joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d940
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], 0
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x20
mov ecx, 0xdf
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x20]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0x60
mov byte [esp + eax - 0x20], dl
inc eax
dec ecx
cmp eax, 0x27
jne 0x43d980
mov edi, dword [esp]
mov eax, dword [0x44f9d8]
test eax, eax
je 0x43d9e6
xor ecx, ecx
mov edx, dword [0x44f9dc]
nop
cmp dword [edx + ecx*8], 0xc85f7986
je 0x43d9c0
inc ecx
cmp eax, ecx
jne 0x43d9b0
jmp 0x43d9e6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43d9e6
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x44f9e0]
push eax
call fcn.00440440
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43db15
push dword [esp + 0xc]
call fcn.0043d7a0
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], ecx
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov edx, 0x20
mov edi, 0xdf
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0x20]
mov ecx, edi
xor ecx, edx
and ecx, esi
xor ecx, edx
add cl, 0x60
mov byte [esp + edx - 0x20], cl
inc edx
dec edi
cmp edx, 0x27
jne 0x43da30
mov edi, dword [esp]
mov edx, dword [0x44f9d8]
test edx, edx
je 0x43daac
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x44f9dc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0xc85f7986
je 0x43da82
inc ebp
cmp edx, ebp
jne 0x43da70
mov ebp, ecx
jmp 0x43daac
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
mov ebp, ecx
je 0x43daac
push 0
push dword [esp + 0xc]
push eax
push 5
push 4
push dword [0x44f9e0]
push edx
mov esi, eax
call fcn.00440440
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43db0c
mov dword [esp + 8], ebp
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43dae5
add edi, 2
cmp si, bp
je 0x43dad0
cmp si, bp
je 0x43daf7
mov esi, dword [ecx]
test esi, esi
jne 0x43dac0
mov edi, 0xc0000225
jmp 0x43db0c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 8]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043d890
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43db50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43dc10
xor eax, eax
cmp dword [ecx], 0
jne 0x43dc55
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x20
mov esi, 0xdf
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x20]
mov ebx, esi
xor ebx, eax
and ebx, edi
xor ebx, eax
add bl, 0x60
mov byte [esp + eax - 0x20], bl
inc eax
dec esi
cmp eax, 0x27
jne 0x43dbd0
mov eax, dword [esp]
mov esi, dword [0x44f9d8]
test esi, esi
je 0x43dc55
xor edi, edi
mov ebx, dword [0x44f9dc]
cmp dword [ebx + edi*8], 0x3ba5404
je 0x43dc5e
inc edi
cmp esi, edi
jne 0x43dc00
jmp 0x43dc55
mov dword [esp + 8], 0x4f8e8990
mov eax, 0x22541d22
nop
nop
nop
movzx ecx, byte [esp + eax - 0x22541d1a]
xor ecx, eax
add ecx, 0x545b6e55
mov edx, ecx
xor edx, 0xf2
and ecx, 0xd
add ecx, ecx
sub ecx, edx
add cl, 0xf3
mov byte [esp + eax - 0x22541d1a], cl
inc eax
cmp eax, 0x22541d26
jne 0x43dc20
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43dc55
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44f9e0]
push esi
call fcn.00440440
add esp, 0x1c
jmp 0x43dc55

Function at 0x43dca0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43dd3a
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov edx, 0x20
mov esi, 0xdf
nop
nop
nop
movzx edi, byte [esp + edx - 0x20]
mov ebx, esi
xor ebx, edx
and ebx, edi
xor ebx, edx
add bl, 0x60
mov byte [esp + edx - 0x20], bl
inc edx
dec esi
cmp edx, 0x27
jne 0x43dcd0
mov edx, dword [0x44f9d8]
test edx, edx
je 0x43dd2e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44f9dc]
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43dd10
inc edi
cmp edx, edi
jne 0x43dd00
jmp 0x43dd2e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43dd2e
push eax
push 1
push dword [0x44f9e0]
push edx
mov esi, ecx
call fcn.00440440
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43dfd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43e064
push 0xf8eb88df
push dword [0x44f9cc]
call fcn.00442a60
add esp, 8
test eax, eax
je 0x43e029
mov ecx, dword [esi]
test ecx, ecx
je 0x43e061
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43e03d
cmp dword [esp], 0
je 0x43e03d
mov dword [esi + 4], 3
jmp 0x43e061
mov ecx, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 8], eax
jmp 0x43e0e3
lea eax, [esp + 0xc]
push eax
call fcn.00443300
add esp, 4
test al, al
je 0x43e061
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43e05e
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 8], ecx
mov ecx, ebx
cmp eax, 2
jne 0x43e0e3
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x20
mov edx, 0xdf
nop
nop
movzx esi, byte [esp + eax - 0x20]
mov ebx, edx
xor ebx, eax
and ebx, esi
xor ebx, eax
add bl, 0x60
mov byte [esp + eax - 0x20], bl
inc eax
dec edx
cmp eax, 0x27
jne 0x43e090
mov eax, dword [esp]
mov edx, dword [0x44f9d8]
test edx, edx
je 0x43e164
xor esi, esi
mov ebx, dword [0x44f9dc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x1cbb9425
je 0x43e140
inc esi
cmp edx, esi
jne 0x43e0d0
jmp 0x43e164
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x20
mov edx, 0xdf
movzx esi, byte [esp + eax - 0x20]
mov ebx, edx
xor ebx, eax
and ebx, esi
xor ebx, eax
add bl, 0x60
mov byte [esp + eax - 0x20], bl
inc eax
dec edx
cmp eax, 0x27
jne 0x43e100
mov eax, dword [esp]
mov edx, dword [0x44f9d8]
test edx, edx
je 0x43e164
xor esi, esi
mov ebx, dword [0x44f9dc]
cmp dword [ebx + esi*8], 0x62429966
je 0x43e140
inc esi
cmp edx, esi
jne 0x43e130
jmp 0x43e164
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43e164
push ecx
push ebp
push edi
push dword [esp + 0x30]
push dword [esp + 0x18]
push 5
push dword [0x44f9e0]
push edx
call fcn.00440440
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43e470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43e489
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43e49a
cmp eax, 2
je 0x43e510
jmp 0x43e53d
push 0xf8eb88df
push dword [0x44f9cc]
call fcn.00442a60
add esp, 8
test eax, eax
je 0x43e4db
mov ecx, dword [esi]
test ecx, ecx
je 0x43e508
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43e4e4
cmp dword [esp + 4], 0
je 0x43e4e4
mov dword [esi + 4], 3
jmp 0x43e508
mov dword [esi + 4], 1
jmp 0x43e53d
lea eax, [esp + 0xc]
push eax
call fcn.00443300
add esp, 4
test al, al
je 0x43e508
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43e505
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43e53d
mov ebx, dword [ebp + 0x18]
push 0x1e03da9a
push dword [0x4579ec]
call fcn.00442a60
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43e5d4
mov ecx, dword [esi]
mov dword [esp + 4], 0xbcbdbebf
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov eax, 0x20
mov edx, 0xdf
nop
nop
nop
movzx esi, byte [esp + eax - 0x1c]
mov ebx, edx
xor ebx, eax
and ebx, esi
xor ebx, eax
add bl, 0x60
mov byte [esp + eax - 0x1c], bl
inc eax
dec edx
cmp eax, 0x27
jne 0x43e560
mov eax, dword [esp + 4]
mov edx, dword [0x44f9d8]
test edx, edx
je 0x43e5d4
xor esi, esi
mov ebx, dword [0x44f9dc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x64567875
je 0x43e5b0
inc esi
cmp edx, esi
jne 0x43e5a0
jmp 0x43e5d4
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43e5d4
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x44f9e0]
push edx
call fcn.00440440
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x441690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
mov edx, edi
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x441704
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, edx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x44185e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x44185e
mov dword [esp], 0x34353637
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x3ae83d0c
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x3ae83d0c]
xor ecx, eax
add ecx, 0xd976cec3
mov edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
mov byte [esp + eax - 0x3ae83d0c], cl
inc eax
cmp eax, 0x3ae83d13
jne 0x441720
mov eax, dword [esp]
mov ecx, dword [0x44f9d8]
test ecx, ecx
je 0x4417a2
xor edx, edx
mov edi, dword [0x44f9dc]
nop
nop
cmp dword [edi + edx*8], 0x7789b0cb
je 0x441774
inc edx
cmp ecx, edx
jne 0x441760
mov edi, dword [esp + 0x24]
jmp 0x4417a2
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
mov edi, dword [esp + 0x24]
je 0x4417a2
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x44f9e0]
push ecx
call fcn.00440440
add esp, 0x28
test eax, eax
js 0x44185e
push 0x1e03da9a
push dword [0x4579ec]
call fcn.00442a60
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x34353637
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov edx, 0x3ae83d0c
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx - 0x3ae83d0c]
xor ebx, edx
add ebx, 0xd976cec3
mov esi, ebx
and esi, 1
or ebx, 1
add ebx, esi
mov byte [esp + edx - 0x3ae83d0c], bl
inc edx
cmp edx, 0x3ae83d13
jne 0x4417f0
mov edx, dword [0x44f9d8]
test edx, edx
je 0x44185e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44f9dc]
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x441840
inc edi
cmp edx, edi
jne 0x441830
jmp 0x44185e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x44185e
push ecx
push 1
push dword [0x44f9e0]
push edx
mov esi, eax
call fcn.00440440
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x27c
mov ebx, dword [0x457a04]
mov ebp, dword [0x457a00]
mov eax, ebp
or eax, ebx
jne 0x441c9a
mov dword [esp + 0x4c], 0xd1bacfa2
mov dword [esp + 0x50], 0xd5bed3b4
mov dword [esp + 0x54], 0xd9f8d7b8
mov dword [esp + 0x58], 0xddb6dbbc
mov dword [esp + 0x5c], 0xe1dedfb0
mov byte [esp + 0x60], 0
xor eax, eax
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x4d
xor cl, byte [esp + eax + 0x4c]
add cl, 0x7f
mov byte [esp + eax + 0x4c], cl
inc eax
cmp eax, 0x15
jne 0x441c60
lea eax, [esp + 0x4c]
push eax
call fcn.00441870
add esp, 4
mov ebp, eax
mov dword [0x457a04], edx
mov dword [0x457a00], eax
or eax, edx
je 0x441d74
mov ebx, edx
lea eax, [esp + 0x14c]
push 0x40
push eax
push ebx
push ebp
call fcn.00441690
add esp, 0x10
test eax, eax
js 0x441d74
mov eax, dword [esp + 0x188]
mov ecx, eax
sar ecx, 0x1f
add eax, ebp
adc ecx, ebx
add eax, 0x18
adc ecx, 0
lea edx, [esp + 0x18c]
push 0xf0
push edx
push ecx
push eax
call fcn.00441690
add esp, 0x10
xor edi, edi
test eax, eax
js 0x441d76
cmp dword [esp + 0x200], 0
je 0x441d76
mov eax, dword [esp + 0x1fc]
mov esi, 0
test eax, eax
je 0x441d78
add eax, ebp
mov ecx, ebx
adc ecx, 0
lea edx, [esp + 0x24]
push 0x28
push edx
push ecx
push eax
call fcn.00441690
add esp, 0x10
test eax, eax
js 0x441d74
mov ecx, dword [esp + 0x38]
lea esi, [ecx*4]
mov eax, 0xffffffff
cmp ecx, 0x40000000
jae 0x441d3d
mov eax, esi
push eax
call fcn.0040ccd0
add esp, 4
mov edx, dword [esp + 0x40]
add edx, ebp
mov ecx, ebx
adc ecx, 0
push esi
mov dword [esp + 0xc], eax
push eax
push ecx
push edx
call fcn.00441690
add esp, 0x10
test eax, eax
js 0x441d87
mov eax, dword [esp + 0x38]
test eax, eax
jns 0x441d90
mov eax, 0xffffffff
jmp 0x441d92
xor edi, edi
xor esi, esi
xor edi, edi
xor esi, esi
jmp 0x441f96
add eax, eax
push eax
call fcn.0040ccd0
add esp, 4
mov esi, dword [esp + 0x3c]
add esi, esi
mov ecx, dword [esp + 0x48]
add ecx, ebp
mov edx, ebx
adc edx, 0
push esi
mov dword [esp + 4], eax
push eax
push edx
push ecx
call fcn.00441690
add esp, 0x10
test eax, eax
js 0x441f87
mov esi, dword [esp + 0x3c]
mov eax, 0xffffffff
cmp esi, 0x40000000
jae 0x441ddc
lea eax, [esi*4]
push eax
call fcn.0040ccd0
add esp, 4
mov edx, esi
and edx, 0xfffffffb
mov ecx, esi
and ecx, 4
or esi, 4
imul esi, ecx
xor ecx, 4
imul ecx, edx
add esi, ecx
mov edx, dword [esp + 0x44]
add edx, ebp
mov ecx, ebx
adc ecx, 0
push esi
mov dword [esp + 0x10], eax
push eax
push ecx
push edx
call fcn.00441690
add esp, 0x10
test eax, eax
js 0x441f75
push ebp
add dword [eax], eax
invalid
mov esi, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
xor edi, edi
xor esi, esi
Function at 0x442550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x93929140
mov byte [esp + 8], 0
mov eax, 0xd85581e4
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x27aa7e20]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x8c
mov byte [esp + eax + 0x27aa7e20], cl
inc eax
cmp eax, 0xd85581e9
jne 0x442570
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x24], 0
sete cl
jmp dword [ecx*4 + 0x44e3ec]

Function at 0x44289d
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0xc1c6c794
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x34aea4d1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x34aea4d1]
lea edi, [eax - 0x34a00000]
mov edx, eax
and edx, 0x34a60056
and edi, 0x8a489
or edi, edx
mov edx, edi
xor edx, 0xffe71056
xor edi, esi
xor esi, 0xffe71056
not edi
and edi, edx
add edi, edi
sub edx, edi
add edx, esi
mov esi, edx
and esi, 1
or edx, 1
add edx, esi
add dl, 0xea
mov byte [esp + eax - 0x34aea4d1], dl
inc eax
cmp eax, 0x34aea4d8
jne 0x442850
mov eax, dword [esp]
mov eax, dword fs:[eax]
mov edx, dword [0x44e484]
jmp edx
Function at 0x442a60
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x3c]
movzx eax, word [ebp]
mov dword [esp], 0x191abd4f
mov word [esp + 4], 0
mov ecx, 0x3eecc8bb
mov edx, 0x133744
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0x3eecc8bb]
mov ebx, edx
and ebx, 0x123174
mov esi, ecx
and esi, 0x2848888b
or esi, ebx
xor esi, edi
mov edi, esi
xor edi, 0xd6b67174
mov ebx, edi
and ebx, 0x58
and esi, 0x58
and edi, 0xa7
or edi, esi
xor edi, 8
lea ebx, [edi + ebx*2]
inc bl
mov byte [esp + ecx - 0x3eecc8bb], bl
inc ecx
dec edx
cmp ecx, 0x3eecc8c1
jne 0x442a90
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44e51c]
Function at 0x443510
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x443530
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x44354b
mov eax, 0xffffffff
jmp 0x44354e
add eax, 0xa
push eax
call fcn.0040ccd0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x443591
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x443580
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x34353637
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ecx + ecx]
mov esi, edx
and esi, 8
mov ebx, ecx
xor ebx, 0xc
add ebx, esi
xor bl, byte [esp + ecx]
add bl, 0xc4
mov byte [esp + ecx], bl
and edx, 2
xor ecx, 1
add ecx, edx
cmp ecx, 7
jb 0x443600
mov esi, dword [esp]
mov ecx, dword [0x44f9d8]
test ecx, ecx
je 0x443681
xor edx, edx
mov ebx, dword [0x44f9dc]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x266686e9
je 0x443650
inc edx
cmp ecx, edx
jne 0x443640
jmp 0x443681
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x443681
mov edx, esp
lea esi, [esp + 0x10]
push edi
push ebp
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push dword [0x44f9e0]
push ecx
mov edi, eax
call fcn.00440440
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040cce0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4436a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4436c0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x4436db
mov eax, 0xffffffff
jmp 0x4436de
add eax, 0xa
push eax
call fcn.0040ccd0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x443721
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x443710
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x34353637
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ecx + ecx]
mov esi, edx
and esi, 8
mov ebx, ecx
xor ebx, 0xc
add ebx, esi
xor bl, byte [esp + ecx + 0x20]
add bl, 0xc4
mov byte [esp + ecx + 0x20], bl
and edx, 2
xor ecx, 1
add ecx, edx
cmp ecx, 7
jb 0x443790
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44f9d8]
test ecx, ecx
je 0x443809
xor edx, edx
mov ebx, dword [0x44f9dc]
nop
nop
nop
cmp dword [ebx + edx*8], 0x87573896
je 0x4437e0
inc edx
cmp ecx, edx
jne 0x4437d0
jmp 0x443809
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x443809
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 2
push dword [0x44f9e0]
push ecx
mov ebx, eax
call fcn.00440440
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.0040cce0
add esp, 4
test edi, edi
je 0x44381c
mov eax, dword [esp + 0x40]
mov dword [edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x34353637
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [eax + eax]
mov ebx, edx
and ebx, 8
mov ecx, eax
xor ecx, 0xc
add ecx, ebx
xor cl, byte [esp + eax]
add cl, 0xc4
mov byte [esp + eax], cl
and edx, 2
xor eax, 1
add eax, edx
cmp eax, 7
jb 0x443860
mov eax, dword [esp]
mov edx, dword [0x44f9d8]
test edx, edx
je 0x4438d8
xor ebx, ebx
mov ecx, dword [0x44f9dc]
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa70a987f
je 0x4438b0
inc ebx
cmp edx, ebx
jne 0x4438a0
jmp 0x4438d8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x4438d8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 5
push dword [0x44f9e0]
push edx
call fcn.00440440
add esp, 0x20
test edi, edi
je 0x4438e2
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x4438ee
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x443900
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0x34353637
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
lea ebx, [edi + edi]
mov ebp, ebx
and ebp, 8
mov eax, edi
xor eax, 0xc
add eax, ebp
xor al, byte [esp + edi]
add al, 0xc4
mov byte [esp + edi], al
and ebx, 2
xor edi, 1
add edi, ebx
cmp edi, 7
jb 0x443930
mov eax, dword [esp]
mov ebx, dword [0x44f9d8]
test ebx, ebx
je 0x4439ae
xor ebp, ebp
mov edi, dword [0x44f9dc]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xd41f89d1
je 0x443980
inc ebp
cmp ebx, ebp
jne 0x443970
jmp 0x4439ae
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x4439ae
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push dword [0x44f9e0]
push ebx
call fcn.00440440
add esp, 0x30
cmp eax, 0x103
jne 0x443a49
mov dword [esp], 0x34353637
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
lea ecx, [eax + eax]
mov edi, ecx
and edi, 8
mov edx, eax
xor edx, 0xc
add edx, edi
xor dl, byte [esp + eax]
add dl, 0xc4
mov byte [esp + eax], dl
and ecx, 2
xor eax, 1
add eax, ecx
cmp eax, 7
jb 0x4439d0
mov eax, dword [esp]
mov ecx, dword [0x44f9d8]
test ecx, ecx
je 0x443a41
xor edx, edx
mov edi, dword [0x44f9dc]
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x53f09cfa
je 0x443a20
inc edx
cmp ecx, edx
jne 0x443a10
jmp 0x443a41
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x443a41
push 0
push 0
push dword [esp + 0x2c]
push 3
push dword [0x44f9e0]
push ecx
call fcn.00440440
add esp, 0x18
test eax, eax
js 0x443a49
mov eax, dword [esp + 8]
test esi, esi
je 0x443a5c
xor ecx, ecx
cmp eax, 0xc0000011
je 0x443a5a
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret