joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43af00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx], 0
lea edx, [edx + 2]
jne 0x43af20
add edx, ecx
add edx, 0xfffffffe
mov edi, ecx
not edi
and edi, edx
xor edx, ecx
add edi, edi
mov esi, edi
mov dword [esp + 8], edx
sub esi, edx
mov dword [esp], 0x2020093
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ebx, 0xcffa4d00
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ebx + 0x3005b300]
xor edx, ebx
mov ebp, edx
not ebp
add edx, 0xf01c7eff
or ebp, edx
and ebp, 1
or edx, 1
add edx, ebp
mov byte [esp + ebx + 0x3005b300], dl
inc ebx
cmp ebx, 0xcffa4d07
jne 0x43af60
cmp edi, dword [esp + 8]
je 0x43affe
mov edx, dword [esp]
sar esi, 1
lea edi, [esi - 1]
mov ebx, esi
and ebx, 3
je 0x43afc1
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec esi
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, edx
mov ebp, eax
dec ebx
jne 0x43afb0
cmp edi, 3
jb 0x43affe
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, edx
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, edx
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, edx
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, edx
add edi, 4
cmp esi, edi
jne 0x43afd0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b9f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x18]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.00444710
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44e458]

Function at 0x43bc80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.00444e90
add esp, 0x14
test eax, eax
js 0x43bdbf
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.004452d0
add esp, 0x24
mov ecx, eax
xor eax, eax
test ecx, ecx
js 0x43bd1a
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x43bce4
mov eax, 0xffffffff
jmp 0x43bceb
lea eax, [eax*2 + 2]
push eax
call fcn.0040ce80
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebx
push dword [esp + 0x10]
call fcn.00445950
add esp, 0x14
test eax, eax
js 0x43bd0f
mov eax, esi
jmp 0x43bd1a
push esi
call fcn.0040ce90
add esp, 4
xor eax, eax
mov ecx, dword [esp]
mov dword [esp + 4], 0x1c1d1a1b
mov word [esp + 8], 0
mov edx, 0xa31f097a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx + 0x5ce0f68a]
xor ebx, edx
mov esi, ebx
xor esi, 0x2e
and ebx, 0x51
add ebx, ebx
sub ebx, esi
add bl, 0xcc
mov byte [esp + edx + 0x5ce0f68a], bl
inc edx
cmp edx, 0xa31f0980
jne 0x43bd40
mov edx, dword [0x450d3c]
test edx, edx
je 0x43bdae
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x450d40]
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43bd90
inc edi
cmp edx, edi
jne 0x43bd80
jmp 0x43bdae
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43bdae
push ecx
push 1
push dword [0x450d44]
push edx
mov esi, eax
call fcn.00441410
mov eax, esi
add esp, 0x10
test eax, eax
jne 0x43bdc1
lea eax, [esp + 4]
push eax
call fcn.00444500
add esp, 4
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
ret
Function at 0x43bdd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edx, dword [esp + 0x40]
mov edi, 0xffffffff
mov ecx, 0xfffffffd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edi
add ecx, 3
cmp byte [edx + edi + 1], 0
lea edi, [edi + 1]
jne 0x43bdf0
shr ecx, 2
movzx eax, byte [edx + edi - 1]
cmp eax, 0x3d
je 0x43be11
cmp eax, 0x2e
jne 0x43be12
dec ecx
movzx eax, byte [edx + edi - 2]
cmp eax, 0x3d
je 0x43be21
cmp eax, 0x2e
jne 0x43be22
dec ecx
mov dword [esp + 4], ecx
mov edx, 0
test edi, edi
je 0x43bf17
xor ecx, ecx
mov ebp, 2
jmp 0x43be52
mov edx, ebx
nop
nop
lea eax, [ebp + 4]
add ebp, 2
mov ecx, edx
cmp ebp, edi
mov ebp, eax
jae 0x43bf17
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x40]
mov esi, edi
mov edi, eax
movzx eax, byte [eax + ebp - 2]
push eax
call fcn.00422fc0
add esp, 4
mov bh, al
movzx eax, byte [edi + ebp - 1]
mov edi, esi
mov esi, dword [esp + 8]
push eax
call fcn.00422fc0
add esp, 4
mov bl, al
shl bh, 2
shr al, 4
and al, 3
or al, bh
lea edx, [esi + 1]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi], al
cmp ebp, edi
jae 0x43be40
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp]
push eax
mov dword [esp + 4], edx
call fcn.00422fc0
mov edx, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x43be40
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea ebx, [esi + 2]
mov edx, dword [esp + 0x44]
mov byte [edx + esi + 1], cl
lea ecx, [ebp + 1]
cmp ecx, edi
jae 0x43be3c
mov ecx, dword [esp + 0x40]
movzx ecx, byte [ecx + ebp + 1]
push ecx
mov byte [esp + 4], al
call fcn.00422fc0
add esp, 4
movzx ecx, byte [esp]
cmp al, 0x40
mov edx, ebx
je 0x43be40
shl cl, 6
add al, cl
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi + 2], al
add esi, 3
mov edx, esi
jmp 0x43be40
mov ebx, dword [esp + 4]
cmp edx, ebx
mov eax, 0
jne 0x43bfa5
mov esi, dword [esp + 0x44]
lea edx, [esi + 0x20]
lea edi, [esp + 0xc]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x2c]
xor ebp, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov eax, ebx
add eax, 0xffffffe0
je 0x43bfa1
cmp ebx, 0x21
je 0x43bf8b
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
mov edx, ebp
and edx, 0x1e
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], dl
lea edx, [ebp + 1]
and edx, 0x1f
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [esi + ebp + 0x21]
mov byte [esi + ebp + 1], dl
add ebp, 2
cmp ecx, ebp
jne 0x43bf60
test bl, 1
je 0x43bfa1
mov ecx, ebp
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 0xc]
xor cl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], cl
mov byte [esi + eax], 0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e6c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x18]
mov dword [esp], 0x4f4e4998
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
nop
movzx edx, byte [esp + ecx]
lea edi, [ecx + 0x21034092]
mov ebx, 0xd
sub ebx, ecx
and ebx, 9
mov esi, edi
and esi, 0x20016
or esi, ebx
xor esi, edx
xor esi, 0x20016
and esi, edi
add esi, esi
not esi
add edx, ecx
add edx, esi
add edx, 0x21034093
mov esi, edx
and esi, 0x25
xor edx, 0x25
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 7
jb 0x43e6e0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
mov edx, dword [0x44e85c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx
Function at 0x43e7f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], 0
mov dword [esp], 0x1c1d1a1b
mov word [esp + 4], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
mov esi, ecx
xor esi, 0x71474eb3
mov edi, eax
and edi, 8
sub edi, esi
lea esi, [edi + 0x1466582d]
mov ebp, 0x6b99a7d2
sub ebp, edi
or ebp, edx
mov ebx, 0xd2
sub ebx, edi
and ebx, edx
xor ebx, ebp
and ebx, esi
add ebx, ebx
not ebx
add ebx, edi
add ebx, 0x1466582d
add bl, dl
add bl, 0x9f
mov byte [esp + ecx], bl
inc ecx
add eax, 2
cmp ecx, 6
jne 0x43e820
mov edi, dword [esp]
mov eax, dword [0x450d3c]
test eax, eax
je 0x43e8b6
xor ecx, ecx
mov edx, dword [0x450d40]
cmp dword [edx + ecx*8], 0xc85f7986
je 0x43e890
inc ecx
cmp eax, ecx
jne 0x43e880
jmp 0x43e8b6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43e8b6
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x450d44]
push eax
call fcn.00441410
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43ea08
push dword [esp + 0xc]
call fcn.0043e6c0
add esp, 4
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp], 0x1c1d1a1b
mov word [esp + 4], 0
xor esi, esi
xor edi, edi
nop
nop
nop
nop
movzx ecx, byte [esp + edi]
mov ebx, edi
xor ebx, 0x71474eb3
mov edx, esi
and edx, 8
sub edx, ebx
lea eax, [edx + 0x1466582d]
mov ebp, 0x6b99a7d2
sub ebp, edx
or ebp, ecx
mov ebx, 0xd2
sub ebx, edx
and ebx, ecx
xor ebx, ebp
and ebx, eax
add ebx, ebx
not ebx
lea eax, [edx + ebx]
add eax, 0x1466582d
add al, cl
add al, 0x9f
mov byte [esp + edi], al
inc edi
add esi, 2
cmp edi, 6
jne 0x43e8f0
mov edi, dword [esp]
mov ecx, dword [0x450d3c]
test ecx, ecx
je 0x43e970
xor edx, edx
mov esi, dword [0x450d40]
mov ebx, dword [esp + 0x2c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xc85f7986
je 0x43e976
inc edx
cmp ecx, edx
jne 0x43e960
jmp 0x43e99e
mov ebx, dword [esp + 0x2c]
jmp 0x43e99e
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, edi
je 0x43e99e
push 0
push dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push eax
push 5
push 4
push dword [0x450d44]
push ecx
call fcn.00441410
add esp, 0x1c
mov edi, eax
test edi, edi
js 0x43e9fc
mov ecx, dword [esp + 8]
mov esi, dword [ecx]
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [edx + esi]
movzx ebp, word [ebx + esi]
test di, di
je 0x43e9d5
add esi, 2
cmp di, bp
je 0x43e9c0
cmp di, bp
je 0x43e9e7
mov esi, dword [ecx]
test esi, esi
jne 0x43e9b0
mov edi, 0xc0000225
jmp 0x43e9fc
mov eax, dword [ecx + 0x44]
mov edx, dword [esp + 0x14]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0xdc]
mov dword [edx + 0xc], eax
xor edi, edi
push dword [esp + 8]
call fcn.0043e770
add esp, 4
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43ea40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, dword [ecx + 8]
test esi, esi
je 0x43eb30
xor eax, eax
cmp dword [ecx], 0
jne 0x43eb5a
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], esi
mov dword [esp + 8], ecx
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp], 0x1c1d1a1b
mov word [esp + 4], 0
xor eax, eax
xor esi, esi
nop
nop
movzx ebx, byte [esp + esi]
mov ebp, esi
xor ebp, 0x71474eb3
mov edi, eax
and edi, 8
sub edi, ebp
lea ecx, [edi + 0x1466582d]
mov edx, 0x6b99a7d2
sub edx, edi
or edx, ebx
mov ebp, 0xd2
sub ebp, edi
and ebp, ebx
xor ebp, edx
and ebp, ecx
add ebp, ebp
not ebp
lea ecx, [edi + ebp]
add ecx, 0x1466582d
add cl, bl
add cl, 0x9f
mov byte [esp + esi], cl
inc esi
add eax, 2
cmp esi, 6
jne 0x43eab0
mov eax, dword [esp]
mov esi, dword [0x450d3c]
test esi, esi
je 0x43eb5a
xor edi, edi
mov ebx, dword [0x450d40]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3ba5404
je 0x43eb64
inc edi
cmp esi, edi
jne 0x43eb20
jmp 0x43eb5a
mov dword [esp + 0xc], 0x591a1b14
mov byte [esp + 0x10], 0
xor eax, eax
nop
mov ecx, eax
add cl, 0x7b
xor cl, byte [esp + eax + 0xc]
add cl, 0x99
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 5
jne 0x43eb40
mov eax, dword [esp + 0xc]
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43eb5a
lea eax, [esp + 0x24]
lea ecx, [esp + 0xc]
push eax
push ecx
push dword [esp + 0x48]
push dword [esp + 0x14]
push 4
push dword [0x450d44]
push esi
call fcn.00441410
add esp, 0x1c
jmp 0x43eb5a

Function at 0x43ebb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 0xc], ecx
mov eax, dword [ecx]
test eax, eax
je 0x43ec77
mov dword [esp + 8], eax
mov dword [esp], 0x1c1d1a1b
mov word [esp + 4], 0
xor edx, edx
xor esi, esi
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi]
mov ebp, esi
xor ebp, 0x71474eb3
mov edi, edx
and edi, 8
sub edi, ebp
lea ecx, [edi + 0x1466582d]
mov eax, 0x6b99a7d2
sub eax, edi
or eax, ebx
mov ebp, 0xd2
sub ebp, edi
and ebp, ebx
xor ebp, eax
and ebp, ecx
add ebp, ebp
not ebp
lea eax, [edi + ebp]
add eax, 0x1466582d
add al, bl
add al, 0x9f
mov byte [esp + esi], al
inc esi
add edx, 2
cmp esi, 6
jne 0x43ebe0
mov edx, dword [0x450d3c]
test edx, edx
je 0x43ec6d
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x450d40]
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43ec50
inc edi
cmp edx, edi
jne 0x43ec40
jmp 0x43ec6d
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43ec6d
push dword [esp + 8]
push 1
push dword [0x450d44]
push edx
call fcn.00441410
add esp, 0x10
mov eax, dword [esp + 0xc]
mov dword [eax], 0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ec80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 0xc], ecx
cmp dword [ecx + 8], 0
je 0x43ed40
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x43ed40
mov dword [esp + 8], eax
mov dword [esp], 0x1c1d1a1b
mov word [esp + 4], 0
xor edx, edx
xor ebx, ebx
nop
nop
movzx ecx, byte [esp + ebx]
mov edi, ebx
xor edi, 0x71474eb3
mov eax, edx
and eax, 8
sub eax, edi
mov esi, 0x6b99a7d2
sub esi, eax
or esi, ecx
mov edi, 0xd2
sub edi, eax
and edi, ecx
xor edi, esi
lea esi, [eax + 0x1466582d]
and edi, esi
add edi, edi
not edi
add eax, edi
add eax, 0x1466582d
add al, cl
add al, 0x9f
mov byte [esp + ebx], al
inc ebx
add edx, 2
cmp ebx, 6
jne 0x43ecc0
mov eax, dword [esp]
mov edx, dword [0x450d3c]
test edx, edx
je 0x43ed7c
xor esi, esi
mov ebx, dword [0x450d40]
mov edi, dword [ebp + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xdef797a3
je 0x43ed81
inc esi
cmp edx, esi
jne 0x43ed30
jmp 0x43eda1
mov dword [esp], 0xb7760900
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x3e
xor cl, byte [esp + eax]
add cl, 0xca
mov byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x43ed60
mov eax, dword [esp]
jmp 0x43eeb5
mov edi, dword [ebp + 0xc]
jmp 0x43eda1
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43eda1
push dword [ebp + 8]
push dword [esp + 0xc]
push 2
push dword [0x450d44]
push edx
call fcn.00441410
add esp, 0x14
cmp edi, 1
mov esi, dword [ebp + 0x10]
mov ecx, esi
sbb ecx, 0
jl 0x43eea4
cmp eax, 0xc000010a
jne 0x43eea4
mov ecx, 0xffffd8f0
mov eax, edi
mul ecx
sub edx, edi
imul ecx, esi, 0xffffd8f0
add ecx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp], 0x1c1d1a1b
mov word [esp + 4], 0
xor eax, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi]
mov ecx, esi
xor ecx, 0x71474eb3
mov edi, eax
and edi, 8
sub edi, ecx
mov ecx, 0x6b99a7d2
sub ecx, edi
or ecx, ebx
mov edx, 0xd2
sub edx, edi
and edx, ebx
xor edx, ecx
lea ecx, [edi + 0x1466582d]
and edx, ecx
add edx, edx
not edx
lea ecx, [edi + edx]
add ecx, 0x1466582d
add cl, bl
add cl, 0x9f
mov byte [esp + esi], cl
inc esi
add eax, 2
cmp esi, 6
jne 0x43ee00
mov eax, dword [esp]
mov esi, dword [0x450d3c]
test esi, esi
je 0x43eea4
xor edi, edi
mov ebx, dword [0x450d40]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x53f09cfa
je 0x43ee80
inc edi
cmp esi, edi
jne 0x43ee70
jmp 0x43eea4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43eea4
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x10]
push 3
push dword [0x450d44]
push esi
call fcn.00441410
add esp, 0x18
test eax, eax
js 0x43eeb5
mov ecx, dword [esp + 0xc]
mov esi, eax
call fcn.0043ebb0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43eec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43ef46
push 0xf8eb88df
push dword [0x450d30]
call fcn.00443d20
add esp, 8
test eax, eax
je 0x43ef0d
mov ecx, dword [esi]
test ecx, ecx
je 0x43ef43
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43ef1f
cmp dword [esp], 0
je 0x43ef1f
mov dword [esi + 4], 3
jmp 0x43ef43
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 8], eax
jmp 0x43eff7
lea eax, [esp + 0xc]
push eax
call fcn.00444500
add esp, 4
test al, al
je 0x43ef43
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43ef40
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 8], ecx
cmp eax, 2
jne 0x43eff7
mov dword [esp], 0x1c1d1a1b
mov word [esp + 4], 0
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx]
mov ebp, edx
xor ebp, 0x71474eb3
mov esi, eax
and esi, 8
sub esi, ebp
lea ebp, [esi + 0x1466582d]
mov edi, 0x6b99a7d2
sub edi, esi
or edi, ebx
mov ecx, 0xd2
sub ecx, esi
and ecx, ebx
xor ecx, edi
and ecx, ebp
add ecx, ecx
not ecx
add ecx, esi
add ecx, 0x1466582d
add cl, bl
add cl, 0x9f
mov byte [esp + edx], cl
inc edx
add eax, 2
cmp edx, 6
jne 0x43ef70
mov eax, dword [esp]
mov edx, dword [0x450d3c]
test edx, edx
je 0x43f0bd
xor esi, esi
mov ebx, dword [0x450d40]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x1cbb9425
je 0x43f090
inc esi
cmp edx, esi
jne 0x43efe0
jmp 0x43f0bd
mov dword [esp], 0x1c1d1a1b
mov word [esp + 4], 0
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx]
mov ecx, edx
xor ecx, 0x71474eb3
mov esi, eax
and esi, 8
sub esi, ecx
lea ecx, [esi + 0x1466582d]
mov edi, 0x6b99a7d2
sub edi, esi
or edi, ebx
mov ebp, 0xd2
sub ebp, esi
and ebp, ebx
xor ebp, edi
and ebp, ecx
add ebp, ebp
not ebp
lea ecx, [esi + ebp]
add ecx, 0x1466582d
add cl, bl
add cl, 0x9f
mov byte [esp + edx], cl
inc edx
add eax, 2
cmp edx, 6
jne 0x43f010
mov eax, dword [esp]
mov edx, dword [0x450d3c]
test edx, edx
je 0x43f0bd
xor esi, esi
mov ebx, dword [0x450d40]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x62429966
je 0x43f090
inc esi
cmp edx, esi
jne 0x43f080
jmp 0x43f0bd
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43f0bd
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x18]
push 5
push dword [0x450d44]
push edx
call fcn.00441410
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43f410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43f429
lea edi, [esp + 0x18]
mov eax, dword [esi + 4]
test eax, eax
je 0x43f43a
cmp eax, 2
je 0x43f4b0
jmp 0x43f4dd
push 0xf8eb88df
push dword [0x450d30]
call fcn.00443d20
add esp, 8
test eax, eax
je 0x43f47b
mov ecx, dword [esi]
test ecx, ecx
je 0x43f4a8
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43f484
cmp dword [esp + 4], 0
je 0x43f484
mov dword [esi + 4], 3
jmp 0x43f4a8
mov dword [esi + 4], 1
jmp 0x43f4dd
lea eax, [esp + 0x14]
push eax
call fcn.00444500
add esp, 4
test al, al
je 0x43f4a8
mov eax, dword [esp + 0x14]
mov ecx, 2
cmp eax, 3
je 0x43f4a5
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43f4dd
mov ebx, dword [ebp + 0x18]
push 0x1e03da9a
push dword [0x458d58]
call fcn.00443d20
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43f5a7
mov dword [esp + 0x10], edi
mov eax, dword [esi]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x1c1d1a1b
mov word [esp + 8], 0
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx + 4]
mov ecx, edx
xor ecx, 0x71474eb3
mov esi, eax
and esi, 8
sub esi, ecx
mov edi, 0x6b99a7d2
sub edi, esi
or edi, ebx
mov ecx, 0xd2
sub ecx, esi
and ecx, ebx
xor ecx, edi
lea edi, [esi + 0x1466582d]
and ecx, edi
add ecx, ecx
not ecx
add ecx, esi
add ecx, 0x1466582d
add cl, bl
add cl, 0x9f
mov byte [esp + edx + 4], cl
inc edx
add eax, 2
cmp edx, 6
jne 0x43f500
mov eax, dword [esp + 4]
mov edx, dword [0x450d3c]
test edx, edx
je 0x43f5a7
xor esi, esi
mov ebx, dword [0x450d40]
mov ecx, dword [esp + 0x10]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x64567875
je 0x43f580
inc esi
cmp edx, esi
jne 0x43f570
jmp 0x43f5a7
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43f5a7
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x1c]
push 5
push dword [0x450d44]
push edx
call fcn.00441410
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x441310
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x44ec94]
Function at 0x442700
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x442772
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, edx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x44292e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x44292e
mov dword [esp], 0x74750a0b
mov dword [esp + 4], 0
mov eax, 0x6be0cb3e
mov ecx, 0x141f34c1
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x6be0cb3e]
mov edx, eax
and edx, edi
add edx, edx
mov ebp, edx
xor ebp, eax
and edx, ecx
add edx, edx
sub edx, ebp
mov ebp, edx
xor ebp, edi
not edx
and edx, edi
add edx, edx
sub edx, ebp
lea edi, [edx + edx]
and edi, 0xc9380f92
mov ebp, edi
and ebp, edx
xor edi, edx
xor edi, 0xc9
lea edx, [edi + ebp*2]
inc dl
mov byte [esp + eax - 0x6be0cb3e], dl
inc eax
dec ecx
cmp eax, 0x6be0cb46
jne 0x442790
mov eax, dword [esp]
mov ecx, dword [0x450d3c]
test ecx, ecx
je 0x442810
xor edx, edx
mov edi, dword [0x450d40]
mov ebp, dword [esp + 0x20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x7789b0cb
je 0x442816
inc edx
cmp ecx, edx
jne 0x442800
jmp 0x442840
mov ebp, dword [esp + 0x20]
jmp 0x442840
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x442840
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x450d44]
push ecx
call fcn.00441410
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x24]
js 0x44292e
push 0x1e03da9a
push dword [0x458d58]
call fcn.00443d20
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x74750a0b
mov dword [esp + 4], 0
mov edx, 0x6be0cb3e
mov esi, 0x141f34c1
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx - 0x6be0cb3e]
mov edi, edx
and edi, ebx
add edi, edi
mov ebp, edi
xor ebp, edx
and edi, esi
add edi, edi
sub edi, ebp
mov ebp, edi
xor ebp, ebx
not edi
and edi, ebx
add edi, edi
sub edi, ebp
lea ebx, [edi + edi]
and ebx, 0xc9380f92
mov ebp, ebx
and ebp, edi
xor ebx, edi
xor ebx, 0xc9
lea ebx, [ebx + ebp*2]
inc bl
mov byte [esp + edx - 0x6be0cb3e], bl
inc edx
dec esi
cmp edx, 0x6be0cb46
jne 0x442890
mov edx, dword [0x450d3c]
test edx, edx
je 0x44292e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x450d40]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x442910
inc edi
cmp edx, edi
jne 0x442900
jmp 0x44292e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x44292e
push ecx
push 1
push dword [0x450d44]
push edx
mov esi, eax
call fcn.00441410
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret