joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43d549
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43d55a
cmp eax, 2
je 0x43d5d0
jmp 0x43d5fd
push 0xfb1631b0
push dword [0x44f3bc]
call fcn.004425e0
add esp, 8
test eax, eax
je 0x43d59b
mov ecx, dword [esi]
test ecx, ecx
je 0x43d5c8
mov dword [esp + 8], 0
lea edx, [esp + 8]
push edx
push ecx
call eax
test eax, eax
je 0x43d5a4
cmp dword [esp + 8], 0
je 0x43d5a4
mov dword [esi + 4], 3
jmp 0x43d5c8
mov dword [esi + 4], 1
jmp 0x43d5fd
lea eax, [esp + 4]
push eax
call fcn.00442e10
add esp, 4
test al, al
je 0x43d5c8
mov eax, dword [esp + 4]
mov ecx, 2
cmp eax, 3
je 0x43d5c5
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43d5fd
mov ebx, dword [ebp + 0x18]
push 0xc95dc39
push dword [0x4573dc]
call fcn.004425e0
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43d6c4
mov ecx, dword [esi]
mov dword [esp + 0xc], 0x14151617
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x43d66e
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 4]
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0xc]
lea esi, [edx + edx]
and esi, 0x5e887478
mov ebx, edx
not ebx
or ebx, 0x2f443a3c
add ebx, edx
sub edx, esi
lea edx, [edx + ebx*2]
add edx, 0xaf443a3e
xor edx, eax
mov dword [esp + 8], edx
mov eax, dword [esp + 8]
add al, 0xd4
mov edx, dword [esp + 4]
mov byte [esp + edx + 0xc], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x43d620
mov eax, dword [esp + 0xc]
mov edx, dword [0x44f3c8]
test edx, edx
je 0x43d6c4
xor esi, esi
mov ebx, dword [0x44f3cc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x3baba5e0
je 0x43d6a0
inc esi
cmp edx, esi
jne 0x43d690
jmp 0x43d6c4
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43d6c4
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x44f3d0]
push edx
call fcn.0043f830
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x43f750
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44d4fc]

Function at 0x440880
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [esp + 0x40]
movzx eax, word [eax]
mov dword [esp], 0xd7d6af9d
mov dword [esp + 8], 0
mov ecx, dword [esp + 8]
cmp ecx, 3
ja 0x4408ee
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 8]
mov edx, dword [esp + 8]
movzx edx, byte [esp + edx]
mov esi, ecx
xor esi, 0x3be35c4e
and ecx, 0x3be35c4e
lea ecx, [esi + ecx*2]
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0x7a
mov edx, dword [esp + 8]
mov byte [esp + edx], cl
inc dword [esp + 8]
mov ecx, dword [esp + 8]
cmp ecx, 4
jb 0x4408b0
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44d9f0]
mov ecx, dword [esp + 0x40]
mov ebx, dword [ecx + 0x3c]
mov ecx, dword [ecx + ebx]
mov dword [esp + 0xc], 0x4f4e8cb8
mov word [esp + 0x10], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 5
ja 0x44097c
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 0xc]
mov edi, edx
xor edi, 0xdaf01c92
and edx, 0xdaf01c92
lea edx, [edi + edx*2]
lea edi, [edx + esi]
and edx, esi
mov esi, edi
not esi
and esi, edx
add esi, edx
not edx
and edx, edi
sub edx, esi
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
add dl, 0x26
mov esi, dword [esp]
mov byte [esp + esi + 0xc], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 6
jb 0x440930
xor edx, edx
cmp ecx, dword [esp + 0xc]
setne dl
xor eax, eax
jmp dword [edx*4 + 0x44d9f8]
mov edx, dword [esp + 0x40]
mov esi, dword [edx + ebx + 0x78]
cmp dword [edx + ebx + 0x7c], 0
sete al
test esi, esi
sete cl
or cl, al
movzx eax, cl
jmp dword [eax*4 + 0x44da00]
mov eax, dword [edx + esi + 0x20]
add eax, edx
mov dword [esp + 0x28], eax
mov eax, dword [edx + esi + 0x24]
add eax, edx
mov dword [esp + 0x24], eax
mov eax, dword [edx + esi + 0x1c]
add eax, edx
mov dword [esp + 0x20], eax
mov ebp, dword [0x44f3cc]
xor eax, eax
test ebp, ebp
sete al
mov ecx, esi
mov dword [esp + 0x14], esi
jmp dword [eax*4 + 0x44da18]
mov ecx, dword [case.0x440987.1]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
mov ecx, dword [case.0x4408f8.1]
nop
jmp ecx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4408ff
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [esp + 0x40]
movzx eax, word [eax]
mov dword [esp], 0xd7d6af9d
mov dword [esp + 8], 0
mov ecx, dword [esp + 8]
cmp ecx, 3
ja 0x4408ee
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 8]
mov edx, dword [esp + 8]
movzx edx, byte [esp + edx]
mov esi, ecx
xor esi, 0x3be35c4e
and ecx, 0x3be35c4e
lea ecx, [esi + ecx*2]
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0x7a
mov edx, dword [esp + 8]
mov byte [esp + edx], cl
inc dword [esp + 8]
mov ecx, dword [esp + 8]
cmp ecx, 4
jb 0x4408b0
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44d9f0]
mov ecx, dword [esp + 0x40]
mov ebx, dword [ecx + 0x3c]
mov ecx, dword [ecx + ebx]
mov dword [esp + 0xc], 0x4f4e8cb8
mov word [esp + 0x10], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 5
ja 0x44097c
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 0xc]
mov edi, edx
xor edi, 0xdaf01c92
and edx, 0xdaf01c92
lea edx, [edi + edx*2]
lea edi, [edx + esi]
and edx, esi
mov esi, edi
not esi
and esi, edx
add esi, edx
not edx
and edx, edi
sub edx, esi
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
add dl, 0x26
mov esi, dword [esp]
mov byte [esp + esi + 0xc], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 6
jb 0x440930
xor edx, edx
cmp ecx, dword [esp + 0xc]
setne dl
xor eax, eax
jmp dword [edx*4 + 0x44d9f8]
mov edx, dword [esp + 0x40]
mov esi, dword [edx + ebx + 0x78]
cmp dword [edx + ebx + 0x7c], 0
sete al
test esi, esi
sete cl
or cl, al
movzx eax, cl
jmp dword [eax*4 + 0x44da00]
mov eax, dword [edx + esi + 0x20]
add eax, edx
mov dword [esp + 0x28], eax
mov eax, dword [edx + esi + 0x24]
add eax, edx
mov dword [esp + 0x24], eax
mov eax, dword [edx + esi + 0x1c]
add eax, edx
mov dword [esp + 0x20], eax
mov ebp, dword [0x44f3cc]
xor eax, eax
test ebp, ebp
sete al
mov ecx, esi
mov dword [esp + 0x14], esi
jmp dword [eax*4 + 0x44da18]
mov ecx, dword [case.0x440987.1]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
mov ecx, dword [case.0x4408f8.1]
nop
jmp ecx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442060
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 4], 0x898a8bfc
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x4420c9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0x687a21a3
and eax, 0xe87a21a3
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0xd1
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x442090
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x28], 0
sete cl
jmp dword [ecx*4 + 0x44de08]
mov edi, dword [eax + 0xc]
mov eax, dword [case.0x4420da.4]
nop
nop
nop
nop
nop
nop
nop
jmp eax
add edi, 0xc
mov ecx, dword [0x44de3c]
mov dword [esp + 0xc], edi
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edi
jmp ecx
mov eax, dword [eax + 8]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4424f0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], 0x1060734
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x442563
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0x2bcead81
mov edi, eax
xor edi, 0x5431527e
or eax, 0x2bcead81
and eax, edi
lea eax, [esi + eax*2]
xor eax, edx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0x7b
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x442520
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44dee8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x44def0]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x44def8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
add esp, 0xc
pop esi
pop edi
pop ebx
ret

Function at 0x4425e0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [esp + 0x34]
movzx eax, word [esi]
mov dword [esp + 4], 0x494aedff
mov word [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 5
ja 0x442653
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov edi, ecx
xor edi, 0x2d738473
and ecx, 0x2d738473
lea ecx, [edi + ecx*2]
mov edi, ecx
and edi, edx
add ecx, edx
add edi, edi
sub ecx, edi
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
add cl, 0xc1
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 6
jb 0x442610
xor ecx, ecx
cmp dword [esp + 4], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44df08]
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + ecx]
mov dword [esp + 4], 0x292ae0f4
mov byte [esp + 8], 0
mov dword [esp], 0
mov edi, dword [esp]
cmp edi, 4
ja 0x4426dd
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [esp]
mov ebx, dword [esp]
movzx ebx, byte [esp + ebx + 4]
mov ebp, edi
xor ebp, 0x939e45c7
and edi, 0x139e45c7
lea edi, [edi*2]
add edi, ebp
xor edi, ebx
mov dword [esp + 0x10], edi
mov ebx, dword [esp + 0x10]
mov edi, ebx
not edi
and edi, 0xe3
and ebx, 0x1c
sub ebx, edi
mov edi, dword [esp]
mov byte [esp + edi + 4], bl
inc dword [esp]
mov edi, dword [esp]
cmp edi, 5
jb 0x442690
xor ebx, ebx
cmp edx, dword [esp + 4]
setne bl
jmp dword [ebx*4 + 0x44df10]
mov ebx, dword [esi + ecx + 0x78]
mov edi, dword [esi + ecx + 0x7c]
test edi, edi
sete cl
test ebx, ebx
sete dl
or dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x44df38]
jmp dword [0x44df24]
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442830
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov edx, 0xffffffff
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, ecx
inc cl
cmp byte [esi + edx + 1], 0
lea edx, [edx + 1]
jne 0x442850
mov dword [esp + 4], 0xd6d6c857
mov dword [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 7
ja 0x4428d3
nop
nop
nop
mov ecx, dword [esp]
mov esi, dword [esp]
movzx ebp, byte [esp + esi + 4]
mov esi, ecx
xor esi, 0x6d03612e
and ecx, 0xed03612e
lea esi, [esi + ecx*2]
mov ecx, ebp
not ecx
or ecx, esi
lea edi, [ecx + ebp]
inc edi
add esi, ebp
sub esi, edi
mov ecx, esi
xor ecx, edi
not edi
and edi, esi
add edi, edi
sub edi, ecx
mov dword [esp + 0xc], edi
mov ecx, dword [esp + 0xc]
add cl, 0x1a
mov esi, dword [esp]
mov byte [esp + esi + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 8
jb 0x442880
test edx, edx
je 0x44294e
mov esi, dword [esp + 4]
test dl, 3
je 0x442906
movzx ebx, bl
and ebx, 3
mov ebp, eax
mov edi, edx
mov ecx, dword [esp + 0x24]
nop
nop
dec edi
movsx eax, byte [ecx]
inc ecx
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x4428f0
cmp edx, 4
jae 0x442911
jmp 0x44294e
mov edi, edx
mov ecx, dword [esp + 0x24]
cmp edx, 4
jb 0x44294e
mov ebx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx ecx, byte [ebx + edx]
xor ecx, eax
imul ecx, esi
movsx eax, byte [ebx + edx + 1]
xor eax, ecx
imul eax, esi
movsx ecx, byte [ebx + edx + 2]
xor ecx, eax
imul ecx, esi
movsx eax, byte [ebx + edx + 3]
xor eax, ecx
imul eax, esi
add edx, 4
cmp edi, edx
jne 0x442920
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443030
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x54]
mov ebx, dword [esp + 0x44]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x443050
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x44306b
mov eax, 0xffffffff
jmp 0x44306e
add eax, 0xa
push eax
call fcn.0040c690
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x4430b1
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x4430a0
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov ebx, ecx
and ebx, 0xfffd
imul ebx, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 0xc], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xe], cx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0xe8ebeae5
mov word [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 5
ja 0x443185
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, ecx
xor esi, 0x55adcbd7
and ecx, 0xd5adcbd7
lea ecx, [esi + ecx*2]
lea esi, [ecx + edx]
not edx
or ecx, edx
sub edx, ecx
lea ecx, [esi + edx*2]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
add cl, 0xcd
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 6
jb 0x443140
mov esi, dword [esp + 4]
mov ecx, dword [0x44f3c8]
test ecx, ecx
je 0x4431e6
xor edx, edx
mov ebx, dword [0x44f3cc]
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x88a3caae
je 0x4431b0
inc edx
cmp ecx, edx
jne 0x4431a0
jmp 0x4431e6
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x4431e6
lea edx, [esp + 4]
lea esi, [esp + 0x18]
push edi
push dword [esp + 0x54]
push edx
push esi
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push 6
push dword [0x44f3d0]
push ecx
mov edi, eax
call fcn.0043f830
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040c6a0
add esp, 4
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x443220
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x44323b
mov eax, 0xffffffff
jmp 0x44323e
add eax, 0xa
push eax
call fcn.0040c690
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x443281
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x443270
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 4], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 6], cx
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xe8ebeae5
mov word [esp + 0x2c], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 5
ja 0x443335
mov edx, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x28]
mov esi, edx
xor esi, 0x55adcbd7
and edx, 0xd5adcbd7
lea edx, [esi + edx*2]
lea esi, [edx + ecx]
not ecx
or edx, ecx
sub ecx, edx
lea ecx, [esi + ecx*2]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0xcd
mov edx, dword [esp]
mov byte [esp + edx + 0x28], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 6
jb 0x4432f0
mov esi, dword [esp + 0x28]
mov ecx, dword [0x44f3c8]
test ecx, ecx
je 0x443389
xor edx, edx
mov ebx, dword [0x44f3cc]
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x8896be63
je 0x443360
inc edx
cmp ecx, edx
jne 0x443350
jmp 0x443389
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x443389
lea edx, [esp + 0x28]
lea esi, [esp + 0x10]
push edx
push esi
push 2
push dword [0x44f3d0]
push ecx
mov ebx, eax
call fcn.0043f830
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.0040c6a0
add esp, 4
test edi, edi
je 0x44339c
mov eax, dword [esp + 0x48]
mov dword [edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4433b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 0x10], 0xe8ebeae5
mov word [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x443429
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x10]
mov edx, ecx
xor edx, 0x55adcbd7
and ecx, 0xd5adcbd7
lea ecx, [edx + ecx*2]
lea edx, [ecx + eax]
not eax
or ecx, eax
sub eax, ecx
lea eax, [edx + eax*2]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0xcd
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 6
jb 0x4433e0
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [0x44f3c8]
test edx, edx
je 0x443488
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x44f3cc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x77a9e0c4
je 0x443460
inc edi
cmp edx, edi
jne 0x443450
jmp 0x443488
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x443488
lea eax, [esp + 0x10]
lea edi, [esp + 8]
push 5
push 0x18
push eax
push edi
push ecx
push 5
push dword [0x44f3d0]
push edx
call fcn.0043f830
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x443495
mov edx, dword [esp + 0x18]
mov dword [esi], edx
test ecx, ecx
je 0x4434a1
cmp byte [esp + 0x25], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4434b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0xe8ebeae5
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x443523
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0x55adcbd7
and eax, 0xd5adcbd7
lea eax, [edx + eax*2]
lea edx, [eax + ecx]
not ecx
or eax, ecx
sub ecx, eax
lea eax, [edx + ecx*2]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0xcd
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x4434e0
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 8]
mov ecx, dword [0x44f3c8]
test ecx, ecx
je 0x44358c
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
xor ebx, ebx
mov ebp, dword [0x44f3cc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x72e9dc72
je 0x443561
inc ebx
cmp ecx, ebx
jne 0x443550
jmp 0x44358c
mov ecx, dword [ebp + ebx*8 + 4]
cmp ecx, eax
je 0x44358c
lea eax, [esp + 0x10]
push 0
push 0
push edi
push edx
push eax
push 0
push 0
push 0
push esi
push 9
push dword [0x44f3d0]
push ecx
call fcn.0043f830
add esp, 0x30
mov edi, dword [esp + 0x38]
cmp eax, 0x103
jne 0x443656
mov dword [esp + 8], 0xe8ebeae5
mov word [esp + 0xc], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x443606
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0x55adcbd7
and eax, 0xd5adcbd7
lea eax, [edx + eax*2]
lea edx, [eax + ecx]
not ecx
or eax, ecx
sub ecx, eax
lea eax, [edx + ecx*2]
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xcd
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 6
jb 0x4435c0
mov eax, dword [esp + 8]
mov ecx, dword [0x44f3c8]
test ecx, ecx
je 0x44364e
xor edx, edx
mov ebx, dword [0x44f3cc]
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x7e28bda7
je 0x443630
inc edx
cmp ecx, edx
jne 0x443620
jmp 0x44364e
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x44364e
push 0
push 0
push esi
push 3
push dword [0x44f3d0]
push ecx
call fcn.0043f830
add esp, 0x18
test eax, eax
js 0x443656
mov eax, dword [esp + 0x10]
test edi, edi
je 0x443669
xor ecx, ecx
cmp eax, 0xc0000011
je 0x443667
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443680
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0xe8ebeae5
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x4436f3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0x55adcbd7
and eax, 0xd5adcbd7
lea eax, [edx + eax*2]
lea edx, [eax + ecx]
not ecx
or eax, ecx
sub ecx, eax
lea eax, [edx + ecx*2]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0xcd
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x4436b0
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 8]
mov ecx, dword [0x44f3c8]
test ecx, ecx
je 0x44375c
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
xor ebx, ebx
mov ebp, dword [0x44f3cc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xe6919031
je 0x443731
inc ebx
cmp ecx, ebx
jne 0x443720
jmp 0x44375c
mov ecx, dword [ebp + ebx*8 + 4]
cmp ecx, eax
je 0x44375c
lea eax, [esp + 0x10]
push 0
push 0
push edi
push edx
push eax
push 0
push 0
push 0
push esi
push 9
push dword [0x44f3d0]
push ecx
call fcn.0043f830
add esp, 0x30
mov edi, dword [esp + 0x38]
cmp eax, 0x103
jne 0x443826
mov dword [esp + 8], 0xe8ebeae5
mov word [esp + 0xc], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x4437d6
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0x55adcbd7
and eax, 0xd5adcbd7
lea eax, [edx + eax*2]
lea edx, [eax + ecx]
not ecx
or eax, ecx
sub ecx, eax
lea eax, [edx + ecx*2]
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xcd
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 6
jb 0x443790
mov eax, dword [esp + 8]
mov ecx, dword [0x44f3c8]
test ecx, ecx
je 0x44381e
xor edx, edx
mov ebx, dword [0x44f3cc]
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x7e28bda7
je 0x443800
inc edx
cmp ecx, edx
jne 0x4437f0
jmp 0x44381e
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x44381e
push 0
push 0
push esi
push 3
push dword [0x44f3d0]
push ecx
call fcn.0043f830
add esp, 0x18
test eax, eax
js 0x443826
mov eax, dword [esp + 0x10]
test edi, edi
je 0x443830
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret