joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cef0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
mov dword [esp], 0xe1e6e7d4
mov dword [esp + 4], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
mov esi, ecx
and esi, 2
mov ebx, edx
xor ebx, 0x29
add ebx, esi
xor bl, byte [esp + edx]
add bl, 0x33
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 8
jne 0x43cf10
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x45649c]
add esp, 8
pop esi
pop ebx
ret
Function at 0x43cfd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp], 0xd4d5cacb
mov byte [esp + 4], 0
mov eax, 0x2b05744e
mov ecx, 0x14fa8bb1
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x2b05744e]
mov esi, ecx
and esi, 0x10008b93
mov edi, eax
and edi, 0x2805040c
or edi, esi
xor edi, edx
mov edx, edi
xor edx, 0x53
mov esi, edi
xor esi, 0x55
and esi, edx
xor edi, 0xaa
lea edx, [edi + esi*2]
inc dl
mov byte [esp + eax - 0x2b05744e], dl
inc eax
dec ecx
cmp eax, 0x2b057453
jne 0x43d000
mov edi, dword [esp]
mov eax, dword [0x44e478]
test eax, eax
je 0x43d096
xor ecx, ecx
mov edx, dword [0x44e47c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x43d070
inc ecx
cmp eax, ecx
jne 0x43d060
jmp 0x43d096
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43d096
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x44e480]
push eax
call fcn.0043fae0
add esp, 0x1c
mov edi, eax
mov dword [esp], 0xd392919c
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [eax + 4]
mov edx, 0x30c8961b
sub edx, eax
mov esi, edx
and esi, 3
xor esi, 0x2f
or esi, ecx
and ecx, 0xc
xor ecx, 0x2f
or ecx, edx
and ecx, esi
xor cl, byte [esp + eax]
xor cl, 0xcc
add cl, 0x8c
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 5
jb 0x43d0b0
cmp edi, dword [esp]
jne 0x43d225
mov dword [esp + 0x10], ebp
push dword [esp + 8]
call fcn.0043cef0
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp], 0xd4d5cacb
mov byte [esp + 4], 0
mov ecx, 0x2b05744e
mov edi, 0x14fa8bb1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x2b05744e]
mov ebp, edi
and ebp, 0x10008b93
mov edx, ecx
and edx, 0x2805040c
or edx, ebp
xor edx, esi
mov esi, edx
xor esi, 0x53
mov ebp, edx
xor ebp, 0x55
and ebp, esi
xor edx, 0xaa
lea edx, [edx + ebp*2]
inc dl
mov byte [esp + ecx - 0x2b05744e], dl
inc ecx
dec edi
cmp ecx, 0x2b057453
jne 0x43d130
mov edi, dword [esp]
mov edx, dword [0x44e478]
test edx, edx
je 0x43d1c8
xor ebp, ebp
mov esi, dword [0x44e47c]
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x43d1a0
inc ebp
cmp edx, ebp
jne 0x43d190
jmp 0x43d1c8
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x43d1c8
push 0
push dword [esp + 0x10]
push eax
push 5
push 4
push dword [0x44e480]
push edx
mov esi, eax
call fcn.0043fae0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43d21c
mov esi, dword [eax]
mov ecx, eax
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43d1f5
add edi, 2
cmp si, bp
je 0x43d1e0
cmp si, bp
je 0x43d207
mov esi, dword [ecx]
test esi, esi
jne 0x43d1d0
mov edi, 0xc0000225
jmp 0x43d21c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043cf50
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43d270
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43d360
xor eax, eax
cmp dword [ecx], 0
jne 0x43d3a7
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xd4d5cacb
mov byte [esp + 4], 0
mov eax, 0x2b05744e
mov esi, 0x14fa8bb1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x2b05744e]
mov ebx, esi
and ebx, 0x10008b93
mov ebp, eax
and ebp, 0x2805040c
or ebp, ebx
xor ebp, edi
mov edi, ebp
xor edi, 0x53
mov ebx, ebp
xor ebx, 0x55
and ebx, edi
xor ebp, 0xaa
lea ebx, [ebx*2]
add ebx, ebp
inc bl
mov byte [esp + eax - 0x2b05744e], bl
inc eax
dec esi
cmp eax, 0x2b057453
jne 0x43d2f0
mov eax, dword [esp]
mov esi, dword [0x44e478]
test esi, esi
je 0x43d3a7
xor edi, edi
mov ebx, dword [0x44e47c]
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x43d3b1
inc edi
cmp esi, edi
jne 0x43d350
jmp 0x43d3a7
mov dword [esp + 8], 0xb97a7b74
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 6
mov edx, ecx
xor edx, 0xeb
add edx, esi
xor dl, byte [esp + ecx + 8]
add dl, 0x69
mov byte [esp + ecx + 8], dl
inc ecx
add eax, 2
cmp ecx, 7
jne 0x43d380
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43d3a7
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44e480]
push esi
call fcn.0043fae0
add esp, 0x1c
jmp 0x43d3a7

Function at 0x43d3f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43d4bb
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xd4d5cacb
mov byte [esp + 4], 0
mov edx, 0x2b05744e
mov esi, 0x14fa8bb1
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx - 0x2b05744e]
mov ebx, esi
and ebx, 0x10008b93
mov ebp, edx
and ebp, 0x2805040c
or ebp, ebx
xor ebp, edi
mov edi, ebp
xor edi, 0x53
mov ebx, ebp
xor ebx, 0x55
and ebx, edi
xor ebp, 0xaa
lea ebx, [ebx*2]
add ebx, ebp
inc bl
mov byte [esp + edx - 0x2b05744e], bl
inc edx
dec esi
cmp edx, 0x2b057453
jne 0x43d420
mov edx, dword [0x44e478]
test edx, edx
je 0x43d4ae
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44e47c]
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43d490
inc edi
cmp edx, edi
jne 0x43d480
jmp 0x43d4ae
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43d4ae
push eax
push 1
push dword [0x44e480]
push edx
mov esi, ecx
call fcn.0043fae0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 8], 0
je 0x43d570
mov eax, dword [ecx]
test eax, eax
je 0x43d570
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xd4d5cacb
mov byte [esp + 8], 0
mov eax, 0x2b05744e
mov edx, 0x14fa8bb1
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x2b05744a]
mov ebx, edx
and ebx, 0x10008b93
mov esi, eax
and esi, 0x2805040c
or esi, ebx
xor esi, edi
mov edi, esi
xor edi, 0x53
mov ebx, esi
xor ebx, 0x55
and ebx, edi
xor esi, 0xaa
lea ebx, [esi + ebx*2]
inc bl
mov byte [esp + eax - 0x2b05744a], bl
inc eax
dec edx
cmp eax, 0x2b057453
jne 0x43d500
mov eax, dword [esp + 4]
mov ebx, dword [0x44e478]
test ebx, ebx
je 0x43d5c3
xor edi, edi
mov esi, dword [0x44e47c]
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edi*8], 0x2dedf0b8
je 0x43d59f
inc edi
cmp ebx, edi
jne 0x43d560
jmp 0x43d5c3
mov dword [esp + 4], 0xa3626178
mov byte [esp + 8], 0
xor eax, eax
nop
mov ecx, eax
add cl, 0xe8
xor cl, byte [esp + eax + 4]
add cl, 0x78
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 5
jne 0x43d580
mov eax, dword [esp + 4]
jmp 0x43d6c5
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
je 0x43d5c3
push dword [ebp + 8]
push dword [esp + 0x10]
push 2
push dword [0x44e480]
push esi
mov esi, ecx
call fcn.0043fae0
mov ecx, esi
add esp, 0x14
mov edi, dword [ebp + 0xc]
cmp edi, 1
mov esi, dword [ebp + 0x10]
mov edx, esi
sbb edx, 0
jl 0x43d6b8
cmp eax, 0xc000010a
jne 0x43d6b8
mov edx, 0xffffd8f0
mov eax, edi
mul edx
sub edx, edi
imul esi, esi, 0xffffd8f0
add esi, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov eax, dword [ecx]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xd4d5cacb
mov byte [esp + 8], 0
mov eax, 0x2b05744e
mov edx, 0x14fa8bb1
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x2b05744a]
mov esi, edx
and esi, 0x10008b93
mov edi, eax
and edi, 0x2805040c
or edi, esi
xor edi, ebx
mov esi, edi
xor esi, 0x53
mov ebx, edi
xor ebx, 0x55
and ebx, esi
xor edi, 0xaa
lea ebx, [edi + ebx*2]
inc bl
mov byte [esp + eax - 0x2b05744a], bl
inc eax
dec edx
cmp eax, 0x2b057453
jne 0x43d620
mov eax, dword [esp + 4]
mov esi, dword [0x44e478]
test esi, esi
je 0x43d6b8
xor edi, edi
mov ebx, dword [0x44e47c]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x4e66b5a3
je 0x43d690
inc edi
cmp esi, edi
jne 0x43d680
jmp 0x43d6b8
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43d6b8
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x14]
push 3
push dword [0x44e480]
push esi
mov esi, ecx
call fcn.0043fae0
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43d6c5
mov esi, eax
call fcn.0043d3f0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43d6d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43d760
push 0xbbf966b4
push dword [0x44e46c]
call fcn.00442130
add esp, 8
test eax, eax
je 0x43d725
mov ecx, dword [esi]
test ecx, ecx
je 0x43d75d
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43d739
cmp dword [esp], 0
je 0x43d739
mov dword [esi + 4], 3
jmp 0x43d75d
mov ecx, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 8], eax
jmp 0x43d807
lea eax, [esp + 0xc]
push eax
call fcn.00442930
add esp, 4
test al, al
je 0x43d75d
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43d75a
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 8], ecx
mov ecx, ebx
cmp eax, 2
jne 0x43d807
mov dword [esp], 0xd4d5cacb
mov byte [esp + 4], 0
mov ebp, 0x2b05744e
mov edx, 0x14fa8bb1
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ebp - 0x2b05744e]
mov ebx, edx
and ebx, 0x10008b93
mov eax, ebp
and eax, 0x2805040c
or eax, ebx
xor eax, esi
mov esi, eax
xor esi, 0x53
mov ebx, eax
xor ebx, 0x55
and ebx, esi
xor eax, 0xaa
lea eax, [eax + ebx*2]
inc al
mov byte [esp + ebp - 0x2b05744e], al
inc ebp
dec edx
cmp ebp, 0x2b057453
jne 0x43d790
mov eax, dword [esp]
mov edx, dword [0x44e478]
test edx, edx
je 0x43d8b7
xor esi, esi
mov ebx, dword [0x44e47c]
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xc3cdc4a6
je 0x43d890
inc esi
cmp edx, esi
jne 0x43d7f0
jmp 0x43d8b7
mov dword [esp], 0xd4d5cacb
mov byte [esp + 4], 0
mov eax, 0x2b05744e
mov edx, 0x14fa8bb1
nop
nop
nop
movzx esi, byte [esp + eax - 0x2b05744e]
mov ebx, edx
and ebx, 0x10008b93
mov ebp, eax
and ebp, 0x2805040c
or ebp, ebx
xor ebp, esi
mov esi, ebp
xor esi, 0x53
mov ebx, ebp
xor ebx, 0x55
and ebx, esi
xor ebp, 0xaa
lea ebx, [ebx*2]
add ebx, ebp
inc bl
mov byte [esp + eax - 0x2b05744e], bl
inc eax
dec edx
cmp eax, 0x2b057453
jne 0x43d820
mov eax, dword [esp]
mov edx, dword [0x44e478]
test edx, edx
je 0x43d8b7
xor esi, esi
mov ebx, dword [0x44e47c]
nop
nop
cmp dword [ebx + esi*8], 0xae6e2b0b
je 0x43d890
inc esi
cmp edx, esi
jne 0x43d880
jmp 0x43d8b7
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43d8b7
push dword [esp + 0x30]
push dword [esp + 0x30]
push ecx
push edi
push dword [esp + 0x18]
push 5
push dword [0x44e480]
push edx
call fcn.0043fae0
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43dc00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43dc19
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43dc2a
cmp eax, 2
je 0x43dc9c
jmp 0x43dcc9
push 0xbbf966b4
push dword [0x44e46c]
call fcn.00442130
add esp, 8
test eax, eax
je 0x43dc67
mov ecx, dword [esi]
test ecx, ecx
je 0x43dc94
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43dc70
cmp dword [esp], 0
je 0x43dc70
mov dword [esi + 4], 3
jmp 0x43dc94
mov dword [esi + 4], 1
jmp 0x43dcc9
lea eax, [esp + 0xc]
push eax
call fcn.00442930
add esp, 4
test al, al
je 0x43dc94
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43dc91
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43dcc9
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x456494]
call fcn.00442130
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43dd87
mov eax, dword [esi]
mov dword [esp + 8], eax
mov dword [esp], 0xd4d5cacb
mov byte [esp + 4], 0
mov eax, 0x2b05744e
mov ecx, 0x14fa8bb1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x2b05744e]
mov edx, ecx
and edx, 0x10008b93
mov esi, eax
and esi, 0x2805040c
or esi, edx
xor esi, ebx
mov edx, esi
xor edx, 0x53
mov ebx, esi
xor ebx, 0x55
and ebx, edx
xor esi, 0xaa
lea edx, [esi + ebx*2]
inc dl
mov byte [esp + eax - 0x2b05744e], dl
inc eax
dec ecx
cmp eax, 0x2b057453
jne 0x43dcf0
mov eax, dword [esp]
mov edx, dword [0x44e478]
test edx, edx
je 0x43dd87
xor esi, esi
mov ebx, dword [0x44e47c]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x43dd60
inc esi
cmp edx, esi
jne 0x43dd50
jmp 0x43dd87
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43dd87
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x18]
push 5
push dword [0x44e480]
push edx
call fcn.0043fae0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x43fa10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44c6dc]

Function at 0x440c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, edi
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x440c82
mov ecx, ebx
shr ecx, 2
mov eax, edi
mov ebp, edi
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, edx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
test bl, 1
je 0x440dce
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x440dce
mov dword [esp], 0xc0d0a0b
mov word [esp + 4], 0
mov byte [esp + 6], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x42
xor cl, byte [esp + eax]
add cl, 0xb6
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x440ca0
mov eax, dword [esp]
mov ecx, dword [0x44e478]
test ecx, ecx
je 0x440d22
xor edx, edx
mov edi, dword [0x44e47c]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x440cf4
mov ebp, edx
xor ebp, 1
and edx, 1
lea edx, [edx*2]
add edx, ebp
cmp edx, ecx
jb 0x440cd0
mov edi, dword [esp + 0x20]
jmp 0x440d22
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
mov edi, dword [esp + 0x20]
je 0x440d22
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x44e480]
push ecx
call fcn.0043fae0
add esp, 0x28
test eax, eax
js 0x440dce
push 0x732f71fd
push dword [0x456494]
call fcn.00442130
add esp, 8
push 0
push 0
push ebx
push esi
push dword [esp + 0x34]
push edi
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0xc0d0a0b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x42
xor bl, byte [esp + edx]
add bl, 0xb6
mov byte [esp + edx], bl
inc edx
cmp edx, 7
jne 0x440d70
mov edx, dword [0x44e478]
test edx, edx
je 0x440dce
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44e47c]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x440db0
inc edi
cmp edx, edi
jne 0x440da0
jmp 0x440dce
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x440dce
push ecx
push 1
push dword [0x44e480]
push edx
mov esi, eax
call fcn.0043fae0
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441b90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x33323100
mov byte [esp + 8], 0
xor eax, eax
mov edx, 0x636747cb
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 4]
lea esi, [ecx + ecx]
not esi
add esi, ecx
mov ebx, edx
and ebx, 0x6264038c
lea edi, [edx - 0x636747c8]
mov ebp, eax
and ebp, 3
or ebp, ebx
and edi, 3
xor edi, 0x90b003
or edi, ebp
and esi, 0xfe6c0bbc
and ecx, 0x43
or ecx, esi
mov esi, ecx
and esi, edi
add esi, esi
sub edi, esi
lea esi, [edi + ecx]
add ecx, edi
add ecx, 0xf10466fb
mov ebx, ecx
xor ebx, 0xfffffffe
mov edi, ecx
or edi, 1
and edi, ebx
mov ebx, edi
and ebx, 0xfd
mov ebp, edi
and ebp, 2
or edi, 2
imul edi, ebp
xor ebp, 2
imul ebp, ebx
and esi, 1
and ecx, 0xfe
or ecx, esi
add ecx, edi
add ecx, ebp
mov byte [esp + eax + 4], cl
inc eax
dec edx
cmp eax, 5
jne case.default.0x441c4e
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x24], 0
sete cl
jmp dword [ecx*4 + 0x44ce88]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp], 0
mov esi, dword [0x44ced4]
mov edi, dword [edx]
xor ecx, ecx
cmp edi, edx
setne cl
mov dword [esp + 0xc], edx
jmp dword [ecx*4 + 0x44cea0]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
sbb al, 0x44
add byte [esi], bh
sbb eax, 0x10044
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add dword [eax], eax
add byte [eax], al
sbb eax, 0x1c7c0044
inc esp
add byte [edi - 0x6fffbbe4], bh
sbb al, 0x44
add byte [eax + 0x4400441c], dl
sbb eax, 0x1c900044
inc esp
add byte [eax], dh
sbb eax, 0x1cd00044
inc esp
add byte [eax], dh
sbb eax, 0x1ca00044
inc esp
add byte [eax], dh
sbb eax, 0x1d300044
inc esp
add byte [eax], dh
sbb eax, 0x1d320044
inc esp
add byte [ebp + ebx + 0x44], al
add byte [edi - 0x4affbbe4], ch
sbb eax, 0x1db70044
inc esp
add ch, ah
push ds
inc esp
add byte [edx + 0x1e], ah
inc esp
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [esi + ebx + 0x44], ch
add byte [ecx], al
add byte [eax], al
add bh, al
push ds
inc esp
add bl, dl
push ds
inc esp
add byte [edi + 0x1e], cl
inc esp
add ch, ah
push ds
inc esp
add byte [ebp + 0x1e], bl
inc esp
add cl, bh
push ds
inc esp
add byte [esi - 0x53ffbbe1], cl
pop ds
inc esp
add byte [edi + ebx + 0x10044], ch
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add dword [eax], eax
add byte [eax], al
lodsb al, byte [esi]
pop ds
inc esp
add byte [ebx], cl
and byte [eax + eax - 0x30], al
Function at 0x442020
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x14]
mov dword [esp], 0x393a3bec
mov eax, 0xc84e9f4b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x37b160b5]
mov esi, eax
and esi, edx
add edx, eax
add esi, esi
mov edi, edx
sub edi, esi
mov esi, edi
and esi, 8
xor edi, 0x88
lea ebx, [edi + esi*2]
and edx, 1
or ebx, 1
add ebx, edx
mov byte [esp + eax + 0x37b160b5], bl
inc eax
cmp eax, 0xc84e9f4f
jne 0x442040
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44cf58]
Function at 0x442b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x442b70
mov ebx, eax
sar ebx, 1
add ebx, 4
and eax, 2
mov ecx, ebx
xor ecx, 1
add ecx, eax
jns 0x442b95
mov ecx, 0xffffffff
jmp 0x442b97
add ecx, ecx
push ecx
call fcn.0040c9c0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x442be1
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x442bd0
mov word [ecx], 0
lea ecx, [ebx + ebx]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 2]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xc0d0a0b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0xa6fff442
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x59000bbe]
xor edx, ecx
lea esi, [edx + edx]
mov ebx, esi
not ebx
and esi, 0x6a
xor edx, 0xb5
add edx, esi
and ebx, 2
xor edx, 1
add edx, ebx
mov byte [esp + ecx + 0x59000bbe], dl
inc ecx
cmp ecx, 0xa6fff449
jne 0x442c50
mov esi, dword [esp]
mov ecx, dword [0x44e478]
test ecx, ecx
je 0x442ce1
xor edx, edx
mov ebx, dword [0x44e47c]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x442cb0
inc edx
cmp ecx, edx
jne 0x442ca0
jmp 0x442ce1
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x442ce1
mov edx, esp
lea esi, [esp + 0x10]
push edi
push ebp
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push dword [0x44e480]
push ecx
mov edi, eax
call fcn.0043fae0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040c9d0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x442d20
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x442d3b
mov eax, 0xffffffff
jmp 0x442d3e
add eax, 0xa
push eax
call fcn.0040c9c0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x442d81
add ebx, 2
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x442d70
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp], dx
add ecx, edi
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xc0d0a0b
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
mov ecx, 0xa6fff442
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x59000bde]
xor edx, ecx
lea edi, [edx + edx]
mov esi, edi
not esi
and edi, 0x6a
xor edx, 0xb5
add edx, edi
and esi, 2
xor edx, 1
add edx, esi
mov byte [esp + ecx + 0x59000bde], dl
inc ecx
cmp ecx, 0xa6fff449
jne 0x442e00
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44e478]
test ecx, ecx
je 0x442e89
xor edx, edx
mov edi, dword [0x44e47c]
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x50dc24c7
je 0x442e60
inc edx
cmp ecx, edx
jne 0x442e50
jmp 0x442e89
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x442e89
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 2
push dword [0x44e480]
push ecx
mov edi, eax
call fcn.0043fae0
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.0040c9d0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x442e9f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret