bl
inc eax
add edx, 2
inc cl
cmp edx, 0xa
jne 0x43acc0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43ace0
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44be38]
call fcn.0043c860
add esp, 0x1c
jmp 0x43ace0

Function at 0x43ad10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43adba
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xc0c7c6c5
mov byte [esp + 4], 0
mov edx, 0x63e41a51
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx - 0x63e41a51]
xor ebx, edx
mov esi, ebx
not esi
and esi, 0x96
and ebx, 0x69
sub ebx, esi
inc bl
mov byte [esp + edx - 0x63e41a51], bl
inc edx
cmp edx, 0x63e41a56
jne 0x43ad40
mov edx, dword [0x44be30]
test edx, edx
je 0x43adae
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44be34]
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43ad90
inc edi
cmp edx, edi
jne 0x43ad80
jmp 0x43adae
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43adae
push eax
push 4
push edx
push dword [0x44be38]
mov esi, ecx
call fcn.0043c860
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43b070
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [ecx]
mov dword [esp], 0xc0c7c6c5
mov byte [esp + 4], 0
mov eax, 0x63e41a51
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x63e41a51]
xor edx, eax
mov esi, edx
not esi
and esi, 0x96
and edx, 0x69
sub edx, esi
inc dl
mov byte [esp + eax - 0x63e41a51], dl
inc eax
cmp eax, 0x63e41a56
jne 0x43b0a0
test ebx, ebx
jne 0x43b0d2
lea ebx, [esp + 8]
mov eax, dword [esp]
mov ebp, dword [0x44be30]
test ebp, ebp
je 0x43b124
xor edx, edx
mov esi, dword [0x44be34]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe6c7f7c6
je 0x43b100
inc edx
cmp ebp, edx
jne 0x43b0f0
jmp 0x43b124
mov ebp, dword [esi + edx*8 + 4]
cmp ebp, eax
je 0x43b124
push ebx
push edi
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
push 0x14
push ebp
push dword [0x44be38]
call fcn.0043c860
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43c790
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x448a6c]

Function at 0x43dfb0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 4], 0x939291a0
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov esi, 0x18c3d29c
mov edi, 0x673c2d63
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi - 0x18c3d298]
mov eax, edi
or eax, ebx
lea edx, [edi - 0x673c2d00]
and edx, ebx
xor edx, eax
and edx, esi
mov eax, edx
or al, 0xfd
inc al
mov ecx, edx
and cl, 0xbd
mul cl
mov ecx, eax
add cl, bl
mov eax, edx
shr al, 1
and al, 1
or dl, 2
mul dl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0xf4
mov byte [esp + esi - 0x18c3d298], al
inc esi
dec edi
cmp esi, 0x18c3d2a3
jne 0x43dfe0
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x2c], 0
sete cl
jmp dword [ecx*4 + 0x449480]
Function at 0x43e490
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [esp + 0x1c]
mov dword [esp], 0x797a7b54
mov word [esp + 4], 0
xor eax, eax
xor edx, edx
nop
nop
nop
movzx esi, byte [esp + edx]
mov edi, edx
xor edi, 0xab32043f
add edi, eax
xor edi, esi
mov ebx, edi
and ebx, 0x44
add ebx, ebx
xor edi, 0x3b
sub ebx, edi
mov byte [esp + edx], bl
inc edx
add eax, 2
cmp edx, 6
jne 0x43e4b0
mov edx, dword [esp]
jmp dword [0x4495a0]

Function at 0x43e580
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x48]
movzx eax, word [eax]
mov dword [esp], 0xf9fa1d0f
mov word [esp + 4], 0
xor ecx, ecx
nop
nop
mov edx, ecx
xor edx, 0xd4
mov esi, ecx
or esi, 0x2b
and edx, esi
add edx, esi
xor dl, byte [esp + ecx]
add dl, 0x29
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 6
jne case.default.0x43e5ca
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x4495e0]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 0x3c]
mov eax, dword [eax + ecx]
mov dword [esp], 0xe3e22430
mov edx, 0xc86abfa8
mov esi, 0x379540b7
nop
nop
nop
nop
movzx ebp, byte [esp + edx + 0x37954058]
mov edi, edx
and edi, ebp
add edi, edi
mov ebx, ebp
sub ebx, edi
add ebx, edx
add ebx, 0x20
sub edi, ebp
add edi, esi
and edi, 0x69
and ebx, 0x96
sub ebx, edi
inc bl
mov byte [esp + edx + 0x37954058], bl
inc edx
dec esi
cmp edx, 0xc86abfac
jne 0x43e5f0
xor edx, edx
cmp eax, dword [esp]
setne dl
xor eax, eax
jmp dword [edx*4 + 0x4495e8]
mov edx, dword [esp + 0x48]
mov esi, dword [edx + ecx + 0x7c]
mov edi, dword [edx + ecx + 0x78]
test esi, esi
sete cl
test edi, edi
sete dl
or dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x4495f0]
jmp dword [0x449600]
mov ecx, dword [case.0x43e5ca.0]
jmp ecx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43edc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43ede0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43edfb
mov eax, 0xffffffff
jmp 0x43edfe
add eax, 0xa
push eax
call fcn.004082d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x43ee41
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x43ee30
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
add ecx, edi
mov word [esp + 8], cx
mov edx, ecx
and edx, 2
xor ecx, 2
lea ecx, [ecx + edx*2]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x5c5d5e5f
mov dword [esp + 4], 0
mov ecx, 0x9659fb90
nop
nop
movzx edx, byte [esp + ecx + 0x69a60470]
xor edx, ecx
mov esi, edx
not esi
or esi, 0x103e162f
add esi, edx
inc esi
or edx, 0x103e162f
mov edi, esi
and edi, edx
xor edx, esi
lea edx, [edx + edi*2]
inc dl
mov byte [esp + ecx + 0x69a60470], dl
inc ecx
cmp ecx, 0x9659fb98
jne 0x43eec0
mov esi, dword [esp]
mov ecx, dword [0x44be30]
test ecx, ecx
je 0x43ef62
xor edx, edx
mov edi, dword [0x44be34]
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x43ef20
inc edx
cmp ecx, edx
jne 0x43ef10
jmp 0x43ef62
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43ef62
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44be38]
mov edi, eax
call fcn.0043c860
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.004082e0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ef80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43efa0
mov ebx, eax
sar ebx, 1
mov ecx, eax
and ecx, 8
xor ebx, 4
add ebx, ecx
and eax, 2
mov ecx, ebx
xor ecx, 1
add ecx, eax
jns 0x43efcc
mov ecx, 0xffffffff
jmp 0x43efce
add ecx, ecx
push ecx
call fcn.004082d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43f011
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43f000
mov word [ecx], 0
lea ecx, [ebx + ebx]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 2]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x5c5d5e5f
mov dword [esp + 4], 0
mov ecx, 0x9659fb90
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x69a60470]
xor edx, ecx
mov esi, edx
not esi
or esi, 0x103e162f
add esi, edx
inc esi
or edx, 0x103e162f
mov ebx, esi
and ebx, edx
xor edx, esi
lea edx, [edx + ebx*2]
inc dl
mov byte [esp + ecx + 0x69a60470], dl
inc ecx
cmp ecx, 0x9659fb98
jne 0x43f080
mov esi, dword [esp]
mov ecx, dword [0x44be30]
test ecx, ecx
je 0x43f111
xor edx, edx
mov ebx, dword [0x44be34]
nop
nop
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x43f0e0
inc edx
cmp ecx, edx
jne 0x43f0d0
jmp 0x43f111
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43f111
mov edx, esp
lea esi, [esp + 0x10]
push edi
push ebp
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44be38]
mov edi, eax
call fcn.0043c860
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.004082e0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43f150
mov ecx, eax
sar ecx, 1
and eax, 8
mov ebx, ecx
xor ebx, 4
add ebx, eax
and ecx, 1
mov eax, ebx
or eax, 1
add eax, ecx
jns 0x43f17c
mov eax, 0xffffffff
jmp 0x43f17e
add eax, eax
push eax
call fcn.004082d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43f1c1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43f1b0
mov word [ecx], 0
lea ecx, [ebx + ebx]
mov word [esp], cx
and ebx, 1
xor ecx, 2
lea ecx, [ecx + ebx*4]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x5c5d5e5f
mov dword [esp + 0x24], 0
mov ecx, 0x9659fb90
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x69a60490]
xor edx, ecx
mov esi, edx
not esi
or esi, 0x103e162f
add esi, edx
inc esi
or edx, 0x103e162f
mov ebx, esi
and ebx, edx
xor edx, esi
lea edx, [edx + ebx*2]
inc dl
mov byte [esp + ecx + 0x69a60490], dl
inc ecx
cmp ecx, 0x9659fb98
jne 0x43f230
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44be30]
test ecx, ecx
je 0x43f2b9
xor edx, edx
mov ebx, dword [0x44be34]
nop
nop
cmp dword [ebx + edx*8], 0x1ce638e1
je 0x43f290
inc edx
cmp ecx, edx
jne 0x43f280
jmp 0x43f2b9
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43f2b9
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x44be38]
mov ebx, eax
call fcn.0043c860
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.004082e0
add esp, 4
test edi, edi
je 0x43f2cc
mov eax, dword [esp + 0x40]
mov dword [edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x5c5d5e5f
mov dword [esp + 4], 0
mov eax, 0x9659fb90
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x69a60470]
xor ecx, eax
mov edx, ecx
not edx
or edx, 0x103e162f
add edx, ecx
inc edx
or ecx, 0x103e162f
mov ebx, edx
and ebx, ecx
xor ecx, edx
lea ecx, [ecx + ebx*2]
inc cl
mov byte [esp + eax + 0x69a60470], cl
inc eax
cmp eax, 0x9659fb98
jne 0x43f310
mov eax, dword [esp]
mov edx, dword [0x44be30]
test edx, edx
je 0x43f398
xor ebx, ebx
mov ecx, dword [0x44be34]
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x9c142cda
je 0x43f370
inc ebx
cmp edx, ebx
jne 0x43f360
jmp 0x43f398
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x43f398
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x44be38]
call fcn.0043c860
add esp, 0x20
test edi, edi
je 0x43f3a2
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x43f3ae
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f3c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0x5c5d5e5f
mov dword [esp + 4], 0
mov eax, 0x9659fb90
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x69a60470]
xor edi, eax
mov ebx, edi
not ebx
or ebx, 0x103e162f
add ebx, edi
inc ebx
or edi, 0x103e162f
mov ebp, ebx
and ebp, edi
xor edi, ebx
lea ebx, [edi + ebp*2]
inc bl
mov byte [esp + eax + 0x69a60470], bl
inc eax
cmp eax, 0x9659fb98
jne 0x43f3f0
mov eax, dword [esp]
mov ebx, dword [0x44be30]
test ebx, ebx
je 0x43f47e
xor ebp, ebp
mov edi, dword [0x44be34]
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0x5b126fe8
je 0x43f450
inc ebp
cmp ebx, ebp
jne 0x43f440
jmp 0x43f47e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43f47e
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44be38]
call fcn.0043c860
add esp, 0x30
cmp eax, 0x103
jne 0x43f529
mov dword [esp], 0x5c5d5e5f
mov dword [esp + 4], 0
mov eax, 0x9659fb90
nop
nop
nop
movzx ecx, byte [esp + eax + 0x69a60470]
xor ecx, eax
mov edx, ecx
not edx
or edx, 0x103e162f
add edx, ecx
inc edx
or ecx, 0x103e162f
mov edi, edx
and edi, ecx
xor ecx, edx
lea ecx, [ecx + edi*2]
inc cl
mov byte [esp + eax + 0x69a60470], cl
inc eax
cmp eax, 0x9659fb98
jne 0x43f4a0
mov eax, dword [esp]
mov ecx, dword [0x44be30]
test ecx, ecx
je 0x43f521
xor edx, edx
mov edi, dword [0x44be34]
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x43f500
inc edx
cmp ecx, edx
jne 0x43f4f0
jmp 0x43f521
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43f521
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44be38]
call fcn.0043c860
add esp, 0x18
test eax, eax
js 0x43f529
mov eax, dword [esp + 8]
test esi, esi
je 0x43f53c
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43f53a
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f550
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0x5c5d5e5f
mov dword [esp + 4], 0
mov eax, 0x9659fb90
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x69a60470]
xor edi, eax
mov ebx, edi
not ebx
or ebx, 0x103e162f
add ebx, edi
inc ebx
or edi, 0x103e162f
mov ebp, ebx
and ebp, edi
xor edi, ebx
lea ebx, [edi + ebp*2]
inc bl
mov byte [esp + eax + 0x69a60470], bl
inc eax
cmp eax, 0x9659fb98
jne 0x43f580
mov eax, dword [esp]
mov ebx, dword [0x44be30]
test ebx, ebx
je 0x43f60e
xor ebp, ebp
mov edi, dword [0x44be34]
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xa2545bf7
je 0x43f5e0
inc ebp
cmp ebx, ebp
jne 0x43f5d0
jmp 0x43f60e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43f60e
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44be38]
call fcn.0043c860
add esp, 0x30
cmp eax, 0x103
jne 0x43f6b9
mov dword [esp], 0x5c5d5e5f
mov dword [esp + 4], 0
mov eax, 0x9659fb90
nop
nop
nop
movzx ecx, byte [esp + eax + 0x69a60470]
xor ecx, eax
mov edx, ecx
not edx
or edx, 0x103e162f
add edx, ecx
inc edx
or ecx, 0x103e162f
mov edi, edx
and edi, ecx
xor ecx, edx
lea ecx, [ecx + edi*2]
inc cl
mov byte [esp + eax + 0x69a60470], cl
inc eax
cmp eax, 0x9659fb98
jne 0x43f630
mov eax, dword [esp]
mov ecx, dword [0x44be30]
test ecx, ecx
je 0x43f6b1
xor edx, edx
mov edi, dword [0x44be34]
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x43f690
inc edx
cmp ecx, edx
jne 0x43f680
jmp 0x43f6b1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43f6b1
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44be38]
call fcn.0043c860
add esp, 0x18
test eax, eax
js 0x43f6b9
mov eax, dword [esp + 8]
test esi, esi
je 0x43f6c3
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f6d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
xor ebx, ebx
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x43f6f0
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 8], bx
add ebx, 2
mov word [esp + 0xa], bx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x5c5d5e5f
mov dword [esp + 4], 0
mov eax, 0x9659fb90
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x69a60470]
xor edi, eax
mov ebx, edi
not ebx
or ebx, 0x103e162f
add ebx, edi
inc ebx
or edi, 0x103e162f
mov ebp, ebx
and ebp, edi
xor edi, ebx
lea ebx, [edi + ebp*2]
inc bl
mov byte [esp + eax + 0x69a60470], bl
inc eax
cmp eax, 0x9659fb98
jne 0x43f760
mov eax, dword [esp]
mov edi, dword [0x44be30]
test edi, edi
je 0x43f7e2
xor ebx, ebx
mov ebp, dword [0x44be34]
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x40915fe0
je 0x43f7c1
inc ebx
cmp edi, ebx
jne 0x43f7b0
jmp 0x43f7e2
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43f7e2
lea eax, [esp + 0x10]
push esi
push eax
push edx
push ecx
push 0x10
push edi
push dword [0x44be38]
call fcn.0043c860
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret