joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fb50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 4], 0
mov dword [esp + 8], 0xe0e7e6e5
xor eax, eax
nop
mov ecx, eax
add cl, 0x89
xor cl, byte [esp + eax + 8]
xor cl, 0xa0
add cl, 0x33
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jne 0x43fb70
mov edi, dword [esp + 8]
mov eax, dword [0x451ae0]
test eax, eax
je 0x43fbd6
xor ecx, ecx
mov edx, dword [0x451ae4]
nop
nop
cmp dword [edx + ecx*8], 0xc85f7986
je 0x43fbb0
inc ecx
cmp eax, ecx
jne 0x43fba0
jmp 0x43fbd6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43fbd6
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 5
push 4
push dword [0x451ae8]
push eax
call fcn.004425f0
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43fce4
push dword [esp + 4]
call fcn.0043fa10
add esp, 4
mov esi, dword [esp + 4]
mov dword [esp + 0xc], 0xe0e7e6e5
xor edx, edx
nop
nop
nop
nop
mov ecx, edx
add cl, 0x89
xor cl, byte [esp + edx + 0xc]
xor cl, 0xa0
add cl, 0x33
mov byte [esp + edx + 0xc], cl
inc edx
cmp edx, 4
jne 0x43fc00
mov edi, dword [esp + 0xc]
mov edx, dword [0x451ae0]
test edx, edx
je 0x43fc7c
mov dword [esp], esi
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x451ae4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0xc85f7986
je 0x43fc52
inc ebp
cmp edx, ebp
jne 0x43fc40
mov ebp, ecx
jmp 0x43fc7c
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
mov ebp, ecx
je 0x43fc7c
push 0
push dword [esp + 4]
push eax
push 5
push 4
push dword [0x451ae8]
push edx
mov esi, eax
call fcn.004425f0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43fcdb
mov dword [esp], ebp
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43fcb5
add edi, 2
cmp si, bp
je 0x43fca0
cmp si, bp
je 0x43fcc7
mov esi, dword [ecx]
test esi, esi
jne 0x43fc90
mov edi, 0xc0000225
jmp 0x43fcdb
mov edx, dword [ecx + 0x44]
mov esi, dword [esp]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043fad0
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43fd10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x43fdc0
xor eax, eax
cmp dword [ecx], 0
jne 0x43fdea
mov edx, dword [esp + 0x34]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0xe0e7e6e5
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0x89
xor bl, byte [esp + eax]
xor bl, 0xa0
add bl, 0x33
mov byte [esp + eax], bl
inc eax
cmp eax, 4
jne 0x43fd80
mov eax, dword [esp]
mov esi, dword [0x451ae0]
test esi, esi
je 0x43fdea
xor edi, edi
mov ebx, dword [0x451ae4]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3ba5404
je 0x43fdf3
inc edi
cmp esi, edi
jne 0x43fdb0
jmp 0x43fdea
mov dword [esp + 4], 0x17564940
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe
xor cl, byte [esp + eax + 4]
add cl, 0xba
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 4
jne 0x43fdd0
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43fdea
lea eax, [esp + 0x1c]
lea edi, [esp + 4]
push eax
push edi
push edx
push ecx
push 4
push dword [0x451ae8]
push esi
call fcn.004425f0
add esp, 0x1c
jmp 0x43fdea

Function at 0x43fe30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43feba
push ebx
push edi
push esi
push eax
mov dword [esp], 0xe0e7e6e5
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x89
xor bl, byte [esp + edx]
xor bl, 0xa0
add bl, 0x33
mov byte [esp + edx], bl
inc edx
cmp edx, 4
jne 0x43fe50
mov edx, dword [0x451ae0]
test edx, edx
je 0x43feae
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x451ae4]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43fe90
inc edi
cmp edx, edi
jne 0x43fe80
jmp 0x43feae
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43feae
push eax
push 1
push dword [0x451ae8]
push edx
mov esi, ecx
call fcn.004425f0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x43fec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
cmp dword [ecx + 8], 0
je 0x43ff33
mov edx, dword [ecx]
test edx, edx
je 0x43ff33
mov edi, dword [ebp + 0x10]
mov dword [esp], 0xe0e7e6e5
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0x89
xor bl, byte [esp + eax]
xor bl, 0xa0
add bl, 0x33
mov byte [esp + eax], bl
inc eax
cmp eax, 4
jne 0x43fef0
mov eax, dword [esp]
mov ebx, dword [0x451ae0]
test ebx, ebx
je 0x43ff90
xor edi, edi
mov esi, dword [0x451ae4]
nop
nop
nop
nop
cmp dword [esi + edi*8], 0xdef797a3
je 0x43ff6c
inc edi
cmp ebx, edi
jne 0x43ff20
mov edi, dword [ebp + 0x10]
jmp 0x43ff90
mov dword [esp], 0x77b68980
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x1e
xor cl, byte [esp + eax]
add cl, 0x6a
mov byte [esp + eax], cl
inc eax
cmp eax, 6
jne 0x43ff50
mov eax, dword [esp]
jmp 0x4400cb
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
mov edi, dword [ebp + 0x10]
je 0x43ff90
push dword [ebp + 8]
push edx
push 2
push dword [0x451ae8]
push esi
mov esi, ecx
call fcn.004425f0
mov ecx, esi
add esp, 0x14
mov esi, dword [ebp + 0xc]
cmp esi, 1
mov edx, edi
sbb edx, 0
jl 0x440043
cmp eax, 0xc000010a
jne 0x440043
mov edx, 0xffffd8f0
mov eax, esi
mul edx
sub edx, esi
imul esi, edi, 0xffffd8f0
add esi, edx
mov dword [esp], eax
mov dword [esp + 4], esi
mov edx, dword [ecx]
mov dword [esp + 0xc], 0xe0e7e6e5
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0x89
xor bl, byte [esp + eax + 0xc]
xor bl, 0xa0
add bl, 0x33
mov byte [esp + eax + 0xc], bl
inc eax
cmp eax, 4
jne 0x43ffe0
mov eax, dword [esp + 0xc]
mov esi, dword [0x451ae0]
test esi, esi
je 0x440043
xor edi, edi
mov ebx, dword [0x451ae4]
nop
cmp dword [ebx + edi*8], 0x53f09cfa
je 0x440020
inc edi
cmp esi, edi
jne 0x440010
jmp 0x440043
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x440043
mov eax, esp
push eax
push 0
push edx
push 3
push dword [0x451ae8]
push esi
mov esi, ecx
call fcn.004425f0
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x4400cb
mov edx, dword [ecx]
test edx, edx
je 0x4400cb
mov dword [esp + 0x10], edx
mov dword [esp], 0xe0e7e6e5
xor ebx, ebx
nop
nop
mov edx, ebx
add dl, 0x89
xor dl, byte [esp + ebx]
xor dl, 0xa0
add dl, 0x33
mov byte [esp + ebx], dl
inc ebx
cmp ebx, 4
jne 0x440060
mov esi, dword [0x451ae0]
test esi, esi
je 0x4400c5
mov edx, dword [esp]
xor ebx, ebx
mov edi, dword [0x451ae4]
nop
nop
nop
nop
cmp dword [edi + ebx*8], 0x7e776f1
je 0x4400a0
inc ebx
cmp esi, ebx
jne 0x440090
jmp 0x4400c5
mov esi, dword [edi + ebx*8 + 4]
cmp esi, edx
je 0x4400c5
push dword [esp + 0x10]
push 1
push dword [0x451ae8]
push esi
mov esi, ecx
mov edi, eax
call fcn.004425f0
mov eax, edi
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4400e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x44016a
push 0xf8eb88df
push dword [0x451ad4]
call fcn.00444eb0
add esp, 8
test eax, eax
je 0x440135
mov ecx, dword [esi]
test ecx, ecx
je 0x440167
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x440143
cmp dword [esp], 0
je 0x440143
mov dword [esi + 4], 3
jmp 0x440167
mov dword [esi + 4], 1
mov ecx, dword [esi]
jmp 0x4401c0
lea eax, [esp + 4]
push eax
call fcn.00445600
add esp, 4
test al, al
je 0x440167
mov eax, dword [esp + 4]
mov ecx, 2
cmp eax, 3
je 0x440164
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, 2
jne 0x4401c0
mov dword [esp], 0xe0e7e6e5
xor eax, eax
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x89
xor dl, byte [esp + eax]
xor dl, 0xa0
add dl, 0x33
mov byte [esp + eax], dl
inc eax
cmp eax, 4
jne 0x440180
mov eax, dword [esp]
mov edx, dword [0x451ae0]
test edx, edx
je 0x440234
xor esi, esi
mov ebx, dword [0x451ae4]
cmp dword [ebx + esi*8], 0x1cbb9425
je 0x440210
inc esi
cmp edx, esi
jne 0x4401b0
jmp 0x440234
mov dword [esp], 0xe0e7e6e5
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x89
xor dl, byte [esp + eax]
xor dl, 0xa0
add dl, 0x33
mov byte [esp + eax], dl
inc eax
cmp eax, 4
jne 0x4401d0
mov eax, dword [esp]
mov edx, dword [0x451ae0]
test edx, edx
je 0x440234
xor esi, esi
mov ebx, dword [0x451ae4]
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x62429966
je 0x440210
inc esi
cmp edx, esi
jne 0x440200
jmp 0x440234
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x440234
push dword [esp + 0x28]
push edi
push ebp
push dword [esp + 0x28]
push ecx
push 5
push dword [0x451ae8]
push edx
call fcn.004425f0
add esp, 0x20
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x440530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x440549
lea edi, [esp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x44055a
cmp eax, 2
je 0x4405cc
jmp 0x4405f6
push 0xf8eb88df
push dword [0x451ad4]
call fcn.00444eb0
add esp, 8
test eax, eax
je 0x440597
mov ecx, dword [esi]
test ecx, ecx
je 0x4405c4
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x4405a0
cmp dword [esp], 0
je 0x4405a0
mov dword [esi + 4], 3
jmp 0x4405c4
mov dword [esi + 4], 1
jmp 0x4405f6
lea eax, [esp + 4]
push eax
call fcn.00445600
add esp, 4
test al, al
je 0x4405c4
mov eax, dword [esp + 4]
mov ecx, 2
cmp eax, 3
je 0x4405c1
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x4405f6
mov ebx, dword [ebp + 0x18]
push 0x1e03da9a
push dword [0x459af4]
call fcn.00444eb0
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x440674
mov ecx, dword [esi]
mov dword [esp], 0xe0e7e6e5
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x89
xor dl, byte [esp + eax]
xor dl, 0xa0
add dl, 0x33
mov byte [esp + eax], dl
inc eax
cmp eax, 4
jne 0x440610
mov eax, dword [esp]
mov edx, dword [0x451ae0]
test edx, edx
je 0x440674
xor esi, esi
mov ebx, dword [0x451ae4]
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x64567875
je 0x440650
inc esi
cmp edx, esi
jne 0x440640
jmp 0x440674
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x440674
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x451ae8]
push edx
call fcn.004425f0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x441280
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov dword [esp + 0x30], 0x179a198a
mov dword [esp + 0x34], 0x13861588
mov dword [esp + 0x38], 0xf5c1184
mov dword [esp + 0x3c], 0xb9e0d90
mov dword [esp + 0x40], 0x706099c
mov byte [esp + 0x44], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x30]
mov edx, eax
and edx, 4
mov esi, eax
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or edx, 2
imul edx, esi
add edx, edi
mov esi, eax
xor esi, 0xce57f686
mov edi, edx
and edi, esi
xor esi, edx
lea edx, [esi + edi*2]
xor edx, ecx
mov ecx, edx
and ecx, 0x61
xor edx, 0xf8482f61
lea ecx, [edx + ecx*2]
and edx, 1
or ecx, 1
add ecx, edx
mov byte [esp + eax + 0x30], cl
inc eax
cmp eax, 0x15
jne 0x4412c0
lea eax, [esp + 0x30]
push eax
call fcn.00444a30
add esp, 4
mov dword [0x459af4], eax
mov dword [esp + 0x2c], 0x68414043
test eax, eax
je 0x441338
mov dword [esp + 0x2c], 0x5d43e4cd
mov ebp, 0xb2e54ff5
xor eax, eax
cmp ebp, 0xdadeb1c
setl al
mov eax, dword [eax*4 + 0x44f7d0]
mov ecx, 0x4b39eec5
xor ecx, dword [0x44f7d8]
add eax, ecx
inc eax
mov dword [esp + 0x28], ecx
jmp eax

Function at 0x442540
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44fc8c]

Function at 0x44335f
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov ebp, dword [esp + 0x38]
movzx eax, word [ebp]
mov dword [esp + 8], 0xd9da7517
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 8]
mov edi, edx
xor edi, 0x8c14a6af
add edi, ecx
xor edi, esi
lea ebx, [edi + 0x4398be94]
mov esi, ebx
xor esi, 0xfe
or ebx, 1
and ebx, esi
mov esi, 0x6b
sub esi, edi
or esi, 1
sub ebx, esi
mov byte [esp + edx + 8], bl
inc edx
add ecx, 2
cmp edx, 4
jne case.default.0x443358
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x4500d4]
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ebp + ecx]
mov dword [esp + 8], 0x898a505c
mov word [esp + 0xc], 0
mov edx, 0x5212bbe3
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0x5212bbdb]
xor esi, edx
mov edi, esi
and edi, 1
xor esi, 1
lea ebx, [esi + edi*2]
add bl, 0x90
mov byte [esp + edx - 0x5212bbdb], bl
inc edx
cmp edx, 0x5212bbe9
jne 0x443380
xor edx, edx
cmp eax, dword [esp + 8]
setne dl
xor eax, eax
jmp dword [edx*4 + 0x4500dc]
mov edx, dword [ebp + ecx + 0x78]
cmp dword [ebp + ecx + 0x7c], 0
sete al
test edx, edx
sete cl
or cl, al
movzx eax, cl
mov dword [esp + 0x14], edx
jmp dword [eax*4 + 0x4500e4]
mov eax, dword [ebp + edx + 0x20]
add eax, ebp
mov dword [esp + 0x20], eax
mov eax, dword [ebp + edx + 0x24]
add eax, ebp
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + edx + 0x1c]
add eax, ebp
mov dword [esp + 0x18], eax
mov ecx, dword [0x451ae4]
xor eax, eax
test ecx, ecx
sete al
jmp dword [eax*4 + 0x4500ec]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 8], 0x41464714
mov byte [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 8]
mov esi, 0x8e
sub esi, eax
mov ecx, esi
or ecx, edx
and esi, edx
not ecx
add ecx, esi
add cl, 0xcb
mov byte [esp + eax + 8], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 5
jb case.default.0x444a8e
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x28], 0
sete cl
jmp dword [ecx*4 + 0x450560]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp], 0
mov edi, dword [case.0x444a8e.4]
mov ecx, dword [edx]
xor eax, eax
cmp ecx, edx
setne al
mov dword [esp + 0x10], edx
jmp dword [eax*4 + 0x450568]
mov dword [esp + 4], ecx
mov ebp, dword [ecx + 0x30]
xor eax, eax
test ebp, ebp
setne al
mov ebx, 1
jmp dword [eax*4 + 0x450570]
mov ecx, dword [esp + 0x28]
nop
nop
movzx edx, word [ecx]
lea eax, [edx - 0x41]
cmp ax, 0x1a
jae 0x444aef
or edx, 0x20
movzx eax, word [ebp]
lea esi, [eax - 0x41]
cmp si, 0x1a
jae 0x444aff
or eax, 0x20
mov esi, edi
test dx, dx
je 0x444b11
add ebp, 2
add ecx, 2
cmp dx, ax
je 0x444ae0
xor ecx, ecx
cmp dx, ax
sete cl
mov edx, dword [esp + 0x10]
jmp dword [ecx*4 + 0x450578]
mov ecx, dword [esp + 4]
jmp dword [ebx*4 + 0x450590]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x444de0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x919e9f4c
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x65
xor dl, byte [esp + eax]
add dl, 7
mov byte [esp + eax], dl
inc eax
cmp eax, 6
jne case.default.0x444e21
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x450600]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov edi, dword [case.0x444e21.3]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
jmp edi
mov esi, dword [esi]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x450618]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov ecx, dword [0x450648]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
Function at 0x445820
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x445840
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x44585b
mov eax, 0xffffffff
jmp 0x44585e
add eax, 0xa
push eax
call fcn.0040c650
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x4458a1
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x445890
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov ebx, esi
xor ebx, 2
imul ebx, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
mov ecx, 0x72
mov ebp, 0x8d
nop
nop
nop
movzx esi, byte [esp + ecx - 0x72]
mov ebx, ecx
xor ebx, ebp
and ebx, esi
xor ebx, ebp
mov dl, 0xc5
sub dl, bl
mov byte [esp + ecx - 0x72], dl
inc ecx
dec ebp
cmp ecx, 0x78
jne 0x445920
mov esi, dword [esp]
mov ecx, dword [0x451ae0]
test ecx, ecx
je 0x4459a4
xor edx, edx
mov ebx, dword [0x451ae4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x266686e9
je 0x445970
inc edx
cmp ecx, edx
jne 0x445960
jmp 0x4459a4
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x4459a4
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push dword [0x451ae8]
push ecx
mov edi, eax
call fcn.004425f0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040c660
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4459c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4459e0
mov ebx, eax
sar ebx, 1
add ebx, 4
and eax, 2
mov ecx, ebx
xor ecx, 1
add ecx, eax
jns 0x445a05
mov ecx, 0xffffffff
jmp 0x445a07
add ecx, ecx
push ecx
call fcn.0040c650
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x445a51
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x445a40
mov word [ecx], 0
lea ecx, [ebx + ebx]
mov word [esp], cx
lea ecx, [ebx*2 + 2]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x4c4d4a4b
mov word [esp + 0x24], 0
mov ecx, 0x72
mov edi, 0x8d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x52]
mov ebx, ecx
xor ebx, edi
and ebx, esi
xor ebx, edi
mov dl, 0xc5
sub dl, bl
mov byte [esp + ecx - 0x52], dl
inc ecx
dec edi
cmp ecx, 0x78
jne 0x445ac0
mov esi, dword [esp + 0x20]
mov ecx, dword [0x451ae0]
test ecx, ecx
je 0x445b39
xor edx, edx
mov ebx, dword [0x451ae4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x87573896
je 0x445b10
inc edx
cmp ecx, edx
jne 0x445b00
jmp 0x445b39
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x445b39
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 2
push dword [0x451ae8]
push ecx
mov ebx, eax
call fcn.004425f0
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.0040c660
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x445b4f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x445b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
mov eax, 0x72
mov edx, 0x8d
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x72]
mov ecx, eax
xor ecx, edx
and ecx, ebx
xor ecx, edx
mov bl, 0xc5
sub bl, cl
mov byte [esp + eax - 0x72], bl
inc eax
dec edx
cmp eax, 0x78
jne 0x445b90
mov eax, dword [esp]
mov edx, dword [0x451ae0]
test edx, edx
je 0x445c08
xor ebx, ebx
mov ecx, dword [0x451ae4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa70a987f
je 0x445be0
inc ebx
cmp edx, ebx
jne 0x445bd0
jmp 0x445c08
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x445c08
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 5
push dword [0x451ae8]
push edx
call fcn.004425f0
add esp, 0x20
test edi, edi
je 0x445c12
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x445c1e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x445c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
mov edi, 0x72
mov ebx, 0x8d
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + edi - 0x72]
mov eax, edi
xor eax, ebx
and eax, ebp
xor eax, ebx
mov cl, 0xc5
sub cl, al
mov byte [esp + edi - 0x72], cl
inc edi
dec ebx
cmp edi, 0x78
jne 0x445c60
mov eax, dword [esp]
mov ebx, dword [0x451ae0]
test ebx, ebx
je 0x445cde
xor ebp, ebp
mov edi, dword [0x451ae4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xd41f89d1
je 0x445cb0
inc ebp
cmp ebx, ebp
jne 0x445ca0
jmp 0x445cde
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x445cde
lea eax, [esp + 8]
push 0
push 0
push edx
push esi
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push dword [0x451ae8]
push ebx
call fcn.004425f0
add esp, 0x30
cmp eax, 0x103
jne 0x445d89
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
mov eax, 0x72
mov ecx, 0x8d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x72]
mov edx, eax
xor edx, ecx
and edx, esi
xor edx, ecx
mov bl, 0xc5
sub bl, dl
mov byte [esp + eax - 0x72], bl
inc eax
dec ecx
cmp eax, 0x78
jne 0x445d10
mov eax, dword [esp]
mov ecx, dword [0x451ae0]
test ecx, ecx
je 0x445d81
xor edx, edx
mov edi, dword [0x451ae4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x53f09cfa
je 0x445d60
inc edx
cmp ecx, edx
jne 0x445d50
jmp 0x445d81
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x445d81
push 0
push 0
push dword [esp + 0x2c]
push 3
push dword [0x451ae8]
push ecx
call fcn.004425f0
add esp, 0x18
test eax, eax
js 0x445d89
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x445da0
xor ecx, ecx
cmp eax, 0xc0000011
je 0x445d9e
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret