joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432390
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ecx + 4]
test edx, edx
je 0x4323a1
xor eax, eax
cmp dword [ecx], 0
je 0x4323a9
ret 4
mov eax, 0xc0000008
ret 4
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], edx
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 8], 0xead5d4d7
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x432459
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov esi, 0x62
sub esi, eax
add eax, 0x8f1efc9d
xor esi, eax
and esi, edx
xor esi, eax
mov dword [esp + 4], esi
mov eax, dword [esp + 4]
add al, 0xb5
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x432420
mov eax, dword [esp + 8]
mov esi, dword [0x44132c]
test esi, esi
je 0x4324b5
mov edx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x441330]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xcde6ec36
je 0x432490
inc edi
cmp esi, edi
jne 0x432480
jmp 0x4324b5
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x4324b5
lea eax, [esp + 0x1c]
lea edi, [esp + 0x24]
push eax
push edi
push edx
push ecx
push 4
push dword [0x441334]
push esi
call fcn.00433920
add esp, 0x1c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4324c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x4325a2
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 8], 0xead5d4d7
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 0xb
ja 0x43253b
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 8]
mov edi, 0x62
sub edi, edx
add edx, 0x8f1efc9d
xor edi, edx
and edi, esi
xor edi, edx
mov dword [esp + 4], edi
mov edx, dword [esp + 4]
add dl, 0xb5
mov esi, dword [esp]
mov byte [esp + esi + 8], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 0xc
jb 0x432500
mov edx, dword [0x44132c]
test edx, edx
je 0x43258e
mov esi, dword [esp + 8]
xor edi, edi
mov ebx, dword [0x441330]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xa3c1f363
je 0x432570
inc edi
cmp edx, edi
jne 0x432560
jmp 0x43258e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43258e
push eax
push 1
push dword [0x441334]
push edx
mov esi, ecx
call fcn.00433920
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
mov dword [ecx + 4], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4325b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov eax, 0xc0000008
mov dword [esp + 0xc], ecx
cmp dword [ecx + 4], 0
je 0x4327e2
mov ecx, dword [esp + 0xc]
mov ecx, dword [ecx]
test ecx, ecx
je 0x4327e2
mov dword [esp + 0x10], 0xead5d4d7
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xb
ja 0x43264e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
mov esi, 0x62
sub esi, eax
add eax, 0x8f1efc9d
xor esi, eax
and esi, edx
xor esi, eax
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x20]
add al, 0xb5
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xc
jb 0x432610
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
mov edi, dword [0x44132c]
test edi, edi
je 0x4326a3
xor esi, esi
mov edx, dword [0x441330]
nop
nop
nop
nop
nop
nop
cmp dword [edx + esi*8], 0x45a3f4b9
je 0x432683
inc esi
cmp edi, esi
jne 0x432670
mov esi, dword [ebp + 0x10]
jmp 0x4326a3
mov edx, dword [edx + esi*8 + 4]
cmp edx, eax
mov esi, dword [ebp + 0x10]
je 0x4326a3
push dword [ebp + 8]
push ecx
push 2
push dword [0x441334]
push edx
call fcn.00433920
add esp, 0x14
cmp ebx, 1
mov ecx, esi
sbb ecx, 0
jl 0x4327d1
cmp eax, 0xc000010a
jne 0x4327d1
mov edi, esi
mov esi, ebx
and esi, 0xffffd8f0
mov eax, esi
xor eax, 0xffffd8f0
mov ecx, edi
not ecx
mov edx, ebx
and edx, 0x270f
imul ecx, edx
mul edx
mov dword [esp + 0x28], eax
add edx, ecx
mov ecx, edx
or ebx, 0xffffd8f0
imul edi, ebx
mov eax, ebx
mul esi
add edx, edi
sub edx, esi
add eax, dword [esp + 0x28]
adc edx, ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
mov dword [esp + 0x10], 0xead5d4d7
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0xb
ja 0x43277e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
mov esi, 0x62
sub esi, eax
add eax, 0x8f1efc9d
xor esi, eax
and esi, ecx
xor esi, eax
mov dword [esp + 4], esi
mov eax, dword [esp + 4]
add al, 0xb5
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0xc
jb 0x432740
mov eax, dword [esp + 0x10]
mov esi, dword [0x44132c]
test esi, esi
je 0x4327d1
xor edi, edi
mov ecx, dword [0x441330]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + edi*8], 0x39c83604
je 0x4327b0
inc edi
cmp esi, edi
jne 0x4327a0
jmp 0x4327d1
mov ecx, dword [ecx + edi*8 + 4]
cmp ecx, eax
je 0x4327d1
lea eax, [esp + 0x20]
push eax
push 0
push edx
push 3
push dword [0x441334]
push ecx
call fcn.00433920
add esp, 0x18
test eax, eax
js 0x4327e2
mov ecx, dword [esp + 0xc]
mov esi, eax
call fcn.004324c0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4327f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edx, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], 0xead5d4d7
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
test edx, edx
jne 0x432821
lea edx, [esp + 0x18]
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x432869
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 8]
mov edi, 0x62
sub edi, eax
add eax, 0x8f1efc9d
xor edi, eax
and edi, esi
xor edi, eax
mov dword [esp + 4], edi
mov eax, dword [esp + 4]
add al, 0xb5
mov esi, dword [esp]
mov byte [esp + esi + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x432830
mov eax, dword [esp + 8]
mov esi, dword [0x44132c]
test esi, esi
je 0x4328b4
xor edi, edi
mov ebx, dword [0x441330]
nop
cmp dword [ebx + edi*8], 0xaead8b9f
je 0x432890
inc edi
cmp esi, edi
jne 0x432880
jmp 0x4328b4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x4328b4
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
push 5
push dword [0x441334]
push esi
call fcn.00433920
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x433840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x43f50c]
Function at 0x434f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ecx, dword [ebp + 8]
mov dword [esp + 8], 0x3b383966
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xf
ja 0x434fd9
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov esi, pe_nt_image_headers32
sub esi, eax
add eax, 0xf2a8c87
xor esi, eax
and esi, edx
xor esi, eax
mov dword [esp + 4], esi
mov eax, dword [esp + 4]
add al, 0x4f
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x10
jb 0x434fa0
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x43fdb4]
mov ecx, dword [eax + 8]
mov edx, dword [case.0x434fe7.0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [case.0x434fe7.12]
mov edi, dword [edx]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x43fdcc]
mov ebx, 1
jmp dword [ebx*4 + 0x43fdec]
mov edi, dword [edi]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x43fdcc]
xor ebx, ebx
cmp dword [edi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x43fdd4]
jmp esi
mov eax, dword [edi + 0x30]
xor ebx, ebx
jmp dword [ebx*4 + 0x43fdec]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov edi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x435aa0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x435abb
mov eax, 0xffffffff
jmp 0x435abe
add eax, 0xa
push eax
call fcn.004090a0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x435b01
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x435af0
mov word [edx], 0
mov edi, 3
sub edi, esi
and edi, 2
mov edx, ecx
and edx, 0xfffd
imul edx, edi
and esi, 2
or ecx, 2
imul ecx, esi
lea esi, [ecx + edx]
mov word [esp + 0x18], si
add ecx, edx
add ecx, 2
mov word [esp + 0x1a], cx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 8], 0x62656467
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0xc
ja 0x435be0
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
mov esi, 0xee
sub esi, ecx
add ecx, 0x9c90311
xor esi, ecx
and esi, edx
xor esi, ecx
mov dword [esp + 0x20], esi
mov ecx, dword [esp + 0x20]
add cl, 0x89
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0xd
jb 0x435ba0
mov esi, dword [esp + 8]
mov ecx, dword [0x44132c]
test ecx, ecx
je 0x435c51
xor edx, edx
mov edi, dword [0x441330]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xbc8a835b
je 0x435c10
inc edx
cmp ecx, edx
jne 0x435c00
jmp 0x435c51
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x435c51
lea edx, [esp + 8]
lea esi, [esp + 0x24]
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push 0
push edx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xb
push dword [0x441334]
push ecx
mov edi, eax
call fcn.00433920
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.004090b0
add esp, 4
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov edi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x435c90
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x435cab
mov eax, 0xffffffff
jmp 0x435cae
add eax, 0xa
push eax
call fcn.004090a0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x435cf1
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x435ce0
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 0x18], dx
add ecx, edi
add ecx, 2
mov word [esp + 0x1a], cx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 8], 0x62656467
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0xc
ja 0x435dd0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
mov esi, 0xee
sub esi, ecx
add ecx, 0x9c90311
xor esi, ecx
and esi, edx
xor esi, ecx
mov dword [esp + 0x20], esi
mov ecx, dword [esp + 0x20]
add cl, 0x89
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0xd
jb 0x435d90
mov esi, dword [esp + 8]
mov ecx, dword [0x44132c]
test ecx, ecx
je 0x435e35
xor edx, edx
mov edi, dword [0x441330]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xcd669f2f
je 0x435e00
inc edx
cmp ecx, edx
jne 0x435df0
jmp 0x435e35
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x435e35
lea edx, [esp + 8]
lea esi, [esp + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x441334]
push ecx
mov edi, eax
call fcn.00433920
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.004090b0
add esp, 4
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435e50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x435e70
mov ecx, eax
sar ecx, 1
xor ecx, 4
and eax, 8
lea ebx, [ecx + eax]
add eax, ecx
inc eax
test eax, eax
jns 0x435e96
mov eax, 0xffffffff
jmp 0x435e9d
lea eax, [ebx*2 + 2]
push eax
call fcn.004090a0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x435ee1
add esi, 2
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x435ed0
mov word [ecx], 0
lea ecx, [ebx + ebx]
mov word [esp + 4], cx
lea ecx, [ebx*2 + 2]
mov word [esp + 6], cx
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x62656467
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov byte [esp + 0x34], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xc
ja 0x435f9b
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x28]
mov esi, 0xee
sub esi, ecx
add ecx, 0x9c90311
xor esi, ecx
and esi, edx
xor esi, ecx
mov dword [esp + 0xc], esi
mov ecx, dword [esp + 0xc]
add cl, 0x89
mov edx, dword [esp]
mov byte [esp + edx + 0x28], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xd
jb 0x435f60
mov esi, dword [esp + 0x28]
mov ecx, dword [0x44132c]
test ecx, ecx
je 0x435ff9
xor edx, edx
mov ebx, dword [0x441330]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0xdcc9f508
je 0x435fd0
inc edx
cmp ecx, edx
jne 0x435fc0
jmp 0x435ff9
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x435ff9
lea edx, [esp + 0x28]
lea esi, [esp + 0x10]
push edx
push esi
push 2
push dword [0x441334]
push ecx
mov ebx, eax
call fcn.00433920
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.004090b0
add esp, 4
test edi, edi
je 0x43600c
mov eax, dword [esp + 0x48]
mov dword [edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0x62656467
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x43609e
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, 0xee
sub edx, eax
add eax, 0x9c90311
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
add al, 0x89
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x436060
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 8]
mov edx, dword [0x44132c]
test edx, edx
je 0x4360f8
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x441330]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xd75bc899
je 0x4360d0
inc edi
cmp edx, edi
jne 0x4360c0
jmp 0x4360f8
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x4360f8
lea eax, [esp + 8]
lea edi, [esp + 0x24]
push 5
push 0x18
push eax
push edi
push ecx
push 5
push dword [0x441334]
push edx
call fcn.00433920
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x436105
mov edx, dword [esp + 0x10]
mov dword [esi], edx
test ecx, ecx
je 0x436111
cmp byte [esp + 0x1d], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0x62656467
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x436199
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, 0xee
sub edx, eax
add eax, 0x9c90311
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
add al, 0x89
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0x436160
mov eax, dword [esp + 8]
mov edi, dword [0x44132c]
test edi, edi
je 0x4361fd
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [0x441330]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebx*8], 0x47a01aa3
je 0x4361d0
inc ebx
cmp edi, ebx
jne 0x4361c0
jmp 0x4361fd
mov edi, dword [esi + ebx*8 + 4]
cmp edi, eax
je 0x4361fd
lea eax, [esp + 0x1c]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x441334]
push edi
call fcn.00433920
add esp, 0x30
mov edi, dword [ebp + 0x14]
cmp eax, 0x103
jne 0x4362d8
mov dword [esp + 8], 0x62656467
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x43627c
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, 0xee
sub edx, eax
add eax, 0x9c90311
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp], edx
mov eax, dword [esp]
add al, 0x89
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x436240
mov eax, dword [esp + 8]
mov ecx, dword [0x44132c]
test ecx, ecx
je 0x4362d0
xor edx, edx
mov esi, dword [0x441330]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x39c83604
je 0x4362b0
inc edx
cmp ecx, edx
jne 0x4362a0
jmp 0x4362d0
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x4362d0
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x441334]
push ecx
call fcn.00433920
add esp, 0x18
test eax, eax
js 0x4362d8
mov eax, dword [esp + 0x1c]
test edi, edi
je 0x4362eb
xor ecx, ecx
cmp eax, 0xc0000011
je 0x4362e9
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0x62656467
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x436379
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, 0xee
sub edx, eax
add eax, 0x9c90311
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
add al, 0x89
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0x436340
mov eax, dword [esp + 8]
mov edi, dword [0x44132c]
test edi, edi
je 0x4363dd
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [0x441330]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebx*8], 0xa1e50e2a
je 0x4363b0
inc ebx
cmp edi, ebx
jne 0x4363a0
jmp 0x4363dd
mov edi, dword [esi + ebx*8 + 4]
cmp edi, eax
je 0x4363dd
lea eax, [esp + 0x1c]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x441334]
push edi
call fcn.00433920
add esp, 0x30
mov edi, dword [ebp + 0x14]
cmp eax, 0x103
jne 0x4364b8
mov dword [esp + 8], 0x62656467
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x43645c
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, 0xee
sub edx, eax
add eax, 0x9c90311
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp], edx
mov eax, dword [esp]
add al, 0x89
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x436420
mov eax, dword [esp + 8]
mov ecx, dword [0x44132c]
test ecx, ecx
je 0x4364b0
xor edx, edx
mov esi, dword [0x441330]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x39c83604
je 0x436490
inc edx
cmp ecx, edx
jne 0x436480
jmp 0x4364b0
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x4364b0
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x441334]
push ecx
call fcn.00433920
add esp, 0x18
test eax, eax
js 0x4364b8
mov eax, dword [esp + 0x1c]
test edi, edi
je 0x4364c2
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4364d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x4364f0
sar ebx, 1
mov ecx, ebx
and ecx, 0xfffd
mov edx, ebx
and edx, 2
or ebx, 2
imul ebx, edx
xor edx, 2
imul edx, ecx
lea ecx, [edx + ebx]
mov word [esp + 4], cx
lea ecx, [edx + ebx]
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], edi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], 0x62656467
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x4365c9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, 0xee
sub edx, eax
add eax, 0x9c90311
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
add al, 0x89
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0x436590
mov eax, dword [esp + 0x10]
mov edi, dword [0x44132c]
test edi, edi
je 0x436615
xor ebx, ebx
mov ecx, dword [0x441330]
nop
cmp dword [ecx + ebx*8], 0x55708665
je 0x4365f0
inc ebx
cmp edi, ebx
jne 0x4365e0
jmp 0x436615
mov ecx, dword [ecx + ebx*8 + 4]
cmp ecx, eax
je 0x436615
lea eax, [esp + 0x24]
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 4
push dword [0x441334]
push ecx
call fcn.00433920
add esp, 0x1c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret