joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e9f5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov dword [ebp - 8], edx
lea edx, [eax + 0x1000]
push ebx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], 0x10
mov edx, 0xff
push edi
mov edi, dword [ebp - 4]
xor ecx, dword [edi]
add dword [ebp - 4], 4
mov edi, ecx
shr edi, 0x10
and edi, edx
mov edi, dword [eax + edi*4 + 0x400]
mov ebx, ecx
shr ebx, 0x18
add edi, dword [eax + ebx*4]
mov ebx, ecx
shr ebx, 8
and ebx, edx
xor edi, dword [eax + ebx*4 + 0x800]
mov dword [ebp - 0x10], ecx
and ecx, edx
add edi, dword [eax + ecx*4 + 0xc00]
xor edi, dword [ebp - 8]
dec dword [ebp - 0xc]
mov ecx, edi
mov edi, dword [ebp - 0x10]
mov dword [ebp - 8], edi
jne 0x43ea1a
mov edx, dword [eax + 0x1040]
mov eax, dword [eax + 0x1044]
xor edx, ecx
xor eax, edi
pop edi
mov dword [esi], eax
mov dword [esi + 4], edx
pop ebx
leave
ret

Function at 0x43ea7c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x1044]
mov dword [ebp + 0xc], edx
push edi
mov dword [ebp + 8], 0x10
mov edx, 0xff
mov edi, dword [ebp + 0xc]
xor ecx, dword [edi]
sub dword [ebp + 0xc], 4
mov edi, ecx
shr edi, 0x10
and edi, edx
mov edi, dword [eax + edi*4 + 0x400]
mov ebx, ecx
shr ebx, 0x18
add edi, dword [eax + ebx*4]
mov ebx, ecx
shr ebx, 8
and ebx, edx
xor edi, dword [eax + ebx*4 + 0x800]
mov dword [ebp - 8], ecx
and ecx, edx
add edi, dword [eax + ecx*4 + 0xc00]
xor edi, dword [ebp - 4]
dec dword [ebp + 8]
mov ecx, edi
mov edi, dword [ebp - 8]
mov dword [ebp - 4], edi
jne 0x43eaa7
mov edx, dword [eax + 0x1004]
mov eax, dword [eax + 0x1000]
xor edx, ecx
xor eax, edi
pop edi
mov dword [esi], eax
mov dword [esi + 4], edx
pop esi
pop ebx
leave
ret
Function at 0x441628
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x10], 0x20
je 0x441639
or eax, 0xffffffff
leave
ret
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
lea esi, [ebp - 0x10]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [eax + 0xc]
mov esi, 0xfc
mov ecx, dword [edx - 0xc]
add ecx, dword [edx]
add edx, 4
mov edi, ecx
and edi, 7
shr ecx, 3
xor ecx, dword [edi*4 + 0x4767fc]
dec esi
mov dword [edx], ecx
jne 0x44166a
xor edx, edx
mov esi, dword [eax + edx*4 + 0x164]
lea ecx, [eax + edx*4]
add dword [ecx], esi
inc edx
cmp edx, 0x17
jb 0x441688
mov edx, dword [eax + 0xec]
mov ecx, dword [eax + 0x84]
and edx, 0xff7fffff
or edx, 0x1000001
and dword [ebp + 0x10], 0
mov esi, 0x100
mov edi, dword [ebp + 0x10]
lea edi, [eax + edi*4]
mov ebx, dword [edi]
and ecx, 0xff7fffff
add ecx, edx
and ebx, 0xffffff
xor ebx, ecx
inc dword [ebp + 0x10]
mov dword [edi], ebx
cmp dword [ebp + 0x10], esi
jb 0x4416bb
mov edx, dword [eax]
mov dword [eax + 0x400], edx
mov edx, 0xff
and ecx, edx
and dword [ebp + 0x10], 0
mov edi, dword [ebp + 0x10]
mov ebx, ecx
xor ebx, edi
mov ebx, dword [eax + ebx*4]
xor ebx, ecx
and ebx, edx
mov ecx, ebx
mov ebx, dword [eax + ecx*4]
shl edi, 2
inc dword [ebp + 0x10]
mov dword [edi + eax], ebx
mov edi, dword [edi + eax + 4]
mov dword [eax + ecx*4], edi
cmp dword [ebp + 0x10], esi
jb 0x4416f0
mov ecx, dword [ebp - 0x10]
and dword [eax + 0x414], 0
mov dword [eax + 0x404], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x408], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 0x40c], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax + 0x410], ecx
xor eax, eax
pop ebx
leave
ret
Function at 0x441ae4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 0x24
xor ebx, ebx
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.00458090
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shr eax, 2
add esp, 0xc
xor esi, esi
cmp eax, ebx
jbe 0x441b21
mov edx, dword [ebp + 0xc]
lea edx, [edx + eax*4 - 4]
mov edi, dword [edx]
mov dword [ebp + esi*4 - 0x24], edi
inc esi
sub edx, 4
cmp esi, eax
jb 0x441b13
mov eax, dword [ebp + 8]
mov dword [eax + 0x210], ecx
mov byte [ebp + ecx - 0x24], bl
xor edi, edi
cmp dword [eax + 0x210], ebx
jbe 0x441b5f
mov edx, eax
lea ecx, [ebp - 0x24]
sub edx, ecx
mov esi, dword [eax + 0x210]
lea ecx, [ebp + edi - 0x24]
mov bl, byte [ecx]
lea esi, [ebp + esi - 0x24]
xor byte [esi], bl
mov bl, byte [ecx]
inc edi
mov byte [edx + ecx], bl
cmp edi, dword [eax + 0x210]
jb 0x441b3f
xor esi, esi
cmp dword [eax + 0x210], esi
jbe 0x441c0c
mov dword [ebp + 0x10], 0x23
lea edi, [eax + 0x10]
mov edx, 0xff
xor ecx, ecx
rol byte [ebp + ecx - 0x24], 3
inc ecx
cmp ecx, dword [eax + 0x210]
jbe 0x441b7e
lea ecx, [esi + 1]
mov dword [ebp + 8], ecx
cmp esi, 0x10
jae 0x441bcb
xor esi, esi
mov ebx, dword [ebp + 0x10]
add ebx, esi
and ebx, edx
movzx ebx, byte [ebx + 0x490700]
mov bl, byte [ebx + 0x490700]
add bl, byte [ebp + ecx - 0x24]
mov byte [edi + esi], bl
mov ebx, ecx
sub ebx, dword [eax + 0x210]
inc ecx
neg ebx
sbb ebx, ebx
and ecx, ebx
inc esi
cmp esi, 0x10
jb 0x441b99
jmp 0x441bf6
xor esi, esi
mov ebx, dword [ebp + 0x10]
add ebx, esi
and ebx, edx
mov bl, byte [ebx + 0x490700]
add bl, byte [ebp + ecx - 0x24]
mov byte [edi + esi], bl
mov ebx, ecx
sub ebx, dword [eax + 0x210]
inc ecx
neg ebx
sbb ebx, ebx
and ecx, ebx
inc esi
cmp esi, 0x10
jb 0x441bcd
mov esi, dword [ebp + 8]
add dword [ebp + 0x10], 0x11
add edi, 0x10
cmp esi, dword [eax + 0x210]
jb 0x441b7c
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x44287a
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, 0x496218
push edi
mov ecx, eax
dec ecx
push 2
mov dword [ebp - 0xc], eax
sub dword [ebp - 0xc], ecx
mov byte [0x495d18], 0
mov byte [0x496218], 1
mov byte [0x495d19], 0
mov byte [0x496219], 3
mov byte [0x495d1b], 1
pop ebx
lea esi, [ecx + 2]
mov edi, 0x100
mov dl, byte [esi]
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
mov cl, dl
add cl, cl
xor cl, dl
xor cl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + esi], cl
movzx eax, cl
mov byte [eax + 0x495d18], bl
inc ebx
inc esi
cmp ebx, edi
jl 0x4428bf
xor edx, edx
mov byte [0x496490], 0x63
mov byte [0x4963f3], 0
inc edx
movzx eax, dl
movzx eax, byte [eax + 0x495d18]
mov ecx, 0x496317
sub ecx, eax
mov bl, byte [ecx]
mov cl, bl
rol cl, 1
xor bl, cl
rol cl, 1
xor bl, cl
rol cl, 1
mov al, cl
rol al, 1
xor al, bl
xor al, cl
xor al, 0x63
mov byte [edx + 0x496490], al
movzx eax, al
mov byte [eax + 0x496390], dl
inc edx
cmp edx, edi
jl 0x4428f9
mov dl, 1
mov ecx, 0x496318
movzx eax, dl
mov dword [ecx], eax
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
add dl, dl
add ecx, 4
xor dl, al
cmp ecx, 0x496390
jl 0x44293d
xor esi, esi
mov al, byte [esi + 0x496490]
mov byte [ebp - 1], al
and byte [ebp - 1], 0x80
mov cl, al
mov byte [ebp - 6], al
sete dl
add cl, cl
dec dl
and dl, 0x1b
mov bl, cl
xor bl, dl
xor bl, al
cmp byte [ebp - 1], 0
mov byte [ebp - 7], al
sete al
dec al
and al, 0x1b
xor cl, al
mov byte [ebp - 8], cl
lea ecx, [ebp - 8]
mov byte [ebp - 5], bl
call fcn.00442760
mov ebx, dword [0x490a00]
mov dword [esi*4 + 0x495e18], eax
mov al, byte [esi + 0x496390]
mov byte [ebp - 0xc], al
push dword [ebp - 0xc]
movzx eax, bl
push eax
call fcn.0044277f
push dword [ebp - 0xc]
mov byte [ebp - 5], al
movzx eax, bh
push eax
call fcn.0044277f
push dword [ebp - 0xc]
mov byte [ebp - 6], al
movzx eax, byte [0x490a02]
push eax
call fcn.0044277f
push dword [ebp - 0xc]
mov byte [ebp - 7], al
movzx eax, byte [0x490a03]
push eax
call fcn.0044277f
add esp, 0x20
lea ecx, [ebp - 8]
mov byte [ebp - 8], al
call fcn.00442760
mov dword [esi*4 + 0x496590], eax
inc esi
cmp esi, edi
jl 0x44295d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x442cee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 4]
push edi
test ebx, ebx
jle 0x442d2e
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
lea edi, [esi + 0x3c]
mov ecx, dword [ebp + 8]
call fcn.00442760
xor eax, dword [edi]
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
add dword [ebp + 8], 4
add edi, 4
cmp dword [ebp - 4], ebx
mov dword [ebp + ecx*4 - 0x34], eax
jl 0x442d0e
mov ecx, dword [esi + 8]
cmp ecx, 1
lea edi, [ebp - 0x54]
lea eax, [ebp - 0x34]
mov dword [ebp + 8], edi
jle 0x442de8
dec ecx
mov dword [ebp - 0x10], ecx
cmp dword [esi + 4], 0
jle 0x442dd5
lea edx, [esi + ebx*4 + 0x3c]
mov dword [ebp - 4], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
add ebx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x495e18]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x495e18]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x495e18]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
xor edx, dword [ebx*4 + 0x495e18]
mov ebx, dword [ebp - 4]
xor edx, dword [ebx]
add dword [ebp - 4], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 8]
jne 0x442d6e
mov ebx, dword [ebp - 0x14]
dec dword [ebp - 0x10]
mov ecx, eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [ebp + 8], edi
jne 0x442d47
cmp dword [esi + 4], 0
jle 0x442e6c
lea edx, [esi + ebx*4 + 0x3c]
mov dword [ebp - 8], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
mov dword [ebp - 0x10], edx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
movzx ebx, byte [ebx + 0x496490]
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + 0x496490]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
movzx ebx, byte [ebx + 0x496490]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
movzx ebx, byte [ebx + 0x496490]
xor edx, ebx
mov ebx, dword [ebp - 8]
xor edx, dword [ebx]
add dword [ebp - 8], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 0x10]
jne 0x442e06
and dword [ebp - 4], 0
cmp dword [esi + 4], 0
jle 0x442eb3
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add edx, 2
sub eax, edi
mov ecx, dword [edi]
and dword [edi], 0
and dword [eax + edi], 0
mov ebx, ecx
shr ebx, 8
mov byte [edx - 1], bl
mov byte [edx - 2], cl
mov ebx, ecx
shr ecx, 0x18
shr ebx, 0x10
inc dword [ebp - 4]
mov byte [edx + 1], cl
mov ecx, dword [ebp - 4]
mov byte [edx], bl
add edi, 4
add edx, 4
cmp ecx, dword [esi + 4]
jl 0x442e81
pop edi
pop esi
pop ebx
leave
ret
Function at 0x442eb8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 4]
push edi
test ebx, ebx
jle 0x442efb
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
lea edi, [esi + 0x21c]
mov ecx, dword [ebp + 8]
call fcn.00442760
xor eax, dword [edi]
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
add dword [ebp + 8], 4
add edi, 4
cmp dword [ebp - 4], ebx
mov dword [ebp + ecx*4 - 0x34], eax
jl 0x442edb
mov ecx, dword [esi + 8]
cmp ecx, 1
lea edi, [ebp - 0x54]
lea eax, [ebp - 0x34]
mov dword [ebp + 8], edi
jle 0x442fb8
dec ecx
mov dword [ebp - 0x10], ecx
cmp dword [esi + 4], 0
jle 0x442fa5
lea edx, [esi + ebx*4 + 0x21c]
mov dword [ebp - 4], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0x24]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
add ebx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x496590]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x496590]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x496590]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
xor edx, dword [ebx*4 + 0x496590]
mov ebx, dword [ebp - 4]
xor edx, dword [ebx]
add dword [ebp - 4], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 8]
jne 0x442f3e
mov ebx, dword [ebp - 0x14]
dec dword [ebp - 0x10]
mov ecx, eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [ebp + 8], edi
jne 0x442f14
cmp dword [esi + 4], 0
jle 0x443043
lea edx, [esi + ebx*4 + 0x21c]
mov dword [ebp - 8], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0x24]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
mov dword [ebp - 0x10], edx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
movzx ebx, byte [ebx + 0x496390]
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + 0x496390]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
movzx ebx, byte [ebx + 0x496390]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
movzx ebx, byte [ebx + 0x496390]
xor edx, ebx
mov ebx, dword [ebp - 8]
xor edx, dword [ebx]
add dword [ebp - 8], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 0x10]
jne 0x442fdd
and dword [ebp - 4], 0
cmp dword [esi + 4], 0
jle 0x44308a
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add edx, 2
sub eax, edi
mov ecx, dword [edi]
and dword [edi], 0
and dword [eax + edi], 0
mov ebx, ecx
shr ebx, 8
mov byte [edx - 1], bl
mov byte [edx - 2], cl
mov ebx, ecx
shr ecx, 0x18
shr ebx, 0x10
inc dword [ebp - 4]
mov byte [edx + 1], cl
mov ecx, dword [ebp - 4]
mov byte [edx], bl
add edi, 4
add edx, 4
cmp ecx, dword [esi + 4]
jl 0x443058
pop edi
pop esi
pop ebx
leave
ret
Function at 0x443238
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
mov edi, 0x2911
push edi
push 0xd
mov eax, esi
xor eax, 0x1fff
push eax
push edi
push 0xd
push eax
push eax
call fcn.00443207
add esp, 0x10
push eax
call fcn.00443207
add esp, 0x10
mov byte [esi + 0x499c40], al
inc esi
cmp esi, 0x2000
jb 0x443241
xor esi, esi
mov edi, 0xaa7
push edi
push 0xb
mov eax, esi
xor eax, 0x7ff
push eax
push edi
push 0xb
push eax
push eax
call fcn.00443207
add esp, 0x10
push eax
call fcn.00443207
add esp, 0x10
mov byte [esi + 0x499440], al
inc esi
cmp esi, 0x800
jb 0x443278
pop edi
xor eax, eax
pop esi
mov ecx, eax
and ecx, 0xfffffff8
shl ecx, 7
mov edx, eax
and edx, 4
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 2
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 1
or ecx, edx
shl ecx, 7
mov dword [eax*8 + 0x498c40], ecx
mov ecx, eax
and ecx, 0xffffff80
shl ecx, 7
mov edx, eax
and edx, 0x40
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 0x20
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 0x10
or ecx, edx
shl ecx, 3
mov dword [eax*8 + 0x498c44], ecx
inc eax
cmp eax, 0x100
jb 0x4432ac
ret
Function at 0x4462af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 8]
push ebx
lea ebx, [edx + 0xb8]
push esi
push edi
mov dword [ebp - 4], ebx
add edx, 0xabc
mov dword [ebp - 8], 0x100
movzx eax, byte [ebx + 0x100]
mov edi, eax
and edi, 3
movzx esi, byte [edi + 0x491a10]
movzx edi, byte [edi + 0x491a14]
mov ecx, eax
shr ecx, 2
xor esi, ecx
mov ecx, eax
shr ecx, 1
xor ecx, eax
shr ecx, 1
xor ecx, edi
xor ecx, eax
xor esi, eax
mov edi, ecx
imul ecx, ecx, 0x1000100
imul edi, edi, 0x10100
add edi, esi
shl edi, 8
add edi, eax
shl eax, 0x10
add ecx, esi
add eax, ecx
mov dword [edx], eax
mov dword [edx - 0x800], edi
movzx esi, byte [ebx]
mov edi, esi
and edi, 3
movzx ecx, byte [edi + 0x491a10]
movzx edi, byte [edi + 0x491a14]
mov eax, esi
shr eax, 2
xor ecx, eax
mov eax, esi
shr eax, 1
xor eax, esi
shr eax, 1
xor eax, edi
xor eax, esi
xor ecx, esi
mov ebx, eax
mov edi, esi
imul ebx, ebx, 0x101
shl edi, 8
add edi, ecx
imul ecx, ecx, 0x1000001
shl eax, 8
add eax, esi
shl edi, 0x10
shl eax, 8
add edi, ebx
mov ebx, dword [ebp - 4]
add eax, ecx
mov dword [edx - 0x400], edi
mov dword [edx + 0x400], eax
add edx, 4
inc ebx
dec dword [ebp - 8]
mov dword [ebp - 4], ebx
jne 0x4462d0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44783c
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, 0x496e98
push edi
mov ecx, eax
dec ecx
push 2
mov dword [ebp - 0xc], eax
sub dword [ebp - 0xc], ecx
mov byte [0x496998], 0
mov byte [0x496e98], 1
mov byte [0x496999], 0
mov byte [0x496e99], 3
mov byte [0x49699b], 1
pop ebx
lea esi, [ecx + 2]
mov edi, 0x100
mov dl, byte [esi]
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
mov cl, dl
add cl, cl
xor cl, dl
xor cl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + esi], cl
movzx eax, cl
mov byte [eax + 0x496998], bl
inc ebx
inc esi
cmp ebx, edi
jl 0x447881
xor edx, edx
mov byte [0x497110], 0x63
mov byte [0x497073], 0
inc edx
movzx eax, dl
movzx eax, byte [eax + 0x496998]
mov ecx, 0x496f97
sub ecx, eax
mov bl, byte [ecx]
mov cl, bl
rol cl, 1
xor bl, cl
rol cl, 1
xor bl, cl
rol cl, 1
mov al, cl
rol al, 1
xor al, bl
xor al, cl
xor al, 0x63
mov byte [edx + 0x497110], al
movzx eax, al
mov byte [eax + 0x497010], dl
inc edx
cmp edx, edi
jl 0x4478bb
mov dl, 1
mov ecx, 0x496f98
movzx eax, dl
mov dword [ecx], eax
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
add dl, dl
add ecx, 4
xor dl, al
cmp ecx, 0x497010
jl 0x4478ff
xor esi, esi
mov al, byte [esi + 0x497110]
mov byte [ebp - 1], al
and byte [ebp - 1], 0x80
mov cl, al
mov byte [ebp - 6], al
sete dl
add cl, cl
dec dl
and dl, 0x1b
mov bl, cl
xor bl, dl
xor bl, al
cmp byte [ebp - 1], 0
mov byte [ebp - 7], al
sete al
dec al
and al, 0x1b
xor cl, al
mov byte [ebp - 8], cl
lea ecx, [ebp - 8]
mov byte [ebp - 5], bl
call fcn.00442760
mov ebx, dword [0x491ab8]
mov dword [esi*4 + 0x496a98], eax
mov al, byte [esi + 0x497010]
mov byte [ebp - 0xc], al
push dword [ebp - 0xc]
movzx eax, bl
push eax
call fcn.00447741
push dword [ebp - 0xc]
mov byte [ebp - 5], al
movzx eax, bh
push eax
call fcn.00447741
push dword [ebp - 0xc]
mov byte [ebp - 6], al
movzx eax, byte [0x491aba]
push eax
call fcn.00447741
push dword [ebp - 0xc]
mov byte [ebp - 7], al
movzx eax, byte [0x491abb]
push eax
call fcn.00447741
add esp, 0x20
lea ecx, [ebp - 8]
mov byte [ebp - 8], al
call fcn.00442760
mov dword [esi*4 + 0x497210], eax
inc esi
cmp esi, edi
jl 0x44791f
pop edi
pop esi
pop ebx
leave
ret
Function at 0x447caf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 4]
push edi
test ebx, ebx
jle 0x447cef
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
lea edi, [esi + 0x3c]
mov ecx, dword [ebp + 8]
call fcn.00442760
xor eax, dword [edi]
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
add dword [ebp + 8], 4
add edi, 4
cmp dword [ebp - 4], ebx
mov dword [ebp + ecx*4 - 0x34], eax
jl 0x447ccf
mov ecx, dword [esi + 8]
cmp ecx, 1
lea edi, [ebp - 0x54]
lea eax, [ebp - 0x34]
mov dword [ebp + 8], edi
jle 0x447da9
dec ecx
mov dword [ebp - 0x10], ecx
cmp dword [esi + 4], 0
jle 0x447d96
lea edx, [esi + ebx*4 + 0x3c]
mov dword [ebp - 4], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
add ebx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x496a98]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x496a98]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x496a98]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
xor edx, dword [ebx*4 + 0x496a98]
mov ebx, dword [ebp - 4]
xor edx, dword [ebx]
add dword [ebp - 4], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 8]
jne 0x447d2f
mov ebx, dword [ebp - 0x14]
dec dword [ebp - 0x10]
mov ecx, eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [ebp + 8], edi
jne 0x447d08
cmp dword [esi + 4], 0
jle 0x447e2d
lea edx, [esi + ebx*4 + 0x3c]
mov dword [ebp - 8], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
mov dword [ebp - 0x10], edx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
movzx ebx, byte [ebx + 0x497110]
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + 0x497110]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
movzx ebx, byte [ebx + 0x497110]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
movzx ebx, byte [ebx + 0x497110]
xor edx, ebx
mov ebx, dword [ebp - 8]
xor edx, dword [ebx]
add dword [ebp - 8], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 0x10]
jne 0x447dc7
and dword [ebp - 4], 0
cmp dword [esi + 4], 0
jle 0x447e74
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add edx, 2
sub eax, edi
mov ecx, dword [edi]
and dword [edi], 0
and dword [eax + edi], 0
mov ebx, ecx
shr ebx, 8
mov byte [edx - 1], bl
mov byte [edx - 2], cl
mov ebx, ecx
shr ecx, 0x18
shr ebx, 0x10
inc dword [ebp - 4]
mov byte [edx + 1], cl
mov ecx, dword [ebp - 4]
mov byte [edx], bl
add edi, 4
add edx, 4
cmp ecx, dword [esi + 4]
jl 0x447e42
pop edi
pop esi
pop ebx
leave
ret