joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a8d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x230
mov eax, dword [0x44c9ec]
mov dword [esp + 0x1b0], 0x9796e198
xor ecx, ecx
nop
nop
nop
nop
mov edx, ecx
add dl, 0xa6
xor dl, byte [esp + ecx + 0x1b0]
add dl, 0xc2
mov byte [esp + ecx + 0x1b0], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 4
jb 0x40a8f0
mov ecx, dword [esp + 0x1b0]
mov dword [esp + 0x20], 0x13a1119f
mov dword [esp + 0x24], 0xef49ed1e
mov dword [esp + 0x28], 0xeb18e91b
mov dword [esp + 0x2c], 0xe75ae512
mov dword [esp + 0x30], 0xe356e154
mov word [esp + 0x34], 0xfdfc
mov dword [esp + 0x36], 0
mov word [esp + 0x3a], 0
mov edx, 0x7c
mov esi, 0x83
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx - 0x5c]
mov ebx, esi
xor ebx, edx
and ebx, edi
xor ebx, edx
add bl, 0x94
mov byte [esp + edx - 0x5c], bl
inc edx
dec esi
cmp edx, 0x98
jne 0x40a970
lea esi, [esp + 0x20]
push ecx
push 0
push esi
call eax
mov ecx, 0x44c9f0
push eax
call fcn.0043d8a0
movzx eax, al
mov eax, dword [eax*4 + 0x4469f4]
mov ecx, 0x617c39fb
xor ecx, dword [0x4469fc]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx

Function at 0x40bb50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44c9c8]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40bbfe
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x446cc4]
xor eax, eax
jmp 0x40c1e8
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40c250
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov ebx, dword [esp + 0x468]
mov dword [esp + 0x3c], 0x3fad39f5
mov dword [esp + 0x40], 0x238b3da2
mov dword [esp + 0x44], 0x278a218c
mov dword [esp + 0x48], 0x2bf92585
mov dword [esp + 0x4c], 0x2ffc29fd
mov dword [esp + 0x50], 0x13f22dfc
mov dword [esp + 0x54], 0x17ad11f8
mov dword [esp + 0x58], 0x1b8815bd
mov dword [esp + 0x5c], 0x1f8d19bc
mov dword [esp + 0x60], 0x3951d87
mov dword [esp + 0x64], 0x7b401e0
mov dword [esp + 0x68], 0xbea05b0
mov dword [esp + 0x6c], 0xfde09d9
mov dword [esp + 0x70], 0xf3220dde
mov dword [esp + 0x74], 0xf716f12f
mov dword [esp + 0x78], 0xfb53f54f
mov dword [esp + 0x7c], 0xff24f96a
mov dword [esp + 0x80], 0xe33dfd28
mov dword [esp + 0x84], 0xe77ee100
mov dword [esp + 0x88], 0xeb3ee53e
mov dword [esp + 0x8c], 0xef0ee901
mov dword [esp + 0x90], 0xd342ed2d
mov dword [esp + 0x94], 0xd77ad140
mov dword [esp + 0x98], 0xdb61d571
mov dword [esp + 0x9c], 0xdf78d97d
mov dword [esp + 0xa0], 0xc36bdd13
mov dword [esp + 0xa4], 0xc715c154
mov dword [esp + 0xa8], 0xcb1dc511
mov dword [esp + 0xac], 0xcf1cc913
mov dword [esp + 0xb0], 0xb368cd1b
mov dword [esp + 0xb4], 0xb75eb150
mov dword [esp + 0xb8], 0xbb72b57b
mov dword [esp + 0xbc], 0xbf73b90c
mov dword [esp + 0xc0], 0xa34ebd70
mov dword [esp + 0xc4], 0xa70aa140
mov dword [esp + 0xc8], 0xab05a50d
mov dword [esp + 0xcc], 0xaf4ea90d
mov dword [esp + 0xd0], 0x9337ad67
mov dword [esp + 0xd4], 0x97399137
mov dword [esp + 0xd8], 0x9b739507
mov dword [esp + 0xdc], 0x9f599978
mov dword [esp + 0xe0], 0x83149d34
mov dword [esp + 0xe4], 0x872b8113
mov dword [esp + 0xe8], 0x8b598521
mov dword [esp + 0xec], 0x8f5f8959
mov dword [esp + 0xf0], 0x73a08d55
mov dword [esp + 0xf4], 0x77a471a0
mov dword [esp + 0xf8], 0x7ba875a4
mov dword [esp + 0xfc], 0x7f9e79a8
mov dword [esp + 0x100], 0x63c37dcb
mov dword [esp + 0x104], 0x67c761ca
mov dword [esp + 0x108], 0x6bc365f2
mov dword [esp + 0x10c], 0x6fbb69bb
mov dword [esp + 0x110], 0x53896dbb
mov dword [esp + 0x114], 0x57815182
mov dword [esp + 0x118], 0x5b5a558e
mov dword [esp + 0x11c], 0
mov eax, dword [0x44c9bc]
mov ecx, 0xe48089ca
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x1b7f7672]
xor edx, ecx
add edx, 0x897d4f0d
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + ecx + 0x1b7f7672], dl
inc ecx
cmp ecx, 0xe4808aae
jne 0x40c4b0
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
xor edx, edx
test eax, eax
setne dl
mov ecx, 0x3fbf78ef
xor ecx, dword [0x446d7c]
mov edx, dword [edx*4 + 0x446d74]
add ecx, edx
inc ecx
xor edi, edi
xor esi, esi
jmp ecx
Function at 0x40cbd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0x893b8b5f
mov dword [esp + 0x40], 0x8531870e
mov dword [esp + 0x44], 0x81368330
mov dword [esp + 0x48], 0x9d6f9f3f
mov dword [esp + 0x4c], 0x99689b57
mov dword [esp + 0x50], 0x95769768
mov dword [esp + 0x54], 0x913b936c
mov dword [esp + 0x58], 0x6ddc6f27
mov dword [esp + 0x5c], 0x69db6bd0
mov dword [esp + 0x60], 0x65eb67e1
mov dword [esp + 0x64], 0x61b06384
mov dword [esp + 0x68], 0x7d9e7fcc
mov dword [esp + 0x6c], 0x798a7bb3
mov dword [esp + 0x70], 0x7586778a
mov dword [esp + 0x74], 0x719273b1
mov dword [esp + 0x78], 0x4df94fd9
mov dword [esp + 0x7c], 0x49804bfe
mov dword [esp + 0x80], 0x45834784
mov dword [esp + 0x84], 0x41ca43a4
mov dword [esp + 0x88], 0x5d925f8a
mov dword [esp + 0x8c], 0x59ba5bab
mov dword [esp + 0x90], 0x55e65787
mov dword [esp + 0x94], 0x51e653e4
mov dword [esp + 0x98], 0x2d872feb
mov dword [esp + 0x9c], 0x29942b97
mov dword [esp + 0xa0], 0x259127fd
mov dword [esp + 0xa4], 0x21d323a8
mov dword [esp + 0xa8], 0x3df33feb
mov dword [esp + 0xac], 0x39c83bf5
mov dword [esp + 0xb0], 0x35fc37f5
mov dword [esp + 0xb4], 0x31ca33d4
mov dword [esp + 0xb8], 0xdd60fe5
mov dword [esp + 0xbc], 0x9d90ba0
mov dword [esp + 0xc0], 0x5f207dc
mov dword [esp + 0xc4], 0x1b603e4
mov dword [esp + 0xc8], 0x1dab1fb7
mov dword [esp + 0xcc], 0x19fa1ba7
mov dword [esp + 0xd0], 0x15ad17c1
mov dword [esp + 0xd4], 0x11a713a9
mov dword [esp + 0xd8], 0xed19efa1
mov dword [esp + 0xdc], 0xe937eb0c
mov dword [esp + 0xe0], 0xe568e750
mov dword [esp + 0xe4], 0xe151e355
mov dword [esp + 0xe8], 0xfd0fff5b
mov dword [esp + 0xec], 0xf935fb33
mov dword [esp + 0xf0], 0xf504f73f
mov dword [esp + 0xf4], 0xf100f304
mov dword [esp + 0xf8], 0xcd3ccf00
mov dword [esp + 0xfc], 0xc92acb3c
mov dword [esp + 0x100], 0xc579c765
mov dword [esp + 0x104], 0xc17dc37e
mov dword [esp + 0x108], 0xdd69df4e
mov dword [esp + 0x10c], 0xd911db2d
mov dword [esp + 0x110], 0xd51fd715
mov dword [esp + 0x114], 0xd11fd326
mov dword [esp + 0x118], 0xadaeaf1a
mov eax, dword [0x44c9bc]
xor esi, esi
mov ecx, 0xffffffff
nop
nop
nop
nop
nop
mov edx, ecx
or edx, 0xbee19663
lea edi, [esi + edx]
inc edi
mov edx, edi
and edx, 0xfffffffd
mov ebx, edi
and ebx, 2
or edi, 2
imul edi, ebx
xor ebx, 2
imul ebx, edx
mov edx, esi
xor edx, 0xbee19663
add edx, edi
movzx edi, byte [esp + esi + 0x3c]
add edx, ebx
xor edx, edi
lea edi, [edx + edx]
mov ebx, edi
and ebx, 0x20
xor edx, 0x10
add edx, ebx
and edi, 2
xor edx, 1
add edx, edi
mov byte [esp + esi + 0x3c], dl
inc esi
dec ecx
cmp esi, 0xe0
jne 0x40ce20
lea edi, [esp + 0x3c]
push 0
push 0
push 0
push 0
push edi
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x446f8c]
mov ecx, 0x70f4db2c
xor ecx, dword [0x446f94]
add eax, ecx
inc eax
jmp eax
Function at 0x4193d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edi + 2], 0
lea edi, [edi + 2]
jne 0x4193f0
mov esi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x419410
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x419430
mov eax, 0xffffffff
jmp 0x419439
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.00408ac0
add esp, 4
movzx ecx, word [esi]
mov ebx, eax
test cx, cx
je 0x419471
add esi, 2
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x419460
mov word [ebx], 0x5c
add ebx, 2
mov edx, dword [esp + 0x38]
movzx ecx, word [edx]
test cx, cx
je 0x4194a1
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419490
mov word [ebx], 0
lea ecx, [esp + 0x10]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x1c], eax
push eax
call fcn.00440bc0
add esp, 0x14
mov dword [esp + 8], eax
mov dword [esp], 0x317e7fb9
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x386f0c15
mov ecx, 0xea
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + eax - 0x386f0c15]
mov edx, ecx
xor edx, eax
and edx, ebp
xor edx, eax
add edx, 0xe5d4c396
mov esi, edx
xor esi, 0xfffffffe
mov ebp, edx
or ebp, 1
and ebp, esi
mov esi, ebp
and esi, 0xfd
mov ebx, ebp
and ebx, 2
or ebp, 2
imul ebp, ebx
xor ebx, 2
imul ebx, esi
xor edx, 1
add edx, ebp
add edx, ebx
mov byte [esp + eax - 0x386f0c15], dl
inc eax
dec ecx
cmp eax, 0x386f0c1c
jne 0x4194f0
xor eax, eax
mov esi, dword [esp + 8]
cmp esi, dword [esp]
sete al
jmp dword [eax*4 + 0x4474a8]
Function at 0x419850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x428
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov ecx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x419870
sar ecx, 1
lea edx, [esp + 0x74]
push edx
push 0
push 0
mov dword [esp + 0xc], ecx
push ecx
push eax
push 0
call dword [0x44dd10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x270], 0x5f9e99bf
mov byte [esp + 0x274], 0
mov edx, 0x76321a
mov eax, 0x7f89cde5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx - 0x762faa]
mov ecx, ebx
and ecx, 0xffffffa5
xor ecx, 0xfb8ee8a5
mov esi, ebx
xor esi, 0xfb8ee8a5
or ebx, 0x5a
and ebx, esi
or ebx, ecx
mov esi, eax
and esi, 0x68808881
mov ecx, edx
and ecx, 0x22024
or ecx, esi
xor ecx, 0x930a6024
mov edi, edx
xor edi, 0xfb8ee8a5
mov esi, edx
or esi, 0x70121a
and esi, edi
mov edi, ecx
xor edi, esi
not esi
and esi, ecx
add edi, ecx
sub edi, esi
xor edi, ebx
mov ecx, edi
and ecx, 0x7d
xor edi, 0xfdb1057d
lea ecx, [edi + ecx*2]
and edi, 1
or ecx, 1
xor ecx, edi
lea ecx, [ecx + edi*2]
mov byte [esp + edx - 0x762faa], cl
inc edx
dec eax
cmp edx, 0x76321f
jne 0x4198c0
xor ecx, ecx
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x270]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x447948]
Function at 0x41dde0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x190
mov dword [esp + 0x10], 0x9f7099ab
mov dword [esp + 0x14], 0xa3519d6b
mov dword [esp + 0x18], 0xa7a6a152
mov dword [esp + 0x1c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x10]
lea ecx, [eax + eax]
mov edi, ecx
and edi, 0x14
mov esi, eax
xor esi, 0x4c43ceda
add esi, edi
mov edi, esi
not edi
lea ebx, [edx + edx]
not ebx
add ebx, edx
and edx, edi
or ebx, edi
add ebx, esi
inc ebx
or ebx, edx
add bl, 0xbe
mov byte [esp + eax + 0x10], bl
and ecx, 2
xor eax, 1
add eax, ecx
cmp eax, 0x10
jb 0x41de20
mov dword [esp + 0x28], 0x63f661f8
mov dword [esp + 0x2c], 0x67f665f0
mov dword [esp + 0x30], 0x5b855992
mov dword [esp + 0x34], 0x5fc25d83
mov dword [esp + 0x38], 0x53f151cf
mov dword [esp + 0x3c], 0x57ca55f5
mov dword [esp + 0x40], 0x4bd549d0
mov dword [esp + 0x44], 0x4fda4ddf
mov dword [esp + 0x48], 0x4342418a
mov word [esp + 0x4c], 0
xor eax, eax
mov ecx, eax
add cl, 0x98
xor cl, byte [esp + eax + 0x28]
add cl, 8
mov byte [esp + eax + 0x28], cl
xor eax, 0xff
mov ecx, 0x100
sub ecx, eax
cmp eax, 0xda
mov eax, ecx
ja 0x41deb0
movzx ecx, word [esp + 0x28]
lea eax, [esp + 0x14c]
test cx, cx
je 0x41df01
lea edx, [esp + 0x2a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41def0
mov word [eax], 0
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
mov edi, dword [ebp + 0xc]
je 0x41df31
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41df20
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x41df61
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41df50
mov word [eax], 0
mov ebx, dword [edi]
mov dword [esp + 0x28], 0xfde0e05a
mov byte [esp + 0x2c], 0x58
mov dword [esp + 0x2d], 0
mov byte [esp + 0x31], 0
mov eax, 0xef
mov ecx, 0x10
nop
nop
nop
nop
mov esi, ecx
and esi, 0x11
mov edx, eax
and edx, 0x8e
or edx, esi
xor dl, byte [esp + eax - 0xc7]
xor dl, 0x71
add dl, 0x55
mov byte [esp + eax - 0xc7], dl
inc eax
dec ecx
cmp eax, 0xf9
jne 0x41df90
movzx eax, byte [esp + 0x28]
test al, al
je 0x41dfdd
lea ecx, [esp + 0x29]
mov esi, ebx
nop
nop
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41dfd0
jmp 0x41dfdf
mov esi, ebx
mov byte [esi], 0
lea eax, [esp + 0x134]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x14c]
push eax
push ecx
push edx
call fcn.0040bb50
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x447c68]
mov ecx, dword [0x447c70]
mov edx, ecx
and edx, 0xed7d78bc
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0x92828744
jmp eax
Function at 0x425de5
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0x714d0f6b
mov dword [esp + 8], 0x75e273e0
mov dword [esp + 0xc], 0x79d57730
mov dword [esp + 0x10], 0x7dd97bec
mov dword [esp + 0x14], 0x61c27f1b
mov dword [esp + 0x18], 0x65ca63d4
mov dword [esp + 0x1c], 0x69c867f3
mov dword [esp + 0x20], 0x6dcd6bcc
mov dword [esp + 0x24], 0x51cc6ffe
mov dword [esp + 0x28], 0x55c053fb
mov dword [esp + 0x2c], 0x59ea57f0
mov dword [esp + 0x30], 0x5dc85be8
mov dword [esp + 0x34], 0x41f85fcd
mov dword [esp + 0x38], 0x45ee43eb
mov dword [esp + 0x3c], 0x49d347e3
lea eax, [esp + 0x40]
mov word [esp + 0x40], 0x4b48
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0xbd
xor dl, byte [esp + ecx + 4]
add dl, 0x4f
mov byte [esp + ecx + 4], dl
mov edx, ecx
xor edx, 1
and ecx, 1
lea ecx, [edx + ecx*2]
cmp ecx, 0x44
jb 0x425cf0
lea esi, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, esp
push eax
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x44dd10]
mov dword [esp + 4], 0xd11e1f39
mov word [esp + 8], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 4]
mov ebp, ecx
xor ebp, 0x548f150b
lea edx, [ecx + ecx]
mov edi, edx
and edi, 8
or edi, 0x89162a10
sub edi, ebp
lea ebp, [esi + esi]
not ebp
add ebp, esi
mov ebx, esi
and ebx, 0xffffffc5
and ebp, 0x8004a3a
or ebp, ebx
xor ebp, edi
xor ebp, 0xc378a0c5
mov ebx, esi
not ebx
and ebx, edi
or ebx, ebp
and edi, ebx
not edi
or edi, esi
add edi, ebx
lea esi, [edi*2 + 2]
not esi
lea ebx, [esi + edi]
inc ebx
add bl, 0xe7
mov byte [esp + ecx + 4], bl
xor ecx, 0xd48f450d
and edx, 0xa
add ecx, edx
add ecx, 0x2b70baf4
cmp ecx, 6
jb case.default.0x425dde
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x4485c8]
mov ebx, dword [esp]
test ebx, ebx
jns 0x425df3
mov eax, 0xffffffff
jmp 0x425df6
lea eax, [ebx + ebx]
push eax
call fcn.00408ac0
add esp, 4
mov edi, eax
mov eax, esp
push eax
push ebx
push edi
push 0x1e
lea eax, [esp + 0x5a]
push eax
push 0
call dword [0x44dd10]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4485d0]
xor ebx, ebx
jmp dword [0x4485d8]
mov dword [esp + 4], 0xe902eb30
mov dword [esp + 8], 0xed1cef13
mov dword [esp + 0xc], 0xf119f308
mov dword [esp + 0x10], 0xf510f706
mov dword [esp + 0x14], 0xf90cfb1b
mov dword [esp + 0x18], 0xfdfeff1c
mov word [esp + 0x1c], 0
mov byte [esp + 0x1e], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa7
xor cl, byte [esp + eax + 4]
add cl, 0xbd
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 0x1b
jne 0x425e70
push 0
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0xac]
call fcn.00421970
add esp, 0x14
mov ebx, eax
jmp dword [0x4485d8]
push edi
call fcn.00408ad0
add esp, 4
mov eax, ebx
add esp, 0x88
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 0xc], 0x4f4e4970
mov dword [esp + 0x10], 0
mov eax, 0xffffffff
xor ecx, ecx
xor edx, edx
movzx esi, byte [esp + edx + 0xc]
mov edi, ecx
and edi, 4
mov ebx, edx
or ebx, 0xbd99c0ed
mov ebp, eax
or ebp, 2
and ebp, ebx
not ebp
mov ebx, edi
and ebx, ebp
xor ebp, edi
lea edi, [ebx*2]
add edi, ebp
lea ebx, [edi + edi]
not ebx
add ebx, edi
xor ebx, edi
and ebx, esi
xor ebx, edi
add bl, 0xa6
mov byte [esp + edx + 0xc], bl
inc edx
dec eax
add ecx, 2
cmp edx, 8
jne 0x439a50
mov ecx, dword [esp + 0xc]
mov dword [esp], 0xcccdcacb
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
mov edx, eax
add dl, 0xd2
xor dl, byte [esp + eax]
add dl, 0xe6
mov byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x439ab0
mov eax, dword [esp]
mov edx, dword [0x44dd14]
test edx, edx
je 0x439b11
xor esi, esi
mov edi, dword [0x44dd18]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xeb857808
je 0x439af0
inc esi
cmp edx, esi
jne 0x439ae0
jmp 0x439b11
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x439b11
lea eax, [esp + 0x14]
push eax
push ecx
push 0xffffffffffffffff
push 0xc
push edx
push dword [0x44dd1c]
call fcn.0043e8e0
add esp, 0x18
xor ebx, ebx
test eax, eax
js 0x439bee
mov ecx, dword [esp + 0x14]
mov dword [esp], 0xcccdcacb
mov dword [esp + 4], 0
nop
nop
mov eax, ebx
add al, 0xd2
xor al, byte [esp + ebx]
add al, 0xe6
mov byte [esp + ebx], al
inc ebx
cmp ebx, 8
jne 0x439b30
mov eax, dword [esp]
mov edx, dword [0x44dd14]
test edx, edx
je 0x439b7c
xor esi, esi
mov edi, dword [0x44dd18]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x8869e8e9
je 0x439b70
inc esi
cmp edx, esi
jne 0x439b60
jmp 0x439b7c
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
jne 0x439bf8
mov dword [esp], 0xcccdcacb
mov dword [esp + 4], 0
xor edx, edx
nop
nop
nop
mov ebx, edx
add bl, 0xd2
xor bl, byte [esp + edx]
add bl, 0xe6
mov byte [esp + edx], bl
inc edx
cmp edx, 8
jne 0x439b90
test eax, eax
setns bl
mov eax, dword [0x44dd14]
test eax, eax
je 0x439bea
mov edx, dword [esp]
xor esi, esi
mov edi, dword [0x44dd18]
nop
nop
nop
cmp dword [edi + esi*8], 0x1b6183f2
je 0x439bd0
inc esi
cmp eax, esi
jne 0x439bc0
jmp 0x439bea
mov eax, dword [edi + esi*8 + 4]
cmp eax, edx
je 0x439bea
push ecx
push 4
push eax
push dword [0x44dd1c]
call fcn.0043e8e0
add esp, 0x10
and bl, byte [esp + 0xb]
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, esp
lea esi, [esp + 0xc]
push eax
push 4
push esi
push 0x14
push ecx
push 0x14
push edx
push dword [0x44dd1c]
call fcn.0043e8e0
add esp, 0x20
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0xc], 0
setne byte [esp + 0xb]
jmp 0x439b7c
Function at 0x43a450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 8]
push eax
sub esp, 0xc
mov esi, esp
lea ecx, [ebp - 0x1c]
push 0x68
push 7
push 0x100080
push ecx
push eax
call fcn.00440bc0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44a4e8]

Function at 0x43a700
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.00441290
add esp, 0x14
test eax, eax
js 0x43a82f
lea esi, [esp + 0xc]
lea eax, [esp + 0x10]
push esi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00441680
add esp, 0x24
mov ecx, eax
xor ebx, ebx
mov eax, 0
test ecx, ecx
js 0x43a7a4
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
test eax, eax
jns 0x43a773
mov eax, 0xffffffff
jmp 0x43a775
add eax, eax
push eax
call fcn.00408ac0
add esp, 4
push esi
mov esi, eax
push eax
push 0
push edi
push dword [esp + 0x10]
call fcn.00441d00
add esp, 0x14
test eax, eax
js 0x43a799
mov eax, esi
jmp 0x43a7a4
push esi
call fcn.00408ad0
add esp, 4
xor eax, eax
mov ecx, dword [esp]
mov dword [esp + 4], 0xcccdcacb
mov dword [esp + 8], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
add dl, 0xd2
xor dl, byte [esp + ebx + 4]
add dl, 0xe6
mov byte [esp + ebx + 4], dl
inc ebx
cmp ebx, 8
jne 0x43a7c0
mov edx, dword [0x44dd14]
test edx, edx
je 0x43a81e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44dd18]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43a800
inc edi
cmp edx, edi
jne 0x43a7f0
jmp 0x43a81e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43a81e
push ecx
push 4
push edx
push dword [0x44dd1c]
mov esi, eax
call fcn.0043e8e0
mov eax, esi
add esp, 0x10
test eax, eax
jne 0x43a831
lea eax, [esp + 4]
push eax
call fcn.004409b0
add esp, 4
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
ret
Function at 0x43c450
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x18]
xor eax, eax
test esi, esi
setne al
jmp dword [eax*4 + 0x44a7e0]