joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405110
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x405222
mov esi, dword [esp + 0x28]
test esi, esi
je 0x405222
cmp dword [esp + 0x2c], 0
je 0x405222
push esi
call fcn.0040cc90
add esp, 4
test eax, eax
je 0x40517a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x405181
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x405160
jmp 0x405183
mov ebx, 0x1505
jmp 0x405183
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x40522a
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x4051e7
call fcn.00405e60
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x405222
push ecx
call fcn.0040cc90
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x40529d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405248
inc edi
dec esi
je 0x40519c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x4051a1
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405240
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040cc90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405240
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040ccb0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405240
mov eax, 0xffffffff
jmp 0x405222
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4052b8
inc edi
dec esi
je 0x4051e2
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x4051e7
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4052b0
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040cc90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4052b0
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040ccb0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4052b0
jmp 0x4051e7
Function at 0x405bb0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405d9a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405d9a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405d9a
cmp dword [ecx], 0
jne 0x405d9a
push esi
call fcn.0040cc90
add esp, 4
test eax, eax
je 0x405c1a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405c21
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405c00
jmp 0x405c23
mov edi, 0x1505
jmp 0x405c23
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x405cf4
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405c81
call fcn.00405e60
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405d9a
push esi
call fcn.0040cc90
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405db0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040cc90
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x4c7008]
add esp, 4
test eax, eax
je 0x405d95
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040cbb0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405d9a
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405d18
inc ebx
dec edx
je 0x405c3c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405c41
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405d10
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040cc90
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405d10
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040ccb0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405d10
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404cb0
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405ce9
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40e400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
push eax
sub esp, 0x18
mov eax, esp
sub esp, 0x80
mov ecx, esp
sub esp, 0x100
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x20], ecx
push eax
mov ecx, esp
push eax
mov dword [ebp - 0x3c], esp
sub esp, 0x70
mov edx, esp
sub esp, 0x28
mov dword [ebp - 0x48], esp
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x28], ecx
sub esp, 0xc
mov dword [ebp - 0x34], esp
sub esp, 0x40
mov dword [ebp - 0x30], esp
sub esp, 0x80
mov dword [ebp - 0x38], esp
mov ecx, dword [0x4cd1f0]
mov dword [ebp - 0x44], 0xe1e6ffe4
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x10]
cmp edx, 3
ja 0x40e4a9
nop
nop
nop
nop
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
movzx esi, byte [ebp + esi - 0x44]
mov edi, edx
xor edi, 0x297a4529
and edx, 0x297a4529
lea edx, [edi + edx*2]
xor edx, esi
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x14]
add dl, 0x33
mov esi, dword [ebp - 0x10]
mov byte [ebp + esi - 0x44], dl
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
cmp edx, 4
jb 0x40e470
mov edx, dword [ebp - 0x44]
mov dword [eax], 0xd9a5db4d
mov dword [eax + 4], 0xdda6dfaa
mov dword [eax + 8], 0xd1a6d3a8
mov dword [eax + 0xc], 0xd5e4d7a0
mov dword [eax + 0x10], 0xe996ebb0
mov dword [eax + 0x14], 0xedeeef94
mov byte [eax + 0x18], 0
mov dword [ebp - 0x10], 0
mov esi, dword [ebp - 0x10]
cmp esi, 0x18
ja 0x40e538
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
movzx edi, byte [eax + edi]
mov ebx, esi
xor ebx, 0xf9dc2ccf
and esi, 0xf9dc2ccf
lea esi, [ebx + esi*2]
lea ebx, [esi + edi]
and esi, edi
mov edi, ebx
not edi
and edi, esi
add edi, esi
not esi
and esi, ebx
sub esi, edi
mov dword [ebp - 0x14], esi
mov ebx, dword [ebp - 0x14]
add bl, 0xf5
mov esi, dword [ebp - 0x10]
mov byte [eax + esi], bl
inc dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
cmp esi, 0x19
jb 0x40e4f0
push edx
push 0
push eax
call ecx
mov ecx, 0x4cd1b8
push eax
call fcn.0043dab0
movzx eax, al
mov eax, dword [eax*4 + 0x4c7a50]
mov ecx, 0xa8ad300
xor ecx, dword [0x4c7a58]
add eax, ecx
inc eax
jmp eax
Function at 0x4271e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x460
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x5c], 0x23b621b3
mov dword [esp + 0x60], 0x27472541
mov dword [esp + 0x64], 0x5b0459c5
mov dword [esp + 0x68], 0x5fd65d39
mov dword [esp + 0x6c], 0x53525135
mov byte [esp + 0x70], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x14
ja 0x4272ac
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x5c]
mov edx, eax
not edx
or edx, 0x114035b8
add edx, eax
xor eax, 0x914035b8
lea esi, [eax + edx*2]
lea eax, [eax + edx*2]
add eax, 2
lea edx, [ecx + esi]
add edx, 2
and eax, ecx
mov ecx, edx
not ecx
and ecx, eax
add ecx, eax
not eax
and eax, edx
sub eax, ecx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
add al, 0x68
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x5c], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x15
jb 0x427250
lea esi, [esp + 0x5c]
lea ecx, [esp + 0x44]
push esi
call fcn.0043c250
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x4ca290]
Function at 0x438140
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x438160
mov dword [esp + 4], 0x969698f7
mov dword [esp], 0
mov esi, dword [esp]
cmp esi, 3
ja 0x4381e8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
mov ebx, esi
xor ebx, 0xb867e0e6
and esi, 0x3867e0e6
lea esi, [ebx + esi*2]
lea ebx, [esi + edi]
and esi, edi
mov edi, ebx
xor edi, esi
add edi, esi
not esi
and esi, ebx
add esi, esi
sub esi, edi
mov dword [esp + 8], esi
mov ebx, dword [esp + 8]
mov esi, ebx
not esi
and esi, 0x7e
and ebx, 0x81
sub ebx, esi
mov esi, dword [esp]
mov byte [esp + esi + 4], bl
inc dword [esp]
mov esi, dword [esp]
cmp esi, 4
jb 0x438190
test edx, edx
je 0x43824e
sar edx, 1
mov esi, dword [esp + 4]
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x438211
mov ebp, eax
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x438200
cmp edi, 3
jb 0x43824e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x438220
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4384c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa8
mov eax, dword [0x4ce504]
mov dword [esp + 0x24], 0x4fb9496d
mov dword [esp + 0x28], 0x43d54dc5
mov dword [esp + 0x2c], 0x47a341d4
mov dword [esp + 0x30], 0x7bbe45d9
mov dword [esp + 0x34], 0x7fe779ee
mov dword [esp + 0x38], 0x73977df6
mov dword [esp + 0x3c], 0x77767155
mov word [esp + 0x40], 0
mov byte [esp + 0x42], 0
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
cmp ecx, 0x1e
ja 0x438586
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
movzx ecx, byte [esp + ecx + 0x24]
mov esi, edx
xor esi, 0x8e2ff792
add edx, edx
and edx, 0x1c5fef24
mov edi, edx
and edi, esi
xor edx, esi
lea edx, [edx + edi*2]
mov esi, edx
and esi, ecx
add edx, ecx
add esi, esi
sub edx, esi
mov dword [esp + 0x94], edx
mov ecx, dword [esp + 0x94]
add cl, 0x26
mov edx, dword [esp + 0x14]
mov byte [esp + edx + 0x24], cl
inc dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
cmp ecx, 0x1f
jb 0x438530
lea ecx, [esp + 0x14]
lea edi, [esp + 0x94]
lea ebx, [esp + 0x24]
push ecx
push 8
push edi
push 0xd
push ebx
push 0
call eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4cbc60]
Function at 0x43c250
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x4c4d4a4b
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43c2b9
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0x5cb5cef2
and eax, 0xdcb5cef2
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x46
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43c280
mov edi, dword [esp + 4]
mov eax, dword [0x4ce508]
test eax, eax
je 0x43c306
xor ecx, ecx
mov edx, dword [0x4ce50c]
nop
nop
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x43c2e0
inc ecx
cmp eax, ecx
jne 0x43c2d0
jmp 0x43c306
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43c306
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x4ce510]
push eax
call fcn.0043edd0
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43c455
mov dword [esp + 0x14], esi
push dword [esp + 0xc]
call fcn.0043c110
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x4c4d4a4b
mov byte [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 4
ja 0x43c38b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0x5cb5cef2
and edx, 0xdcb5cef2
lea edx, [edi + edx*2]
xor edx, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 0x46
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 5
jb 0x43c350
mov edi, dword [esp + 4]
mov edx, dword [0x4ce508]
test edx, edx
je 0x43c3e6
xor ebx, ebx
mov ebp, dword [0x4ce50c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x43c3c1
inc ebx
cmp edx, ebx
jne 0x43c3b0
jmp 0x43c3e6
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x43c3e6
push 0
push ecx
push eax
push 5
push 4
push dword [0x4ce510]
push edx
mov esi, eax
call fcn.0043edd0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43c44c
mov ecx, dword [esp + 0x2c]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x43c425
add ebx, 2
cmp bp, si
je 0x43c410
cmp bp, si
je 0x43c437
mov ebx, dword [edx]
test ebx, ebx
jne 0x43c400
mov edi, 0xc0000225
jmp 0x43c44c
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x14]
mov dword [esi + 8], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043c1a0
add esp, 4
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43c640
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43c70a
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x4c4d4a4b
mov byte [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 4
ja 0x43c6ab
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0x5cb5cef2
and edx, 0xdcb5cef2
lea edx, [edi + edx*2]
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 0x46
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 5
jb 0x43c670
mov edx, dword [0x4ce508]
test edx, edx
je 0x43c6fe
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x4ce50c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x43c6e0
inc edi
cmp edx, edi
jne 0x43c6d0
jmp 0x43c6fe
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43c6fe
push eax
push 1
push dword [0x4ce510]
push edx
mov esi, ecx
call fcn.0043edd0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x43cef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43cf09
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43cf1a
cmp eax, 2
je 0x43cf90
jmp 0x43cfbd
push 0xfb1631b0
push dword [0x4ce4fc]
call fcn.00441630
add esp, 8
test eax, eax
je 0x43cf5b
mov ecx, dword [esi]
test ecx, ecx
je 0x43cf88
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43cf64
cmp dword [esp + 4], 0
je 0x43cf64
mov dword [esi + 4], 3
jmp 0x43cf88
mov dword [esi + 4], 1
jmp 0x43cfbd
lea eax, [esp + 0xc]
push eax
call fcn.00441ea0
add esp, 4
test al, al
je 0x43cf88
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43cf85
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43cfbd
mov ebx, dword [ebp + 0x18]
push 0xc95dc39
push dword [0x4d651c]
call fcn.00441630
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43d064
mov ecx, dword [esi]
mov dword [esp + 4], 0x4c4d4a4b
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43d019
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0x5cb5cef2
and eax, 0xdcb5cef2
lea eax, [esi + eax*2]
xor eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x46
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43cfe0
mov eax, dword [esp + 4]
mov edx, dword [0x4ce508]
test edx, edx
je 0x43d064
xor esi, esi
mov ebx, dword [0x4ce50c]
nop
cmp dword [ebx + esi*8], 0x3baba5e0
je 0x43d040
inc esi
cmp edx, esi
jne 0x43d030
jmp 0x43d064
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43d064
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x4ce510]
push edx
call fcn.0043edd0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x43dd70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov dword [esp + 0x30], 0x6316611e
mov dword [esp + 0x34], 0x671a6500
mov dword [esp + 0x38], 0x7b447904
mov dword [esp + 0x3c], 0x7f027d18
mov dword [esp + 0x40], 0x7372710c
mov word [esp + 0x44], 0
mov byte [esp + 0x46], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x16
ja 0x43ddfe
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x30]
mov edx, eax
xor edx, 0xfe035668
and eax, 0xfe035668
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0xf8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x30], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x17
jb 0x43ddc0
lea eax, [esp + 0x30]
push eax
call fcn.00440ff0
add esp, 4
mov dword [0x4d651c], eax
mov esi, 0xd87aa3c5
test eax, eax
je 0x43de1e
mov esi, 0xdbc77ccb
mov ebp, 0xebd9a2a5
lea edi, [esp + 0x2a]
xor eax, eax
cmp ebp, 0xf86a3e1
setl al
mov eax, dword [eax*4 + 0x4cc1c4]
mov ecx, 0xb9337a90
xor ecx, dword [0x4cc1cc]
add eax, ecx
inc eax
mov dword [esp + 0xc], ecx
jmp eax
Function at 0x440200
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x30]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x2c]
jb 0x440272
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, edx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x44040e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x44040e
mov dword [esp + 4], 0x6c6d6e6f
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x4402d3
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0x79efaa68
mov edi, eax
xor edi, 0x6105597
or eax, 0x79efaa68
and eax, edi
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0xf8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x440290
mov eax, dword [esp + 4]
mov ecx, dword [0x4ce508]
test ecx, ecx
je 0x44032a
xor edx, edx
mov edi, dword [0x4ce50c]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x54ca534e
je 0x440300
inc edx
cmp ecx, edx
jne 0x4402f0
jmp 0x44032a
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x44032a
lea eax, [esp + 0xc]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x4ce510]
push ecx
call fcn.0043edd0
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x28]
js 0x44040e
push 0xc95dc39
push dword [0x4d651c]
call fcn.00441630
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x24]
call eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x6c6d6e6f
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 3
ja 0x4403c5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0x79efaa68
mov ebx, edx
xor ebx, 0x6105597
or edx, 0x79efaa68
and edx, ebx
lea edx, [edi + edx*2]
xor edx, esi
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
add dl, 0xf8
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 4
jb 0x440380
mov edx, dword [0x4ce508]
test edx, edx
je 0x44040e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x4ce50c]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x4403f0
inc edi
cmp edx, edi
jne 0x4403e0
jmp 0x44040e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x44040e
push ecx
push 1
push dword [0x4ce510]
push edx
mov esi, eax
call fcn.0043edd0
mov eax, esi
add esp, 0x10
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440420
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x578
mov esi, esp
mov dword [esi + 0x1ec], 0
mov dword [esi + 0x1e8], 0
push 0x33
call fcn.0044044c