joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x18]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.00440af0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4493e4]

Function at 0x439ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
lea eax, [esp + 8]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x3c]
call fcn.00441220
add esp, 0x14
test eax, eax
js 0x43a07e
lea ebx, [esp + 0x10]
lea eax, [esp + 0x14]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x28]
call fcn.00441620
add esp, 0x24
test eax, eax
js 0x439f53
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov ecx, eax
inc ecx
jns 0x439f5d
mov eax, 0xffffffff
jmp 0x439f64
mov dword [esp + 4], 0
jmp 0x439f9b
lea eax, [eax*2 + 2]
push eax
call fcn.00408380
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x18]
call fcn.00441c40
add esp, 0x14
test eax, eax
js 0x439f8a
mov dword [esp + 4], edi
jmp 0x439f9b
mov dword [esp + 4], 0
push edi
call fcn.00408390
add esp, 4
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
mov dword [esp], 0x60676665
mov ecx, 0x2ee6ee8d
mov edx, 0x5dcddd1a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0x2ee6ee8d]
mov ebx, edx
and ebx, 0x50c55d32
mov ebp, ecx
xor ebp, 0x3862af99
mov esi, 0x8c
sub esi, ebx
sub esi, ebp
lea eax, [ebx + ebp]
add eax, 0xd1191173
and esi, edi
mov ebx, eax
xor ebx, edi
and eax, edi
add eax, esi
add ebx, edi
sub ebx, eax
mov eax, ebx
and eax, 1
or ebx, 1
add ebx, eax
add bl, 2
mov byte [esp + ecx - 0x2ee6ee8d], bl
inc ecx
add edx, 2
cmp ecx, 0x2ee6ee91
jne 0x439fc0
mov ecx, dword [0x44ce38]
test ecx, ecx
mov eax, dword [esp + 4]
je 0x43a061
mov edx, dword [esp]
xor edi, edi
mov ebx, dword [0x44ce3c]
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43a040
inc edi
cmp ecx, edi
jne 0x43a030
jmp 0x43a061
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43a061
push dword [esp + 0xc]
push 4
push ecx
push dword [0x44ce40]
mov esi, eax
call fcn.0043e410
mov eax, esi
add esp, 0x10
test eax, eax
jne 0x43a080
mov esi, eax
mov eax, esp
push eax
call fcn.004408e0
add esp, 4
test al, al
je 0x43a07e
mov eax, esi
cmp dword [esp], 1
je 0x43a080
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43bd00
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 8
mov eax, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449720]

Function at 0x43bd60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp], 0x14151617
mov byte [esp + 4], 0
mov eax, 4
mov ecx, 0xfb
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 4]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0xec
mov byte [esp + eax - 4], dl
inc eax
dec ecx
cmp eax, 9
jne 0x43bd90
mov ebp, dword [esp]
mov eax, dword [0x44ce38]
test eax, eax
je 0x43bdf6
xor ecx, ecx
mov edx, dword [0x44ce3c]
nop
cmp dword [edx + ecx*8], 0x61813e67
je 0x43bdd0
inc ecx
cmp eax, ecx
jne 0x43bdc0
jmp 0x43bdf6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebp
je 0x43bdf6
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x44ce40]
call fcn.0043e410
add esp, 0x1c
mov ebp, eax
mov dword [esp], 0x81464748
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xf1
xor cl, byte [esp + eax]
add cl, 0x4b
mov byte [esp + eax], cl
inc eax
cmp eax, 6
jne 0x43be10
cmp ebp, dword [esp]
jne 0x43bf74
mov dword [esp + 0x10], edi
push dword [esp + 0xc]
call fcn.0043bc60
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], ecx
mov dword [esp], 0x14151617
mov byte [esp + 4], 0
mov edx, 4
mov edi, 0xfb
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 4]
mov ecx, edi
xor ecx, edx
and ecx, esi
xor ecx, edx
add cl, 0xec
mov byte [esp + edx - 4], cl
inc edx
dec edi
cmp edx, 9
jne 0x43be60
mov ebp, dword [esp]
mov edx, dword [0x44ce38]
test edx, edx
je 0x43bedc
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x44ce3c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x61813e67
je 0x43beb2
inc ebp
cmp edx, ebp
jne 0x43bea0
mov ebp, ecx
jmp 0x43bedc
mov edx, dword [esi + ebp*8 + 4]
mov ebp, ecx
cmp edx, ecx
je 0x43bedc
push 0
push dword [esp + 0xc]
push eax
push 5
push 0x10
push edx
push dword [0x44ce40]
mov esi, eax
call fcn.0043e410
add esp, 0x1c
mov ebp, eax
mov eax, esi
test ebp, ebp
js 0x43bf6b
mov dword [esp], 0x418685eb
mov dword [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xa1
xor dl, byte [esp + ecx]
add dl, 0xdb
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 8
jne 0x43bf00
mov ecx, dword [esp]
mov dword [esp + 8], ecx
mov esi, dword [eax]
mov ecx, eax
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + ebp]
movzx edi, word [ebx + ebp]
test si, si
je 0x43bf45
add ebp, 2
cmp si, di
je 0x43bf30
cmp si, di
je 0x43bf56
mov esi, dword [ecx]
test esi, esi
jne 0x43bf20
mov ebp, dword [esp + 8]
jmp 0x43bf6b
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor ebp, ebp
push eax
call fcn.0043bd00
add esp, 4
mov eax, ebp
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43bfa0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43c060
xor eax, eax
cmp dword [ecx], 0
jne 0x43c0b8
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x14151617
mov byte [esp + 4], 0
mov eax, 4
mov esi, 0xfb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 4]
mov ebx, esi
xor ebx, eax
and ebx, edi
xor ebx, eax
add bl, 0xec
mov byte [esp + eax - 4], bl
inc eax
dec esi
cmp eax, 9
jne 0x43c020
mov eax, dword [esp]
mov esi, dword [0x44ce38]
test esi, esi
je 0x43c0b8
xor edi, edi
mov ebx, dword [0x44ce3c]
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43c0c1
inc edi
cmp esi, edi
jne 0x43c050
jmp 0x43c0b8
mov dword [esp + 8], 0x6126271c
mov dword [esp + 0xc], 0
mov eax, 0x28a5ee1b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x28a5ee13]
lea edx, [eax - 0x28a5eda2]
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
xor edx, 0xfffffffe
or ecx, 1
and edx, ecx
xor ecx, edx
lea ecx, [ecx + edx*2]
mov byte [esp + eax - 0x28a5ee13], cl
inc eax
cmp eax, 0x28a5ee23
jne 0x43c080
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43c0b8
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44ce40]
call fcn.0043e410
add esp, 0x1c
jmp 0x43c0b8

Function at 0x43c0f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43c18a
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x14151617
mov byte [esp + 4], 0
mov edx, 4
mov esi, 0xfb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx - 4]
mov ebx, esi
xor ebx, edx
and ebx, edi
xor ebx, edx
add bl, 0xec
mov byte [esp + edx - 4], bl
inc edx
dec esi
cmp edx, 9
jne 0x43c120
mov edx, dword [0x44ce38]
test edx, edx
je 0x43c17e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44ce3c]
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43c160
inc edi
cmp edx, edi
jne 0x43c150
jmp 0x43c17e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43c17e
push eax
push 4
push edx
push dword [0x44ce40]
mov esi, ecx
call fcn.0043e410
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43c440
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [ecx]
mov dword [esp], 0x14151617
mov byte [esp + 4], 0
mov eax, 4
mov ebp, 0xfb
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 4]
mov edx, ebp
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0xec
mov byte [esp + eax - 4], dl
inc eax
dec ebp
cmp eax, 9
jne 0x43c470
test ebx, ebx
jne 0x43c493
lea ebx, [esp + 8]
mov eax, dword [esp]
mov ebp, dword [0x44ce38]
test ebp, ebp
je 0x43c4e4
xor edx, edx
mov esi, dword [0x44ce3c]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe6c7f7c6
je 0x43c4c0
inc edx
cmp ebp, edx
jne 0x43c4b0
jmp 0x43c4e4
mov ebp, dword [esi + edx*8 + 4]
cmp ebp, eax
je 0x43c4e4
push ebx
push edi
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
push 0x14
push ebp
push dword [0x44ce40]
call fcn.0043e410
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43d0a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov dword [esp + 0x2c], 0x49c64bde
mov dword [esp + 0x30], 0x45d247d4
mov dword [esp + 0x34], 0x419043d0
mov dword [esp + 0x38], 0x7dea7fdc
mov dword [esp + 0x3c], 0x797a7be8
mov word [esp + 0x40], 0
mov byte [esp + 0x42], 0
xor ecx, ecx
mov eax, ecx
nop
movzx edx, byte [esp + ecx + 0x2c]
lea esi, [ecx + 0x2f51493]
and esi, edx
add edx, ecx
add edx, 0x2f51493
add esi, esi
sub edx, esi
add dl, 0x21
mov byte [esp + ecx + 0x2c], dl
mov edx, ecx
xor eax, 1
add eax, ecx
and ecx, 1
and edx, 0x1e
sub eax, edx
add eax, ecx
mov ecx, eax
cmp eax, 0x17
jb 0x43d0e0
lea eax, [esp + 0x2c]
push eax
call fcn.0043fba0
add esp, 4
mov dword [0x454e54], eax
mov dword [esp + 0x28], 0x7828acd5
test eax, eax
je 0x43d13e
mov dword [esp + 0x28], 0xfc6cf0d7
mov ebp, 0x915a53ef
xor eax, eax
cmp ebp, 0xe65e566e
setl al
mov eax, dword [eax*4 + 0x449738]
mov ecx, 0xd534c21c
xor ecx, dword [0x449740]
add eax, ecx
inc eax
mov dword [esp + 0x24], ecx
jmp eax

Function at 0x43e350
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x449bd4]

Function at 0x43f130
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov ebp, dword [esp + 0x48]
movzx eax, word [ebp]
mov dword [esp + 4], 0xf10eb5c3
mov byte [esp + 8], 0
mov ecx, 0x73422582
mov edx, 0xcbdda7d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx - 0xcbdda79]
lea esi, [edi + edi]
not esi
add esi, edi
mov ebx, edx
or ebx, edi
and edi, 0xffffffa0
and esi, 0x210d685f
or esi, edi
xor esi, ecx
xor esi, 0x5ef297a0
and esi, ebx
mov edi, esi
and edi, 0x89a8e
mov ebx, edi
not ebx
add esi, ebx
add esi, 0xc04abb8f
mov ebx, esi
and ebx, edi
xor edi, esi
lea edi, [edi + ebx*2]
and esi, 1
xor edi, 1
lea ebx, [edi + esi*2]
mov byte [esp + edx - 0xcbdda79], bl
dec ecx
inc edx
cmp edx, 0xcbdda82
jne 0x43f160
xor ecx, ecx
cmp dword [esp + 4], eax
setne cl
mov eax, dword [ecx*4 + 0x449f58]
mov ecx, 0xab84ef5
xor ecx, dword [0x449f60]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x43fba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 4], 0x898a8b7c
mov dword [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe3
xor cl, byte [esp + eax + 4]
add cl, 0x91
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 8
jne case.default.0x43fbe7
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x2c], 0
sete cl
jmp dword [ecx*4 + 0x44a4a8]
mov edx, dword [eax + 0xc]
mov esi, dword [edx + 0xc]
add edx, 0xc
mov eax, dword [case.0x43fbe7.6]
mov dword [esp + 0xc], eax
mov dword [esp], 0
mov ebx, dword [0x44a4ec]
xor eax, eax
cmp esi, edx
setne al
mov dword [esp + 0x10], edx
jmp dword [eax*4 + 0x44a4b0]
mov eax, dword [esi + 0x30]
xor ecx, ecx
test eax, eax
setne cl
mov edi, 1
jmp dword [ecx*4 + 0x44a4b8]
mov dword [esp + 0x14], esi
mov ecx, dword [esp + 0x2c]
mov edi, eax
jmp dword [esp + 0xc]
mov edi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [ecx]
lea esi, [ebp - 0x41]
cmp si, 0x1a
jae 0x43fc5f
or ebp, 0x20
movzx esi, word [edi]
lea edx, [esi - 0x41]
cmp dx, 0x1a
jae 0x43fc6e
or esi, 0x20
test bp, bp
je 0x43fc7e
add ecx, 2
add edi, 2
cmp bp, si
je 0x43fc50
mov ecx, dword [esp + 0x2c]
mov edi, eax
jmp case.0x43fbe7.6
mov ecx, dword [esp + 0x2c]
mov edi, eax
jmp dword [0x44a4cc]
movzx ebp, word [ecx]
lea edx, [ebp - 0x41]
cmp dx, 0x1a
jae 0x43fcab
or ebp, 0x20
movzx esi, word [edi]
lea edx, [esi - 0x41]
cmp dx, 0x1a
jae 0x43fcba
or esi, 0x20
test bp, bp
je 0x43fc90
add ecx, 2
add edi, 2
cmp bp, si
je case.0x43fbe7.6
jmp 0x43fc90
jmp dword [edi*4 + 0x44a4d8]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43fef0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x710e0f5c
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
mov edx, eax
add dl, 0xbd
xor dl, byte [esp + eax]
add dl, 0x4f
mov byte [esp + eax], dl
inc eax
cmp eax, 7
jne case.default.0x43ff31
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44a548]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [0x44a570]
mov edi, dword [edx]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x44a560]
jmp dword [0x44a55c]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [0x44a570]
mov edi, dword [edx]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x44a560]
jmp esi
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43ffe0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0xcfcec918
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
mov edx, eax
add dl, 0x32
xor dl, byte [esp + eax]
add dl, 6
mov byte [esp + eax], dl
inc eax
cmp eax, 7
jne case.default.0x440021
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44a588]
mov edx, dword [eax + 0xc]
mov esi, dword [edx + 0xc]
add edx, 0xc
xor eax, eax
mov edi, dword [0x44a5b0]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x44a590]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x44a598]
mov ebx, 1
jmp dword [ebx*4 + 0x44a5a0]
mov eax, dword [esi + 0x28]
xor ebx, ebx
jmp dword [ebx*4 + 0x44a5a0]
mov esi, dword [esi]
nop
nop
jmp edi
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x4400a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov ebp, dword [esp + 0x48]
movzx eax, word [ebp]
mov dword [esp], 0x7776dfad
xor ecx, ecx
mov dl, 0xe9
nop
nop
nop
nop
nop
nop
mov dh, byte [esp + ecx]
xor dh, dl
mov bl, 0x91
sub bl, dh
mov byte [esp + ecx], bl
inc ecx
dec dl
cmp ecx, 4
jne case.default.0x4400de
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44a5b8]
jmp dword [0x44a5c0]
nop
nop
nop
nop
nop
mov edx, dword [ebp + 0x3c]
mov eax, dword [ebp + edx]
mov dword [esp], 0x33328c80
mov word [esp + 4], 0
jmp dword [0x44a5c8]
xor ecx, ecx
cmp ecx, 5
ja 0x440134
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov bl, 0xf3
sub bl, cl
xor bl, byte [esp + ecx]
mov bh, 0xc3
sub bh, bl
mov byte [esp + ecx], bh
inc ecx
cmp ecx, 5
jbe 0x440120
mov ecx, dword [esp]
xor ebx, ebx
cmp eax, ecx
setne bl
xor eax, eax
jmp dword [ebx*4 + 0x44a5d0]
mov edi, dword [ebp + edx + 0x78]
mov esi, dword [ebp + edx + 0x7c]
test esi, esi
sete cl
test edi, edi
sete dl
or dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x44a5d8]
mov dword [esp + 0x14], esi
mov eax, dword [ebp + edi + 0x20]
add eax, ebp
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + edi + 0x24]
add eax, ebp
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + edi + 0x1c]
add eax, ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edi
mov ecx, dword [ebp + edi + 0x18]
xor edx, edx
mov eax, dword [0x44a5e8]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x24], ecx
cmp edx, ecx
setb al
mov dword [esp + 8], 2
jmp dword [eax*4 + 0x44a5e0]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], edx
mov eax, dword [eax + edx*4]
mov dword [esp + 0x30], eax
jmp dword [esp + 0x28]
xor ecx, ecx
cmp dword [esp + 8], 2
sete cl
mov eax, ebp
jmp dword [ecx*4 + 0x44a650]
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44010b
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov ebp, dword [esp + 0x48]
movzx eax, word [ebp]
mov dword [esp], 0x7776dfad
xor ecx, ecx
mov dl, 0xe9
nop
nop
nop
nop
nop
nop
mov dh, byte [esp + ecx]
xor dh, dl
mov bl, 0x91
sub bl, dh
mov byte [esp + ecx], bl
inc ecx
dec dl
cmp ecx, 4
jne case.default.0x4400de
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44a5b8]
jmp dword [0x44a5c0]
nop
nop
nop
nop
nop
mov edx, dword [ebp + 0x3c]
mov eax, dword [ebp + edx]
mov dword [esp], 0x33328c80
mov word [esp + 4], 0
jmp dword [0x44a5c8]
xor ecx, ecx
cmp ecx, 5
ja 0x440134
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov bl, 0xf3
sub bl, cl
xor bl, byte [esp + ecx]
mov bh, 0xc3
sub bh, bl
mov byte [esp + ecx], bh
inc ecx
cmp ecx, 5
jbe 0x440120
mov ecx, dword [esp]
xor ebx, ebx
cmp eax, ecx
setne bl
xor eax, eax
jmp dword [ebx*4 + 0x44a5d0]
mov edi, dword [ebp + edx + 0x78]
mov esi, dword [ebp + edx + 0x7c]
test esi, esi
sete cl
test edi, edi
sete dl
or dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x44a5d8]
mov dword [esp + 0x14], esi
mov eax, dword [ebp + edi + 0x20]
add eax, ebp
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + edi + 0x24]
add eax, ebp
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + edi + 0x1c]
add eax, ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edi
mov ecx, dword [ebp + edi + 0x18]
xor edx, edx
mov eax, dword [0x44a5e8]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x24], ecx
cmp edx, ecx
setb al
mov dword [esp + 8], 2
jmp dword [eax*4 + 0x44a5e0]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], edx
mov eax, dword [eax + edx*4]
mov dword [esp + 0x30], eax
jmp dword [esp + 0x28]
xor ecx, ecx
cmp dword [esp + 8], 2
sete cl
mov eax, ebp
jmp dword [ecx*4 + 0x44a650]
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov esi, dword [esp + 0x3c]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax], 0
lea eax, [eax + 2]
jne 0x440950
lea ecx, [esi + eax]
add ecx, 0xfffffffe
mov eax, esi
not eax
and eax, ecx
xor ecx, esi
add eax, eax
sub eax, ecx
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x44097c
mov eax, 0xffffffff
jmp 0x44097f
add eax, 0xa
push eax
call fcn.00408380
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [edi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [esi]
test bx, bx
je 0x4409c1
add esi, 2
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [esi]
add esi, 2
test bx, bx
jne 0x4409b0
mov word [edx], 0
mov edx, 3
sub edx, edi
and edx, 2
mov esi, ecx
and esi, 0xfffd
imul esi, edx
and edi, 2
or ecx, 2
imul ecx, edi
lea edx, [ecx + esi]
mov word [esp + 8], dx
add ecx, esi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x14151617
mov dword [esp + 4], 0
mov ecx, 0xc4aa0abc
nop
nop
movzx edx, byte [esp + ecx + 0x3b55f544]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0x54
mov byte [esp + ecx + 0x3b55f544], dl
inc ecx
cmp ecx, 0xc4aa0ac4
jne 0x440a40
mov esi, dword [esp]
mov ecx, dword [0x44ce38]
test ecx, ecx
je 0x440ad2
xor edx, edx
mov edi, dword [0x44ce3c]
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x440a90
inc edx
cmp ecx, edx
jne 0x440a80
jmp 0x440ad2
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x440ad2
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44ce40]
mov edi, eax
call fcn.0043e410
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408390
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax], 0
lea eax, [eax + 2]
jne 0x440b10
add eax, esi
add eax, 0xfffffffe
mov ebx, esi
not ebx
and ebx, eax
xor eax, esi
add ebx, ebx
sub ebx, eax
sar ebx, 1
lea ebp, [ebx + 4]
mov ecx, ebx
and ecx, 1
mov eax, ebp
or eax, 1
add eax, ecx
jns 0x440b45
mov eax, 0xffffffff
jmp 0x440b47
add eax, eax
push eax
call fcn.00408380
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x440b91
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x440b80
mov word [ecx], 0
mov ecx, 3
sub ecx, ebx
and ecx, 2
mov edx, ebp
and edx, 0xfffd
imul edx, ecx
and ebx, 2
or ebp, 2
imul ebp, ebx
lea ecx, [edx + ebp]
mov word [esp + 8], cx
lea ecx, [edx + ebp]
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x14151617
mov dword [esp + 4], 0
mov ecx, 0xc4aa0abc
nop
movzx edx, byte [esp + ecx + 0x3b55f544]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0x54
mov byte [esp + ecx + 0x3b55f544], dl
inc ecx
cmp ecx, 0xc4aa0ac4
jne 0x440c10
mov esi, dword [esp]
mov ecx, dword [0x44ce38]
test ecx, ecx
je 0x440c94
xor edx, edx
mov ebx, dword [0x44ce3c]
nop
nop
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x440c60
inc edx
cmp ecx, edx
jne 0x440c50
jmp 0x440c94
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x440c94
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44ce40]
mov edi, eax
call fcn.0043e410
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408390
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret