joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a57d
Capabilities:
Encode data using xor

Disassembly:
push eax
sub esp, 0x14
mov edx, esp
sub esp, 0x54
mov dword [ebp - 0x2c], esp
sub esp, 0xc
mov dword [ebp - 0x28], esp
sub esp, 0x28
mov dword [ebp - 0x24], esp
sub esp, 0x2c
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 0x40], esp
push eax
mov dword [ebp - 0x30], esp
sub esp, 0x24
mov dword [ebp - 0x38], esp
sub esp, 0x40
mov dword [ebp - 0x18], esp
sub esp, 0x44
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 0x14], esp
sub esp, 8
mov dword [ebp - 0x34], esp
push eax
mov dword [ebp - 0x48], esp
push eax
mov dword [ebp - 0x44], esp
sub esp, 0x28
mov dword [ebp - 0x60], esp
sub esp, 8
mov eax, esp
sub esp, 8
mov dword [ebp - 0x68], esp
sub esp, 8
mov dword [ebp - 0x3c], esp
sub esp, 0x24
mov dword [ebp - 0x6c], esp
mov dword [edx], 0x71c07fa7
mov dword [edx + 4], 0x75c673c5
mov dword [edx + 8], 0x49ca77d7
mov dword [edx + 0xc], 0x4d9a4bf4
mov dword [edx + 0x10], 0x41fa4fef
mov dword [edx + 0x14], 0x454243f8
xor ecx, ecx
mov dword [ebp - 0x10], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
mov esi, ecx
and esi, 0x1c
xor esi, 0xa96bd3fc
mov edi, ecx
and edi, 3
sub edi, esi
mov esi, edi
and esi, 0x10840815
xor edi, 0x18a41995
lea ebx, [edi + esi*2]
add ebx, 0xa96bd3fc
xor ebx, edx
mov edx, ebx
and edx, 1
or ebx, 1
add ebx, edx
mov edx, dword [ebp - 0x10]
add bl, 0x16
mov byte [edx + ecx], bl
inc ecx
cmp ecx, 0x18
jne 0x42a620
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], 0x912c9f30
mov dword [ecx + 4], 0x952b9357
mov dword [ecx + 8], 0x8923972f
mov dword [ecx + 0xc], 0x8d388b3c
mov dword [ecx + 0x10], 0x81228f27
mov dword [ecx + 0x14], 0x8541833f
mov dword [ecx + 0x18], 0x793e8741
mov dword [ecx + 0x1c], 0x7dc47bc3
mov dword [ecx + 0x20], 0x71d27fbb
mov dword [ecx + 0x24], 0x75c373c5
mov dword [ecx + 0x28], 0x69c277b2
mov dword [ecx + 0x2c], 0x6da96bc1
mov dword [ecx + 0x30], 0x61a96fde
mov dword [ecx + 0x34], 0x65d463cc
mov dword [ecx + 0x38], 0x59fa67c7
mov dword [ecx + 0x3c], 0x5dfd5bce
mov dword [ecx + 0x40], 0x51eb5ff0
mov dword [ecx + 0x44], 0x55f553c4
mov dword [ecx + 0x48], 0x49c957f7
mov word [ecx + 0x4c], 0x4b48
mov byte [ecx + 0x52], 0
mov dword [ecx + 0x4e], 0
mov edx, 0x39a6521a
nop
nop
nop
nop
nop
movzx esi, byte [ecx]
mov edi, edx
and edi, 0x202642df
lea ebx, [edx - 0x80000000]
and ebx, 0x99801120
or ebx, edi
xor esi, 0x267e4adf
xor ebx, 0xd981b520
mov edi, esi
and edi, ebx
add edi, edi
sub ebx, edi
add ebx, esi
mov esi, ebx
not esi
or esi, 0xa03f9a86
add esi, ebx
inc esi
mov edi, esi
and edi, 0xfffffffd
mov eax, esi
and eax, 2
or esi, 2
imul esi, eax
xor eax, 2
imul eax, edi
mov edi, ebx
xor edi, 0xa03f9a86
add edi, esi
add edi, eax
and ebx, 1
mov eax, edi
xor eax, 1
add ebx, edi
add ebx, eax
and edi, 0xfe
sub ebx, edi
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0x39a651c7
jne 0x42a710
push dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00439b20
add esp, 8
jmp dword [0x447d64]
Function at 0x42b030
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [ebp - 0x7c]
mov ebx, dword [ebp - 0x48]
jmp dword [esi*4 + 0x448048]
Function at 0x42b5f1
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp - 0x80]
add eax, 0x10
cmp dword [ebp - 0x60], 0xfffffff8
jge 0x42b602
mov eax, 0xffffffff
push eax
call fcn.004082b0
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x44]
mov dword [ecx], 0xb1ea8fdd
mov dword [ecx + 4], 0xb59cb320
mov dword [ecx + 8], 0xb92eb720
mov dword [ecx + 0xc], 0xbdbabb2c
mov ebx, 0x715a97e3
mov eax, 0xa5681d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ecx + eax - 0xa5681d]
mov dword [ebp - 0x14], esi
mov ecx, esi
xor ecx, 0xfea38f45
mov edx, esi
or edx, 0xba
and edx, ecx
mov edi, eax
or edi, 0xfea38f45
add edi, ebx
mov ecx, eax
and ecx, 0x4603a
or ecx, edi
mov edi, edx
and edi, 0x45
and esi, 0x18
or esi, edi
mov edi, dword [ebp - 0x14]
and edi, 0x45
and edx, 0xffffffe7
xor edx, edi
xor edx, 0x24238345
or edx, esi
xor edx, ecx
mov ecx, edx
xor ecx, 0x5a800c00
mov esi, edx
and esi, 0x493b0891
xor esi, 0x37fff7ff
add esi, ecx
xor edx, 0xec44fb6e
lea ecx, [edx + esi*2]
lea edx, [edx + esi*2]
add edx, 2
mov esi, edx
not esi
or esi, 1
add ecx, esi
add ecx, 2
xor edx, 1
lea ecx, [edx + ecx*2]
add cl, 2
mov edx, dword [ebp - 0x44]
mov byte [edx + eax - 0xa5681d], cl
mov ecx, dword [ebp - 0x44]
dec ebx
inc eax
cmp eax, 0xa5682d
jne 0x42b640
mov edx, dword [ebp - 0x48]
movzx ecx, word [edx]
mov esi, dword [ebp - 0x10]
mov eax, esi
test cx, cx
je 0x42b711
add edx, 2
mov eax, esi
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x42b700
mov word [eax], 0
mov ecx, dword [ebp - 0x44]
movzx ecx, word [ecx]
test cx, cx
mov edi, dword [ebp - 0x6c]
je 0x42b741
mov edx, dword [ebp - 0x70]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x42b730
mov word [eax], 0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x50]
push dword [eax]
push dword [eax + 4]
push esi
call fcn.00408fd0
mov ebx, eax
jmp dword [0x447ff8]

Function at 0x42b7db
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x34], 0x383b3a3d
mov ecx, 0x6a31675
mov esi, 0x8b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + esi - 0xbf]
mov edx, esi
and edx, eax
mov ebx, edx
and ebx, 0xffffff8d
mov edi, edx
and edi, 2
or edx, 2
imul edx, edi
xor edi, 2
imul edi, ebx
add edx, edi
lea edi, [ecx + edx]
not edx
add edx, esi
and edx, eax
not eax
and eax, edi
sub edx, eax
lea eax, [edx + edx]
mov edi, eax
and edi, 0x90
xor edx, 0x48
add edx, edi
and eax, 2
xor edx, 1
add edx, eax
mov byte [ebp + esi - 0xbf], dl
dec ecx
inc esi
cmp esi, 0x8f
jne 0x42b800
mov eax, dword [0x44d05c]
test eax, eax
je case.0x42a1dd.116
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov esi, dword [0x44d060]
cmp dword [esi + edx*8], 0x1b6183f2
je 0x42b880
inc edx
cmp eax, edx
jne 0x42b870
jmp case.0x42a1dd.116
mov eax, dword [esi + edx*8 + 4]
cmp eax, ecx
je case.0x42a1dd.116
push dword [ebp - 0x14]
push 4
push eax
push dword [0x44d064]
call fcn.0043df70
add esp, 0x10
jmp case.0x42a1dd.116
Function at 0x42c0e2
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], ebp
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
mov dword [esp + 0x20], 0x383b3a3d
mov ecx, 0x6a31675
mov esi, 0x8b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi - 0x6b]
mov edx, esi
and edx, edi
mov ebx, edx
and ebx, 0xffffff8d
mov ebp, edx
and ebp, 2
or edx, 2
imul edx, ebp
xor ebp, 2
imul ebp, ebx
add edx, ebp
lea ebx, [ecx + edx]
not edx
add edx, esi
and edx, edi
not edi
and edi, ebx
sub edx, edi
lea edi, [edx + edx]
mov ebx, edi
and ebx, 0x90
xor edx, 0x48
add edx, ebx
and edi, 2
xor edx, 1
add edx, edi
mov byte [esp + esi - 0x6b], dl
dec ecx
inc esi
cmp esi, 0x8f
jne 0x42c110
mov ecx, dword [0x44d05c]
test ecx, ecx
mov ebx, eax
mov ebp, dword [esp + 4]
je 0x42c19a
mov edx, dword [esp + 0x20]
xor esi, esi
mov edi, dword [0x44d060]
cmp dword [edi + esi*8], 0x1b6183f2
je 0x42c192
inc esi
cmp ecx, esi
jne 0x42c182
jmp 0x42c19a
mov ecx, dword [edi + esi*8 + 4]
cmp ecx, edx
jne 0x42c1b4
mov dword [esp], ebx
jmp dword [0x448190]
push dword [esp]
push 4
push ecx
push dword [0x44d064]
call fcn.0043df70
add esp, 0x10
mov dword [esp], ebx
jmp dword [0x448190]

Function at 0x42c2c2
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], 0x383b3a3d
mov ecx, 0x6a31675
mov esi, 0x8b
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi - 0x6b]
mov edx, esi
and edx, edi
mov ebx, edx
and ebx, 0xffffff8d
mov ebp, edx
and ebp, 2
or edx, 2
imul edx, ebp
xor ebp, 2
imul ebp, ebx
add edx, ebp
lea ebx, [ecx + edx]
not edx
add edx, esi
and edx, edi
not edi
and edi, ebx
sub edx, edi
lea edi, [edx + edx]
mov ebx, edi
and ebx, 0x90
xor edx, 0x48
add edx, ebx
and edi, 2
xor edx, 1
add edx, edi
mov byte [esp + esi - 0x6b], dl
dec ecx
inc esi
cmp esi, 0x8f
jne 0x42c2e0
mov ecx, dword [0x44d05c]
test ecx, ecx
je case.0x4284aa.338
mov edx, dword [esp + 0x20]
xor esi, esi
mov edi, dword [0x44d060]
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x1b6183f2
je 0x42c360
inc esi
cmp ecx, esi
jne 0x42c350
jmp case.0x4284aa.338
mov ecx, dword [edi + esi*8 + 4]
cmp ecx, edx
je case.0x4284aa.338
push eax
push 4
push ecx
push dword [0x44d064]
call fcn.0043df70
add esp, 0x10
Function at 0x438d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + edx + 2], 0
lea edx, [edx + 2]
jne 0x438d30
mov dword [esp], 0x2e2a2cb1
mov esi, 0x4fc54c87
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + esi - 0x4fc54c87]
mov ebx, ecx
not ebx
or ebx, esi
add bl, bl
add bl, cl
neg bl
movzx ecx, bl
add ecx, esi
add cl, 0x5b
mov byte [esp + esi - 0x4fc54c87], cl
inc esi
cmp esi, 0x4fc54c8b
jne 0x438d50
test edx, edx
je 0x438dee
mov ecx, edi
mov esi, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x438db1
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x438da0
cmp edi, 3
jb 0x438dee
mov ebx, ecx
xor edi, edi
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edi*2]
xor ecx, eax
imul ecx, esi
movzx eax, word [ebx + edi*2 + 2]
xor eax, ecx
imul eax, esi
movzx ecx, word [ebx + edi*2 + 4]
xor ecx, eax
imul ecx, esi
movzx eax, word [ebx + edi*2 + 6]
xor eax, ecx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x438dc0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x438e00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 4], 0x191a1b14
mov byte [esp + 8], 0
mov ecx, 0xce6c6d3b
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx + 0x319392c9]
mov edx, eax
mov esi, eax
and edx, ecx
mov eax, edx
not eax
and eax, 2
mov ebx, edx
and ebx, 0x7d
imul ebx, eax
mov eax, esi
sub al, bl
mov esi, eax
mov eax, edx
shr al, 1
and al, 1
or dl, 2
mul dl
add al, al
mov edx, esi
sub dl, al
movzx eax, dl
add eax, ecx
add al, 0xd9
mov byte [esp + ecx + 0x319392c9], al
inc ecx
cmp ecx, 0xce6c6d40
jne 0x438e20
mov ecx, dword [esp + 4]
mov dword [esp + 0xc], 0x383b3a3d
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
mov esi, edx
xor esi, 0x75
mov ebx, eax
and ebx, 4
sub ebx, esi
xor bl, byte [esp + edx + 0xc]
add bl, 0x49
mov byte [esp + edx + 0xc], bl
inc edx
add eax, 2
cmp edx, 4
jne 0x438e80
mov eax, dword [esp + 0xc]
mov edx, dword [0x44d05c]
test edx, edx
je 0x438ef1
xor esi, esi
mov edi, dword [0x44d060]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xeb857808
je 0x438ed0
inc esi
cmp edx, esi
jne 0x438ec0
jmp 0x438ef1
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x438ef1
lea eax, [esp + 0xc]
push eax
push ecx
push 0xffffffffffffffff
push 0xc
push edx
push dword [0x44d064]
call fcn.0043df70
add esp, 0x18
xor ebx, ebx
test eax, eax
js 0x438fee
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x383b3a3d
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
xor esi, 0x75
mov edx, ebx
and edx, 4
sub edx, esi
xor dl, byte [esp + eax + 4]
add dl, 0x49
mov byte [esp + eax + 4], dl
inc eax
add ebx, 2
cmp eax, 4
jne 0x438f10
mov eax, dword [esp + 4]
mov edx, dword [0x44d05c]
test edx, edx
je 0x438f6c
xor esi, esi
mov edi, dword [0x44d060]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x8869e8e9
je 0x438f60
inc esi
cmp edx, esi
jne 0x438f50
jmp 0x438f6c
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
jne 0x438ff7
mov dword [esp + 4], 0x383b3a3d
xor edx, edx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, esi
xor edi, 0x75
mov ebx, edx
and ebx, 4
sub ebx, edi
xor bl, byte [esp + esi + 4]
add bl, 0x49
mov byte [esp + esi + 4], bl
inc esi
add edx, 2
cmp esi, 4
jne 0x438f80
test eax, eax
setns bl
mov eax, dword [0x44d05c]
test eax, eax
je 0x438fea
mov edx, dword [esp + 4]
xor esi, esi
mov edi, dword [0x44d060]
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x1b6183f2
je 0x438fd0
inc esi
cmp eax, esi
jne 0x438fc0
jmp 0x438fea
mov eax, dword [edi + esi*8 + 4]
cmp eax, edx
je 0x438fea
push ecx
push 4
push eax
push dword [0x44d064]
call fcn.0043df70
add esp, 0x10
and bl, byte [esp + 3]
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
ret
lea eax, [esp + 4]
lea esi, [esp + 0x10]
push eax
push 4
push esi
push 0x14
push ecx
push 0x14
push edx
push dword [0x44d064]
call fcn.0043df70
add esp, 0x20
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0x10], 0
setne byte [esp + 3]
jmp 0x438f6c
Function at 0x439b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.00440b70
add esp, 0x14
test eax, eax
js 0x439c53
lea ebx, [esp + 8]
lea eax, [esp + 0xc]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.00440f60
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x439bbc
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 8]
mov ecx, eax
inc ecx
jns 0x439b8a
mov eax, 0xffffffff
jmp 0x439b91
lea eax, [eax*2 + 2]
push eax
call fcn.004082b0
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x14]
call fcn.00441580
add esp, 0x14
test eax, eax
jns 0x439bbc
push esi
call fcn.004082c0
add esp, 4
xor esi, esi
mov eax, dword [esp + 4]
mov dword [esp], 0x383b3a3d
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov ebx, ecx
xor ebx, 0x75
mov edx, edi
and edx, 4
sub edx, ebx
xor dl, byte [esp + ecx]
add dl, 0x49
mov byte [esp + ecx], dl
inc ecx
add edi, 2
cmp ecx, 4
jne 0x439bd0
mov ecx, dword [0x44d05c]
test ecx, ecx
je 0x439c3a
mov edx, dword [esp]
xor edi, edi
mov ebx, dword [0x44d060]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x439c20
inc edi
cmp ecx, edi
jne 0x439c10
jmp 0x439c3a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x439c3a
push eax
push 4
push ecx
push dword [0x44d064]
call fcn.0043df70
add esp, 0x10
test esi, esi
jne 0x439c55
mov eax, esp
push eax
call fcn.00440270
add esp, 4
test al, al
je 0x439c53
cmp dword [esp], 1
je 0x439c55
xor esi, esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b7e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x696a6bb4
mov word [esp + 4], 0
xor ecx, ecx
mov eax, 0xffffffff
xor esi, esi
nop
nop
movzx ebx, byte [esp + esi]
mov ebp, esi
xor ebp, 0x49b08117
lea edi, [ecx + ebp]
and edi, ebx
add edi, edi
add ebp, ebx
lea ebx, [ecx + ebp]
mov edx, eax
sub edx, ebp
and edx, edi
not edi
and edi, ebx
sub edi, edx
mov ebx, edi
and ebx, 0xc
add ebx, ebx
xor edi, 0x73
sub ebx, edi
mov byte [esp + esi], bl
inc esi
add ecx, 2
add eax, 0xfffffffe
cmp esi, 6
jne 0x43b800
mov eax, dword [esp]
mov ecx, dword fs:[eax]
push dword [esp + 0x1c]
push 0
push dword [ecx + 0x18]
call dword [0x455080]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp], 0xf8fbfafd
xor eax, eax
nop
nop
nop
nop
mov edx, eax
add dl, 0xab
xor dl, byte [esp + eax]
add dl, 0xa9
mov byte [esp + eax], dl
inc eax
cmp eax, 4
jne 0x43b900
mov ebp, dword [esp]
mov esi, dword [0x44d05c]
test esi, esi
mov dword [esp + 0x10], ecx
je 0x43b966
xor edi, edi
mov edx, dword [0x44d060]
nop
nop
nop
cmp dword [edx + edi*8], 0x61813e67
je 0x43b940
inc edi
cmp esi, edi
jne 0x43b930
jmp 0x43b966
mov edx, dword [edx + edi*8 + 4]
cmp edx, ebp
je 0x43b966
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 0x10
push edx
push dword [0x44d064]
call fcn.0043df70
add esp, 0x1c
mov ebp, eax
mov dword [esp], 0x41868788
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
mov esi, eax
and esi, 2
mov edi, ecx
xor edi, 0xc642d8a1
add edi, esi
xor edi, edx
mov edx, edi
and edx, 0x5a
xor edi, 0xda
lea edx, [edi + edx*2]
inc dl
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 4
jne 0x43b980
mov esi, ebp
cmp ebp, dword [esp]
jne 0x43baf0
push dword [esp + 0xc]
call fcn.0043b7e0
add esp, 4
mov edi, dword [esp + 0xc]
mov dword [esp], 0xf8fbfafd
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
add cl, 0xab
xor cl, byte [esp + edx]
add cl, 0xa9
mov byte [esp + edx], cl
inc edx
cmp edx, 4
jne 0x43b9e0
mov esi, dword [esp]
mov edx, dword [0x44d05c]
test edx, edx
je 0x43ba4f
mov dword [esp + 8], edi
mov edi, esi
xor esi, esi
mov ebp, dword [0x44d060]
nop
cmp dword [ebp + esi*8], 0x61813e67
je 0x43ba23
inc esi
cmp edx, esi
jne 0x43ba10
mov esi, edi
jmp 0x43ba4f
mov edx, dword [ebp + esi*8 + 4]
mov esi, edi
cmp edx, edi
je 0x43ba4f
push 0
push dword [esp + 0xc]
push eax
push 5
push 0x10
push edx
push dword [0x44d064]
mov esi, eax
call fcn.0043df70
add esp, 0x1c
mov ecx, eax
mov eax, esi
mov esi, ecx
test esi, esi
js 0x43bae7
mov dword [esp], 0xd99a95b7
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
nop
nop
nop
nop
mov edx, ecx
add dl, 0xdb
xor dl, byte [esp + ecx]
add dl, 0xb9
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 7
jne 0x43ba70
mov ecx, dword [esp]
mov dword [esp + 8], ecx
mov edx, dword [eax]
mov ecx, eax
nop
mov ebp, dword [ecx + edx + 0x3c]
add ecx, edx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [ebp + esi]
movzx edi, word [ebx + esi]
test edx, edx
je 0x43bab5
add esi, 2
cmp dx, di
je 0x43baa0
movzx esi, di
mov edi, esi
xor edi, edx
not esi
and esi, edx
add esi, esi
cmp esi, edi
je 0x43bad2
mov edx, dword [ecx]
test edx, edx
jne 0x43ba90
mov esi, dword [esp + 8]
jmp 0x43bae7
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor esi, esi
push eax
call fcn.0043b860
add esp, 4
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43bb20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x43bbd0
xor eax, eax
cmp dword [ecx], 0
jne 0x43bc1a
mov edx, dword [esp + 0x34]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0xf8fbfafd
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0xab
xor bl, byte [esp + eax]
add bl, 0xa9
mov byte [esp + eax], bl
inc eax
cmp eax, 4
jne 0x43bb90
mov eax, dword [esp]
mov esi, dword [0x44d05c]
test esi, esi
je 0x43bc1a
xor edi, edi
mov ebx, dword [0x44d060]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43bc23
inc edi
cmp esi, edi
jne 0x43bbc0
jmp 0x43bc1a
mov dword [esp + 4], 0x296a6b6c
mov dword [esp + 8], 0
mov eax, 0xe9b6897
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0xe9b6893]
xor ecx, eax
mov edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
add cl, 0xc
mov byte [esp + eax - 0xe9b6893], cl
inc eax
cmp eax, 0xe9b689f
jne 0x43bbf0
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43bc1a
lea eax, [esp + 0x1c]
lea edi, [esp + 4]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44d064]
call fcn.0043df70
add esp, 0x1c
jmp 0x43bc1a

Function at 0x43bc50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43bcda
push ebx
push edi
push esi
push eax
mov dword [esp], 0xf8fbfafd
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0xab
xor bl, byte [esp + edx]
add bl, 0xa9
mov byte [esp + edx], bl
inc edx
cmp edx, 4
jne 0x43bc70
mov edx, dword [0x44d05c]
test edx, edx
je 0x43bcce
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44d060]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43bcb0
inc edi
cmp edx, edi
jne 0x43bca0
jmp 0x43bcce
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43bcce
push eax
push 4
push edx
push dword [0x44d064]
mov esi, ecx
call fcn.0043df70
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x43bfa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
mov ecx, dword [ecx]
mov dword [esp], 0xf8fbfafd
xor eax, eax
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0xab
xor dl, byte [esp + eax]
add dl, 0xa9
mov byte [esp + eax], dl
inc eax
cmp eax, 4
jne 0x43bfc0
test ebx, ebx
jne 0x43bfdc
lea ebx, [esp + 4]
mov eax, dword [esp]
mov ebp, dword [0x44d05c]
test ebp, ebp
je 0x43c034
xor edx, edx
mov esi, dword [0x44d060]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe6c7f7c6
je 0x43c010
inc edx
cmp ebp, edx
jne 0x43c000
jmp 0x43c034
mov ebp, dword [esi + edx*8 + 4]
cmp ebp, eax
je 0x43c034
push ebx
push dword [esp + 0x28]
push edi
push dword [esp + 0x28]
push ecx
push 0x14
push ebp
push dword [0x44d064]
call fcn.0043df70
add esp, 0x20
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43ded0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
xor ecx, ecx
test edi, edi
sete cl
jmp dword [ecx*4 + 0x449d78]
Function at 0x4402c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4402e0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x4402fb
mov eax, 0xffffffff
jmp 0x4402fe
add eax, 0xa
push eax
call fcn.004082b0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x440341
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x440330
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov edi, ecx
and edi, 0xfffd
imul edi, edx
and esi, 2
or ecx, 2
imul ecx, esi
add ecx, edi
mov word [esp + 8], cx
mov edx, ecx
and edx, 2
xor ecx, 2
lea ecx, [ecx + edx*2]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x5c5d5e5f
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0x58fa0f70
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x58fa0f70]
xor edx, ecx
mov esi, edx
not esi
and esi, 0x31
and edx, 0xce
sub edx, esi
inc dl
mov byte [esp + ecx - 0x58fa0f70], dl
inc ecx
cmp ecx, 0x58fa0f77
jne 0x4403d0
mov esi, dword [esp]
mov ecx, dword [0x44d05c]
test ecx, ecx
je 0x440462
xor edx, edx
mov edi, dword [0x44d060]
cmp dword [edi + edx*8], 0xf6e92f34
je 0x440420
inc edx
cmp ecx, edx
jne 0x440410
jmp 0x440462
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x440462
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44d064]
mov edi, eax
call fcn.0043df70
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.004082c0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret