joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439180
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00440bb0
add esp, 0x14
test eax, eax
js 0x4392a6
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00440ff0
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0x43921a
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x4391e8
mov eax, 0xffffffff
jmp 0x4391ef
lea eax, [eax*2 + 2]
push eax
call fcn.004083b0
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.004415f0
add esp, 0x14
test eax, eax
jns 0x43921a
push esi
call fcn.004083c0
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x40474645
mov byte [esp + 8], 0
nop
nop
nop
nop
nop
nop
mov ecx, ebx
add cl, 0x11
xor cl, byte [esp + ebx + 4]
add cl, 0xab
mov byte [esp + ebx + 4], cl
inc ebx
cmp ebx, 5
jne 0x439230
mov ecx, dword [0x44cd58]
test ecx, ecx
je 0x43928a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44cd5c]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x439270
inc edi
cmp ecx, edi
jne 0x439260
jmp 0x43928a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43928a
push eax
push 4
push ecx
push dword [0x44cd60]
call fcn.0043dda0
add esp, 0x10
test esi, esi
jne 0x4392a8
lea eax, [esp + 4]
push eax
call fcn.004401c0
add esp, 4
test al, al
je 0x4392a6
cmp dword [esp + 4], 1
je 0x4392a8
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43af60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x818687f4
mov dword [esp + 4], 0
mov ecx, 0x2d68059f
mov edx, 0x5ad00b3e
movzx esi, byte [esp + ecx - 0x2d68059f]
mov ebx, edx
and ebx, 0x50900142
mov ebp, ecx
xor ebp, 0xa85e70a1
lea edi, [ebx + ebp]
add ebx, ebp
add ebx, 0x61
and ebx, esi
mov ebp, ebx
or ebp, 0xfffffffd
inc ebp
mov eax, ebx
and eax, 0xfffffffd
imul eax, ebp
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
sub eax, ebx
add edi, esi
add eax, edi
add eax, 0x8954279d
mov esi, eax
and esi, 0x5a
xor eax, 0xda
lea eax, [eax + esi*2]
add al, 0xc5
mov byte [esp + ecx - 0x2d68059f], al
inc ecx
add edx, 2
cmp ecx, 0x2d6805a7
jne 0x43af80
mov eax, dword [esp]
mov eax, dword fs:[eax]
push dword [esp + 0x1c]
push 0
push dword [eax + 0x18]
call dword [0x454d7c]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43b010
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x4495f4]
Function at 0x43b3a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43b4a0
xor eax, eax
cmp dword [ecx], 0
jne 0x43b50a
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x40474645
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax]
lea esi, [eax + eax]
and esi, 2
mov edi, eax
xor edi, 0xa8086811
add edi, esi
mov ebp, edi
and ebp, ebx
add edi, ebx
add ebp, ebp
sub edi, ebp
lea ebx, [edi + 0x5e97c380]
lea ebp, [edi + 0x5e97c400]
and ebp, 0xaa
mov edx, 0xa1683cff
sub edx, edi
not edx
or edx, 0xaa
or ebx, 0xaa
and ebx, edx
add ebx, ebp
inc bl
mov byte [esp + eax], bl
xor eax, 1
add eax, esi
cmp eax, 5
jb 0x43b410
mov eax, dword [esp]
mov esi, dword [0x44cd58]
test esi, esi
je 0x43b50a
xor edi, edi
mov ebx, dword [0x44cd5c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43b514
inc edi
cmp esi, edi
jne 0x43b490
jmp 0x43b50a
mov dword [esp + 8], 0x17d6c9c0
mov word [esp + 0xc], 0
mov eax, 0x9391924e
mov ecx, 0xb1
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x6c6e6dba]
mov esi, edx
not esi
mov edi, eax
and edi, esi
or esi, ecx
add edx, esi
inc edx
or edx, edi
add edx, 0xdde33eae
mov esi, edx
and esi, 0x79
xor edx, 0x1e282479
lea ebx, [edx + esi*2]
and edx, 1
or ebx, 1
add ebx, edx
add bl, 0x52
mov byte [esp + eax + 0x6c6e6dba], bl
inc eax
dec ecx
cmp eax, 0x93919254
jne 0x43b4c0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43b50a
lea eax, [esp + 0x20]
lea edx, [esp + 8]
push eax
push edx
push dword [esp + 0x44]
push ecx
push 0x10
push esi
push dword [0x44cd60]
call fcn.0043dda0
add esp, 0x1c
jmp 0x43b50a
Function at 0x43b540
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43b61e
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp], 0x40474645
mov byte [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx]
lea esi, [edx + edx]
and esi, 2
mov edi, edx
xor edi, 0xa8086811
add edi, esi
mov ebp, edi
and ebp, ebx
add edi, ebx
add ebp, ebp
sub edi, ebp
lea ebx, [edi + 0x5e97c380]
lea ebp, [edi + 0x5e97c400]
and ebp, 0xaa
mov eax, 0xa1683cff
sub eax, edi
not eax
or eax, 0xaa
or ebx, 0xaa
and ebx, eax
add ebx, ebp
inc bl
mov byte [esp + edx], bl
xor edx, 1
add edx, esi
cmp edx, 5
jb 0x43b570
mov edx, dword [0x44cd58]
test edx, edx
je 0x43b611
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44cd5c]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43b5f0
inc edi
cmp edx, edi
jne 0x43b5e0
jmp 0x43b611
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43b611
push dword [esp + 8]
push 4
push edx
push dword [0x44cd60]
mov esi, ecx
call fcn.0043dda0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 8], 0
je 0x43b6f0
mov eax, dword [ecx]
test eax, eax
je 0x43b6f0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x40474645
mov byte [esp + 8], 0
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + edi + 4]
lea ebx, [edi + edi]
and ebx, 2
mov eax, edi
xor eax, 0xa8086811
add eax, ebx
mov esi, eax
and esi, edx
add eax, edx
add esi, esi
sub eax, esi
lea edx, [eax + 0x5e97c380]
mov esi, 0xa1683cff
sub esi, eax
not esi
or esi, 0xaa
or edx, 0xaa
and edx, esi
add eax, 0x5e97c400
and eax, 0xaa
add edx, eax
inc dl
mov byte [esp + edi + 4], dl
xor edi, 1
add edi, ebx
cmp edi, 5
jb 0x43b660
mov eax, dword [esp + 4]
mov edx, dword [0x44cd58]
test edx, edx
je 0x43b76c
xor edi, edi
mov ebx, dword [0x44cd5c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xaf0e0c2e
je 0x43b748
inc edi
cmp edx, edi
jne 0x43b6e0
jmp 0x43b76c
mov dword [esp + 4], 0xc3828188
mov eax, 0xa2f17c60
mov ecx, 0x9f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x5d0e83a4]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
mov esi, edx
not esi
add edx, 0x1f
and esi, 1
or edx, 1
add edx, esi
mov byte [esp + eax + 0x5d0e83a4], dl
inc eax
dec ecx
cmp eax, 0xa2f17c64
jne 0x43b710
mov eax, dword [esp + 4]
jmp 0x43b875
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x43b76c
push dword [ebp + 8]
push dword [esp + 0x10]
push 8
push edx
push dword [0x44cd60]
mov esi, ecx
call fcn.0043dda0
mov ecx, esi
add esp, 0x14
mov edi, dword [ebp + 0xc]
cmp edi, 1
mov esi, dword [ebp + 0x10]
mov edx, esi
sbb edx, 0
jl 0x43b868
cmp eax, 0xc000010a
jne 0x43b868
mov edx, 0xffffd8f0
mov eax, edi
mul edx
sub edx, edi
imul esi, esi, 0xffffd8f0
add esi, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov eax, dword [ecx]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x40474645
mov byte [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 4]
lea esi, [eax + eax]
and esi, 2
mov edi, eax
xor edi, 0xa8086811
add edi, esi
mov edx, edi
and edx, ebx
add edi, ebx
add edx, edx
sub edi, edx
lea ebx, [edi + 0x5e97c380]
mov edx, 0xa1683cff
sub edx, edi
not edx
or edx, 0xaa
or ebx, 0xaa
and ebx, edx
lea edx, [edi + 0x5e97c400]
and edx, 0xaa
add ebx, edx
inc bl
mov byte [esp + eax + 4], bl
xor eax, 1
add eax, esi
cmp eax, 5
jb 0x43b7c0
mov eax, dword [esp + 4]
mov esi, dword [0x44cd58]
test esi, esi
je 0x43b868
xor edi, edi
mov ebx, dword [0x44cd5c]
cmp dword [ebx + edi*8], 0x4c697c35
je 0x43b840
inc edi
cmp esi, edi
jne 0x43b830
jmp 0x43b868
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43b868
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x14]
push 0xc
push esi
push dword [0x44cd60]
mov esi, ecx
call fcn.0043dda0
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43b875
mov esi, eax
call fcn.0043b540
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43b880
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [ecx]
mov dword [esp], 0x40474645
mov byte [esp + 4], 0
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edi]
lea edx, [edi + edi]
and edx, 2
mov eax, edi
xor eax, 0xa8086811
add eax, edx
mov esi, eax
and esi, ebx
add eax, ebx
add esi, esi
sub eax, esi
lea ebx, [eax + 0x5e97c380]
lea esi, [eax + 0x5e97c400]
and esi, 0xaa
mov ebp, 0xa1683cff
sub ebp, eax
not ebp
or ebp, 0xaa
or ebx, 0xaa
and ebx, ebp
add ebx, esi
inc bl
mov byte [esp + edi], bl
xor edi, 1
add edi, edx
cmp edi, 5
jb 0x43b8a0
mov eax, dword [esp]
mov edx, dword [0x44cd58]
test edx, edx
je 0x43b928
xor edi, edi
mov ebx, dword [0x44cd5c]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xc18bc4ba
je 0x43b920
inc edi
cmp edx, edi
jne 0x43b910
jmp 0x43b928
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
jne 0x43b932
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
push 0x18
push edx
push dword [0x44cd60]
call fcn.0043dda0
add esp, 0x2c
jmp 0x43b92b

Function at 0x43b960
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x30]
mov eax, dword [ecx]
mov dword [esp + 8], eax
mov dword [esp], 0x40474645
mov byte [esp + 4], 0
xor esi, esi
nop
movzx edx, byte [esp + esi]
lea ebp, [esi + esi]
and ebp, 2
mov eax, esi
xor eax, 0xa8086811
add eax, ebp
mov edi, eax
and edi, edx
add eax, edx
add edi, edi
sub eax, edi
lea edx, [eax + 0x5e97c380]
lea edi, [eax + 0x5e97c400]
and edi, 0xaa
mov ecx, 0xa1683cff
sub ecx, eax
not ecx
or ecx, 0xaa
or edx, 0xaa
and edx, ecx
add edx, edi
inc dl
mov byte [esp + esi], dl
xor esi, 1
add esi, ebp
cmp esi, 5
jb 0x43b980
test ebx, ebx
jne 0x43b9df
lea ebx, [esp + 0xc]
mov eax, dword [esp]
mov edx, dword [0x44cd58]
test edx, edx
je 0x43ba3b
xor esi, esi
mov ebp, dword [0x44cd5c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + esi*8], 0xe6c7f7c6
je 0x43ba11
inc esi
cmp edx, esi
jne 0x43ba00
jmp 0x43ba3b
mov edx, dword [ebp + esi*8 + 4]
cmp edx, eax
je 0x43ba3b
push ebx
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x18]
push 0x14
push edx
push dword [0x44cd60]
call fcn.0043dda0
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43f84c
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov dword [esp], 0xb7b68958
mov ebp, 0x5e
mov edx, 0xcc1faa21
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ebp - 0x5e]
mov esi, edx
or esi, edi
lea ecx, [edx + 0x33e05600]
mov ebx, ecx
and ebx, 0xa
mov eax, ebp
and eax, 0x75
or eax, ebx
xor eax, 0x75
or eax, ecx
and eax, edi
not esi
or esi, eax
mov eax, esi
xor eax, 0xb0cf559c
and esi, 0xf30aa63
add esi, esi
sub esi, eax
add esi, 0xad6da845
mov eax, esi
and eax, 1
xor esi, 1
lea eax, [esi + eax*2]
mov byte [esp + ebp - 0x5e], al
inc ebp
dec edx
cmp ebp, 0x62
jne case.default.0x43f864
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor ecx, ecx
mov ebp, dword [esp + 0x18]
test ebp, ebp
sete cl
jmp dword [ecx*4 + 0x44a4a8]
mov ebp, dword [eax + 8]
mov edx, dword [case.0x43f864.3]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx
mov edx, dword [eax + 0xc]
add edx, 0xc
mov esi, dword [case.0x43f864.13]
xor eax, eax
mov edi, dword [case.0x43f864.20]
mov ebx, dword [edx]
xor ecx, ecx
cmp ebx, edx
setne cl
jmp dword [ecx*4 + 0x44a4c0]
mov ecx, dword [case.0x43f864.10]
nop
nop
nop
nop
jmp ecx
mov eax, dword [ebx + 0x30]
xor ecx, ecx
jmp dword [ecx*4 + 0x44a500]
mov ebx, dword [ebx]
xor ecx, ecx
cmp ebx, edx
setne cl
jmp dword [ecx*4 + 0x44a4c0]
jmp esi
xor ecx, ecx
cmp dword [ebx + 0x18], ebp
sete cl
jmp dword [ecx*4 + 0x44a4e8]
jmp edi
mov ecx, 1
jmp dword [ecx*4 + 0x44a500]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
jmp fcn.0043f9da
clc
inc ebx
add byte [ebx - 8], ch
inc ebx
add byte [eax - 0x7fffbc08], al
clc
inc ebx
add byte [edx - 0x7fffbc08], al
clc
inc ebx
add byte [esi - 0x2fffbc08], ah
clc
inc ebx
add byte [eax - 0x4fffbc08], dh
clc
inc ebx
add byte [eax - 0x1ffbc08], dh
clc
inc ebx
add al, dl
clc
inc ebx
add al, dl
clc
inc ebx
add dl, dl
clc
inc ebx
add al, dl
clc
inc ebx
add al, dh
clc
inc ebx
add byte [edx - 0xfffbc08], dh
clc
inc ebx
add al, dh
clc
inc ebx
add al, dh
clc
inc ebx
add dl, dh
clc
inc ebx
add dh, bh
clc
inc ebx
add byte [esi + 0x700043f8], bh
stc
inc ebx
add ah, dl
stc
inc ebx
add bh, al
stc
inc ebx
add byte [ecx + edi*8 - 0x644ffbd], ch
inc ebx
add byte [eax - 0x38ffbc07], dl
stc
inc ebx
add byte [ecx + edi*8 - 0x62fffbd], bl
inc ebx
add al, dl
stc
inc ebx
add al, dl
stc
inc ebx
add dl, dl
stc
inc ebx
add byte [ebp - 6], al
cli

Function at 0x43f910
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x23222150
mov dword [esp + 4], 0
xor eax, eax
mov edx, 0xf7
movzx ebx, byte [esp + eax]
lea esi, [edx - 0x80]
and esi, 0x53
mov edi, eax
and edi, 4
or edi, esi
xor edi, 0xa4
and edi, ebx
or ebx, edx
not ebx
or ebx, edi
add bl, 0xd8
mov byte [esp + eax], bl
inc eax
dec edx
cmp eax, 8
jne case.default.0x43f969
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44a508]
Function at 0x43fcdb
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp ecx, 6
ja 0x43fd36
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
mov esi, ecx
and esi, 3
mov edi, ecx
xor edi, 0x913438bb
lea esi, [edi + esi*2]
mov edi, edx
and edi, esi
mov ebp, edi
and ebp, 0xfffffffd
mov eax, edi
and eax, 2
mov ebx, edi
or ebx, 0xfd
inc ebx
imul ebx, ebp
or edi, 2
imul edi, eax
sub ebx, edi
add ebx, esi
add bl, dl
add bl, 0x59
mov byte [esp + ecx], bl
inc ecx
cmp ecx, 6
jbe 0x43fcf0
mov eax, dword [esp]
xor ecx, ecx
cmp eax, dword [esp + 8]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44a598]

Function at 0x43ff82
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
jmp dword [ecx*4 + 0x44a5f8]

Function at 0x440210
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x440220
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x44023b
mov eax, 0xffffffff
jmp 0x44023e
add eax, 0xa
push eax
call fcn.004083b0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x440281
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x440270
mov word [ecx], 0
lea ecx, [edi*2 + 8]
mov word [esp + 8], cx
lea ecx, [edi*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x20272625
mov dword [esp + 4], 0
xor ebx, ebx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi]
mov ecx, ebx
and ecx, 2
mov edx, esi
xor edx, 0x3b269f89
add edx, ecx
xor edx, edi
mov ecx, edx
not ecx
or ecx, 0xd83ee252
lea edi, [edx + ecx]
inc edi
mov ecx, edi
and ecx, 0xfd
mov ebp, edi
and ebp, 2
or edi, 2
imul edi, ebp
xor ebp, 2
imul ebp, ecx
xor edx, 0x52
add edx, edi
add edx, ebp
inc dl
mov byte [esp + esi], dl
inc esi
add ebx, 2
cmp esi, 8
jne 0x4402f0
mov esi, dword [esp]
mov ecx, dword [0x44cd58]
test ecx, ecx
je 0x4403b5
xor edx, edx
mov edi, dword [0x44cd5c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x440370
inc edx
cmp ecx, edx
jne 0x440360
jmp 0x4403b5
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x4403b5
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44cd60]
mov edi, eax
call fcn.0043dda0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.004083c0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4403d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x4403e0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x4403fb
mov eax, 0xffffffff
jmp 0x4403fe
add eax, 0xa
push eax
call fcn.004083b0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x440441
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x440430
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov ebx, esi
xor ebx, 2
imul ebx, edx
or ecx, 2
imul ecx, esi
add ecx, ebx
mov word [esp + 8], cx
mov edx, ecx
and edx, 2
xor ecx, 2
lea ecx, [ecx + edx*2]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x20272625
mov dword [esp + 4], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
movzx esi, byte [esp + edx]
mov ebp, ecx
and ebp, 2
mov ebx, edx
xor ebx, 0x3b269f89
add ebx, ebp
xor ebx, esi
mov esi, ebx
not esi
or esi, 0xd83ee252
add esi, ebx
inc esi
mov ebp, esi
and ebp, 0xfd
mov edi, esi
and edi, 2
or esi, 2
imul esi, edi
xor edi, 2
imul edi, ebp
xor ebx, 0x52
add ebx, esi
add ebx, edi
inc bl
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 8
jne 0x4404c0
mov esi, dword [esp]
mov ecx, dword [0x44cd58]
test ecx, ecx
je 0x440577
xor edx, edx
mov ebx, dword [0x44cd5c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x440540
inc edx
cmp ecx, edx
jne 0x440530
jmp 0x440577
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x440577
mov edx, esp
lea esi, [esp + 0x10]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44cd60]
mov edi, eax
call fcn.0043dda0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.004083c0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4405b0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x4405cb
mov eax, 0xffffffff
jmp 0x4405ce
add eax, 0xa
push eax
call fcn.004083b0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp + 4], eax
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x440611
add esi, 2
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x440600
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x20272625
mov dword [esp + 0x2c], 0
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 0x28]
mov edi, eax
and edi, 2
mov ebx, edx
xor ebx, 0x3b269f89
add ebx, edi
xor ebx, esi
mov esi, ebx
not esi
or esi, 0xd83ee252
add esi, ebx
inc esi
mov edi, esi
and edi, 0xfd
mov ecx, esi
and ecx, 2
or esi, 2
imul esi, ecx
xor ecx, 2
imul ecx, edi
xor ebx, 0x52
add ebx, esi
add ebx, ecx
inc bl
mov byte [esp + edx + 0x28], bl
inc edx
add eax, 2
cmp edx, 8
jne 0x440680
mov esi, dword [esp + 0x28]
mov ecx, dword [0x44cd58]
test ecx, ecx
je 0x440725
xor edx, edx
mov ebx, dword [0x44cd5c]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1ce638e1
je 0x440700
inc edx
cmp ecx, edx
jne 0x4406f0
jmp 0x440725
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x440725
lea eax, [esp + 0x28]
lea edx, [esp + 0x10]
push eax
push edx
push 8
push ecx
push dword [0x44cd60]
call fcn.0043dda0
add esp, 0x14
mov esi, eax
push dword [esp + 4]
call fcn.004083c0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x44073e
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp], 0x20272625
mov dword [esp + 4], 0
xor eax, eax
xor edx, edx
nop
movzx ecx, byte [esp + edx]
mov esi, eax
and esi, 2
mov ebx, edx
xor ebx, 0x3b269f89
add ebx, esi
xor ebx, ecx
mov ecx, ebx
not ecx
or ecx, 0xd83ee252
add ecx, ebx
inc ecx
mov esi, ecx
and esi, 0xfd
mov edi, ecx
and edi, 2
or ecx, 2
imul ecx, edi
xor edi, 2
imul edi, esi
xor ebx, 0x52
add ebx, ecx
add ebx, edi
inc bl
mov byte [esp + edx], bl
inc edx
add eax, 2
cmp edx, 8
jne 0x440770
mov eax, dword [esp]
mov ecx, dword [0x44cd58]
test ecx, ecx
je 0x440818
xor edx, edx
mov ebx, dword [0x44cd5c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x9c142cda
je 0x4407f0
inc edx
cmp ecx, edx
jne 0x4407e0
jmp 0x440818
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x440818
mov eax, esp
lea edx, [esp + 0x1c]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 0x14
push ecx
push dword [0x44cd60]
call fcn.0043dda0
add esp, 0x20
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x440825
mov ecx, dword [esp + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x440834
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret