joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b070
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x41b080
sar ebp, 1
mov eax, esp
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x44a594]
mov edi, dword [esp]
test edi, edi
jns 0x41b0ac
mov eax, 0xffffffff
jmp 0x41b0af
lea eax, [edi + edi]
push eax
call fcn.00408940
add esp, 4
mov esi, eax
mov eax, esp
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x44a594]
lea ebx, [esp + 0xc]
push ebx
push esi
call fcn.0043d120
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x444110]
Function at 0x427060
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, edx
mov edi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov ebx, 0xffffffff
nop
nop
nop
cmp byte [ebp + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x427080
lea esi, [ebx + 1]
push esi
call fcn.00408940
add esp, 4
mov dword [esp + 4], edi
mov dword [edi], eax
mov ecx, esi
shr ecx, 2
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, esi
and edx, 0xfffffffc
add eax, edx
add edx, ebp
mov dword [esp], esi
mov ecx, esi
shr ecx, 1
and ecx, 1
mov esi, edx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
jne 0x4270e3
mov esi, dword [esp]
and esi, 2
movzx ecx, byte [edx + esi]
mov byte [eax + esi], cl
test ebx, ebx
je 0x427198
neg ebx
mov eax, 0xffffffff
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp]
xor edx, eax
mov eax, edx
shr eax, 1
mov ecx, edx
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov esi, ecx
shr esi, 1
mov eax, edx
shl eax, 0x1e
sar eax, 0x1f
and eax, 0xedb88320
xor eax, esi
mov edi, edx
shl edi, 0x1d
sar edi, 0x1f
and edi, 0x76dc419
mov esi, edx
shl esi, 0x1c
sar esi, 0x1f
and esi, 0xedb8832
xor esi, edi
mov edi, edx
shl edi, 0x1b
sar edi, 0x1f
and edi, 0x1db71064
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x3b6e20c8
xor edx, edi
xor edx, esi
mov esi, eax
shr esi, 6
xor edx, esi
shl ecx, 0x1a
sar ecx, 0x1f
and ecx, 0x76dc4190
xor ecx, edx
shl eax, 0x1a
sar eax, 0x1f
and eax, 0xedb88320
xor eax, ecx
inc ebp
inc ebx
jne 0x4270f0
lea ecx, [eax + eax]
not ecx
add ecx, eax
mov eax, dword [esp + 4]
mov dword [eax + 4], ecx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0xffffffff
jmp 0x427182
Function at 0x436730
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
mov dword [esp], 0x999a9bac
mov word [esp + 4], 0
mov ecx, 0x1b
mov edx, 0xe4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x1b]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add bl, 0x79
mov byte [esp + ecx - 0x1b], bl
inc ecx
dec edx
cmp ecx, 0x21
jne 0x436760
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x4525bc]
add esp, 8
pop esi
pop ebx
ret
Function at 0x436880
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], 0
mov dword [esp], 0x585b5a45
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xf
xor cl, byte [esp + eax]
add cl, 0xb5
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 5
jb 0x4368b0
mov edi, dword [esp]
mov eax, dword [0x44a598]
test eax, eax
je 0x436926
xor ecx, ecx
mov edx, dword [0x44a59c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x436900
inc ecx
cmp eax, ecx
jne 0x4368f0
jmp 0x436926
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x436926
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x44a5a0]
call fcn.004391b0
add esp, 0x1c
mov edi, eax
mov dword [esp], 0x17564944
mov byte [esp + 4], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 0xc
mov edx, ecx
xor edx, 0x8e
add edx, esi
xor dl, byte [esp + ecx]
add dl, 0x3a
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 5
jne 0x436940
cmp edi, dword [esp]
jne 0x436a75
push dword [esp + 0xc]
call fcn.00436730
add esp, 4
mov esi, dword [esp + 0xc]
mov dword [esp], 0x585b5a45
mov byte [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
add cl, 0xf
xor cl, byte [esp + edx]
add cl, 0xb5
mov byte [esp + edx], cl
mov ecx, edx
and ecx, 1
xor edx, 1
lea edx, [edx + ecx*2]
cmp edx, 5
jb 0x436990
mov edi, dword [esp]
mov edx, dword [0x44a598]
test edx, edx
je 0x436a0c
mov dword [esp + 8], esi
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x44a59c]
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x4369e2
inc ebp
cmp edx, ebp
jne 0x4369d0
mov ebp, ecx
jmp 0x436a0c
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
mov ebp, ecx
je 0x436a0c
push 0
push dword [esp + 0xc]
push eax
push 5
push 0x10
push edx
push dword [0x44a5a0]
mov esi, eax
call fcn.004391b0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x436a6c
mov dword [esp + 8], ebp
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x436a45
add edi, 2
cmp si, bp
je 0x436a30
cmp si, bp
je 0x436a57
mov esi, dword [ecx]
test esi, esi
jne 0x436a20
mov edi, 0xc0000225
jmp 0x436a6c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 8]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.004367a0
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x436ab0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x436b70
xor eax, eax
cmp dword [ecx], 0
jne 0x436bd9
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x585b5a45
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0xf
xor bl, byte [esp + eax]
add bl, 0xb5
mov byte [esp + eax], bl
mov esi, eax
and esi, 1
xor eax, 1
lea eax, [eax + esi*2]
cmp eax, 5
jb 0x436b20
mov eax, dword [esp]
mov esi, dword [0x44a598]
test esi, esi
je 0x436bd9
xor edi, edi
mov ebx, dword [0x44a59c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x436be2
inc edi
cmp esi, edi
jne 0x436b60
jmp 0x436bd9
mov dword [esp + 8], 0xc186878c
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 8]
mov esi, eax
and esi, 2
mov edi, ecx
xor edi, 0xfd861
add edi, esi
xor edi, edx
mov edx, edi
and edx, 0x10c3
xor edi, 0x29b035c3
lea edx, [edi + edx*2]
add edx, 0xd6009057
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + ecx + 8], dl
inc ecx
add eax, 2
cmp ecx, 7
jne 0x436b90
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x436bd9
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44a5a0]
call fcn.004391b0
add esp, 0x1c
jmp 0x436bd9

Function at 0x436c10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x436caa
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x585b5a45
mov byte [esp + 4], 0
xor edx, edx
nop
nop
mov ebx, edx
add bl, 0xf
xor bl, byte [esp + edx]
add bl, 0xb5
mov byte [esp + edx], bl
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
cmp edx, 5
jb 0x436c30
mov edx, dword [0x44a598]
test edx, edx
je 0x436c9e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44a59c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x436c80
inc edi
cmp edx, edi
jne 0x436c70
jmp 0x436c9e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x436c9e
push eax
push 4
push edx
push dword [0x44a5a0]
mov esi, ecx
call fcn.004391b0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x4371f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x437209
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43721a
cmp eax, 2
je 0x437290
jmp 0x4372bd
push 0xbbf966b4
push dword [0x44a58c]
call fcn.0043c470
add esp, 8
test eax, eax
je 0x43725b
mov ecx, dword [esi]
test ecx, ecx
je 0x437288
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x437264
cmp dword [esp + 4], 0
je 0x437264
mov dword [esi + 4], 3
jmp 0x437288
mov dword [esi + 4], 1
jmp 0x4372bd
lea eax, [esp + 0xc]
push eax
call fcn.0043cd90
add esp, 4
test al, al
je 0x437288
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x437285
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x4372bd
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x4525b4]
call fcn.0043c470
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x437344
mov ecx, dword [esi]
mov dword [esp + 4], 0x585b5a45
mov byte [esp + 8], 0
xor eax, eax
nop
nop
mov edx, eax
add dl, 0xf
xor dl, byte [esp + eax + 4]
add dl, 0xb5
mov byte [esp + eax + 4], dl
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 5
jb 0x4372d0
mov eax, dword [esp + 4]
mov edx, dword [0x44a598]
test edx, edx
je 0x437344
xor esi, esi
mov ebx, dword [0x44a59c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x437320
inc esi
cmp edx, esi
jne 0x437310
jmp 0x437344
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x437344
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 0x14
push edx
push dword [0x44a5a0]
call fcn.004391b0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x4390f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x447020]

Function at 0x43a270
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x48]
movzx eax, word [eax]
mov dword [esp + 8], 0x83825b4d
mov dword [esp + 0xc], 0
xor ecx, ecx
movzx edx, byte [esp + ecx + 8]
mov edi, ecx
xor edi, 0x1f
mov ebx, edi
and ebx, 5
mov esi, ecx
and esi, 2
or esi, ebx
xor esi, 0x1a
and esi, edi
mov edi, ecx
or edi, edx
or edi, 0x4aad13e0
mov ebx, edi
not ebx
lea ebp, [edi + ebx*2]
not edx
or edx, esi
not ebp
lea ebx, [edi + ebx*2]
inc ebx
or ebx, edx
add ebx, ebp
add bl, 0xa0
mov byte [esp + ecx + 8], bl
mov edx, ecx
not edx
or edx, 1
add edx, ecx
inc edx
mov esi, edx
and esi, 0xfffffffd
mov edi, edx
and edi, 2
or edx, 2
imul edx, edi
xor edi, 2
imul edi, esi
xor ecx, 1
add ecx, edx
add ecx, edi
cmp ecx, 8
jb 0x43a290
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
mov eax, dword [ecx*4 + 0x4475e0]
mov ecx, 0xc43a1cca
xor ecx, dword [0x4475e8]
add ecx, eax
inc ecx
xor eax, eax
mov ebx, dword [esp + 0x48]
jmp ecx
Function at 0x43ab40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x43abb6
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, ebx
mov ebx, edx
mov edi, esi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov ebx, ebp
test bl, 1
je 0x43ad0e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x43ad0e
mov dword [esp], 0xf4f5fafb
mov dword [esp + 4], 0
mov eax, esp
mov ecx, 0x29
nop
nop
nop
nop
movzx edi, byte [eax]
lea edx, [ecx - 0xe2ca200]
or edx, edi
and edi, ecx
not edx
or edx, edi
mov ebx, edx
and ebx, 0x51
add ebx, ebx
xor edx, 0x2e
sub ebx, edx
mov byte [eax], bl
inc eax
dec ecx
cmp ecx, 0x21
jne 0x43abd0
mov eax, dword [esp]
mov ecx, dword [0x44a598]
test ecx, ecx
je 0x43ac20
xor edx, edx
mov edi, dword [0x44a59c]
mov ebx, dword [esp + 0x2c]
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x43ac26
inc edx
cmp ecx, edx
jne 0x43ac10
jmp 0x43ac50
mov ebx, dword [esp + 0x2c]
jmp 0x43ac50
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43ac50
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1c
push ecx
push dword [0x44a5a0]
call fcn.004391b0
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x24]
js 0x43ad0e
push 0x732f71fd
push dword [0x4525b4]
call fcn.0043c470
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0xf4f5fafb
mov dword [esp + 4], 0
mov edx, esp
mov esi, 0x29
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx]
lea edi, [esi - 0xe2ca200]
or edi, ebx
and ebx, esi
not edi
or edi, ebx
mov ebx, edi
and ebx, 0x51
add ebx, ebx
xor edi, 0x2e
sub ebx, edi
mov byte [edx], bl
inc edx
dec esi
cmp esi, 0x21
jne 0x43aca0
mov edx, dword [0x44a598]
test edx, edx
je 0x43ad0e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44a59c]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43acf0
inc edi
cmp edx, edi
jne 0x43ace0
jmp 0x43ad0e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43ad0e
push ecx
push 4
push edx
push dword [0x44a5a0]
mov esi, eax
call fcn.004391b0
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43bfa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0xb18e8f5c
mov dword [esp + 8], 0
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 4]
mov edi, eax
and edi, 0xa
mov ecx, edx
xor ecx, 0x9100425d
add ecx, edi
mov edi, esi
not edi
mov ebx, edi
and ebx, 0x86
or edi, 0x79
add esi, edi
inc esi
or esi, ebx
mov edi, ecx
not edi
or edi, 0x79
lea ebx, [edi + ecx]
inc ebx
and ecx, 6
xor ecx, 0x86
or ebx, ecx
xor ebx, esi
add bl, 0x2f
mov byte [esp + edx + 4], bl
inc edx
add eax, 2
cmp edx, 8
jne 0x43bfc0
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
mov ecx, dword [0x447bd4]
nop
nop
nop
jmp ecx

Function at 0x43c370
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x393a3b6c
mov word [esp + 4], 0
mov eax, 0x31648b
mov edx, 0xffce9b74
nop
movzx esi, byte [esp + eax - 0x31648b]
mov ebx, eax
and ebx, esi
mov edi, ebx
and edi, 2
mov ebp, ebx
or ebx, 2
imul ebx, edi
xor edi, 2
and ebp, 0xffffff9d
imul ebp, edi
add ebx, ebp
lea edi, [eax + esi]
mov ebp, edx
sub ebp, esi
and ebp, ebx
not ebx
and ebx, edi
sub ebx, ebp
add bl, 0x49
mov byte [esp + eax - 0x31648b], bl
inc eax
dec edx
cmp eax, 0x316491
jne 0x43c390
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
cmp dword [esp + 0x1c], 0
sete dl
jmp dword [edx*4 + 0x447c78]
Function at 0x43c470
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x3c]
movzx ecx, word [ebp]
mov dword [esp], 0x4146bdb3
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx]
lea ebx, [edx + 0x91]
and ebx, eax
mov esi, ebx
and esi, 2
mov edi, ebx
or ebx, 2
imul ebx, esi
xor esi, 2
and edi, 0xffffff9d
imul edi, esi
add ebx, edi
add eax, edx
add eax, 0xf4a0391
mov esi, ebx
xor esi, eax
not ebx
and ebx, eax
add ebx, ebx
sub ebx, esi
mov eax, ebx
and eax, 0x28
mov esi, ebx
and esi, 2
mov edi, esi
xor edi, 2
imul edi, eax
or eax, 2
imul eax, esi
xor ebx, 0x2a
add ebx, edi
add ebx, eax
inc bl
mov byte [esp + edx], bl
mov eax, edx
and eax, 1
xor edx, 1
lea edx, [edx + eax*2]
cmp edx, 7
jb case.default.0x43c513
xor eax, eax
cmp dword [esp], ecx
setne al
jmp dword [eax*4 + 0x447cb8]
jmp dword [0x447cd0]
mov ecx, dword [case.0x43c513.4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
mov ecx, dword [ebp + 0x3c]
mov edx, dword [ebp + ecx]
mov dword [esp], 0x777644b8
mov byte [esp + 4], 0
mov esi, 0x93a531be
mov edi, 0x41
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + esi + 0x6c5ace42]
mov ebx, edi
xor ebx, esi
and ebx, eax
xor ebx, esi
lea eax, [ebx + 0x49]
mov ebp, 0x36
sub ebp, ebx
or ebp, 1
add ebp, ebx
xor eax, 1
lea eax, [eax + ebp*2]
add al, 0x94
mov byte [esp + esi + 0x6c5ace42], al
inc esi
dec edi
cmp esi, 0x93a531c3
jne 0x43c6e0
mov ebp, dword [esp + 0x3c]
jmp dword [0x447cd8]
mov dword [esp], 0x777644b8
mov byte [esp + 4], 0
mov ecx, 0x93a531be
mov eax, 0x41
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x6c5ace42]
mov esi, eax
xor esi, ecx
and esi, edx
xor esi, ecx
lea edx, [esi + 0x49]
mov edi, 0x36
sub edi, esi
or edi, 1
add edi, esi
xor edx, 1
lea edx, [edx + edi*2]
add dl, 0x94
mov byte [esp + ecx + 0x6c5ace42], dl
inc ecx
dec eax
cmp ecx, 0x93a531c3
jne 0x43c740
jmp case.0x43c513.6
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c722
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x3c]
movzx ecx, word [ebp]
mov dword [esp], 0x4146bdb3
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx]
lea ebx, [edx + 0x91]
and ebx, eax
mov esi, ebx
and esi, 2
mov edi, ebx
or ebx, 2
imul ebx, esi
xor esi, 2
and edi, 0xffffff9d
imul edi, esi
add ebx, edi
add eax, edx
add eax, 0xf4a0391
mov esi, ebx
xor esi, eax
not ebx
and ebx, eax
add ebx, ebx
sub ebx, esi
mov eax, ebx
and eax, 0x28
mov esi, ebx
and esi, 2
mov edi, esi
xor edi, 2
imul edi, eax
or eax, 2
imul eax, esi
xor ebx, 0x2a
add ebx, edi
add ebx, eax
inc bl
mov byte [esp + edx], bl
mov eax, edx
and eax, 1
xor edx, 1
lea edx, [edx + eax*2]
cmp edx, 7
jb case.default.0x43c513
xor eax, eax
cmp dword [esp], ecx
setne al
jmp dword [eax*4 + 0x447cb8]
jmp dword [0x447cd0]
mov ecx, dword [case.0x43c513.4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
mov ecx, dword [ebp + 0x3c]
mov edx, dword [ebp + ecx]
mov dword [esp], 0x777644b8
mov byte [esp + 4], 0
mov esi, 0x93a531be
mov edi, 0x41
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + esi + 0x6c5ace42]
mov ebx, edi
xor ebx, esi
and ebx, eax
xor ebx, esi
lea eax, [ebx + 0x49]
mov ebp, 0x36
sub ebp, ebx
or ebp, 1
add ebp, ebx
xor eax, 1
lea eax, [eax + ebp*2]
add al, 0x94
mov byte [esp + esi + 0x6c5ace42], al
inc esi
dec edi
cmp esi, 0x93a531c3
jne 0x43c6e0
mov ebp, dword [esp + 0x3c]
jmp dword [0x447cd8]
mov dword [esp], 0x777644b8
mov byte [esp + 4], 0
mov ecx, 0x93a531be
mov eax, 0x41
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x6c5ace42]
mov esi, eax
xor esi, ecx
and esi, edx
xor esi, ecx
lea edx, [esi + 0x49]
mov edi, 0x36
sub edi, esi
or edi, 1
add edi, esi
xor edx, 1
lea edx, [edx + edi*2]
add dl, 0x94
mov byte [esp + ecx + 0x6c5ace42], dl
inc ecx
dec eax
cmp ecx, 0x93a531c3
jne 0x43c740
jmp case.0x43c513.6
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cde0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43ce00
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43ce1b
mov eax, 0xffffffff
jmp 0x43ce1e
add eax, 0xa
push eax
call fcn.00408940
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x43ce61
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x43ce50
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x2c2d2e2f
mov dword [esp + 4], 0
mov ecx, 0x8062a388
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x7f9d5c78]
xor edx, ecx
mov esi, edx
and esi, 0x57
xor edx, 0x57
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx + 0x7f9d5c78], dl
inc ecx
cmp ecx, 0x8062a390
jne 0x43cee0
mov esi, dword [esp]
mov ecx, dword [0x44a598]
test ecx, ecx
je 0x43cf72
xor edx, edx
mov edi, dword [0x44a59c]
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xbb9b186e
je 0x43cf30
inc edx
cmp ecx, edx
jne 0x43cf20
jmp 0x43cf72
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43cf72
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44a5a0]
mov edi, eax
call fcn.004391b0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408950
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cf90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43cfb0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x43cfcb
mov eax, 0xffffffff
jmp 0x43cfce
add eax, 0xa
push eax
call fcn.00408940
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43d011
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43d000
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x2c2d2e2f
mov dword [esp + 4], 0
mov ecx, 0x8062a388
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x7f9d5c78]
xor edx, ecx
mov esi, edx
and esi, 0x57
xor edx, 0x57
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx + 0x7f9d5c78], dl
inc ecx
cmp ecx, 0x8062a390
jne 0x43d080
mov esi, dword [esp]
mov ecx, dword [0x44a598]
test ecx, ecx
je 0x43d101
xor edx, edx
mov ebx, dword [0x44a59c]
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x43d0d0
inc edx
cmp ecx, edx
jne 0x43d0c0
jmp 0x43d101
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43d101
mov edx, esp
lea esi, [esp + 0x10]
push edi
push ebp
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44a5a0]
mov edi, eax
call fcn.004391b0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408950
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret