joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bf90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x7c7d7a7b
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43c014
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx edx, byte [esp + ecx + 4]
mov ecx, eax
xor ecx, 0xd47f60ea
and eax, 0xd47f60ea
lea ecx, [ecx + eax*2]
lea eax, [ecx + edx]
and ecx, edx
mov edx, eax
not edx
and edx, ecx
mov esi, ecx
not esi
and eax, esi
sub eax, edx
mov edx, eax
not edx
and edx, ecx
and eax, esi
sub eax, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x6e
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43bfc0
mov edi, dword [esp + 4]
mov eax, dword [0x44e4ac]
test eax, eax
je 0x43c066
xor ecx, ecx
mov edx, dword [0x44e4b0]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x43c040
inc ecx
cmp eax, ecx
jne 0x43c030
jmp 0x43c066
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43c066
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x44e4b4]
push eax
call fcn.0043f3f0
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43c1c5
mov dword [esp + 0x14], ebx
push dword [esp + 0xc]
call fcn.0043bdc0
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x7c7d7a7b
mov byte [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 4
ja 0x43c106
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0xd47f60ea
and edx, 0xd47f60ea
lea edi, [edi + edx*2]
lea edx, [edi + esi]
and edi, esi
mov esi, edx
not esi
and esi, edi
mov ebx, edi
not ebx
and edx, ebx
sub edx, esi
mov esi, edx
not esi
and esi, edi
and edx, ebx
sub edx, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 0x6e
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 5
jb 0x43c0b0
mov edi, dword [esp + 4]
mov edx, dword [0x44e4ac]
test edx, edx
je 0x43c156
xor ebx, ebx
mov ebp, dword [0x44e4b0]
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x43c131
inc ebx
cmp edx, ebx
jne 0x43c120
jmp 0x43c156
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x43c156
push 0
push ecx
push eax
push 5
push 4
push dword [0x44e4b4]
push edx
mov esi, eax
call fcn.0043f3f0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43c1bc
mov ecx, dword [esp + 0x2c]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x43c195
add ebx, 2
cmp bp, si
je 0x43c180
cmp bp, si
je 0x43c1a7
mov ebx, dword [edx]
test ebx, ebx
jne 0x43c170
mov edi, 0xc0000225
jmp 0x43c1bc
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x14]
mov dword [esi + 8], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043be60
add esp, 4
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43c200
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ecx + 8]
test edx, edx
je 0x43c310
xor eax, eax
cmp dword [ecx], 0
jne 0x43c372
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], edx
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x7c7d7a7b
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43c2d4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx esi, byte [esp + edx + 4]
mov edx, eax
xor edx, 0xd47f60ea
and eax, 0xd47f60ea
lea edx, [edx + eax*2]
lea eax, [edx + esi]
and edx, esi
mov esi, eax
not esi
and esi, edx
mov edi, edx
not edi
and eax, edi
sub eax, esi
mov esi, eax
not esi
and esi, edx
and eax, edi
sub eax, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 0x6e
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43c280
mov eax, dword [esp + 4]
mov esi, dword [0x44e4ac]
test esi, esi
je 0x43c372
mov edx, dword [esp + 0x40]
xor edi, edi
mov ebx, dword [0x44e4b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x43c37b
inc edi
cmp esi, edi
jne 0x43c300
jmp 0x43c372
mov dword [esp + 0xc], 0xd3121118
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x43c36e
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0xc]
mov edx, eax
xor edx, 0x334ea004
and eax, 0x334ea004
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add al, 0xec
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0xc], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x43c330
mov eax, dword [esp + 0xc]
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43c372
lea eax, [esp + 0xc]
lea edi, [esp + 0x18]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44e4b4]
push esi
call fcn.0043f3f0
add esp, 0x1c
jmp 0x43c372
Function at 0x43c3c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43c49a
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x7c7d7a7b
mov byte [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 4
ja 0x43c446
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx edi, byte [esp + esi + 4]
mov esi, edx
xor esi, 0xd47f60ea
and edx, 0xd47f60ea
lea esi, [esi + edx*2]
lea edx, [esi + edi]
and esi, edi
mov edi, edx
not edi
and edi, esi
mov ebx, esi
not ebx
and edx, ebx
sub edx, edi
mov edi, edx
not edi
and edi, esi
and edx, ebx
sub edx, edi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 0x6e
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 5
jb 0x43c3f0
mov edx, dword [0x44e4ac]
test edx, edx
je 0x43c48e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44e4b0]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x43c470
inc edi
cmp edx, edi
jne 0x43c460
jmp 0x43c48e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43c48e
push eax
push 1
push dword [0x44e4b4]
push edx
mov esi, ecx
call fcn.0043f3f0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x43c730
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43c7c8
push 0xfb1631b0
push dword [0x44e4a0]
call fcn.00441e40
add esp, 8
test eax, eax
je 0x43c78d
mov ecx, dword [esi]
test ecx, ecx
je 0x43c7c5
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43c7a1
cmp dword [esp + 4], 0
je 0x43c7a1
mov dword [esi + 4], 3
jmp 0x43c7c5
mov ecx, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 0x10], eax
jmp 0x43c887
lea eax, [esp + 0xc]
push eax
call fcn.00442700
add esp, 4
test al, al
je 0x43c7c5
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43c7c2
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebx
cmp eax, 2
jne 0x43c887
mov dword [esp + 4], 0x7c7d7a7b
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43c854
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx esi, byte [esp + edx + 4]
mov edx, eax
xor edx, 0xd47f60ea
and eax, 0xd47f60ea
lea edx, [edx + eax*2]
lea eax, [edx + esi]
and edx, esi
mov esi, eax
not esi
and esi, edx
mov ebx, edx
not ebx
and eax, ebx
sub eax, esi
mov esi, eax
not esi
and esi, edx
and eax, ebx
sub eax, esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x6e
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43c800
mov eax, dword [esp + 4]
mov edx, dword [0x44e4ac]
test edx, edx
je 0x43c954
xor esi, esi
mov ebx, dword [0x44e4b0]
nop
nop
cmp dword [ebx + esi*8], 0x495ce5ca
je 0x43c930
inc esi
cmp edx, esi
jne 0x43c870
jmp 0x43c954
mov dword [esp + 4], 0x7c7d7a7b
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43c904
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx esi, byte [esp + edx + 4]
mov edx, eax
xor edx, 0xd47f60ea
and eax, 0xd47f60ea
lea edx, [edx + eax*2]
lea eax, [edx + esi]
and edx, esi
mov esi, eax
not esi
and esi, edx
mov ebx, edx
not ebx
and eax, ebx
sub eax, esi
mov esi, eax
not esi
and esi, edx
and eax, ebx
sub eax, esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x6e
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43c8b0
mov eax, dword [esp + 4]
mov edx, dword [0x44e4ac]
test edx, edx
je 0x43c954
xor esi, esi
mov ebx, dword [0x44e4b0]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x1b788dcf
je 0x43c930
inc esi
cmp edx, esi
jne 0x43c920
jmp 0x43c954
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43c954
push dword [esp + 0x34]
push ecx
push edi
push ebp
push dword [esp + 0x20]
push 5
push dword [0x44e4b4]
push edx
call fcn.0043f3f0
add esp, 0x20
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43cce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43ccf9
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43cd0a
cmp eax, 2
je 0x43cd80
jmp 0x43cdad
push 0xfb1631b0
push dword [0x44e4a0]
call fcn.00441e40
add esp, 8
test eax, eax
je 0x43cd4b
mov ecx, dword [esi]
test ecx, ecx
je 0x43cd78
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43cd54
cmp dword [esp + 4], 0
je 0x43cd54
mov dword [esi + 4], 3
jmp 0x43cd78
mov dword [esi + 4], 1
jmp 0x43cdad
lea eax, [esp + 0xc]
push eax
call fcn.00442700
add esp, 4
test al, al
je 0x43cd78
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43cd75
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43cdad
mov ebx, dword [ebp + 0x18]
push 0xc95dc39
push dword [0x4564c0]
call fcn.00441e40
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43ce74
mov ecx, dword [esi]
mov dword [esp + 4], 0x7c7d7a7b
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43ce24
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx esi, byte [esp + edx + 4]
mov edx, eax
xor edx, 0xd47f60ea
and eax, 0xd47f60ea
lea edx, [edx + eax*2]
lea eax, [edx + esi]
and edx, esi
mov esi, eax
not esi
and esi, edx
mov ebx, edx
not ebx
and eax, ebx
sub eax, esi
mov esi, eax
not esi
and esi, edx
and eax, ebx
sub eax, esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x6e
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43cdd0
mov eax, dword [esp + 4]
mov edx, dword [0x44e4ac]
test edx, edx
je 0x43ce74
xor esi, esi
mov ebx, dword [0x44e4b0]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x3baba5e0
je 0x43ce50
inc esi
cmp edx, esi
jne 0x43ce40
jmp 0x43ce74
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43ce74
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x44e4b4]
push edx
call fcn.0043f3f0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x43f2e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
xor ecx, ecx
test esi, esi
sete cl
jmp dword [ecx*4 + 0x44c5e4]

Function at 0x44010c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 8]
push eax
push eax
mov ecx, esp
movzx eax, word [eax]
mov dword [ebp - 0x28], 0x595af517
mov word [ebp - 0x24], 0
mov byte [ebp - 0x22], 0
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x18]
cmp edx, 6
ja 0x440192
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
movzx edi, byte [ebp + esi - 0x28]
mov esi, edx
xor esi, 0x5217d16f
and edx, 0xd217d16f
lea esi, [esi + edx*2]
lea edx, [esi + edi]
and esi, edi
mov edi, edx
xor edi, esi
mov ebx, esi
not ebx
and edx, ebx
add edx, edx
sub edx, edi
xor esi, edx
and edx, ebx
add edx, edx
sub edx, esi
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x10]
add dl, 0xd5
mov esi, dword [ebp - 0x18]
mov byte [ebp + esi - 0x28], dl
inc dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
cmp edx, 7
jb 0x440140
mov edx, dword [ebp - 0x28]
xor ebx, ebx
cmp edx, eax
setne bl
xor edx, edx
jmp dword [ebx*4 + 0x44c9f8]
jmp dword [0x44ca04]
mov dword [ecx], 0xf9fa40b4
mov byte [ecx + 4], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 4
ja case.0x44019e.3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
movzx edx, byte [ecx + edx]
mov esi, eax
xor esi, 0xeb5ad27f
mov edi, eax
xor edi, 0x14a52d80
or eax, 0x6b5ad27f
and eax, edi
lea eax, [esi + eax*2]
lea esi, [eax + edx]
and eax, edx
add eax, eax
sub esi, eax
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x28]
add al, 0x85
mov edx, dword [ebp - 0x10]
mov byte [ecx + edx], al
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 5
jb 0x4401d0
jmp case.0x44019e.3
jmp dword [0x44ca0c]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3c]
mov edx, dword [edx + eax]
mov dword [ebp - 0x14], edx
mov dword [ecx], 0xf9fa40b4
mov byte [ecx + 4], 0
mov dword [ebp - 0x10], 0
mov esi, dword [ebp - 0x10]
cmp esi, 4
ja 0x440220
nop
nop
nop
nop
nop
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
movzx edi, byte [ecx + edi]
mov ebx, esi
xor ebx, 0xeb5ad27f
mov edx, esi
xor edx, 0x14a52d80
or esi, 0x6b5ad27f
and esi, edx
lea edx, [ebx + esi*2]
lea esi, [edx + edi]
and edx, edi
add edx, edx
sub esi, edx
mov dword [ebp - 0x28], esi
mov edx, dword [ebp - 0x28]
add dl, 0x85
mov esi, dword [ebp - 0x10]
mov byte [ecx + esi], dl
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
cmp edx, 5
jb 0x440250
jmp 0x440220
xor ebx, ebx
mov edx, dword [ebp - 0x14]
cmp edx, dword [ecx]
setne bl
xor edx, edx
jmp dword [ebx*4 + 0x44ca10]
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + eax + 0x78]
cmp dword [ecx + eax + 0x7c], 0
sete al
test esi, esi
sete cl
or cl, al
movzx eax, cl
xor edx, edx
jmp dword [eax*4 + 0x44ca18]
mov eax, edx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4407f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x34]
mov ecx, ebx
add ecx, ebp
mov edx, edi
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x30]
jb 0x440864
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, edx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x4409fe
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x4409fe
mov dword [esp + 4], 0x80b0a0d
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x4408c9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0x84d12d43
and eax, 0x4d12d43
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xb1
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x440890
mov eax, dword [esp + 4]
mov ecx, dword [0x44e4ac]
test ecx, ecx
je 0x440922
xor edx, edx
mov edi, dword [0x44e4b0]
nop
cmp dword [edi + edx*8], 0x54ca534e
je 0x4408f4
inc edx
cmp ecx, edx
jne 0x4408e0
mov edi, dword [esp + 0x2c]
jmp 0x440922
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
mov edi, dword [esp + 0x2c]
je 0x440922
lea eax, [esp + 0x10]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x44e4b4]
push ecx
call fcn.0043f3f0
add esp, 0x28
test eax, eax
js 0x4409fe
push 0xc95dc39
push dword [0x4564c0]
call fcn.00441e40
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x28]
call eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 4], 0x80b0a0d
mov word [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 5
ja 0x4409ab
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0x84d12d43
and edx, 0x4d12d43
lea edx, [edi + edx*2]
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 0xb1
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 6
jb 0x440970
mov edx, dword [0x44e4ac]
test edx, edx
je 0x4409fe
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44e4b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x4409e0
inc edi
cmp edx, edi
jne 0x4409d0
jmp 0x4409fe
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x4409fe
push ecx
push 1
push dword [0x44e4b4]
push edx
mov esi, eax
call fcn.0043f3f0
mov eax, esi
add esp, 0x10
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441070
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ecx, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov esi, 2
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
dec esi
cmp byte [ebp + edx + 1], 0
lea edx, [edx + 1]
jne 0x441090
mov dword [esp + 0xc], 0xeeeaec71
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x441100
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 0xc]
mov ebx, eax
xor ebx, 0x9643c27
and eax, 0x9643c27
lea eax, [ebx + eax*2]
lea ebx, [eax + edi]
and eax, edi
add eax, eax
sub ebx, eax
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x1c]
add al, 0x3d
mov edi, dword [esp]
mov byte [esp + edi + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x4410c0
test edx, edx
je 0x44111f
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0xc]
mov ebx, ecx
not ebx
test dl, 1
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
jne 0x441126
jmp 0x44114f
mov eax, ecx
jmp 0x4411c0
movsx eax, byte [ebp]
xor eax, dword [esp + 0x38]
mov edx, eax
not edx
and edx, ecx
mov edi, eax
and edi, ebx
imul edi, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
mov edx, esi
neg edx
inc ebp
add eax, edi
mov dword [esp + 4], eax
test esi, esi
mov edi, dword [esp + 0x14]
je 0x4411c0
xor esi, esi
mov eax, dword [esp + 4]
mov dword [esp + 8], ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 8]
movsx ebp, byte [ecx + esi]
xor ebp, eax
mov eax, ebp
not eax
and eax, edi
mov ebx, ebp
mov ecx, dword [esp + 0x18]
and ebx, ecx
imul ebx, eax
mov eax, ebp
and eax, edi
or ebp, edi
imul ebp, eax
add ebp, ebx
mov eax, dword [esp + 8]
movsx eax, byte [eax + esi + 1]
xor eax, ebp
mov ebx, eax
not ebx
and ebx, edi
mov ebp, eax
and ebp, ecx
imul ebp, ebx
mov ebx, eax
and ebx, edi
or eax, edi
imul eax, ebx
add eax, ebp
add esi, 2
cmp edx, esi
jne 0x441170
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442910
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x44]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x442930
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x44294b
mov eax, 0xffffffff
jmp 0x44294e
add eax, 0xa
push eax
call fcn.0040c770
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x442991
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x442980
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 0xc], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xe], cx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0x80b0a0d
mov word [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 5
ja 0x442a42
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, ecx
not esi
or esi, 0x4d12d43
add esi, ecx
xor ecx, 0x84d12d43
lea ecx, [ecx + esi*2]
add ecx, 2
xor ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
add cl, 0xb1
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 6
jb 0x442a00
mov esi, dword [esp + 4]
mov ecx, dword [0x44e4ac]
test ecx, ecx
je 0x442ab0
xor edx, edx
mov ebx, dword [0x44e4b0]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x88a3caae
je 0x442a7a
mov ebp, edx
and ebp, 1
xor edx, 1
lea edx, [edx + ebp*2]
cmp edx, ecx
jb 0x442a60
jmp 0x442ab0
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x442ab0
lea edx, [esp + 4]
lea esi, [esp + 0x18]
push edi
push dword [esp + 0x54]
push edx
push esi
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push 6
push dword [0x44e4b4]
push ecx
mov edi, eax
call fcn.0043f3f0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040c780
add esp, 4
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret