joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cf60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x94959a9b
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43cfd9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0x4bdb47a6
and eax, 0xcbdb47a6
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0xc2
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x43cfa0
mov edi, dword [esp + 4]
mov eax, dword [0x44f128]
test eax, eax
je 0x43d026
xor ecx, ecx
mov edx, dword [0x44f12c]
nop
nop
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x43d000
inc ecx
cmp eax, ecx
jne 0x43cff0
jmp 0x43d026
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43d026
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x44f130]
push eax
call fcn.0043fbf0
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43d175
mov dword [esp + 0x14], esi
push dword [esp + 0xc]
call fcn.0043ce00
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x94959a9b
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 6
ja 0x43d0ab
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0x4bdb47a6
and edx, 0xcbdb47a6
lea edx, [edi + edx*2]
xor edx, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 0xc2
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 7
jb 0x43d070
mov edi, dword [esp + 4]
mov edx, dword [0x44f128]
test edx, edx
je 0x43d106
xor ebx, ebx
mov ebp, dword [0x44f12c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x43d0e1
inc ebx
cmp edx, ebx
jne 0x43d0d0
jmp 0x43d106
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x43d106
push 0
push ecx
push eax
push 5
push 4
push dword [0x44f130]
push edx
mov esi, eax
call fcn.0043fbf0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43d16c
mov ecx, dword [esp + 0x2c]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x43d145
add ebx, 2
cmp bp, si
je 0x43d130
cmp bp, si
je 0x43d157
mov ebx, dword [edx]
test ebx, ebx
jne 0x43d120
mov edi, 0xc0000225
jmp 0x43d16c
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x14]
mov dword [esi + 8], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043cea0
add esp, 4
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43d1b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ecx + 8]
test edx, edx
je 0x43d2a0
xor eax, eax
cmp dword [ecx], 0
jne 0x43d2f7
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], edx
mov eax, dword [ecx + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x94959a9b
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43d269
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
mov esi, eax
xor esi, 0x4bdb47a6
and eax, 0xcbdb47a6
lea eax, [esi + eax*2]
xor eax, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
add al, 0xc2
mov edx, dword [esp]
mov byte [esp + edx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x43d230
mov eax, dword [esp + 0xc]
mov esi, dword [0x44f128]
test esi, esi
je 0x43d2f7
mov edx, dword [esp + 0x40]
xor edi, edi
mov ebx, dword [0x44f12c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x43d300
inc edi
cmp esi, edi
jne 0x43d290
jmp 0x43d2f7
mov dword [esp + 0x14], 0x29eaebec
mov byte [esp + 0x18], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x43d2f3
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x14]
add eax, 0x93bb23d7
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xcd
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x43d2c0
mov eax, dword [esp + 0x14]
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43d2f7
lea eax, [esp + 4]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44f130]
push esi
call fcn.0043fbf0
add esp, 0x1c
jmp 0x43d2f7

Function at 0x43d340
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43d41a
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x94959a9b
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 6
ja 0x43d3bb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0x4bdb47a6
and edx, 0xcbdb47a6
lea edx, [edi + edx*2]
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 0xc2
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 7
jb 0x43d380
mov edx, dword [0x44f128]
test edx, edx
je 0x43d40e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44f12c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x43d3f0
inc edi
cmp edx, edi
jne 0x43d3e0
jmp 0x43d40e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43d40e
push eax
push 1
push dword [0x44f130]
push edx
mov esi, ecx
call fcn.0043fbf0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x43d690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43d722
push 0xfb1631b0
push dword [0x44f11c]
call fcn.00442650
add esp, 8
test eax, eax
je 0x43d6ed
mov ecx, dword [esi]
test ecx, ecx
je 0x43d71f
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43d6fb
cmp dword [esp + 4], 0
je 0x43d6fb
mov dword [esi + 4], 3
jmp 0x43d71f
mov dword [esi + 4], 1
mov ecx, dword [esi]
jmp 0x43d7c7
lea eax, [esp + 0xc]
push eax
call fcn.00442f20
add esp, 4
test al, al
je 0x43d71f
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43d71c
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, 2
jne 0x43d7c7
mov dword [esp + 4], 0x94959a9b
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43d789
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0x4bdb47a6
and eax, 0xcbdb47a6
lea eax, [esi + eax*2]
xor eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xc2
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x43d750
mov eax, dword [esp + 4]
mov edx, dword [0x44f128]
test edx, edx
je 0x43d884
mov ebp, ebx
xor esi, esi
mov ebx, dword [0x44f12c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x495ce5ca
je 0x43d860
inc esi
cmp edx, esi
jne 0x43d7b0
jmp 0x43d884
mov dword [esp + 4], 0x94959a9b
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43d829
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0x4bdb47a6
and eax, 0xcbdb47a6
lea eax, [esi + eax*2]
xor eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xc2
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x43d7f0
mov eax, dword [esp + 4]
mov edx, dword [0x44f128]
test edx, edx
je 0x43d884
xor esi, esi
mov ebx, dword [0x44f12c]
nop
cmp dword [ebx + esi*8], 0x1b788dcf
je 0x43d850
inc esi
cmp edx, esi
jne 0x43d840
jmp 0x43d884
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43d884
push ebp
push edi
push dword [esp + 0x30]
jmp 0x43d86e
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43d884
push dword [esp + 0x30]
push edi
push ebp
push dword [esp + 0x30]
push ecx
push 5
push dword [0x44f130]
push edx
call fcn.0043fbf0
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43dc00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43dc19
lea edi, [esp + 0x18]
mov eax, dword [esi + 4]
test eax, eax
je 0x43dc2a
cmp eax, 2
je 0x43dca0
jmp 0x43dccd
push 0xfb1631b0
push dword [0x44f11c]
call fcn.00442650
add esp, 8
test eax, eax
je 0x43dc6b
mov ecx, dword [esi]
test ecx, ecx
je 0x43dc98
mov dword [esp + 8], 0
lea edx, [esp + 8]
push edx
push ecx
call eax
test eax, eax
je 0x43dc74
cmp dword [esp + 8], 0
je 0x43dc74
mov dword [esi + 4], 3
jmp 0x43dc98
mov dword [esi + 4], 1
jmp 0x43dccd
lea eax, [esp + 0x10]
push eax
call fcn.00442f20
add esp, 4
test al, al
je 0x43dc98
mov eax, dword [esp + 0x10]
mov ecx, 2
cmp eax, 3
je 0x43dc95
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43dccd
mov ebx, dword [ebp + 0x18]
push 0xc95dc39
push dword [0x45713c]
call fcn.00442650
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43dda1
mov ecx, dword [esi]
mov dword [esp + 8], 0x94959a9b
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x43dd3e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
mov esi, eax
xor esi, 0x4bdb47a6
and eax, 0xcbdb47a6
lea eax, [esi + eax*2]
xor eax, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0xc2
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 7
jb 0x43dd00
mov eax, dword [esp + 8]
mov edx, dword [0x44f128]
test edx, edx
je 0x43dda1
mov dword [esp + 0x14], ecx
xor esi, esi
mov ebx, dword [0x44f12c]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x3baba5e0
je 0x43dd7a
mov ecx, esi
and ecx, 1
xor esi, 1
lea esi, [esi + ecx*2]
cmp esi, edx
jb 0x43dd60
jmp 0x43dda1
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43dda1
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x24]
push 5
push dword [0x44f130]
push edx
call fcn.0043fbf0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x440a40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [esp + 0x40]
movzx eax, word [eax]
mov dword [esp + 8], 0xd1ce1503
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 6
ja 0x440ad5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov esi, edx
or esi, 0x82e949d2
mov edi, edx
not edi
or edi, 0x7d16b62d
and edi, esi
not edi
and edx, 0xfd16b62d
lea edx, [edi + edx*2]
xor edx, ecx
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x14]
mov edx, ecx
xor edx, 0xe1
and ecx, 0x1e
add ecx, ecx
sub ecx, edx
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 7
jb 0x440a80
mov ecx, dword [esp + 8]
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
jmp dword [edx*4 + 0x44d6e4]
jmp dword [0x44d6f8]
mov ecx, dword [esp + 0x40]
mov ebp, dword [ecx + 0x3c]
mov ecx, dword [ecx + ebp]
lea edx, [esp + 0xc]
mov dword [esp + 8], 0x111e586c
mov esi, dword [0x44d704]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx + 2], 0
mov word [edx], 0
jmp esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x441060
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov edx, 0xffffffff
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, ecx
inc cl
cmp byte [esi + edx + 1], 0
lea edx, [edx + 1]
jne 0x441080
mov dword [esp + 4], 0x161618b7
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 3
ja 0x44110d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov esi, dword [esp]
movzx ebp, byte [esp + esi + 4]
lea esi, [ecx + ecx]
and esi, 0x1f72688c
sub ecx, esi
add ecx, 0x8fb93446
mov edi, ecx
and edi, esi
xor ecx, esi
lea edi, [ecx + edi*2]
lea esi, [edi + ebp]
and edi, ebp
mov ecx, esi
xor ecx, edi
mov ebp, edi
not ebp
and esi, ebp
add esi, esi
sub esi, ecx
xor edi, esi
and esi, ebp
add esi, esi
sub esi, edi
mov dword [esp + 8], esi
mov ecx, dword [esp + 8]
add cl, 0xa2
mov esi, dword [esp]
mov byte [esp + esi + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 4
jb 0x4410b0
test edx, edx
je 0x44118e
mov esi, dword [esp + 4]
test dl, 3
je 0x441146
movzx ebx, bl
and ebx, 3
mov ebp, eax
mov edi, edx
mov ecx, dword [esp + 0x20]
nop
nop
nop
nop
nop
nop
nop
nop
dec edi
movsx eax, byte [ecx]
inc ecx
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x441130
cmp edx, 4
jae 0x441151
jmp 0x44118e
mov edi, edx
mov ecx, dword [esp + 0x20]
cmp edx, 4
jb 0x44118e
mov ebx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx ecx, byte [ebx + edx]
xor ecx, eax
imul ecx, esi
movsx eax, byte [ebx + edx + 1]
xor eax, ecx
imul eax, esi
movsx ecx, byte [ebx + edx + 2]
xor ecx, eax
imul ecx, esi
movsx eax, byte [ebx + edx + 3]
xor eax, ecx
imul eax, esi
add edx, 4
cmp edi, edx
jne 0x441160
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441410
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x578
mov esi, esp
mov dword [esi + 0x1ec], 0
mov dword [esi + 0x1e8], 0
push 0x33
call fcn.0044143c
Function at 0x442540
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], 0x797a7b2c
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x4425b3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0x68505eeb
and eax, 0xe8505eeb
lea eax, [esi + eax*2]
lea esi, [eax + edx]
not edx
or eax, edx
sub edx, eax
lea eax, [esi + edx*2]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x69
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x442570
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44dbe8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [0x44dc14]
mov edi, dword [edx]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x44dc00]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov ecx, dword [case.0x4425c1.4]
nop
nop
nop
nop
nop
nop
nop
jmp ecx
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x442650
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [esp + 0x40]
movzx eax, word [eax]
mov dword [esp + 4], 0xcfcea7b5
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 3
ja 0x4426d0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov esi, edx
xor esi, 0xe6dc09d2
and edx, 0xe6dc09d2
lea esi, [esi + edx*2]
mov edx, esi
and edx, ecx
add ecx, esi
sub ecx, edx
mov esi, 0x13bca9ff
sub esi, ecx
and esi, edx
not edx
and edx, ecx
sub edx, esi
mov dword [esp + 8], edx
mov ecx, dword [esp + 8]
add cl, 0xe6
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 4
jb 0x442680
xor ecx, ecx
cmp dword [esp + 4], eax
setne cl
xor eax, eax
mov esi, dword [esp + 0x40]
jmp dword [ecx*4 + 0x44dc28]
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + edx]
mov dword [esp + 8], 0xd7d60418
mov word [esp + 0xc], 0
mov dword [esp + 4], 0
mov esi, dword [esp + 4]
cmp esi, 5
ja 0x442743
nop
nop
nop
nop
mov esi, dword [esp + 4]
mov edi, dword [esp + 4]
movzx edi, byte [esp + edi + 8]
add esi, 0x5fd4af2e
xor esi, edi
mov dword [esp], esi
mov ebx, dword [esp]
add bl, 0x1a
mov esi, dword [esp + 4]
mov byte [esp + esi + 8], bl
inc dword [esp + 4]
mov esi, dword [esp + 4]
cmp esi, 6
jb 0x442710
xor ebx, ebx
cmp ecx, dword [esp + 8]
setne bl
mov esi, dword [esp + 0x40]
jmp dword [ebx*4 + 0x44dc30]
mov ebx, dword [esi + edx + 0x78]
mov edi, dword [esi + edx + 0x7c]
test edi, edi
sete cl
test ebx, ebx
sete dl
or dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x44dc38]
mov eax, dword [esi + ebx + 0x20]
add eax, esi
mov dword [esp + 0x28], eax
mov eax, dword [esi + ebx + 0x24]
add eax, esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edi
mov eax, dword [esi + ebx + 0x1c]
add eax, esi
mov dword [esp + 0x1c], eax
mov eax, dword [0x44dc5c]
mov dword [esp + 0x14], ebx
jmp eax
jmp dword [0x44dc48]
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebp, dword [esp + 0x58]
mov ebx, dword [esp + 0x54]
mov esi, dword [esp + 0x44]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax], 0
lea eax, [eax + 2]
jne 0x442f90
lea ecx, [esi + eax]
add ecx, 0xfffffffe
add eax, esi
mov edx, 1
sub edx, eax
and edx, esi
mov eax, esi
not eax
and eax, ecx
sub eax, edx
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x442fc3
mov eax, 0xffffffff
jmp 0x442fc6
add eax, 0xa
push eax
call fcn.0040c4b0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x443011
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x443000
mov word [ecx], 0
lea ecx, [edi*2 + 8]
mov word [esp + 0xc], cx
and edi, 1
xor ecx, 2
lea ecx, [ecx + edi*4]
mov word [esp + 0xe], cx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0x282b2a25
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 6
ja 0x4430d3
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, ecx
xor esi, 0xbd7d8977
add ecx, ecx
and ecx, 0x7afb12ee
mov edi, ecx
and edi, esi
xor ecx, esi
lea ecx, [ecx + edi*2]
xor ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
add cl, 0xad
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 7
jb 0x443090
mov esi, dword [esp + 4]
mov ecx, dword [0x44f128]
test ecx, ecx
je 0x443141
xor edx, edx
mov edi, dword [0x44f12c]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x10f02cc2
je 0x443100
inc edx
cmp ecx, edx
jne 0x4430f0
jmp 0x443141
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x443141
lea esi, [esp + 4]
lea edx, [esp + 0x18]
push 0
push 0
push ebp
push ebx
push dword [esp + 0x60]
push dword [esp + 0x70]
push 0
push esi
push edx
push dword [esp + 0x70]
push dword [esp + 0x70]
push 0xb
push dword [0x44f130]
push ecx
mov edi, eax
call fcn.0043fbf0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.0040c4c0
add esp, 4
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443160
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
mov esi, dword [esp + 0x44]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax], 0
lea eax, [eax + 2]
jne 0x443180
lea ecx, [esi + eax]
add ecx, 0xfffffffe
add eax, esi
mov edx, 1
sub edx, eax
and edx, esi
mov eax, esi
not eax
and eax, ecx
sub eax, edx
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x4431b3
mov eax, 0xffffffff
jmp 0x4431b6
add eax, 0xa
push eax
call fcn.0040c4b0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x443201
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x4431f0
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 0xc], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xe], cx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0x282b2a25
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 6
ja 0x4432c3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, ecx
xor esi, 0xbd7d8977
add ecx, ecx
and ecx, 0x7afb12ee
mov ebx, ecx
and ebx, esi
xor ecx, esi
lea ecx, [ecx + ebx*2]
xor ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
add cl, 0xad
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 7
jb 0x443280
mov esi, dword [esp + 4]
mov ecx, dword [0x44f128]
test ecx, ecx
je 0x443323
xor edx, edx
mov ebx, dword [0x44f12c]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x88a3caae
je 0x4432f0
inc edx
cmp ecx, edx
jne 0x4432e0
jmp 0x443323
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x443323
lea edx, [esp + 4]
lea esi, [esp + 0x18]
push edi
push ebp
push edx
push esi
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push 6
push dword [0x44f130]
push ecx
mov edi, eax
call fcn.0043fbf0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040c4c0
add esp, 4
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret