joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e380
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
xor ecx, ecx
cmp dword [esp + 0x1c], 0
setne cl
jmp dword [ecx*4 + 0x44e3b0]

Function at 0x43e440
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0x10], ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp], 0xd8dbdac5
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
mov edx, eax
and edx, 4
xor edx, 0xd4
mov ecx, eax
and ecx, 3
sub ecx, edx
add cl, 0x23
xor cl, byte [esp + eax]
add cl, 0x75
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x43e470
mov eax, dword [esp]
mov esi, dword [0x450710]
test esi, esi
je 0x43e4e4
xor ecx, ecx
mov edx, dword [0x450714]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x43e4c0
inc ecx
cmp esi, ecx
jne 0x43e4b0
jmp 0x43e4e4
mov edx, dword [edx + ecx*8 + 4]
cmp edx, eax
je 0x43e4e4
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x450718]
push edx
call fcn.00441310
add esp, 0x1c
mov dword [esp + 8], eax
mov dword [esp], 0x8fcec9cc
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ebp, 0x12
mov ecx, 0xcd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ebp - 0x12]
mov edx, ecx
or edx, esi
not edx
lea edi, [ecx - 0x80]
and edi, 0x4c
mov eax, ebp
and eax, 0x13
or eax, edi
xor eax, 0x93
and eax, esi
or eax, edx
add al, 6
mov byte [esp + ebp - 0x12], al
inc ebp
dec ecx
cmp ebp, 0x19
jne 0x43e510
mov edi, dword [esp + 8]
cmp edi, dword [esp]
jne 0x43e655
push dword [esp + 0xc]
call fcn.0043e320
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp], 0xd8dbdac5
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor esi, esi
mov edi, esi
and edi, 4
xor edi, 0xd4
mov edx, esi
and edx, 3
sub edx, edi
add dl, 0x23
xor dl, byte [esp + esi]
add dl, 0x75
mov byte [esp + esi], dl
inc esi
cmp esi, 7
jne 0x43e570
mov edi, dword [esp]
mov edx, dword [0x450710]
test edx, edx
je 0x43e5f7
mov dword [esp + 8], ecx
mov ecx, edi
xor ebp, ebp
mov esi, dword [0x450714]
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x43e5cd
mov edi, ebp
and edi, 1
xor ebp, 1
lea ebp, [ebp + edi*2]
cmp ebp, edx
jb 0x43e5b0
mov edi, ecx
jmp 0x43e5f7
mov edx, dword [esi + ebp*8 + 4]
mov edi, ecx
cmp edx, ecx
je 0x43e5f7
push 0
push dword [esp + 0xc]
push eax
push 5
push 4
push dword [0x450718]
push edx
mov esi, eax
call fcn.00441310
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43e64c
mov esi, dword [eax]
mov ecx, eax
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [edx + esi]
movzx ebp, word [ebx + esi]
test di, di
je 0x43e625
add esi, 2
cmp di, bp
je 0x43e610
cmp di, bp
je 0x43e637
mov esi, dword [ecx]
test esi, esi
jne 0x43e600
mov edi, 0xc0000225
jmp 0x43e64c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043e380
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43e6a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43e760
xor eax, eax
cmp dword [ecx], 0
jne 0x43e7b2
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xd8dbdac5
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
mov esi, eax
and esi, 4
xor esi, 0xd4
mov ebx, eax
and ebx, 3
sub ebx, esi
add bl, 0x23
xor bl, byte [esp + eax]
add bl, 0x75
mov byte [esp + eax], bl
inc eax
cmp eax, 7
jne 0x43e710
mov eax, dword [esp]
mov esi, dword [0x450710]
test esi, esi
je 0x43e7b2
xor edi, edi
mov ebx, dword [0x450714]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x43e7bb
inc edi
cmp esi, edi
jne 0x43e750
jmp 0x43e7b2
mov dword [esp + 8], 0x146474c
mov eax, 0x9405e111
mov ecx, 0xee
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x6bfa1ef7]
mov esi, ecx
xor esi, eax
and esi, edx
xor esi, eax
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
add dl, 0xaa
mov byte [esp + eax + 0x6bfa1ef7], dl
inc eax
dec ecx
cmp eax, 0x9405e115
jne 0x43e780
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43e7b2
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push dword [0x450718]
push esi
call fcn.00441310
add esp, 0x1c
jmp 0x43e7b2

Function at 0x43e800
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43e8aa
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xd8dbdac5
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 4
xor esi, 0xd4
mov ebx, edx
and ebx, 3
sub ebx, esi
add bl, 0x23
xor bl, byte [esp + edx]
add bl, 0x75
mov byte [esp + edx], bl
inc edx
cmp edx, 7
jne 0x43e830
mov edx, dword [0x450710]
test edx, edx
je 0x43e89e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x450714]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43e880
inc edi
cmp edx, edi
jne 0x43e870
jmp 0x43e89e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43e89e
push eax
push 1
push dword [0x450718]
push edx
mov esi, ecx
call fcn.00441310
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43ebb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43ec3e
push 0xbbf966b4
push dword [0x450704]
call fcn.00443ee0
add esp, 8
test eax, eax
je 0x43ec09
mov ecx, dword [esi]
test ecx, ecx
je 0x43ec3b
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43ec17
cmp dword [esp], 0
je 0x43ec17
mov dword [esi + 4], 3
jmp 0x43ec3b
mov dword [esi + 4], 1
mov ecx, dword [esi]
jmp 0x43ecb7
lea eax, [esp + 8]
push eax
call fcn.004445d0
add esp, 4
test al, al
je 0x43ec3b
mov eax, dword [esp + 8]
mov ecx, 2
cmp eax, 3
je 0x43ec38
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, 2
jne 0x43ecb7
mov dword [esp], 0xd8dbdac5
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 4
xor esi, 0xd4
mov edx, eax
and edx, 3
sub edx, esi
add dl, 0x23
xor dl, byte [esp + eax]
add dl, 0x75
mov byte [esp + eax], dl
inc eax
cmp eax, 7
jne 0x43ec60
mov eax, dword [esp]
mov edx, dword [0x450710]
test edx, edx
je 0x43ed54
mov ebp, ebx
xor esi, esi
mov ebx, dword [0x450714]
nop
cmp dword [ebx + esi*8], 0xc3cdc4a6
je 0x43ed30
inc esi
cmp edx, esi
jne 0x43eca0
jmp 0x43ed54
mov dword [esp], 0xd8dbdac5
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
mov esi, eax
and esi, 4
xor esi, 0xd4
mov edx, eax
and edx, 3
sub edx, esi
add dl, 0x23
xor dl, byte [esp + eax]
add dl, 0x75
mov byte [esp + eax], dl
inc eax
cmp eax, 7
jne 0x43ecd0
mov eax, dword [esp]
mov edx, dword [0x450710]
test edx, edx
je 0x43ed54
xor esi, esi
mov ebx, dword [0x450714]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xae6e2b0b
je 0x43ed20
inc esi
cmp edx, esi
jne 0x43ed10
jmp 0x43ed54
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43ed54
push ebp
push edi
push dword [esp + 0x2c]
jmp 0x43ed3e
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43ed54
push dword [esp + 0x2c]
push edi
push ebp
push dword [esp + 0x2c]
push ecx
push 5
push dword [0x450718]
push edx
call fcn.00441310
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43f070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43f089
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43f09a
cmp eax, 2
je 0x43f110
jmp 0x43f13d
push 0xbbf966b4
push dword [0x450704]
call fcn.00443ee0
add esp, 8
test eax, eax
je 0x43f0db
mov ecx, dword [esi]
test ecx, ecx
je 0x43f108
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43f0e4
cmp dword [esp + 4], 0
je 0x43f0e4
mov dword [esi + 4], 3
jmp 0x43f108
mov dword [esi + 4], 1
jmp 0x43f13d
lea eax, [esp + 0xc]
push eax
call fcn.004445d0
add esp, 4
test al, al
je 0x43f108
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43f105
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43f13d
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x45872c]
call fcn.00443ee0
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43f1d4
mov ecx, dword [esi]
mov dword [esp + 4], 0xd8dbdac5
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 4
xor esi, 0xd4
mov edx, eax
and edx, 3
sub edx, esi
add dl, 0x23
xor dl, byte [esp + eax + 4]
add dl, 0x75
mov byte [esp + eax + 4], dl
inc eax
cmp eax, 7
jne 0x43f160
mov eax, dword [esp + 4]
mov edx, dword [0x450710]
test edx, edx
je 0x43f1d4
xor esi, esi
mov ebx, dword [0x450714]
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x43f1b0
inc esi
cmp edx, esi
jne 0x43f1a0
jmp 0x43f1d4
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43f1d4
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x450718]
push edx
call fcn.00441310
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x441250
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44e984]
Function at 0x442600
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x442672
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, edx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x4427ee
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x4427ee
mov dword [esp], 0x383b3a3d
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x598bd3cb
mov ecx, 0x34
nop
movzx edi, byte [esp + eax - 0x598bd3cb]
mov edx, ecx
xor edx, eax
and edx, edi
xor edx, eax
mov edi, 0x77
sub edi, edx
add edx, 8
and edi, 0x53
and edx, 0xac
sub edx, edi
add dl, 0x54
mov byte [esp + eax - 0x598bd3cb], dl
inc eax
dec ecx
cmp eax, 0x598bd3d2
jne 0x442690
mov eax, dword [esp]
mov ecx, dword [0x450710]
test ecx, ecx
je 0x44271a
xor edx, edx
mov edi, dword [0x450714]
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x4426f0
inc edx
cmp ecx, edx
jne 0x4426e0
jmp 0x44271a
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x44271a
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x450718]
push ecx
call fcn.00441310
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x24]
js 0x4427ee
push 0x732f71fd
push dword [0x45872c]
call fcn.00443ee0
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x383b3a3d
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov edx, 0x598bd3cb
mov esi, 0x34
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx - 0x598bd3cb]
mov ebx, esi
xor ebx, edx
and ebx, edi
xor ebx, edx
mov edi, 0x77
sub edi, ebx
add ebx, 8
and edi, 0x53
and ebx, 0xac
sub ebx, edi
add bl, 0x54
mov byte [esp + edx - 0x598bd3cb], bl
inc edx
dec esi
cmp edx, 0x598bd3d2
jne 0x442770
mov edx, dword [0x450710]
test edx, edx
je 0x4427ee
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x450714]
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x4427d0
inc edi
cmp edx, edi
jne 0x4427c0
jmp 0x4427ee
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x4427ee
push ecx
push 1
push dword [0x450718]
push edx
mov esi, eax
call fcn.00441310
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
movzx eax, word [ebp]
mov dword [esp], 0x313ed5e3
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
mov edi, ecx
and edi, 2
mov ebx, edx
xor ebx, 0x65b6f075
add ebx, edi
mov edi, ebx
and edi, esi
add ebx, esi
add edi, edi
sub ebx, edi
add bl, 0xb7
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 4
jne case.default.0x443f36
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44f294]
Function at 0x444641
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x444630
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x44464b
mov eax, 0xffffffff
jmp 0x44464e
add eax, 0xa
push eax
call fcn.0040cd40
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x444691
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x444680
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xb08f8e8d
mov byte [esp + 4], 0
mov ecx, 0xb6483e23
mov edx, 0x49b7c2dc
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0x49b7c2dc]
lea edi, [edx - 0x49b7c1ff]
and edi, esi
mov ebx, edi
and ebx, 0xfffffffd
mov ebp, edi
and ebp, 2
or edi, 2
imul edi, ebp
xor ebp, 2
imul ebp, ebx
add edi, ebp
lea ebp, [ecx + edi]
mov ebx, edx
sub ebx, edi
and ebx, esi
not esi
and esi, ebp
sub ebx, esi
add bl, 0xaf
mov byte [esp + edx - 0x49b7c2dc], bl
dec ecx
inc edx
cmp ecx, 0xb6483e1e
jne 0x444710
mov esi, dword [esp]
mov ecx, dword [0x450710]
test ecx, ecx
je 0x4447c5
xor edx, edx
mov edi, dword [0x450714]
cmp dword [edi + edx*8], 0xbb9b186e
je 0x444780
inc edx
cmp ecx, edx
jne 0x444770
jmp 0x4447c5
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x4447c5
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0xb
push dword [0x450718]
push ecx
mov edi, eax
call fcn.00441310
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.0040cd50
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4447e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x4447f0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x44480b
mov eax, 0xffffffff
jmp 0x44480e
add eax, 0xa
push eax
call fcn.0040cd40
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x444851
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x444840
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov ebx, esi
xor ebx, 2
imul ebx, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xb08f8e8d
mov byte [esp + 4], 0
mov ecx, 0xb6483e23
mov ebp, 0x49b7c2dc
nop
nop
nop
nop
nop
movzx esi, byte [esp + ebp - 0x49b7c2dc]
lea ebx, [ebp - 0x49b7c1ff]
and ebx, esi
mov edx, ebx
and edx, 0xfffffffd
mov edi, ebx
and edi, 2
or ebx, 2
imul ebx, edi
xor edi, 2
imul edi, edx
add ebx, edi
lea edi, [ecx + ebx]
mov edx, ebp
sub edx, ebx
and edx, esi
not esi
and esi, edi
sub edx, esi
add dl, 0xaf
mov byte [esp + ebp - 0x49b7c2dc], dl
dec ecx
inc ebp
cmp ecx, 0xb6483e1e
jne 0x4448d0
mov esi, dword [esp]
mov ecx, dword [0x450710]
test ecx, ecx
je 0x444977
xor edx, edx
mov ebx, dword [0x450714]
cmp dword [ebx + edx*8], 0x1affabda
je 0x444940
inc edx
cmp ecx, edx
jne 0x444930
jmp 0x444977
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x444977
mov edx, esp
lea esi, [esp + 0x10]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push dword [0x450718]
push ecx
mov edi, eax
call fcn.00441310
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040cd50
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4449b0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x4449cb
mov eax, 0xffffffff
jmp 0x4449ce
add eax, 0xa
push eax
call fcn.0040cd40
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp + 4], eax
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x444a11
add esi, 2
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x444a00
mov word [ecx], 0
lea eax, [ebx*2 + 8]
mov word [esp + 8], ax
lea eax, [ebx*2 + 0xa]
mov word [esp + 0xa], ax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xb08f8e8d
mov byte [esp + 0x2c], 0
mov ecx, 0xb6483e23
mov esi, 0x49b7c2dc
nop
nop
nop
movzx eax, byte [esp + esi - 0x49b7c2b4]
lea ebx, [esi - 0x49b7c1ff]
and ebx, eax
mov edi, ebx
and edi, 0xfffffffd
mov edx, ebx
and edx, 2
or ebx, 2
imul ebx, edx
xor edx, 2
imul edx, edi
add ebx, edx
mov edx, esi
sub edx, ebx
lea edi, [ecx + ebx]
and edx, eax
not eax
and eax, edi
sub edx, eax
add dl, 0xaf
mov byte [esp + esi - 0x49b7c2b4], dl
dec ecx
inc esi
cmp ecx, 0xb6483e1e
jne 0x444a80
mov esi, dword [esp + 0x28]
mov ecx, dword [0x450710]
test ecx, ecx
je 0x444b25
xor edx, edx
mov ebx, dword [0x450714]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x50dc24c7
je 0x444b00
inc edx
cmp ecx, edx
jne 0x444af0
jmp 0x444b25
mov eax, dword [ebx + edx*8 + 4]
cmp eax, esi
je 0x444b25
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push ecx
push edx
push 2
push dword [0x450718]
push eax
call fcn.00441310
add esp, 0x14
mov esi, eax
push dword [esp + 4]
call fcn.0040cd50
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x444b3e
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp], 0xb08f8e8d
mov byte [esp + 4], 0
mov eax, 0xb6483e23
mov edi, 0x49b7c2dc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edi - 0x49b7c2dc]
lea ecx, [edi - 0x49b7c1ff]
and ecx, ebx
mov esi, ecx
and esi, 0xfffffffd
mov edx, ecx
and edx, 2
or ecx, 2
imul ecx, edx
xor edx, 2
imul edx, esi
add ecx, edx
mov edx, edi
sub edx, ecx
add ecx, eax
and edx, ebx
not ebx
and ebx, ecx
sub edx, ebx
add dl, 0xaf
mov byte [esp + edi - 0x49b7c2dc], dl
dec eax
inc edi
cmp eax, 0xb6483e1e
jne 0x444b80
mov eax, dword [esp]
mov ecx, dword [0x450710]
test ecx, ecx
je 0x444c18
xor edx, edx
mov ebx, dword [0x450714]
nop
nop
cmp dword [ebx + edx*8], 0x7cde1e50
je 0x444bf0
inc edx
cmp ecx, edx
jne 0x444be0
jmp 0x444c18
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x444c18
mov eax, esp
lea edx, [esp + 0x1c]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 5
push dword [0x450718]
push ecx
call fcn.00441310
add esp, 0x20
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x444c25
mov ecx, dword [esp + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x444c34
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov dword [esp], 0xb08f8e8d
mov byte [esp + 4], 0
mov eax, 0xb6483e23
mov esi, 0x49b7c2dc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + esi - 0x49b7c2dc]
lea edi, [esi - 0x49b7c1ff]
and edi, ebp
mov ebx, edi
and ebx, 0xfffffffd
mov ecx, edi
and ecx, 2
or edi, 2
imul edi, ecx
xor ecx, 2
imul ecx, ebx
add edi, ecx
lea ecx, [eax + edi]
mov ebx, esi
sub ebx, edi
and ebx, ebp
not ebp
and ebp, ecx
sub ebx, ebp
add bl, 0xaf
mov byte [esp + esi - 0x49b7c2dc], bl
dec eax
inc esi
cmp eax, 0xb6483e1e
jne 0x444c70
mov eax, dword [esp]
mov edi, dword [0x450710]
test edi, edi
je 0x444d12
xor ebx, ebx
mov ebp, dword [0x450714]
nop
cmp dword [ebp + ebx*8], 0xc81e0bf6
je 0x444ce1
inc ebx
cmp edi, ebx
jne 0x444cd0
jmp 0x444d12
mov ebx, dword [ebp + ebx*8 + 4]
cmp ebx, eax
je 0x444d12
lea eax, [esp + 8]
push 0
push 0
push edx
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push dword [0x450718]
push ebx
call fcn.00441310
add esp, 0x30
cmp eax, 0x103
jne 0x444dd9
mov dword [esp], 0xb08f8e8d
mov byte [esp + 4], 0
mov eax, 0xb6483e23
mov ecx, 0x49b7c2dc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x49b7c2dc]
lea edi, [ecx - 0x49b7c1ff]
and edi, edx
mov esi, edi
and esi, 0xfffffffd
mov ebx, edi
and ebx, 2
or edi, 2
imul edi, ebx
xor ebx, 2
imul ebx, esi
add edi, ebx
lea esi, [eax + edi]
mov ebx, ecx
sub ebx, edi
and ebx, edx
not edx
and edx, esi
sub ebx, edx
add bl, 0xaf
mov byte [esp + ecx - 0x49b7c2dc], bl
dec eax
inc ecx
cmp eax, 0xb6483e1e
jne 0x444d40
mov eax, dword [esp]
mov ecx, dword [0x450710]
test ecx, ecx
je 0x444dd1
xor edx, edx
mov edi, dword [0x450714]
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x444db0
inc edx
cmp ecx, edx
jne 0x444da0
jmp 0x444dd1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x444dd1
push 0
push 0
push dword [esp + 0x2c]
push 3
push dword [0x450718]
push ecx
call fcn.00441310
add esp, 0x18
test eax, eax
js 0x444dd9
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x444df0
xor ecx, ecx
cmp eax, 0xc0000011
je 0x444dee
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret