joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ede0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc0000008
cmp dword [ecx + 4], 0
je 0x43efe9
mov edx, dword [ecx]
test edx, edx
je 0x43efe9
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp], 0x62656467
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov word [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
and edi, 1
mov esi, eax
and esi, 0xfffffffe
sub edi, esi
movzx ebx, byte [esp + eax]
mov esi, eax
xor esi, 0xe71b0e31
add esi, eax
add esi, edi
mov edi, esi
and edi, ebx
or esi, ebx
lea ebx, [esi + esi]
not ebx
add ebx, esi
or ebx, edi
lea esi, [ebx + ebx]
not esi
add esi, ebx
mov dword [esp + 0x10], esi
mov ebx, dword [esp + 0x10]
mov esi, ebx
not esi
and ebx, 0x96
and esi, 0x69
sub ebx, esi
add bl, 0x12
mov byte [esp + eax], bl
inc eax
cmp eax, 0xe
jne 0x43ee30
mov eax, dword [esp]
mov ebx, dword [0x44fb4c]
test ebx, ebx
je 0x43eed1
xor edi, edi
mov esi, dword [0x44fb50]
nop
nop
nop
nop
nop
nop
cmp dword [esi + edi*8], 0x45a3f4b9
je 0x43eeb0
inc edi
cmp ebx, edi
jne 0x43eea0
jmp 0x43eed1
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
je 0x43eed1
push dword [ebp + 8]
push edx
push 2
push dword [0x44fb54]
push esi
mov esi, ecx
call fcn.00440280
mov ecx, esi
add esp, 0x14
mov edi, dword [ebp + 0xc]
cmp edi, 1
mov esi, dword [ebp + 0x10]
mov edx, esi
sbb edx, 0
jl 0x43efd5
cmp eax, 0xc000010a
jne 0x43efd5
mov edx, 0xffffd8f0
mov eax, edi
mul edx
sub edx, edi
imul esi, esi, 0xffffd8f0
add esi, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov edx, dword [ecx]
mov dword [esp], 0x62656467
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov word [esp + 0xc], 0
xor eax, eax
nop
nop
nop
mov edi, eax
and edi, 1
mov esi, eax
and esi, 0xfffffffe
sub edi, esi
movzx ebx, byte [esp + eax]
mov esi, eax
xor esi, 0xe71b0e31
add esi, eax
add esi, edi
mov edi, esi
and edi, ebx
or esi, ebx
lea ebx, [esi + esi]
not ebx
add ebx, esi
or ebx, edi
lea esi, [ebx + ebx]
not esi
add esi, ebx
mov dword [esp + 0x18], esi
mov ebx, dword [esp + 0x18]
mov esi, ebx
not esi
and ebx, 0x96
and esi, 0x69
sub ebx, esi
add bl, 0x12
mov byte [esp + eax], bl
inc eax
cmp eax, 0xe
jne 0x43ef30
mov eax, dword [esp]
mov esi, dword [0x44fb4c]
test esi, esi
je 0x43efd5
xor edi, edi
mov ebx, dword [0x44fb50]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x39c83604
je 0x43efb0
inc edi
cmp esi, edi
jne 0x43efa0
jmp 0x43efd5
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43efd5
lea eax, [esp + 0x10]
push eax
push 0
push edx
push 3
push dword [0x44fb54]
push esi
mov esi, ecx
call fcn.00440280
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43efe2
mov esi, eax
call fcn.0043ece0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43eff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], 0x62656467
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov word [esp + 0x14], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 1
mov edx, eax
and edx, 0xfffffffe
sub esi, edx
movzx edi, byte [esp + eax + 8]
mov edx, eax
xor edx, 0xe71b0e31
add edx, eax
add edx, esi
mov esi, edx
and esi, edi
or edx, edi
lea edi, [edx + edx]
not edi
add edi, edx
or edi, esi
lea edx, [edi + edi]
not edx
add edx, edi
mov dword [esp + 4], edx
mov edx, dword [esp + 4]
mov esi, edx
not esi
and edx, 0x96
and esi, 0x69
sub edx, esi
add dl, 0x12
mov byte [esp + eax + 8], dl
inc eax
cmp eax, 0xe
jne 0x43f030
test ebx, ebx
jne 0x43f08f
lea ebx, [esp + 4]
mov eax, dword [esp + 8]
mov edx, dword [0x44fb4c]
test edx, edx
je 0x43f0e4
xor esi, esi
mov edi, dword [0x44fb50]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xaead8b9f
je 0x43f0c0
inc esi
cmp edx, esi
jne 0x43f0b0
jmp 0x43f0e4
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x43f0e4
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
push 5
push dword [0x44fb54]
push edx
call fcn.00440280
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x440110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, eax
test ecx, ecx
sete al
jmp dword [eax*4 + 0x44d990]

Function at 0x4402c0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x280
push dword [0x457b64]
call fcn.00441210
add esp, 4
movzx eax, al
jmp dword [eax*4 + 0x44dc9c]

Function at 0x441210
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov eax, dword [ebp + 8]
push eax
sub esp, 0xc
mov ecx, esp
and ecx, 0xfffffff8
mov esp, ecx
push eax
sub esp, 0x18
mov dword [esi + 0x20], esp
sub esp, 8
mov dword [esi + 0x30], esp
movzx eax, word [eax]
mov dword [esi + 4], 0xe64a709e
mov edx, dword [esi + 4]
add edx, 0xaf
movzx edi, dl
mov dword [esi + 4], 0xe64a70ab
mov edx, dword [esi + 4]
shl edx, 8
add edx, 0xaf00
movzx edx, dx
or edx, edi
mov dword [esi + 4], 0xe64a7051
mov edi, dword [esi + 4]
shl edi, 0x10
add edi, 0xaf0000
mov dword [esi + 4], 0xe64a7051
and edi, 0xff0000
or edi, edx
mov edx, dword [esi + 4]
shl edx, 0x18
add edi, edx
add edi, 0xaf000000
xor edx, edx
cmp edi, eax
mov dword [esi + 4], 0xe64a70eb
mov eax, dword [esi + 4]
mov dword [esi + 4], 0xe64a70ec
mov eax, dword [esi + 4]
mov dword [esi + 4], 0xe64a70ed
mov eax, dword [esi + 4]
mov dword [esi + 4], 0xe64a70ee
mov eax, dword [esi + 4]
mov dword [esi + 4], 0xe64a70ef
mov eax, dword [esi + 4]
setne dl
xor eax, eax
jmp dword [edx*4 + 0x44ddcc]

Function at 0x4418f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, esp
push eax
sub esp, 0xc
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [eax], 0x23222d1c
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [esi + 4], eax
mov word [eax + 0xc], 0
mov ecx, 0x27
mov edx, 0xfd6479d9
mov eax, dword [esi + 4]
movzx edi, byte [eax + ecx - 0x27]
lea ebx, [edi + edi]
not ebx
add ebx, edi
lea eax, [ebx + ebx]
not eax
add eax, ebx
lea ebx, [edx + 0x14dc300]
or ebx, eax
and edi, edx
mov eax, edi
not eax
or eax, ebx
sub edi, ebx
add edi, eax
mov dword [esi + 0x14], edi
mov ebx, dword [esi + 0x14]
mov eax, ebx
xor eax, 0xa
and ebx, 0x75
add ebx, ebx
sub ebx, eax
mov eax, dword [esi + 4]
mov byte [eax + ecx - 0x27], bl
inc ecx
dec edx
cmp ecx, 0x35
jne 0x441930
mov eax, dword [esi + 4]
mov eax, dword [eax]
mov edx, dword fs:[eax]
mov ecx, dword [0x44e4a0]
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
Function at 0x441d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x5b5a59a8
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1b], 0
mov eax, 0x8bc94b19
mov esi, 0x17929632
nop
nop
nop
mov dword [esp], esi
movzx ecx, byte [esp + eax + 0x7436b4f7]
mov edi, eax
xor edi, 0xd5bb00e5
mov esi, dword [esp]
and esi, 0x14809634
sub esi, edi
lea edi, [ecx + ecx]
not edi
add edi, ecx
or edi, ecx
mov edx, 0xfffffffe
sub edx, edi
sub edx, ecx
add edi, ecx
inc edi
and edx, 0xd9cb4f6e
and edi, 0x2634b091
or edi, edx
mov edx, edi
xor edx, 0x2634b091
xor edi, 0xd9cb4f6e
lea ebx, [edx*2 + 1]
and ebx, edi
lea edi, [edx + edx]
xor edi, 0xfffffffe
and edi, edx
sub edi, ebx
mov edx, esi
not edx
lea edx, [esi + edx*2]
inc edx
or edx, edi
not ecx
or ecx, esi
mov edi, ecx
and edi, 2
mov esi, ecx
or esi, 2
imul esi, edi
xor edi, 2
sub esi, ecx
and ecx, 0xfffffffd
imul ecx, edi
add esi, ecx
and esi, edx
not esi
mov dword [esp + 0xc], esi
mov ecx, dword [esp + 0xc]
mov edx, ecx
neg edx
mov esi, ecx
or esi, 0xfa64076c
mov edi, esi
and edi, edx
xor esi, edx
lea edx, [esi + edi*2]
mov esi, dword [esp]
and ecx, 0x93
sub ecx, edx
mov byte [esp + eax + 0x7436b4f7], cl
inc eax
add esi, 2
cmp eax, 0x8bc94b28
jne 0x441d40
mov eax, dword [esp + 0x10]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
jmp dword [ecx*4 + 0x44e574]

Function at 0x441f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 8], 0x4b545506
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edi + 8]
lea edx, [edi - 0x5e58733]
lea ecx, [eax + eax]
not ecx
add ecx, eax
lea esi, [ecx + ecx]
not esi
add esi, ecx
add esi, esi
not esi
add esi, eax
or esi, ecx
mov ebx, 0xe58732
sub ebx, edi
mov ecx, edx
and ecx, 0x581840d6
and ebx, 0x810409
or ebx, ecx
mov ecx, eax
mov dword [esp], eax
not ecx
xor ebx, esi
xor ebx, 0xa2833c09
or esi, edx
not esi
or esi, ebx
lea ebx, [eax + ecx*2]
mov eax, SysReAllocString
sub eax, ebx
mov ebx, dword [esp]
lea ebx, [ebx + ecx*2]
inc ebx
mov ecx, ebx
and eax, 0x68d486c3
and ebx, 0x972b793c
or ebx, eax
lea eax, [edi*2 - 0xbcb0e66]
not eax
add eax, edi
add eax, 0xfa1a78cd
and ecx, edx
and eax, 0xc48643
and edx, 0x920a781c
or edx, eax
xor edx, ebx
or edx, ecx
and edx, esi
not edx
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0x65
mov byte [esp + edi + 8], al
mov eax, edi
and eax, 1
xor edi, 1
lea edi, [edi + eax*2]
cmp edi, 0xb
jb 0x441f50
mov ecx, dword [esp + 8]
jmp dword [0x44e5d4]
Function at 0x4420c0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
mov dword [esp + 8], 0x333493e5
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov eax, 0x13a35c68
mov esi, 0x6c5ca397
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x13a35c60]
mov ebx, esi
and ebx, 0x40402007
mov edx, eax
and edx, 0x11235058
sub edx, ebx
lea ebx, [edx + 0x6c5ca398]
and ebx, edi
add edx, edi
add edx, 0x6c5ca398
add ebx, ebx
sub edx, ebx
mov dword [esp + 4], edx
mov edx, dword [esp + 4]
add dl, 0x11
mov byte [esp + eax - 0x13a35c60], dl
inc eax
dec esi
cmp eax, 0x13a35c78
jne 0x442100
xor eax, eax
cmp dword [esp + 8], ecx
setne al
jmp dword [eax*4 + 0x44e634]
Function at 0x442e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x442e40
mov edi, eax
sar edi, 1
add edi, 4
and eax, 2
mov ecx, edi
xor ecx, 1
add ecx, eax
jns 0x442e65
mov ecx, 0xffffffff
jmp 0x442e67
add ecx, ecx
push ecx
call fcn.00409230
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp + 4], eax
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x442eb1
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x442ea0
mov word [ecx], 0
lea ecx, [edi + edi]
mov word [esp + 0xc], cx
lea ecx, [edi*2 + 2]
mov word [esp + 0xe], cx
mov eax, dword [esp + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], 0x18
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x18], 0xd2d1d0d7
mov dword [esp + 0x1c], 0
mov byte [esp + 0x20], 0
mov ecx, 0x4dcce63
mov edx, 0xfb23319c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 8], edx
movzx ebx, byte [esp + ecx - 0x4dcce4b]
mov esi, ebx
not esi
mov edx, esi
and edx, 0x498e514
mov edi, ebx
and edi, 0xffffffeb
or edi, edx
mov edx, edi
xor edx, 0x3671aeb
xor edi, 0x498e514
mov eax, edi
xor esi, edi
add edi, edx
mov edx, dword [esp + 8]
add edi, esi
and eax, ebx
sub edi, eax
inc edi
or edi, edx
add edi, 0x8000000
or ebx, ecx
and ebx, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x14]
add al, 0x4b
mov byte [esp + ecx - 0x4dcce4b], al
inc ecx
dec edx
cmp ecx, 0x4dcce6c
jne 0x442f30
mov esi, dword [esp + 0x18]
mov ecx, dword [0x44fb4c]
test ecx, ecx
je 0x442ffd
xor edx, edx
mov edi, dword [0x44fb50]
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xbc8a835b
je 0x442fc0
inc edx
cmp ecx, edx
jne 0x442fb0
jmp 0x442ffd
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x442ffd
lea eax, [esp + 0x18]
lea edx, [esp + 0x2c]
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push 0
push eax
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xb
push dword [0x44fb54]
push ecx
call fcn.00440280
add esp, 0x38
mov esi, eax
push dword [esp + 4]
call fcn.00409240
add esp, 4
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov edi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x443040
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x44305b
mov eax, 0xffffffff
jmp 0x44305e
add eax, 0xa
push eax
call fcn.00409230
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov dword [esp + 4], eax
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x4430b1
add edi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x4430a0
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov edi, ecx
and edi, 0xfffd
imul edi, edx
and esi, 2
or ecx, 2
imul ecx, esi
add ecx, edi
mov word [esp + 0xc], cx
mov edx, ecx
and edx, 2
or ecx, 2
add ecx, edx
mov word [esp + 0xe], cx
mov eax, dword [esp + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], 0x18
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x18], 0xd2d1d0d7
mov dword [esp + 0x1c], 0
mov byte [esp + 0x20], 0
mov ecx, 0x4dcce63
mov edx, 0xfb23319c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 8], edx
movzx esi, byte [esp + ecx - 0x4dcce4b]
mov ebx, esi
not ebx
mov edx, ebx
and edx, 0x498e514
mov edi, esi
and edi, 0xffffffeb
or edi, edx
mov edx, edi
xor edx, 0x3671aeb
xor edi, 0x498e514
mov eax, edi
xor ebx, edi
add edi, edx
mov edx, dword [esp + 8]
add edi, ebx
and eax, esi
sub edi, eax
inc edi
or edi, edx
add edi, 0x8000000
or esi, ecx
and esi, edi
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x14]
add al, 0x4b
mov byte [esp + ecx - 0x4dcce4b], al
inc ecx
dec edx
cmp ecx, 0x4dcce6c
jne 0x443150
mov esi, dword [esp + 0x18]
mov ecx, dword [0x44fb4c]
test ecx, ecx
je 0x443211
xor edx, edx
mov edi, dword [0x44fb50]
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xcd669f2f
je 0x4431e0
inc edx
cmp ecx, edx
jne 0x4431d0
jmp 0x443211
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x443211
lea eax, [esp + 0x18]
lea edx, [esp + 0x2c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x44fb54]
push ecx
call fcn.00440280
add esp, 0x24
mov esi, eax
push dword [esp + 4]
call fcn.00409240
add esp, 4
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x443250
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x44326b
mov eax, 0xffffffff
jmp 0x44326e
add eax, 0xa
push eax
call fcn.00409230
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp + 4], eax
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x4432b1
add esi, 2
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x4432a0
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 0xc], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xe], cx
mov eax, dword [esp + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0xd2d1d0d7
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
mov ecx, 0x4dcce63
mov edx, 0xfb23319c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 8], edx
movzx edi, byte [esp + ecx - 0x4dcce33]
mov esi, edi
not esi
mov edx, esi
and edx, 0x498e514
mov ebx, edi
and ebx, 0xffffffeb
or ebx, edx
mov edx, ebx
xor edx, 0x3671aeb
xor ebx, 0x498e514
mov eax, ebx
xor esi, ebx
add ebx, edx
mov edx, dword [esp + 8]
add ebx, esi
and eax, edi
sub ebx, eax
inc ebx
or ebx, edx
add ebx, 0x8000000
or edi, ecx
and edi, ebx
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x14]
add al, 0x4b
mov byte [esp + ecx - 0x4dcce33], al
inc ecx
dec edx
cmp ecx, 0x4dcce6c
jne 0x443330
mov esi, dword [esp + 0x30]
mov ecx, dword [0x44fb4c]
test ecx, ecx
je 0x4433e5
xor edx, edx
mov edi, dword [0x44fb50]
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xdcc9f508
je 0x4433c0
inc edx
cmp ecx, edx
jne 0x4433b0
jmp 0x4433e5
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x4433e5
lea eax, [esp + 0x30]
lea edx, [esp + 0x18]
push eax
push edx
push 2
push dword [0x44fb54]
push ecx
call fcn.00440280
add esp, 0x14
mov esi, eax
push dword [esp + 4]
call fcn.00409240
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4433fe
mov eax, dword [esp + 0x50]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0xd2d1d0d7
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov eax, 0x4dcce63
mov edx, 0xfb23319c
nop
nop
nop
nop
nop
mov dword [esp + 4], edx
movzx esi, byte [esp + eax - 0x4dcce5b]
mov ecx, esi
not ecx
mov edi, ecx
and edi, 0x498e514
mov ebx, esi
and ebx, 0xffffffeb
or ebx, edi
mov edi, ebx
xor edi, 0x3671aeb
xor ebx, 0x498e514
mov edx, ebx
xor ecx, ebx
add ebx, edi
add ebx, ecx
and edx, esi
sub ebx, edx
mov edx, dword [esp + 4]
inc ebx
or ebx, edx
add ebx, 0x8000000
or esi, eax
and esi, ebx
mov dword [esp + 0x24], esi
mov ecx, dword [esp + 0x24]
add cl, 0x4b
mov byte [esp + eax - 0x4dcce5b], cl
inc eax
dec edx
cmp eax, 0x4dcce6c
jne 0x443440
mov eax, dword [esp + 8]
mov ecx, dword [0x44fb4c]
test ecx, ecx
je 0x4434fa
xor edx, edx
mov esi, dword [0x44fb50]
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xd75bc899
je 0x4434d0
inc edx
cmp ecx, edx
jne 0x4434c0
jmp 0x4434fa
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x4434fa
lea eax, [esp + 8]
lea edx, [esp + 0x24]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 5
push dword [0x44fb54]
push ecx
call fcn.00440280
add esp, 0x20
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x443507
mov ecx, dword [esp + 0x10]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x443516
cmp byte [esp + 0x1d], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0xd2d1d0d7
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov eax, 0x4dcce63
mov edx, 0xfb23319c
nop
nop
nop
nop
nop
mov dword [esp + 4], edx
movzx ecx, byte [esp + eax - 0x4dcce5b]
mov esi, ecx
not esi
mov edx, esi
and edx, 0x498e514
mov edi, ecx
and edi, 0xffffffeb
or edi, edx
mov edx, edi
xor edx, 0x3671aeb
xor edi, 0x498e514
mov ebx, edi
xor esi, edi
add edi, edx
mov edx, dword [esp + 4]
add edi, esi
and ebx, ecx
sub edi, ebx
inc edi
or edi, edx
add edi, 0x8000000
or ecx, eax
and ecx, edi
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
add cl, 0x4b
mov byte [esp + eax - 0x4dcce5b], cl
inc eax
dec edx
cmp eax, 0x4dcce6c
jne 0x443550
mov eax, dword [esp + 8]
mov ecx, dword [0x44fb4c]
test ecx, ecx
je 0x443611
xor esi, esi
mov edi, dword [0x44fb50]
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x47a01aa3
je 0x4435e0
inc esi
cmp ecx, esi
jne 0x4435d0
jmp 0x443611
mov esi, dword [edi + esi*8 + 4]
cmp esi, eax
je 0x443611
lea eax, [esp + 0x18]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x44fb54]
push esi
call fcn.00440280
add esp, 0x30
cmp eax, 0x103
jne 0x4436f8
mov dword [esp + 8], 0xd2d1d0d7
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov eax, 0x4dcce63
mov edi, 0xfb23319c
nop
nop
nop
nop
nop
mov dword [esp + 4], edi
movzx edx, byte [esp + eax - 0x4dcce5b]
mov edi, edx
not edi
mov ebx, edi
and ebx, 0x498e514
mov esi, edx
and esi, 0xffffffeb
or esi, ebx
mov ebx, esi
xor ebx, 0x3671aeb
xor esi, 0x498e514
mov ecx, esi
xor edi, esi
add esi, ebx
add esi, edi
mov edi, dword [esp + 4]
and ecx, edx
sub esi, ecx
inc esi
or esi, edi
add esi, 0x8000000
or edx, eax
and edx, esi
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x20]
add cl, 0x4b
mov byte [esp + eax - 0x4dcce5b], cl
inc eax
dec edi
cmp eax, 0x4dcce6c
jne 0x443640
mov eax, dword [esp + 8]
mov ecx, dword [0x44fb4c]
test ecx, ecx
je 0x4436f0
xor edx, edx
mov esi, dword [0x44fb50]
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x39c83604
je 0x4436d0
inc edx
cmp ecx, edx
jne 0x4436c0
jmp 0x4436f0
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x4436f0
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x44fb54]
push ecx
call fcn.00440280
add esp, 0x18
test eax, eax
js 0x4436f8
mov eax, dword [esp + 0x18]
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x44370e
xor ecx, ecx
cmp eax, 0xc0000011
je 0x44370c
mov ecx, dword [esp + 0x1c]
mov dword [edx], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret