joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e950
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x43ea20
xor eax, eax
cmp dword [ecx], 0
jne 0x43ea5a
mov edx, dword [esp + 0x34]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x60676665
mov eax, 0xc11c8ee9
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x3ee37117]
xor ebx, eax
add ebx, 0x3a713572
mov esi, ebx
xor esi, 0xf3
and ebx, 0xc
add ebx, ebx
sub ebx, esi
add bl, 0xf4
mov byte [esp + eax + 0x3ee37117], bl
inc eax
cmp eax, 0xc11c8eed
jne 0x43e9c0
mov eax, dword [esp]
mov esi, dword [0x451e48]
test esi, esi
je 0x43ea5a
xor edi, edi
mov ebx, dword [0x451e4c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x43ea63
inc edi
cmp esi, edi
jne 0x43ea10
jmp 0x43ea5a
mov dword [esp + 4], 0xc186878c
mov dword [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x61
xor cl, byte [esp + eax + 4]
add cl, 0x1b
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 8
jne 0x43ea40
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43ea5a
lea eax, [esp + 0x1c]
lea edi, [esp + 4]
push eax
push edi
push edx
push ecx
push 4
push esi
push dword [0x451e50]
call fcn.00441a80
add esp, 0x1c
jmp 0x43ea5a

Function at 0x43eaa0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43eb4a
push ebx
push edi
push esi
push eax
mov dword [esp], 0x60676665
mov edx, 0xc11c8ee9
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx + 0x3ee37117]
xor ebx, edx
add ebx, 0x3a713572
mov esi, ebx
xor esi, 0xf3
and ebx, 0xc
add ebx, ebx
sub ebx, esi
add bl, 0xf4
mov byte [esp + edx + 0x3ee37117], bl
inc edx
cmp edx, 0xc11c8eed
jne 0x43eac0
mov edx, dword [0x451e48]
test edx, edx
je 0x43eb3e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x451e4c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43eb20
inc edi
cmp edx, edi
jne 0x43eb10
jmp 0x43eb3e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43eb3e
push eax
push 1
push edx
push dword [0x451e50]
mov esi, ecx
call fcn.00441a80
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x43ee40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43eece
push 0xbbf966b4
push dword [0x451e3c]
call fcn.00444590
add esp, 8
test eax, eax
je 0x43ee99
mov ecx, dword [esi]
test ecx, ecx
je 0x43eecb
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43eea7
cmp dword [esp], 0
je 0x43eea7
mov dword [esi + 4], 3
jmp 0x43eecb
mov dword [esi + 4], 1
mov ecx, dword [esi]
jmp 0x43ef57
lea eax, [esp + 4]
push eax
call fcn.00444eb0
add esp, 4
test al, al
je 0x43eecb
mov eax, dword [esp + 4]
mov ecx, 2
cmp eax, 3
je 0x43eec8
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, 2
jne 0x43ef57
mov dword [esp], 0x60676665
mov eax, 0xc11c8ee9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x3ee37117]
xor edx, eax
add edx, 0x3a713572
mov esi, edx
xor esi, 0xf3
and edx, 0xc
add edx, edx
sub edx, esi
add dl, 0xf4
mov byte [esp + eax + 0x3ee37117], dl
inc eax
cmp eax, 0xc11c8eed
jne 0x43eef0
mov eax, dword [esp]
mov edx, dword [0x451e48]
test edx, edx
je 0x43f004
mov ebp, ebx
xor esi, esi
mov ebx, dword [0x451e4c]
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xc3cdc4a6
je 0x43efe0
inc esi
cmp edx, esi
jne 0x43ef40
jmp 0x43f004
mov dword [esp], 0x60676665
mov eax, 0xc11c8ee9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x3ee37117]
xor edx, eax
add edx, 0x3a713572
mov esi, edx
xor esi, 0xf3
and edx, 0xc
add edx, edx
sub edx, esi
add dl, 0xf4
mov byte [esp + eax + 0x3ee37117], dl
inc eax
cmp eax, 0xc11c8eed
jne 0x43ef70
mov eax, dword [esp]
mov edx, dword [0x451e48]
test edx, edx
je 0x43f004
xor esi, esi
mov ebx, dword [0x451e4c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xae6e2b0b
je 0x43efd0
inc esi
cmp edx, esi
jne 0x43efc0
jmp 0x43f004
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43f004
push ebp
push edi
push dword [esp + 0x28]
jmp 0x43efee
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43f004
push dword [esp + 0x28]
push edi
push ebp
push dword [esp + 0x28]
push ecx
push 5
push edx
push dword [0x451e50]
call fcn.00441a80
add esp, 0x20
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43f390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43f3a9
lea edi, [esp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x43f3ba
cmp eax, 2
je 0x43f42c
jmp 0x43f459
push 0xbbf966b4
push dword [0x451e3c]
call fcn.00444590
add esp, 8
test eax, eax
je 0x43f3f7
mov ecx, dword [esi]
test ecx, ecx
je 0x43f424
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43f400
cmp dword [esp], 0
je 0x43f400
mov dword [esi + 4], 3
jmp 0x43f424
mov dword [esi + 4], 1
jmp 0x43f459
lea eax, [esp + 4]
push eax
call fcn.00444eb0
add esp, 4
test al, al
je 0x43f424
mov eax, dword [esp + 4]
mov ecx, 2
cmp eax, 3
je 0x43f421
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43f459
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x459e64]
call fcn.00444590
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43f4f4
mov ecx, dword [esi]
mov dword [esp], 0x60676665
mov eax, 0xc11c8ee9
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x3ee37117]
xor edx, eax
add edx, 0x3a713572
mov esi, edx
xor esi, 0xf3
and edx, 0xc
add edx, edx
sub edx, esi
add dl, 0xf4
mov byte [esp + eax + 0x3ee37117], dl
inc eax
cmp eax, 0xc11c8eed
jne 0x43f470
mov eax, dword [esp]
mov edx, dword [0x451e48]
test edx, edx
je 0x43f4f4
xor esi, esi
mov ebx, dword [0x451e4c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x43f4d0
inc esi
cmp edx, esi
jne 0x43f4c0
jmp 0x43f4f4
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43f4f4
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push edx
push dword [0x451e50]
call fcn.00441a80
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x4419a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44ffb4]

Function at 0x442a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor edi, edi
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x442ae0
mov ecx, ebx
shr ecx, 2
mov eax, ebp
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, edx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
test bl, 1
je 0x442c7e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x442c7e
mov dword [esp], 0xd8dbdac5
mov dword [esp + 4], 0
nop
movzx ecx, byte [esp + edi]
mov edx, edi
and edx, 5
mov ebp, edi
and ebp, 2
mov eax, edi
or eax, 2
imul eax, ebp
xor ebp, 2
imul ebp, edx
add eax, ebp
mov edx, edi
xor edx, 0xc798bd2f
mov ebp, eax
and ebp, edx
xor edx, eax
lea edx, [edx + ebp*2]
xor edx, ecx
mov eax, 0xeb
sub eax, edx
and edx, 1
or eax, 1
sub edx, eax
mov byte [esp + edi], dl
inc edi
cmp edi, 8
jne 0x442af0
mov eax, dword [esp]
mov ecx, dword [0x451e48]
test ecx, ecx
je 0x442b70
xor edx, edx
mov edi, dword [0x451e4c]
mov ebp, dword [esp + 0x20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x442b76
inc edx
cmp ecx, edx
jne 0x442b60
jmp 0x442ba0
mov ebp, dword [esp + 0x20]
jmp 0x442ba0
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x442ba0
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push ecx
push dword [0x451e50]
call fcn.00441a80
add esp, 0x28
test eax, eax
js 0x442c7e
push 0x732f71fd
push dword [0x459e64]
call fcn.00444590
add esp, 8
push 0
push 0
push ebx
push esi
push dword [esp + 0x34]
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0xd8dbdac5
mov dword [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
mov edi, edx
and edi, 5
mov ebx, edx
and ebx, 2
mov ebp, edx
or ebp, 2
imul ebp, ebx
xor ebx, 2
imul ebx, edi
add ebp, ebx
mov edi, edx
xor edi, 0xc798bd2f
mov ebx, ebp
and ebx, edi
xor edi, ebp
lea ebx, [edi + ebx*2]
xor ebx, esi
mov esi, 0xeb
sub esi, ebx
and ebx, 1
or esi, 1
sub ebx, esi
mov byte [esp + edx], bl
inc edx
cmp edx, 8
jne 0x442bf0
mov edx, dword [0x451e48]
test edx, edx
je 0x442c7e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x451e4c]
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x442c60
inc edi
cmp edx, edi
jne 0x442c50
jmp 0x442c7e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x442c7e
push ecx
push 1
push edx
push dword [0x451e50]
mov esi, eax
call fcn.00441a80
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4433c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x2c]
mov esi, 2
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec esi
cmp byte [eax + edx + 1], 0
lea edx, [edx + 1]
jne 0x4433e0
mov dword [esp], eax
mov dword [esp + 4], 0xbebabc31
mov word [esp + 8], 0
xor eax, eax
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ebx + 4]
mov ebp, ebx
xor ebp, 0xd97bec9f
add ebp, eax
xor edi, 0xb69057b5
mov ecx, ebp
and ecx, 0x901044b5
or ecx, 0x824a800
and ebp, 0x496ba80a
xor ebp, ecx
xor ebp, 0xbeb4ffb5
mov ecx, edi
and ecx, ebp
add ecx, ecx
sub ebp, ecx
add ebp, edi
mov ecx, ebp
not ecx
or ecx, 0xc09460e4
add ecx, ebp
or ebp, 0xc09460e4
add ecx, ebp
inc ecx
mov edi, ecx
and edi, 1
xor ecx, 1
lea ecx, [ecx + edi*2]
mov byte [esp + ebx + 4], cl
inc ebx
add eax, 2
cmp ebx, 6
jne 0x443410
test edx, edx
je 0x443497
mov ebx, dword [esp + 4]
mov edi, ebx
not edi
test dl, 1
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], ebx
jne 0x4434a0
jmp 0x4434ce
mov eax, dword [esp + 0x30]
jmp 0x44353d
mov ebp, dword [esp + 0x2c]
movsx eax, byte [ebp]
xor eax, ecx
mov ecx, eax
or ecx, ebx
mov edx, edi
mov edi, eax
and edi, ebx
imul edi, ecx
mov ecx, eax
not ecx
and ecx, ebx
and eax, edx
imul eax, ecx
mov edx, esi
neg edx
add eax, edi
inc ebp
mov dword [esp], ebp
mov ecx, eax
test esi, esi
mov ebp, dword [esp]
mov ebx, dword [esp + 0xc]
je 0x44353d
xor esi, esi
mov eax, ecx
mov dword [esp + 0x10], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx edi, byte [ebp + esi]
xor edi, eax
mov eax, edi
or eax, ebx
mov ecx, edi
and ecx, ebx
imul ecx, eax
mov eax, edi
not eax
and eax, ebx
mov edx, dword [esp + 0x14]
and edi, edx
imul edi, eax
add edi, ecx
movsx eax, byte [ebp + esi + 1]
xor eax, edi
mov ecx, eax
or ecx, ebx
mov edi, eax
and edi, ebx
imul edi, ecx
mov ecx, eax
not ecx
and ecx, ebx
and eax, edx
mov edx, dword [esp + 0x10]
imul eax, ecx
add eax, edi
add esi, 2
cmp edx, esi
jne 0x4434f0
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44438a
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x292a2b74
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
mov esi, eax
and esi, 5
mov edi, eax
and edi, 2
mov ebx, eax
or ebx, 2
imul ebx, edi
xor edi, 2
imul edi, esi
add ebx, edi
mov esi, eax
xor esi, 0xaea5a937
mov edi, ebx
and edi, esi
xor esi, ebx
lea esi, [esi + edi*2]
not esi
mov edi, edx
or edi, esi
and esi, edx
lea edx, [esi + esi]
not edx
add edx, esi
and edx, edi
mov bl, 0xec
sub bl, dl
mov byte [esp + eax], bl
inc eax
cmp eax, 8
jne case.default.0x4443fa
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x4508b8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x4508d0]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x4508d0]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x4508d8]
mov edi, 1
jmp dword [edi*4 + 0x4508e0]
add esp, 8
pop esi
pop edi
pop ebx
ret
inc esp
inc esp
add byte [ecx], bl
inc esp
inc esp
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], bl
inc esp
inc esp
add byte [ecx], al
add byte [eax], al
add byte [edi + 0x44], dh
inc esp
add byte [esp + eax*2 + 0x44], bl
add byte [ebx + 0x44], ch
inc esp
add byte [eax + 0x44], al
inc esp
add byte [edi + 0x44], dh
inc esp
add byte [esp + eax*2 + 0x44], cl
add al, bl
Function at 0x444590
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x3c]
movzx eax, word [eax]
mov dword [esp], 0x33329b85
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
mov edi, ecx
and edi, 8
mov ebx, edx
xor ebx, 0xdc65998c
add ebx, edi
xor ebx, esi
mov esi, ebx
and esi, 0x41
mov ebp, ebx
and ebp, 2
mov edi, ebp
xor edi, 2
imul edi, esi
or esi, 2
imul esi, ebp
mov ebp, ebx
and ebp, 0x43
add ebp, ebp
sub ebx, ebp
add ebx, edi
add ebx, esi
add bl, 0x44
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 7
jne case.default.0x444617
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
mov edi, dword [esp + 0x3c]
jmp dword [ecx*4 + 0x450968]
mov ecx, dword [edi + 0x3c]
mov eax, dword [edi + ecx]
mov dword [esp], 0xb9bac0f4
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x9f
xor bl, byte [esp + edx]
add bl, 0xe5
mov byte [esp + edx], bl
inc edx
cmp edx, 7
jne case.default.0x44465e
xor edx, edx
cmp eax, dword [esp]
setne dl
xor eax, eax
jmp dword [edx*4 + 0x450970]
mov ebx, dword [edi + ecx + 0x78]
mov esi, dword [edi + ecx + 0x7c]
test esi, esi
sete cl
test ebx, ebx
sete dl
or dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x450978]
mov eax, dword [edi + ebx + 0x20]
add eax, edi
mov dword [esp + 0x20], eax
mov eax, dword [edi + ebx + 0x24]
add eax, edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], esi
mov eax, dword [edi + ebx + 0x1c]
add eax, edi
mov dword [esp + 0x14], eax
mov eax, dword [case.0x44465e.5]
nop
nop
nop
nop
nop
nop
jmp eax
xor ecx, ecx
xor eax, eax
mov dword [esp + 8], 0
cmp ecx, dword [edi + ebx + 0x18]
setb al
mov dword [esp + 0x1c], 1
mov dword [esp + 0xc], ebx
jmp dword [eax*4 + 0x450990]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4446b2
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x3c]
movzx eax, word [eax]
mov dword [esp], 0x33329b85
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
mov edi, ecx
and edi, 8
mov ebx, edx
xor ebx, 0xdc65998c
add ebx, edi
xor ebx, esi
mov esi, ebx
and esi, 0x41
mov ebp, ebx
and ebp, 2
mov edi, ebp
xor edi, 2
imul edi, esi
or esi, 2
imul esi, ebp
mov ebp, ebx
and ebp, 0x43
add ebp, ebp
sub ebx, ebp
add ebx, edi
add ebx, esi
add bl, 0x44
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 7
jne case.default.0x444617
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
mov edi, dword [esp + 0x3c]
jmp dword [ecx*4 + 0x450968]
mov ecx, dword [edi + 0x3c]
mov eax, dword [edi + ecx]
mov dword [esp], 0xb9bac0f4
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x9f
xor bl, byte [esp + edx]
add bl, 0xe5
mov byte [esp + edx], bl
inc edx
cmp edx, 7
jne case.default.0x44465e
xor edx, edx
cmp eax, dword [esp]
setne dl
xor eax, eax
jmp dword [edx*4 + 0x450970]
mov ebx, dword [edi + ecx + 0x78]
mov esi, dword [edi + ecx + 0x7c]
test esi, esi
sete cl
test ebx, ebx
sete dl
or dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x450978]
mov eax, dword [edi + ebx + 0x20]
add eax, edi
mov dword [esp + 0x20], eax
mov eax, dword [edi + ebx + 0x24]
add eax, edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], esi
mov eax, dword [edi + ebx + 0x1c]
add eax, edi
mov dword [esp + 0x14], eax
mov eax, dword [case.0x44465e.5]
nop
nop
nop
nop
nop
nop
jmp eax
xor ecx, ecx
xor eax, eax
mov dword [esp + 8], 0
cmp ecx, dword [edi + ebx + 0x18]
setb al
mov dword [esp + 0x1c], 1
mov dword [esp + 0xc], ebx
jmp dword [eax*4 + 0x450990]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4450a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4450c0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x4450db
mov eax, 0xffffffff
jmp 0x4450de
add eax, 0xa
push eax
call fcn.0040ce10
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x445121
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x445110
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xd8dbdac5
mov dword [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x2f
xor dl, byte [esp + ecx]
add dl, 0x15
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 8
jb 0x445190
mov esi, dword [esp]
mov ecx, dword [0x451e48]
test ecx, ecx
je 0x445211
xor edx, edx
mov ebx, dword [0x451e4c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x4451e0
inc edx
cmp ecx, edx
jne 0x4451d0
jmp 0x445211
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x445211
mov edx, esp
lea esi, [esp + 0x10]
push edi
push ebp
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push ecx
push dword [0x451e50]
mov edi, eax
call fcn.00441a80
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040ce20
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x445230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x445250
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x44526b
mov eax, 0xffffffff
jmp 0x44526e
add eax, 0xa
push eax
call fcn.0040ce10
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x4452b1
add ebx, 2
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x4452a0
mov word [edx], 0
mov edi, 3
sub edi, esi
and edi, 2
mov edx, ecx
and edx, 0xfffd
imul edx, edi
and esi, 2
or ecx, 2
imul ecx, esi
lea esi, [ecx + edx]
mov word [esp], si
add ecx, edx
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xd8dbdac5
mov dword [esp + 0x24], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x2f
xor dl, byte [esp + ecx + 0x20]
add dl, 0x15
mov byte [esp + ecx + 0x20], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 8
jb 0x445330
mov esi, dword [esp + 0x20]
mov ecx, dword [0x451e48]
test ecx, ecx
je 0x4453a9
xor edx, edx
mov edi, dword [0x451e4c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x50dc24c7
je 0x445380
inc edx
cmp ecx, edx
jne 0x445370
jmp 0x4453a9
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x4453a9
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 2
push ecx
push dword [0x451e50]
mov edi, eax
call fcn.00441a80
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.0040ce20
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4453bf
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret