joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4195a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x4195c0
sar esi, 1
lea ecx, [esp + 0x6c]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44f268]
mov dword [esp + 0x128], 0x599a9bb1
mov byte [esp + 0x12c], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, edx
xor edi, 0x65
mov ebx, ecx
and ebx, 4
sub ebx, edi
xor bl, byte [esp + edx + 0x128]
add bl, 0xf9
mov byte [esp + edx + 0x128], bl
inc edx
add ecx, 2
cmp edx, 5
jne case.default.0x419634
xor ecx, ecx
cmp eax, dword [esp + 0x128]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x448adc]
mov ebx, dword [esp + 0x6c]
test ebx, ebx
jns 0x41964a
mov eax, 0xffffffff
jmp 0x41964d
lea eax, [ebx + ebx]
push eax
call fcn.004083e0
add esp, 4
lea ecx, [esp + 0x6c]
push ecx
push ebx
mov dword [esp + 0x24], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44f268]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448ae4]
xor eax, eax
jmp dword [0x448aec]
push dword [esp + 0x1c]
call fcn.004083f0
add esp, 4
xor eax, eax
jmp case.0x419634.0
mov eax, dword [esp + 0x6c]
mov ecx, eax
add ecx, 0xd
jns 0x4196a9
mov eax, 0xffffffff
jmp 0x4196b0
lea eax, [eax*2 + 0x1a]
push eax
call fcn.004083e0
add esp, 4
mov esi, eax
mov dword [esp + 0x128], 0x17e219fc
mov dword [esp + 0x12c], 0x139d15f5
mov dword [esp + 0x130], 0xf2e119c
mov dword [esp + 0x134], 0xb970de6
mov dword [esp + 0x138], 0x7890986
mov dword [esp + 0x13c], 0x391059d
mov dword [esp + 0x140], 0x3f3e0192
mov dword [esp + 0x144], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
and edi, 0xc
mov edx, ecx
xor edx, 0xc6
add edx, edi
xor dl, byte [esp + ecx + 0x128]
add dl, 0x22
mov byte [esp + ecx + 0x128], dl
inc ecx
add eax, 2
cmp ecx, 0x20
jne 0x419720
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x419771
mov eax, dword [esp + 0x1c]
lea edx, [eax + 2]
mov eax, esi
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419760
mov word [eax], 0
movzx ecx, word [esp + 0x128]
test cx, cx
je 0x4197a1
lea edx, [esp + 0x12a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419790
mov word [eax], 0
lea eax, [esp + 0x2b8]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00442370
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448af4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41963b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x4195c0
sar esi, 1
lea ecx, [esp + 0x6c]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44f268]
mov dword [esp + 0x128], 0x599a9bb1
mov byte [esp + 0x12c], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, edx
xor edi, 0x65
mov ebx, ecx
and ebx, 4
sub ebx, edi
xor bl, byte [esp + edx + 0x128]
add bl, 0xf9
mov byte [esp + edx + 0x128], bl
inc edx
add ecx, 2
cmp edx, 5
jne case.default.0x419634
xor ecx, ecx
cmp eax, dword [esp + 0x128]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x448adc]
mov ebx, dword [esp + 0x6c]
test ebx, ebx
jns 0x41964a
mov eax, 0xffffffff
jmp 0x41964d
lea eax, [ebx + ebx]
push eax
call fcn.004083e0
add esp, 4
lea ecx, [esp + 0x6c]
push ecx
push ebx
mov dword [esp + 0x24], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44f268]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448ae4]
xor eax, eax
jmp dword [0x448aec]
push dword [esp + 0x1c]
call fcn.004083f0
add esp, 4
xor eax, eax
jmp case.0x419634.0
mov eax, dword [esp + 0x6c]
mov ecx, eax
add ecx, 0xd
jns 0x4196a9
mov eax, 0xffffffff
jmp 0x4196b0
lea eax, [eax*2 + 0x1a]
push eax
call fcn.004083e0
add esp, 4
mov esi, eax
mov dword [esp + 0x128], 0x17e219fc
mov dword [esp + 0x12c], 0x139d15f5
mov dword [esp + 0x130], 0xf2e119c
mov dword [esp + 0x134], 0xb970de6
mov dword [esp + 0x138], 0x7890986
mov dword [esp + 0x13c], 0x391059d
mov dword [esp + 0x140], 0x3f3e0192
mov dword [esp + 0x144], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
and edi, 0xc
mov edx, ecx
xor edx, 0xc6
add edx, edi
xor dl, byte [esp + ecx + 0x128]
add dl, 0x22
mov byte [esp + ecx + 0x128], dl
inc ecx
add eax, 2
cmp ecx, 0x20
jne 0x419720
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x419771
mov eax, dword [esp + 0x1c]
lea edx, [eax + 2]
mov eax, esi
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419760
mov word [eax], 0
movzx ecx, word [esp + 0x128]
test cx, cx
je 0x4197a1
lea edx, [esp + 0x12a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419790
mov word [eax], 0
lea eax, [esp + 0x2b8]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00442370
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448af4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41da40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x190
mov dword [esp + 8], 0x893c8bfd
mov dword [esp + 0xc], 0x85378705
mov dword [esp + 0x10], 0x81828336
mov eax, 0x58453a23
mov ecx, 0xa7bac5dc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x58453a1b]
mov esi, ecx
and esi, 0x8408c158
mov edi, eax
and edi, 0x58400227
or edi, esi
xor edi, edx
xor edi, 0x58
lea ebx, [eax - 0x58453a00]
and ebx, edx
or ebx, edi
and edx, eax
sub ebx, edx
add bl, 0x51
mov byte [esp + eax - 0x58453a1b], bl
inc eax
dec ecx
cmp eax, 0x58453a2f
jne 0x41da80
mov dword [esp + 0x30], 0x33be31a8
mov dword [esp + 0x34], 0x2fbe2da0
mov dword [esp + 0x38], 0x2bfd29e2
mov dword [esp + 0x3c], 0x27b225f3
mov dword [esp + 0x40], 0x238121b7
mov dword [esp + 0x44], 0x1f8a1dbd
mov dword [esp + 0x48], 0x1b8d1980
mov dword [esp + 0x4c], 0x179a1587
mov dword [esp + 0x50], 0x131211da
mov byte [esp + 0x54], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x30]
mov edi, eax
and edi, 0x18
mov edx, ecx
xor edx, 0x63ab09cc
add edx, edi
xor edx, esi
neg edx
mov esi, edx
and esi, 0x7d
add esi, esi
xor edx, 2
sub edx, esi
add dl, 2
mov byte [esp + ecx + 0x30], dl
inc ecx
add eax, 2
cmp ecx, 0x25
jne 0x41db20
movzx ecx, word [esp + 0x30]
lea eax, [esp + 0x14c]
test cx, cx
je 0x41db83
lea edx, [esp + 0x32]
mov esi, dword [ebp + 0x10]
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41db70
jmp 0x41db86
mov esi, dword [ebp + 0x10]
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x41dbb1
lea edx, [esi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41dba0
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x41dbe1
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41dbd0
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
mov dword [esp + 0x30], 0x1b141c76
mov byte [esp + 0x34], 0x7c
mov dword [esp + 0x35], 0
mov byte [esp + 0x39], 0
mov eax, 0x48eed457
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x48eed427]
lea edx, [eax - 0x48eed3ed]
and edx, ecx
lea esi, [eax + ecx]
add edx, edx
sub ecx, edx
add ecx, eax
and esi, 1
or ecx, 1
add ecx, esi
mov byte [esp + eax - 0x48eed427], cl
inc eax
cmp eax, 0x48eed461
jne 0x41dc10
movzx eax, byte [esp + 0x30]
test al, al
je 0x41dc5b
lea ecx, [esp + 0x31]
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41dc50
mov byte [edi], 0
lea eax, [esp + 0x134]
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x14c]
push eax
push ecx
push edx
call fcn.0040b280
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x448e1c]
mov ecx, 0x4187179e
xor ecx, dword [0x448e24]
add eax, ecx
inc eax
jmp eax
Function at 0x422110
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
mov edi, 0xfffffffe
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x422120
sar edi, 1
lea eax, [esp + 8]
push eax
push 0
push 0
push edi
push ebx
push 0
call dword [0x44f268]
mov dword [esp + 0xc], 0xd99a9bb1
mov word [esp + 0x10], 0
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, esi
and edx, 1
mov ecx, esi
and ecx, 2
mov ebp, ecx
xor ebp, 2
imul ebp, edx
or edx, 2
imul edx, ecx
mov ecx, esi
xor ecx, 0xdb
add ecx, ebp
add ecx, edx
xor cl, byte [esp + esi + 0xc]
add cl, 0xb9
mov byte [esp + esi + 0xc], cl
inc esi
cmp esi, 6
jne case.default.0x42219e
xor ecx, ecx
cmp eax, dword [esp + 0xc]
setne cl
jmp dword [ecx*4 + 0x4491a8]
mov ebp, dword [esp + 8]
test ebp, ebp
jns 0x4221c2
mov eax, 0xffffffff
jmp 0x4221c9
mov eax, dword [case.0x42219e.4]
xor ebx, ebx
nop
nop
nop
nop
nop
jmp eax
lea eax, [ebp*2]
push eax
call fcn.004083e0
add esp, 4
mov esi, eax
lea eax, [esp + 8]
push eax
push ebp
push esi
push edi
push ebx
push 0
call dword [0x44f268]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4491c0]
xor ebx, ebx
jmp dword [0x4491c8]
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4242b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4242c0
cmp eax, 0xffffffed
jge 0x4242d7
mov eax, 0xffffffff
jmp 0x4242da
add eax, 0x12
push eax
call fcn.004083e0
add esp, 4
mov esi, eax
mov dword [esp], 0x1781197c
mov dword [esp + 4], 0x139b1589
mov dword [esp + 8], 0xf5c115c
mov dword [esp + 0xc], 0xb940d90
mov word [esp + 0x10], 0x908
mov dword [esp + 0x12], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 6
xor cl, byte [esp + eax]
add cl, 0xe2
mov byte [esp + eax], cl
inc eax
cmp eax, 0x16
jne 0x424320
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x424361
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x424350
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x424391
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424380
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00442530
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x4492f8]
Function at 0x426c6d
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp], 0x23e321c5
mov dword [esp + 4], 0x27962594
mov dword [esp + 8], 0x3b9b39fc
mov dword [esp + 0xc], 0x3f9f3d88
mov dword [esp + 0x10], 0x339e31d5
mov dword [esp + 0x14], 0x378e35e0
mov dword [esp + 0x18], 0xbb409bd
mov dword [esp + 0x1c], 0xfab0da8
mov dword [esp + 0x20], 0x3a001b2
mov dword [esp + 0x24], 0x7b405bd
mov dword [esp + 0x28], 0x1bb619bc
mov dword [esp + 0x2c], 0x1fac1dcc
mov dword [esp + 0x30], 0x13b411af
mov dword [esp + 0x34], 0x17aa15ad
mov dword [esp + 0x38], 0xeb59e94d
lea eax, [esp + 0x3c]
mov word [esp + 0x3c], 0xedec
mov dword [esp + 0x3e], 0
mov word [esp + 0x42], 0
mov ecx, 0xb7a34648
movzx edx, byte [esp + ecx + 0x485cb9b8]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0x98
mov byte [esp + ecx + 0x485cb9b8], dl
inc ecx
cmp ecx, 0xb7a3468c
jne 0x426c70
lea esi, [esp + 0x4a]
mov edx, esp
mov ecx, 0xf
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea ebp, [esp + 0x44]
push ebp
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x44f268]
mov dword [esp], 0x77363907
mov ecx, 0x27334376
mov edx, 0x89
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x27334376]
mov edi, edx
and edi, ebx
not ebx
and ebx, ecx
or edi, ebx
xor edi, 0x4f
and ebx, 0x30
add ebx, ebx
sub ebx, edi
inc bl
mov byte [esp + ecx - 0x27334376], bl
inc ecx
dec edx
cmp ecx, 0x2733437a
jne 0x426cf0
xor ecx, ecx
cmp eax, dword [esp]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x44986c]
Function at 0x42be9a
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xb8
mov dword [esp + 0x28], 0xd99ddbff
mov dword [esp + 0x2c], 0xddaedfa8
mov dword [esp + 0x30], 0xd1b5d398
mov dword [esp + 0x34], 0xd5b1d7a4
mov dword [esp + 0x38], 0xe986ebef
mov dword [esp + 0x3c], 0xed9fefba
mov dword [esp + 0x40], 0xe199e398
mov dword [esp + 0x44], 0xe581e790
mov dword [esp + 0x48], 0xf9c7fb80
mov dword [esp + 0x4c], 0xfd92ffc5
mov dword [esp + 0x50], 0xf189f389
mov dword [esp + 0x54], 0xf583f785
mov dword [esp + 0x58], 0x97b0b8b
mov dword [esp + 0x5c], 0xd3c0f7a
mov dword [esp + 0x60], 0x1710384
mov dword [esp + 0x64], 0x506077c
lea eax, [esp + 0x68]
mov dword [esp], eax
mov byte [esp + 0x68], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x28]
mov edx, ecx
and edx, 0x4f
mov edi, ecx
and edi, 0x30
xor edi, 0xd2c48531
sub edx, edi
mov edi, edx
and edi, esi
mov ebx, edi
and ebx, 2
mov ebp, edi
or ebp, 0xfd
inc ebp
mov eax, edi
and eax, 0xfffffffd
imul eax, ebp
or edi, 2
imul edi, ebx
sub eax, edi
add edx, esi
add edx, eax
add dl, 0xf5
mov byte [esp + ecx + 0x28], dl
inc ecx
cmp ecx, 0x41
jne 0x42bf30
lea edx, [esp + 0x78]
lea eax, [esp + 0x28]
mov ecx, 0x10
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xb8]
xor ecx, ecx
mov eax, dword [esp]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x1f
push edx
push 0
call dword [0x44f268]
mov dword [esp + 0x28], 0x91cecf29
mov word [esp + 0x2c], 0
mov byte [esp + 0x2e], 0
mov ecx, 0xef607bad
mov ebp, 0x109f8452
movzx ebx, byte [esp + ecx + 0x109f847b]
mov edi, ebx
and edi, ecx
mov edx, edi
and edx, 2
mov esi, edi
or edi, 2
imul edi, edx
xor edx, 2
and esi, 0xffffffbd
imul esi, edx
add edi, esi
mov edx, edi
xor edx, ecx
and edi, ebp
add edi, edi
sub edx, edi
add dl, bl
add dl, 0x9f
mov byte [esp + ecx + 0x109f847b], dl
inc ecx
dec ebp
cmp ecx, 0xef607bb4
jne 0x42bfd0
xor ecx, ecx
cmp eax, dword [esp + 0x28]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x44a308]
Function at 0x42c940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x20
mov esi, esp
mov edi, dword [ebp + 8]
test edi, edi
je 0x42ca8a
mov dword [esi + 4], ecx
movzx edx, byte [edi]
test dl, dl
je 0x42c98b
xor ecx, ecx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
cmp dl, 0x2f
je 0x42c993
movzx edx, byte [edi + ebx + 1]
inc ebx
add ecx, 2
test dl, dl
jne 0x42c970
xor ebx, ebx
jmp 0x42ca25
mov ecx, dword [esi + 4]
jmp 0x42ca8a
mov byte [esi + 3], al
and ecx, 2
mov eax, ebx
xor eax, 1
add eax, ecx
add eax, 3
and eax, 0xfffffffc
call fcn.004082c0
mov edx, esp
and edx, 0xfffffff0
mov esp, edx
mov ecx, ebx
shr ecx, 2
mov eax, edi
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, ebx
and eax, 0xfffffffc
mov ecx, dword [ebp + 8]
lea edi, [ecx + eax]
mov dword [esi + 0xc], edx
add eax, edx
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov edx, ebx
mov dword [esi + 8], edi
mov ebx, edi
mov edi, eax
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov ebx, edx
mov ecx, edx
and ecx, 2
or eax, ecx
test bl, 1
je 0x42c9fe
mov edx, dword [esi + 8]
movzx ecx, byte [edx + ecx]
mov byte [eax], cl
inc eax
mov edx, dword [ebp + 8]
add ebx, edx
mov byte [eax], 0
mov ecx, 0xffffffff
mov edi, dword [esi + 0xc]
nop
nop
cmp byte [edx + ecx + 1], 0
lea ecx, [ecx + 1]
jne 0x42ca10
cmp ecx, 2
movzx eax, byte [esi + 3]
jae 0x42ca25
mov edi, edx
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x42ca88
mov byte [esi + 3], al
mov dword [esi + 0xc], edi
mov dword [esi + 8], ebx
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esi + 4], ecx
mov eax, dword [ecx]
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx ebx, byte [eax + edi]
lea edx, [ebx - 0x41]
cmp edx, 0x1a
jae 0x42ca5f
or ebx, 0x20
mov ecx, dword [esi + 0xc]
movsx edx, byte [ecx + edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x1a
jae 0x42ca71
or edx, 0x20
test ebx, ebx
je 0x42ca7a
inc edi
cmp ebx, edx
je 0x42ca50
cmp ebx, edx
je 0x42ca96
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 4]
test ecx, ecx
jne 0x42ca40
xor ecx, ecx
mov eax, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
cmp byte [esi + 3], 0x2f
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
jne 0x42ca8a
inc eax
push eax
call fcn.0042c940
mov ecx, eax
jmp 0x42ca8a
Function at 0x43a650
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x43a670
mov dword [esp], 0x323230c3
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor esi, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edi]
mov ecx, esi
and ecx, 8
mov ebp, edi
xor ebp, 0x9e9ca8c
add ebp, ecx
mov ecx, ebp
and ecx, ebx
add ecx, ecx
sub ecx, ebp
mov ebp, ebx
not ebp
and ebp, ecx
not ecx
and ecx, ebx
sub ecx, ebp
add cl, 0x44
mov byte [esp + edi], cl
inc edi
add esi, 2
cmp edi, 7
jne 0x43a6a0
test edx, edx
je 0x43a74e
mov esi, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x43a708
mov ebp, eax
mov ecx, dword [esp + 0x1c]
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x43a6f0
cmp edi, 3
jae 0x43a711
jmp 0x43a74e
mov ecx, dword [esp + 0x1c]
cmp edi, 3
jb 0x43a74e
mov ebx, ecx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edi*2]
xor ecx, eax
imul ecx, esi
movzx eax, word [ebx + edi*2 + 2]
xor eax, ecx
imul eax, esi
movzx ecx, word [ebx + edi*2 + 4]
xor ecx, eax
imul ecx, esi
movzx eax, word [ebx + edi*2 + 6]
xor eax, ecx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x43a720
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b0a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x44]
call fcn.00442370
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b7d4]

Function at 0x43b350
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00442b00
add esp, 0x14
test eax, eax
js 0x43b496
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00442f40
add esp, 0x24
xor esi, esi
test eax, eax
js 0x43b3e7
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x43b3b3
mov eax, 0xffffffff
jmp 0x43b3ba
lea eax, [eax*2 + 2]
push eax
call fcn.004083e0
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00443580
add esp, 0x14
test eax, eax
js 0x43b3de
mov esi, edi
jmp 0x43b3e7
push edi
call fcn.004083f0
add esp, 4
mov eax, dword [esp]
mov dword [esp + 4], 0xc0d0a0b
mov word [esp + 8], 0
mov ecx, 0x876a5882
nop
nop
movzx edx, byte [esp + ecx + 0x7895a782]
xor edx, ecx
lea edi, [edx + 0x5aec4575]
mov ebx, edi
and ebx, 1
and edi, 0xfe
and edx, 1
or edx, edi
lea edx, [edx + ebx*2]
mov byte [esp + ecx + 0x7895a782], dl
inc ecx
cmp ecx, 0x876a5888
jne 0x43b400
mov ecx, dword [0x44f26c]
test ecx, ecx
je 0x43b47a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44f270]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43b460
inc edi
cmp ecx, edi
jne 0x43b450
jmp 0x43b47a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43b47a
push eax
push 4
push ecx
push dword [0x44f274]
call fcn.0043fac0
add esp, 0x10
test esi, esi
jne 0x43b498
lea eax, [esp + 4]
push eax
call fcn.00442160
add esp, 4
test al, al
je 0x43b496
cmp dword [esp + 4], 1
je 0x43b498
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d1b0
Capabilities:
Encode data using xor

Disassembly:
push esi
push eax
mov eax, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44bb34]
Function at 0x43d500
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43d5e0
xor eax, eax
cmp dword [ecx], 0
jne 0x43d61a
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xf0fffefd
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi]
mov ebp, eax
and ebp, 0xa
mov ebx, esi
xor ebx, 0xf04e77d5
add ebx, ebp
xor ebx, edi
mov edi, ebx
and edi, 1
or ebx, 1
add ebx, edi
add bl, 0xd6
mov byte [esp + esi], bl
inc esi
add eax, 2
cmp esi, 7
jne 0x43d580
mov eax, dword [esp]
mov esi, dword [0x44f26c]
test esi, esi
je 0x43d61a
xor edi, edi
mov ebx, dword [0x44f270]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43d624
inc edi
cmp esi, edi
jne 0x43d5d0
jmp 0x43d61a
mov dword [esp + 8], 0x1c6c7cc
mov word [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x51
xor cl, byte [esp + eax + 8]
add cl, 0x6b
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 6
jne 0x43d600
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43d61a
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44f274]
call fcn.0043fac0
add esp, 0x1c
jmp 0x43d61a

Function at 0x43d650
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43d70b
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xf0fffefd
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi]
mov ebp, edx
and ebp, 0xa
mov ebx, esi
xor ebx, 0xf04e77d5
add ebx, ebp
xor ebx, edi
mov edi, ebx
and edi, 1
or ebx, 1
add ebx, edi
add bl, 0xd6
mov byte [esp + esi], bl
inc esi
add edx, 2
cmp esi, 7
jne 0x43d680
mov edx, dword [0x44f26c]
test edx, edx
je 0x43d6fe
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44f270]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43d6e0
inc edi
cmp edx, edi
jne 0x43d6d0
jmp 0x43d6fe
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43d6fe
push eax
push 4
push edx
push dword [0x44f274]
mov esi, ecx
call fcn.0043fac0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret