joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x428
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 8]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x416dc0
mov eax, ebx
sar eax, 1
mov dword [esp + 0xd4], eax
cmp eax, 0xfffffff2
jge 0x416de2
mov eax, 0xffffffff
jmp 0x416de5
lea eax, [ebx + 0x1c]
push eax
call fcn.0040a1d0
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x108], 0xe33ee10c
mov dword [esp + 0x10c], 0xe715e505
mov dword [esp + 0x110], 0xfbdaf90c
mov dword [esp + 0x114], 0xff1bfd2a
mov dword [esp + 0x118], 0xf301f102
mov dword [esp + 0x11c], 0xf709f50d
mov dword [esp + 0x120], 0x8b8a8976
mov word [esp + 0x124], 0
mov byte [esp + 0x126], 0
mov eax, 0x28
mov ecx, 0xd7
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0xe0]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0x38
mov byte [esp + eax + 0xe0], dl
inc eax
dec ecx
cmp eax, 0x47
jne 0x416e60
movzx ecx, word [edi]
mov esi, dword [esp + 4]
mov eax, esi
test cx, cx
je 0x416eb1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x416ea0
mov word [eax], 0
movzx ecx, word [esp + 0x108]
test cx, cx
je 0x416ee1
lea edx, [esp + 0x10a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416ed0
mov word [eax], 0
lea eax, [esp + 0x288]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043fe60
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x445758]
Function at 0x41c6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x198
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x10], 0xd9a4dbf5
mov dword [esp + 0x14], 0xddafdfad
mov dword [esp + 0x18], 0xd1d2d3ae
mov dword [esp + 0x1c], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
xor dl, 0x4f
add dl, al
xor dl, byte [esp + ecx + 0x10]
add dl, 0x75
mov byte [esp + ecx + 0x10], dl
inc ecx
add al, 2
cmp ecx, 0x10
jne 0x41c6f0
mov dword [esp + 0x28], 0x931e9168
mov dword [esp + 0x2c], 0xaf5ead20
mov dword [esp + 0x30], 0xab9da962
mov dword [esp + 0x34], 0xa752a593
mov dword [esp + 0x38], 0xa341a157
mov dword [esp + 0x3c], 0xbf4abd5d
mov dword [esp + 0x40], 0xbb4db940
mov dword [esp + 0x44], 0xb73ab547
mov dword [esp + 0x48], 0xb3b2b17a
mov word [esp + 0x4c], 0
mov byte [esp + 0x4e], 0
xor eax, eax
movzx edx, byte [esp + eax + 0x28]
lea edi, [eax - 0x777afba4]
lea ebx, [eax + 0x5c]
mov ecx, ebx
and ecx, edi
or ecx, edx
or ebx, edi
and ebx, edx
sub ecx, ebx
add cl, 0x34
mov byte [esp + eax + 0x28], cl
lea ecx, [eax + eax]
and ecx, 2
sub eax, ecx
inc eax
mov edx, eax
and edx, ecx
xor eax, ecx
lea eax, [eax + edx*2]
cmp eax, 0x27
jb 0x41c760
movzx ecx, word [esp + 0x28]
lea eax, [esp + 0x154]
test cx, cx
je 0x41c7c1
lea edx, [esp + 0x2a]
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41c7b0
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x41c7f3
lea edx, [esi + 2]
mov edi, dword [ebp + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41c7e0
jmp 0x41c7f6
mov edi, dword [ebp + 0xc]
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x41c821
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41c810
mov word [eax], 0
mov edx, dword [edi]
mov dword [esp + 0x28], 0x75787826
mov byte [esp + 0x2c], 0x10
mov word [esp + 0x2d], 0
mov byte [esp + 0x2f], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 5
xor cl, byte [esp + eax + 0x28]
add cl, 0xe7
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 8
jne 0x41c850
movzx eax, byte [esp + 0x28]
test al, al
je 0x41c88b
lea ecx, [esp + 0x29]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41c880
mov edi, edx
mov byte [edx], 0
lea eax, [esp + 0x138]
lea ecx, [esp + 0x148]
lea edx, [esp + 0x24]
lea ebx, [esp + 0x154]
push eax
push ecx
push edx
push ebx
call fcn.0040d240
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x445ae8]
mov ecx, 0x918a7c2e
xor ecx, dword [0x445af0]
add eax, ecx
inc eax
jmp eax
Function at 0x41ee50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
cmp dword [ecx], 0xffffffff
je 0x41eff7
mov esi, ecx
lea eax, [esp + 0x20]
push 0
push 0
push 2
push eax
call fcn.00420220
test al, al
je 0x41eff7
movzx eax, byte [esp + 0x21]
mov ecx, eax
and ecx, 0x7f
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], 0
cmp ecx, 0x7f
je 0x41eed8
cmp ecx, 0x7e
jne 0x41efd3
mov word [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esi
push 0
push 0
push 2
push eax
call fcn.00420220
movzx ecx, word [esp + 8]
rol cx, 8
mov ebx, eax
movzx eax, cx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
jmp 0x41ef10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esi
push 0
push 0
push 8
push eax
call fcn.00420220
mov ebx, eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
bswap ecx
bswap eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ecx
movzx eax, byte [esp + 0x21]
test al, al
js 0x41efdd
xor eax, eax
test bl, bl
je 0x41eff7
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
push edi
mov dword [esp + 0x3c], eax
call fcn.0040a1d0
add esp, 4
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
lea edx, [esp + 0x18]
mov ecx, esi
push edx
push ebx
push edi
push eax
call fcn.00420220
mov ebx, eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
xor eax, edx
mov edi, dword [esp + 0x28]
xor edi, ecx
or edi, eax
sete byte [esp + 7]
or ecx, edx
setne cl
mov eax, dword [esp + 0x38]
and al, cl
cmp al, 1
jne 0x41efb3
xor eax, eax
xor edx, edx
nop
mov edi, dword [esp + 0x34]
mov ecx, eax
and ecx, 3
movzx ecx, byte [esp + ecx + 0x30]
xor byte [edi + eax], cl
add eax, 1
adc edx, 0
cmp eax, dword [esp + 0x18]
mov ecx, edx
sbb ecx, dword [esp + 0x1c]
jb 0x41ef90
mov edi, dword [ebp + 8]
and bl, byte [esp + 7]
cmp byte [esi + 4], 0
je 0x41f005
lea eax, [esp + 8]
mov ecx, esi
lea edx, [esp + 0x20]
push edx
push eax
call fcn.004204a0
jmp 0x41f016
xor ebx, ebx
test al, al
jns 0x41ef1d
lea eax, [esp + 0x30]
mov ecx, esi
push 0
push 0
push 4
push eax
call fcn.00420220
test bl, bl
jne 0x41ef27
xor ebx, ebx
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [esp + 8]
mov ecx, esi
lea edx, [esp + 0x20]
push edx
push eax
call fcn.00420320
mov eax, dword [esp + 0x14]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [edi + 8], eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [edi + 4], ecx
mov dword [edi], eax
jmp 0x41eff9
Function at 0x427a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
push eax
sub esp, 0x3fc
mov eax, esp
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], eax
push eax
mov ebx, esp
sub esp, 8
mov eax, esp
mov dword [ebp - 0x44], eax
mov edi, eax
sub esp, 0x24
mov dword [ebp - 0x3c], esp
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x90], 0x63166113
mov dword [ebp - 0x8c], 0x67076501
mov dword [ebp - 0x88], 0x7b447905
mov dword [ebp - 0x84], 0x7ff67d19
mov dword [ebp - 0x80], 0x73727115
xor eax, eax
nop
nop
nop
nop
nop
movzx ecx, byte [ebp + eax - 0x90]
lea edx, [eax + 0x53bfd3e8]
xor edx, ecx
add edx, 0x5d40dc77
mov ecx, edx
and ecx, 1
xor edx, 1
lea ecx, [edx + ecx*2]
mov byte [ebp + eax - 0x90], cl
mov ecx, eax
xor ecx, 0x7ffffffe
mov edx, eax
or edx, 1
and edx, ecx
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 0x14
jb 0x427b00
lea esi, [ebp - 0x90]
lea ecx, [ebp - 0x58]
push esi
call fcn.0043af30
shr eax, 0x1f
xor ecx, ecx
jmp dword [eax*4 + 0x446ae4]
Function at 0x42f2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx edi, word [esi]
test di, di
je 0x42f3fd
mov edx, dword [esp + 0x18]
dec edx
je 0x42f3fd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, di
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x42f310
lea ecx, [ebp + 1]
mov byte [ebp], bl
jmp 0x42f3a0
cmp ebx, 0x7ff
ja 0x42f340
cmp edx, 2
jb 0x42f340
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [ebp], cl
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
lea ecx, [ebp + 2]
jmp 0x42f3a0
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x42f3ba
cmp edx, 4
jb 0x42f3ba
shl ebx, 0xa
movzx ecx, word [esi + 2]
lea eax, [ebx + ecx]
add eax, 0xfca02400
add esi, 4
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
mov al, 0x3f
sub al, cl
and al, 0x3f
xor al, 0xbf
lea ecx, [ebp + 4]
mov byte [ebp + 3], al
mov edi, esi
nop
nop
nop
nop
nop
nop
add edx, ebp
sub edx, ecx
mov esi, edi
mov ebp, ecx
movzx edi, word [esi]
test di, di
je 0x42f3fd
test edx, edx
jne 0x42f2f0
jmp 0x42f3fd
movzx eax, cx
cmp eax, 0xdc00
jne 0x42f3c8
mov esi, edi
jmp 0x42f3a8
cmp edx, 3
jb 0x42f3f9
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
mov ecx, eax
not ecx
or ecx, 0x3f
add ecx, eax
add cl, 0x81
mov byte [ebp + 1], cl
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 2], bl
lea ecx, [ebp + 3]
jmp 0x42f3a0
mov ecx, ebp
jmp 0x42f3a0
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4381f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x438210
mov dword [esp], 0x6e6a6cf1
mov dword [esp + 4], 0
mov esi, 0xa584d9e7
nop
movzx ebx, byte [esp + esi + 0x5a7b2619]
xor ebx, esi
mov edi, ebx
and edi, 1
or ebx, 1
add ebx, edi
add bl, 0x7c
mov byte [esp + esi + 0x5a7b2619], bl
inc esi
cmp esi, 0xa584d9ef
jne 0x438230
test edx, edx
je 0x4382be
mov esi, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x438281
mov ebp, eax
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x438270
cmp edi, 3
jb 0x4382be
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x438290
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ae20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xb18e8f5c
mov byte [esp + 4], 0
mov ecx, 0x77f47bdd
mov edx, 0x880b8422
nop
nop
nop
movzx edi, byte [esp + ecx - 0x77f47bdd]
lea esi, [edi + edi]
not esi
add esi, edi
mov ebx, ecx
or ebx, edi
not edi
and edi, esi
mov esi, edi
xor esi, edx
add esi, edi
mov ebp, edi
and ebp, ecx
mov edi, esi
not edi
add edi, ebp
lea eax, [ebx + ebx]
not eax
add eax, ebx
sub esi, ebp
and esi, eax
xor edi, eax
add edi, eax
sub edi, esi
lea ebx, [edi + edi]
not ebx
add ebx, edi
add bl, 0xaf
mov byte [esp + ecx - 0x77f47bdd], bl
inc ecx
dec edx
cmp ecx, 0x77f47be2
jne 0x43ae40
mov eax, dword [esp]
mov ecx, dword fs:[eax]
push dword [esp + 0x1c]
push 0
push dword [ecx + 0x18]
call dword [0x453d00]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b3d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43b49e
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], 0x181b1a1d
xor edx, edx
nop
nop
mov esi, edx
and esi, 1
mov ebx, esi
xor ebx, 0xb19c89d9
mov edi, edx
and edi, 2
mov ebp, edi
sub ebp, ebx
mov eax, 0x2b
sub eax, ebp
neg ebx
add ebx, edi
add ebx, 0x14
and eax, 0x35
and ebx, 0x4a
or ebx, eax
xor bl, byte [esp + edx]
xor bl, 0xb5
add bl, 0x59
mov byte [esp + edx], bl
xor esi, 0x9bbaf00d
neg esi
lea eax, [edi + esi]
inc eax
mov edx, eax
and edx, 0xd
xor eax, 0x9bbaf00d
lea edx, [eax + edx*2]
cmp edx, 4
jb 0x43b3f0
mov edx, dword [0x44bcdc]
test edx, edx
je 0x43b491
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44bce0]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43b470
inc edi
cmp edx, edi
jne 0x43b460
jmp 0x43b491
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43b491
push dword [esp + 4]
push 4
push edx
push dword [0x44bce4]
mov esi, ecx
call fcn.0043d7a0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b4a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov dword [esp + 0xc], ecx
cmp dword [ecx + 8], 0
je 0x43b563
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x43b563
mov dword [esp + 8], eax
mov dword [esp], 0x181b1a1d
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, esi
and ebx, 1
mov edx, ebx
xor edx, 0xb19c89d9
mov ecx, esi
and ecx, 2
mov edi, ecx
sub edi, edx
mov eax, 0x2b
sub eax, edi
neg edx
add edx, ecx
add edx, 0x14
and eax, 0x35
and edx, 0x4a
or edx, eax
xor dl, byte [esp + esi]
xor dl, 0xb5
add dl, 0x59
mov byte [esp + esi], dl
xor ebx, 0x9bbaf00d
neg ebx
lea eax, [ecx + ebx]
inc eax
mov ecx, eax
and ecx, 0xd
xor eax, 0x9bbaf00d
lea esi, [eax + ecx*2]
cmp esi, 4
jb 0x43b4e0
mov eax, dword [esp]
mov edi, dword [0x44bcdc]
test edi, edi
je 0x43b5ea
xor edx, edx
mov ebx, dword [0x44bce0]
nop
cmp dword [ebx + edx*8], 0xaf0e0c2e
je 0x43b5ca
inc edx
cmp edi, edx
jne 0x43b550
jmp 0x43b5ea
mov dword [esp], 0x114e4f44
mov dword [esp + 4], 0
mov eax, 0x496948d
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x496948d]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0x3c
mov esi, ecx
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or edx, 2
imul edx, esi
xor ecx, 0x3e
add ecx, edi
add ecx, edx
inc cl
mov byte [esp + eax - 0x496948d], cl
inc eax
cmp eax, 0x4969495
jne 0x43b580
mov eax, dword [esp]
jmp 0x43b6f1
mov edx, dword [ebx + edx*8 + 4]
cmp edx, eax
je 0x43b5ea
push dword [ebp + 8]
push dword [esp + 0xc]
push 8
push edx
push dword [0x44bce4]
call fcn.0043d7a0
add esp, 0x14
cmp dword [ebp + 0xc], 0
je 0x43b6e0
cmp eax, 0xc000010a
jne 0x43b6e0
mov ecx, 0xffffd8f0
mov esi, dword [ebp + 0xc]
mov eax, esi
mul ecx
sub edx, esi
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x181b1a1d
and al, 0x10
sbb eax, 0x31181b1a
rcl byte [eax - 0x6f6f6f70], 0x90
nop
nop
mov edi, eax
and edi, 1
mov ecx, edi
xor ecx, 0xb19c89d9
mov ebx, eax
and ebx, 2
mov edx, ebx
sub edx, ecx
mov esi, 0x2b
sub esi, edx
neg ecx
lea edx, [ebx + ecx]
add edx, 0x14
and esi, 0x35
and edx, 0x4a
or edx, esi
xor dl, byte [esp + eax + 0x10]
xor dl, 0xb5
add dl, 0x59
mov byte [esp + eax + 0x10], dl
xor edi, 0x9bbaf00d
neg edi
lea eax, [ebx + edi]
inc eax
mov ecx, eax
and ecx, 0xd
xor eax, 0x9bbaf00d
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x43b630
xor edi, edi
cmp dword [ebp + 0xc], 0xffffffff
je 0x43b693
mov edi, esp
mov eax, dword [esp + 0x10]
mov esi, dword [0x44bcdc]
test esi, esi
je 0x43b6e0
xor edx, edx
mov ebx, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
Function at 0x43e690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
movzx eax, word [ebp]
mov dword [esp + 8], 0x8186ddd3
mov dword [esp + 0xc], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 8]
lea esi, [ecx + 0xe0b1ea1]
and esi, edx
add esi, esi
neg esi
lea ebx, [ecx + esi]
add ebx, 0xe0b1ea1
add bl, dl
add bl, 0xdb
mov byte [esp + ecx + 8], bl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 8
jb 0x43e6c0
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
mov eax, dword [ecx*4 + 0x448f14]
mov ecx, dword [0x448f1c]
mov edx, ecx
not edx
and ecx, 0x2abc0cf2
lea esi, [ecx*2 + 2]
sub esi, ecx
add esi, 0xfffffffe
and edx, 0xd543f30d
or edx, esi
lea ecx, [eax + edx]
inc ecx
xor eax, eax
jmp ecx

Function at 0x43f2d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x57564938
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
lea esi, [eax + 0x2e96ee6e]
and esi, edx
add edx, eax
add edx, 0x2e96ee6e
add esi, esi
sub edx, esi
add dl, 0xda
mov byte [esp + eax], dl
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 8
jb 0x43f2f0
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44948c]

Function at 0x43f3a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [esp + 0x40]
movzx eax, word [eax]
mov dword [esp], 0xf0ee7d5
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ecx + ecx]
mov ebx, edx
and ebx, 4
or ebx, ecx
xor bl, byte [esp + ecx]
xor bl, 0x42
add bl, 0xb6
mov byte [esp + ecx], bl
and edx, 2
xor ecx, 1
add ecx, edx
cmp ecx, 4
jb 0x43f3c0
mov ecx, dword [esp]
mov edx, dword [0x4494b8]
nop
nop
nop
nop
jmp edx
Function at 0x43fc90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43fcb0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43fccb
mov eax, 0xffffffff
jmp 0x43fcce
add eax, 0xa
push eax
call fcn.0040a1d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x43fd11
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x43fd00
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
lea edx, [ecx + 0xb2371c5]
lea edi, [ecx + 0xc5]
and edi, esi
or edx, esi
xor edx, edi
mov esi, edx
and esi, 1
or edx, 1
add edx, esi
add dl, 0x26
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 5
xor ecx, 0x26208d95
lea ecx, [ecx + edx*2]
add ecx, 0xd9df726c
cmp ecx, 7
jb 0x43fd90
mov esi, dword [esp]
mov ecx, dword [0x44bcdc]
test ecx, ecx
je 0x43fe42
xor edx, edx
mov edi, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x43fe00
inc edx
cmp ecx, edx
jne 0x43fdf0
jmp 0x43fe42
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43fe42
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44bce4]
mov edi, eax
call fcn.0043d7a0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.0040a1e0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fe60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43fe80
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43fe9b
mov eax, 0xffffffff
jmp 0x43fe9e
add eax, 0xa
push eax
call fcn.0040a1d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x43fee1
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x43fed0
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov ebx, esi
xor ebx, 2
imul ebx, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
lea edx, [ecx + 0xb2371c5]
lea ebx, [ecx + 0xc5]
and ebx, esi
or edx, esi
xor edx, ebx
mov esi, edx
and esi, 1
or edx, 1
add edx, esi
add dl, 0x26
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 5
xor ecx, 0x26208d95
lea ecx, [ecx + edx*2]
add ecx, 0xd9df726c
cmp ecx, 7
jb 0x43ff60
mov esi, dword [esp]
mov ecx, dword [0x44bcdc]
test ecx, ecx
je 0x440004
xor edx, edx
mov ebx, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x43ffd0
inc edx
cmp ecx, edx
jne 0x43ffc0
jmp 0x440004
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x440004
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44bce4]
mov edi, eax
call fcn.0043d7a0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040a1e0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x440040
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x44005b
mov eax, 0xffffffff
jmp 0x44005e
add eax, 0xa
push eax
call fcn.0040a1d0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x4400a1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x440090
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x101f1e1d
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x20]
lea edx, [ecx + 0xb2371c5]
lea ebx, [ecx + 0xc5]
and ebx, esi
or edx, esi
xor edx, ebx
mov esi, edx
and esi, 1
or edx, 1
add edx, esi
add dl, 0x26
mov byte [esp + ecx + 0x20], dl
mov edx, ecx
and edx, 5
xor ecx, 0x26208d95
lea ecx, [ecx + edx*2]
add ecx, 0xd9df726c
cmp ecx, 7
jb 0x440110
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44bcdc]
test ecx, ecx
je 0x4401a9
xor edx, edx
mov ebx, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1ce638e1
je 0x440180
inc edx
cmp ecx, edx
jne 0x440170
jmp 0x4401a9
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x4401a9
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x44bce4]
mov ebx, eax
call fcn.0043d7a0
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.0040a1e0
add esp, 4
test edi, edi
je 0x4401bc
mov eax, dword [esp + 0x40]
mov dword [edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret