joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ee70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x42ee90
mov dword [esp + 4], 0x969a9401
mov byte [esp + 8], 0
mov dword [esp], 0
mov esi, dword [esp]
cmp esi, 4
ja 0x42eef0
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
add esi, 0x356590db
xor esi, edi
mov dword [esp + 0x10], esi
mov ebx, dword [esp + 0x10]
add bl, 0xb9
mov esi, dword [esp]
mov byte [esp + esi + 4], bl
inc dword [esp]
mov esi, dword [esp]
cmp esi, 5
jb 0x42eec0
test edx, edx
je 0x42ef41
sar edx, 1
mov esi, dword [esp + 4]
mov edi, esi
not edi
mov dword [esp + 0xc], edi
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [ecx + ebx*2]
mov edi, ecx
mov ecx, eax
and ecx, ebp
add eax, ebp
add ecx, ecx
sub eax, ecx
mov ecx, eax
not ecx
and ecx, esi
mov ebp, eax
and ebp, dword [esp + 0xc]
imul ebp, ecx
mov ecx, eax
and ecx, esi
or eax, esi
imul eax, ecx
mov ecx, edi
add eax, ebp
inc ebx
cmp edx, ebx
jne 0x42ef10
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x432830
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov dword [esp + 4], 0x7f7e7928
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43288e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0x2cf87cea
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x6e
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x432860
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
push ecx
push 0
push dword [eax + 0x18]
call dword [0x449d10]
add esp, 0x10
ret
Function at 0x432970
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x20272625
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x4329ce
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0x6bdf809
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0xd3
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x4329a0
mov edi, dword [esp + 4]
mov eax, dword [0x441cf0]
test eax, eax
je 0x432a26
xor ecx, ecx
mov edx, dword [0x441cf4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x432a00
inc ecx
cmp eax, ecx
jne 0x4329f0
jmp 0x432a26
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x432a26
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x441cf8]
push eax
call fcn.004347b0
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x432b65
mov dword [esp + 0x14], esi
push dword [esp + 0xc]
call fcn.00432830
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x20272625
mov dword [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 7
ja 0x432aa0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0x6bdf809
xor edx, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 0xd3
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 8
jb 0x432a70
mov edi, dword [esp + 4]
mov edx, dword [0x441cf0]
test edx, edx
je 0x432af6
xor ebx, ebx
mov ebp, dword [0x441cf4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x432ad1
inc ebx
cmp edx, ebx
jne 0x432ac0
jmp 0x432af6
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x432af6
push 0
push ecx
push eax
push 5
push 4
push dword [0x441cf8]
push edx
mov esi, eax
call fcn.004347b0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x432b5c
mov ecx, dword [esp + 0x2c]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x432b35
add ebx, 2
cmp bp, si
je 0x432b20
cmp bp, si
je 0x432b47
mov ebx, dword [edx]
test ebx, ebx
jne 0x432b10
mov edi, 0xc0000225
jmp 0x432b5c
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x14]
mov dword [esi + 4], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 8], ecx
xor edi, edi
push eax
call fcn.004328b0
add esp, 4
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x432ba0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ecx + 4]
test edx, edx
je 0x432c80
xor eax, eax
cmp dword [ecx], 0
jne 0x432cd7
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], edx
mov eax, dword [ecx + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x20272625
mov dword [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x432c4e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
add eax, 0x6bdf809
xor eax, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
add al, 0xd3
mov edx, dword [esp]
mov byte [esp + edx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x432c20
mov eax, dword [esp + 0xc]
mov esi, dword [0x441cf0]
test esi, esi
je 0x432cd7
mov edx, dword [esp + 0x40]
xor edi, edi
mov ebx, dword [0x441cf4]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x432ce0
inc edi
cmp esi, edi
jne 0x432c70
jmp 0x432cd7
mov dword [esp + 0x14], 0x9cacbf4
mov byte [esp + 0x18], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x432cd3
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x14]
add eax, 0x46a9a253
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x61
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x432ca0
mov eax, dword [esp + 0x14]
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x432cd7
lea eax, [esp + 4]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x441cf8]
push esi
call fcn.004347b0
add esp, 0x1c
jmp 0x432cd7

Function at 0x432d10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x432dd1
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x20272625
mov dword [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 7
ja 0x432d70
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0x6bdf809
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 0xd3
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 8
jb 0x432d40
mov edx, dword [0x441cf0]
test edx, edx
je 0x432dbe
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x441cf4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x432da0
inc edi
cmp edx, edi
jne 0x432d90
jmp 0x432dbe
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x432dbe
push eax
push 1
push dword [0x441cf8]
push edx
mov esi, ecx
call fcn.004347b0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
mov dword [ecx + 4], 0
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x433060
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edx, dword [esp + 0x34]
mov ecx, dword [ecx]
mov dword [esp + 4], 0x20272625
mov dword [esp + 8], 0
test edx, edx
jne 0x433085
lea edx, [esp + 0x10]
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x4330ce
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add eax, 0x6bdf809
xor eax, esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xd3
mov esi, dword [esp]
mov byte [esp + esi + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x4330a0
mov eax, dword [esp + 4]
mov ebp, dword [0x441cf0]
test ebp, ebp
je 0x433124
mov ebx, dword [esp + 0x30]
xor esi, esi
mov edi, dword [0x441cf4]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x3baba5e0
je 0x433100
inc esi
cmp ebp, esi
jne 0x4330f0
jmp 0x433124
mov ebp, dword [edi + esi*8 + 4]
cmp ebp, eax
je 0x433124
push edx
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push ecx
push 5
push dword [0x441cf8]
push ebp
call fcn.004347b0
add esp, 0x20
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x433c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x58
mov dword [esp + 0x40], 0xe16ae712
mov dword [esp + 0x44], 0xfd16e31c
mov dword [esp + 0x48], 0xf9c8ff08
mov dword [esp + 0x4c], 0xf50efb04
mov dword [esp + 0x50], 0xf1f6f700
mov dword [esp + 0x54], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x17
ja 0x433c93
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x40]
add eax, 0x99cdd829
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0x33
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x40], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x18
jb 0x433c60
lea eax, [esp + 0x40]
push eax
call fcn.00435a50
add esp, 4
mov dword [0x449d08], eax
mov dword [esp + 0x18], 0xc2560d4e
test eax, eax
je 0x433cb9
mov dword [esp + 0x18], 0x967f3e65
mov esi, 0x993377f8
xor eax, eax
cmp esi, 0xcf562577
setl al
mov dword [esp + 0x14], ecx
jmp dword [eax*4 + 0x43f9d0]
Function at 0x435a50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 8], 0xc9cacb9c
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x435aae
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x46a9a253
xor eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add al, 0x61
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x435a80
mov eax, dword [esp + 8]
mov ecx, dword [0x4404d0]
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx

Function at 0x435dc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], 0x616667b4
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x435e1e
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add eax, 0x1c3f2399
xor eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 3
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x435df0
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x4405a4]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [0x4405c4]
mov edi, dword [edx]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x4405ac]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [0x4405c4]
mov edi, dword [edx]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x4405ac]
mov ebx, 1
jmp dword [ebx*4 + 0x4405cc]
xor ebx, ebx
cmp dword [edi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x4405b4]
jmp esi
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x436870
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebp, dword [esp + 0x58]
mov edi, dword [esp + 0x44]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x436890
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x4368ab
mov eax, 0xffffffff
jmp 0x4368ae
add eax, 0xa
push eax
call fcn.00409540
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x4368f1
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x4368e0
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 0xc], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xe], cx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0x20272625
mov dword [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 7
ja 0x4369b0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add ecx, 0x6bdf809
xor ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
add cl, 0xd3
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 8
jb 0x436980
mov esi, dword [esp + 4]
mov ecx, dword [0x441cf0]
test ecx, ecx
je 0x436a24
xor edx, edx
mov edi, dword [0x441cf4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x10f02cc2
je 0x4369e0
inc edx
cmp ecx, edx
jne 0x4369d0
jmp 0x436a24
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x436a24
lea esi, [esp + 4]
lea edx, [esp + 0x18]
push 0
push 0
push ebp
push dword [esp + 0x60]
push dword [esp + 0x60]
push dword [esp + 0x70]
push 0
push esi
push edx
push dword [esp + 0x70]
push dword [esp + 0x70]
push 0xb
push dword [0x441cf8]
push ecx
mov edi, eax
call fcn.004347b0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00409550
add esp, 4
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
mov esi, dword [esp + 0x44]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x436a60
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x436a7b
mov eax, 0xffffffff
jmp 0x436a7e
add eax, 0xa
push eax
call fcn.00409540
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x436ac1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x436ab0
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 0xc], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xe], cx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0x20272625
mov dword [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 7
ja 0x436b70
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add ecx, 0x6bdf809
xor ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
add cl, 0xd3
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 8
jb 0x436b40
mov esi, dword [esp + 4]
mov ecx, dword [0x441cf0]
test ecx, ecx
je 0x436bd3
xor edx, edx
mov ebx, dword [0x441cf4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x88a3caae
je 0x436ba0
inc edx
cmp ecx, edx
jne 0x436b90
jmp 0x436bd3
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x436bd3
lea edx, [esp + 4]
lea esi, [esp + 0x18]
push edi
push ebp
push edx
push esi
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push 6
push dword [0x441cf8]
push ecx
mov edi, eax
call fcn.004347b0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00409550
add esp, 4
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x436c10
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x436c2b
mov eax, 0xffffffff
jmp 0x436c2e
add eax, 0xa
push eax
call fcn.00409540
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x436c71
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x436c60
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 4], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 6], cx
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x20272625
mov dword [esp + 0x2c], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 7
ja 0x436d20
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x28]
add ecx, 0x6bdf809
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0xd3
mov edx, dword [esp]
mov byte [esp + edx + 0x28], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 8
jb 0x436cf0
mov esi, dword [esp + 0x28]
mov ecx, dword [0x441cf0]
test ecx, ecx
je 0x436d79
xor edx, edx
mov ebx, dword [0x441cf4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x8896be63
je 0x436d50
inc edx
cmp ecx, edx
jne 0x436d40
jmp 0x436d79
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x436d79
lea edx, [esp + 0x28]
lea esi, [esp + 0x10]
push edx
push esi
push 2
push dword [0x441cf8]
push ecx
mov ebx, eax
call fcn.004347b0
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.00409550
add esp, 4
test edi, edi
je 0x436d8c
mov eax, dword [esp + 0x48]
mov dword [edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 0x10], 0x20272625
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 7
ja 0x436e03
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x10]
add eax, 0x6bdf809
xor eax, ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0xd3
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 8
jb 0x436dd0
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [0x441cf0]
test edx, edx
je 0x436e58
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x441cf4]
nop
cmp dword [ebx + edi*8], 0x77a9e0c4
je 0x436e30
inc edi
cmp edx, edi
jne 0x436e20
jmp 0x436e58
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x436e58
lea eax, [esp + 0x10]
lea edi, [esp + 8]
push 5
push 0x18
push eax
push edi
push ecx
push 5
push dword [0x441cf8]
push edx
call fcn.004347b0
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x436e65
mov edx, dword [esp + 0x18]
mov dword [esi], edx
test ecx, ecx
je 0x436e71
cmp byte [esp + 0x25], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0x20272625
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x436ede
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x6bdf809
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0xd3
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x436eb0
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 8]
mov ecx, dword [0x441cf0]
test ecx, ecx
je 0x436f3c
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
xor ebx, ebx
mov ebp, dword [0x441cf4]
cmp dword [ebp + ebx*8], 0x72e9dc72
je 0x436f11
inc ebx
cmp ecx, ebx
jne 0x436f00
jmp 0x436f3c
mov ecx, dword [ebp + ebx*8 + 4]
cmp ecx, eax
je 0x436f3c
lea eax, [esp + 0x10]
push 0
push 0
push edi
push edx
push eax
push 0
push 0
push 0
push esi
push 9
push dword [0x441cf8]
push ecx
call fcn.004347b0
add esp, 0x30
mov edi, dword [esp + 0x38]
cmp eax, 0x103
jne 0x436ff6
mov dword [esp + 8], 0x20272625
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 7
ja 0x436fa1
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x6bdf809
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xd3
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 8
jb 0x436f70
mov eax, dword [esp + 8]
mov ecx, dword [0x441cf0]
test ecx, ecx
je 0x436fee
xor edx, edx
mov ebx, dword [0x441cf4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x7e28bda7
je 0x436fd0
inc edx
cmp ecx, edx
jne 0x436fc0
jmp 0x436fee
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x436fee
push 0
push 0
push esi
push 3
push dword [0x441cf8]
push ecx
call fcn.004347b0
add esp, 0x18
test eax, eax
js 0x436ff6
mov eax, dword [esp + 0x10]
test edi, edi
je 0x437009
xor ecx, ecx
cmp eax, 0xc0000011
je 0x437007
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437020
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0x20272625
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43707e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x6bdf809
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0xd3
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x437050
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 8]
mov ecx, dword [0x441cf0]
test ecx, ecx
je 0x4370dc
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
xor ebx, ebx
mov ebp, dword [0x441cf4]
cmp dword [ebp + ebx*8], 0xe6919031
je 0x4370b1
inc ebx
cmp ecx, ebx
jne 0x4370a0
jmp 0x4370dc
mov ecx, dword [ebp + ebx*8 + 4]
cmp ecx, eax
je 0x4370dc
lea eax, [esp + 0x10]
push 0
push 0
push edi
push edx
push eax
push 0
push 0
push 0
push esi
push 9
push dword [0x441cf8]
push ecx
call fcn.004347b0
add esp, 0x30
mov edi, dword [esp + 0x38]
cmp eax, 0x103
jne 0x437196
mov dword [esp + 8], 0x20272625
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 7
ja 0x437141
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x6bdf809
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xd3
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 8
jb 0x437110
mov eax, dword [esp + 8]
mov ecx, dword [0x441cf0]
test ecx, ecx
je 0x43718e
xor edx, edx
mov ebx, dword [0x441cf4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x7e28bda7
je 0x437170
inc edx
cmp ecx, edx
jne 0x437160
jmp 0x43718e
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x43718e
push 0
push 0
push esi
push 3
push dword [0x441cf8]
push ecx
call fcn.004347b0
add esp, 0x18
test eax, eax
js 0x437196
mov eax, dword [esp + 0x10]
test edi, edi
je 0x4371a0
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret