joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e6d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 4]
push edi
test ebx, ebx
jle 0x43e715
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
lea edi, [esi + 0x3c]
mov ecx, dword [ebp + 8]
call fcn.0043e122
xor eax, dword [edi]
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
add dword [ebp + 8], 4
add edi, 4
cmp dword [ebp - 4], ebx
mov dword [ebp + ecx*4 - 0x34], eax
jl 0x43e6f5
mov ecx, dword [esi + 8]
cmp ecx, 1
lea edi, [ebp - 0x54]
lea eax, [ebp - 0x34]
mov dword [ebp + 8], edi
jle 0x43e7cf
dec ecx
mov dword [ebp - 0x10], ecx
cmp dword [esi + 4], 0
jle 0x43e7bc
lea edx, [esi + ebx*4 + 0x3c]
mov dword [ebp - 4], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
add ebx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x496198]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x496198]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x496198]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
xor edx, dword [ebx*4 + 0x496198]
mov ebx, dword [ebp - 4]
xor edx, dword [ebx]
add dword [ebp - 4], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 8]
jne 0x43e755
mov ebx, dword [ebp - 0x14]
dec dword [ebp - 0x10]
mov ecx, eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [ebp + 8], edi
jne 0x43e72e
cmp dword [esi + 4], 0
jle 0x43e853
lea edx, [esi + ebx*4 + 0x3c]
mov dword [ebp - 8], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
mov dword [ebp - 0x10], edx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
movzx ebx, byte [ebx + 0x496810]
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + 0x496810]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
movzx ebx, byte [ebx + 0x496810]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
movzx ebx, byte [ebx + 0x496810]
xor edx, ebx
mov ebx, dword [ebp - 8]
xor edx, dword [ebx]
add dword [ebp - 8], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 0x10]
jne 0x43e7ed
and dword [ebp - 4], 0
cmp dword [esi + 4], 0
jle 0x43e89a
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add edx, 2
sub eax, edi
mov ecx, dword [edi]
and dword [edi], 0
and dword [eax + edi], 0
mov ebx, ecx
shr ebx, 8
mov byte [edx - 1], bl
mov byte [edx - 2], cl
mov ebx, ecx
shr ecx, 0x18
shr ebx, 0x10
inc dword [ebp - 4]
mov byte [edx + 1], cl
mov ecx, dword [ebp - 4]
mov byte [edx], bl
add edi, 4
add edx, 4
cmp ecx, dword [esi + 4]
jl 0x43e868
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43e89f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 4]
push edi
test ebx, ebx
jle 0x43e8e2
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
lea edi, [esi + 0x21c]
mov ecx, dword [ebp + 8]
call fcn.0043e122
xor eax, dword [edi]
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
add dword [ebp + 8], 4
add edi, 4
cmp dword [ebp - 4], ebx
mov dword [ebp + ecx*4 - 0x34], eax
jl 0x43e8c2
mov ecx, dword [esi + 8]
cmp ecx, 1
lea edi, [ebp - 0x54]
lea eax, [ebp - 0x34]
mov dword [ebp + 8], edi
jle 0x43e99f
dec ecx
mov dword [ebp - 0x10], ecx
cmp dword [esi + 4], 0
jle 0x43e98c
lea edx, [esi + ebx*4 + 0x21c]
mov dword [ebp - 4], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0x24]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
add ebx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x496910]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x496910]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x496910]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
xor edx, dword [ebx*4 + 0x496910]
mov ebx, dword [ebp - 4]
xor edx, dword [ebx]
add dword [ebp - 4], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 8]
jne 0x43e925
mov ebx, dword [ebp - 0x14]
dec dword [ebp - 0x10]
mov ecx, eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [ebp + 8], edi
jne 0x43e8fb
cmp dword [esi + 4], 0
jle 0x43ea2a
lea edx, [esi + ebx*4 + 0x21c]
mov dword [ebp - 8], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0x24]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
mov dword [ebp - 0x10], edx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
movzx ebx, byte [ebx + 0x496710]
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + 0x496710]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
movzx ebx, byte [ebx + 0x496710]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
movzx ebx, byte [ebx + 0x496710]
xor edx, ebx
mov ebx, dword [ebp - 8]
xor edx, dword [ebx]
add dword [ebp - 8], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 0x10]
jne 0x43e9c4
and dword [ebp - 4], 0
cmp dword [esi + 4], 0
jle 0x43ea71
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add edx, 2
sub eax, edi
mov ecx, dword [edi]
and dword [edi], 0
and dword [eax + edi], 0
mov ebx, ecx
shr ebx, 8
mov byte [edx - 1], bl
mov byte [edx - 2], cl
mov ebx, ecx
shr ecx, 0x18
shr ebx, 0x10
inc dword [ebp - 4]
mov byte [edx + 1], cl
mov ecx, dword [ebp - 4]
mov byte [edx], bl
add edi, 4
add edx, 4
cmp ecx, dword [esi + 4]
jl 0x43ea3f
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43edda
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
push 0x800
add eax, 0x880
push 0
push eax
call fcn.00458bb0
add esp, 0xc
and dword [ebp - 4], 0
mov edi, 0x110
xor ecx, ecx
xor esi, esi
movsx eax, byte [esi + 0x4913b8]
dec eax
mov edx, eax
sar edx, 2
cmp edx, dword [ebp - 4]
jne 0x43ee3f
and eax, 3
test dword [eax*4 + 0x4916f0], ecx
je 0x43ee3f
mov edx, esi
sar edx, 3
add edx, dword [ebp + 8]
lea eax, [edi + ecx]
lea eax, [edx + eax*8]
mov edx, esi
and edx, 7
mov dl, byte [edx*4 + 0x4916d0]
or byte [eax], dl
inc esi
cmp esi, 0x40
jl 0x43ee05
inc ecx
cmp ecx, 0x10
jl 0x43ee03
inc dword [ebp - 4]
add edi, 0x10
cmp edi, 0x210
jl 0x43ee01
pop edi
pop esi
leave
ret

Function at 0x43ee5d
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
push 0x800
add eax, 0x1080
push 0
push eax
call fcn.00458bb0
add esp, 0xc
and dword [ebp - 4], 0
mov edi, 0x210
xor ecx, ecx
xor esi, esi
movsx eax, byte [esi + 0x4913f8]
dec eax
mov edx, eax
sar edx, 2
cmp edx, dword [ebp - 4]
jne 0x43eec2
and eax, 3
test dword [eax*4 + 0x4916f0], ecx
je 0x43eec2
mov edx, esi
sar edx, 3
add edx, dword [ebp + 8]
lea eax, [edi + ecx]
lea eax, [edx + eax*8]
mov edx, esi
and edx, 7
mov dl, byte [edx*4 + 0x4916d0]
or byte [eax], dl
inc esi
cmp esi, 0x40
jl 0x43ee88
inc ecx
cmp ecx, 0x10
jl 0x43ee86
inc dword [ebp - 4]
add edi, 0x10
cmp edi, 0x310
jl 0x43ee84
pop edi
pop esi
leave
ret

Function at 0x43eee0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x492fb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ecx, ecx
push edi
xor eax, eax
movsx esi, byte [eax + 0x4916b0]
dec esi
cmp esi, ecx
je 0x43ef0b
inc eax
cmp eax, 0x20
jl 0x43eef7
jmp 0x43ef0f
mov byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0x20
jl 0x43eef5
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], eax
xor edi, edi
lea eax, [edx + 0x80]
xor edx, edx
mov dword [ebp - 0x28], eax
mov eax, edx
sar eax, 1
mov ecx, edx
and ecx, 1
shl ecx, 4
and eax, 0xf
or eax, ecx
mov ecx, edx
xor esi, esi
and ecx, 0x20
or eax, ecx
movsx eax, byte [edi + eax + 0x4914b0]
mov dword [ebp - 0x2c], esi
push 8
pop ebx
mov ecx, esi
sar ebx, cl
test eax, ebx
je 0x43ef6c
mov ecx, dword [ebp - 0x30]
movsx ebx, byte [ecx + esi]
push 0x1f
pop ecx
sub ecx, ebx
xor ebx, ebx
inc ebx
shl ebx, cl
or dword [ebp - 0x2c], ebx
inc esi
cmp esi, 4
jl 0x43ef4d
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x28], 4
inc edx
cmp edx, 0x40
mov dword [ecx], eax
jl 0x43ef28
add dword [ebp - 0x30], 4
mov eax, dword [ebp - 0x28]
add edi, 0x40
cmp edi, 0x200
jl 0x43ef23
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00458424
leave
ret
Function at 0x43efc1
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x492fb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x1880
xor edi, edi
push edi
push ebx
call fcn.00458bb0
mov edx, ebx
call fcn.0043eee0
push ebx
call fcn.0043edda
push ebx
call fcn.0043ee5d
add esp, 0x14
xor ecx, ecx
movsx eax, byte [ecx + str.91__]
mov esi, dword [ebp + 0xc]
dec eax
mov edx, eax
sar edx, 3
movsx edx, byte [edx + esi]
and eax, 7
test dword [eax*4 + 0x4916d0], edx
setne al
mov byte [ebp + ecx - 0x3c], al
inc ecx
cmp ecx, 0x38
jl 0x43effd
movsx eax, byte [edi + 0x491470]
xor ecx, ecx
xor edx, edx
cmp ecx, 0x1c
setge dl
mov esi, eax
dec edx
and edx, 0xffffffe4
add edx, 0x38
cmp eax, edx
jl 0x43f049
lea esi, [eax - 0x1c]
mov dl, byte [ebp + esi - 0x3c]
mov byte [ebp + ecx - 0x74], dl
inc ecx
inc eax
cmp ecx, 0x38
jl 0x43f031
xor ecx, ecx
movsx eax, byte [ecx + 0x491480]
cmp byte [ebp + eax - 0x75], 0
je 0x43f081
mov eax, ecx
cdq
push 6
pop esi
idiv esi
mov edx, dword [edx*4 + 0x4916d0]
lea eax, [eax + edi*8]
add eax, ebx
sar edx, 2
or byte [eax], dl
inc ecx
cmp ecx, 0x30
jl 0x43f05a
inc edi
cmp edi, 0x10
jl 0x43f028
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00458424
leave
ret

Function at 0x43f50c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x1000]
mov dword [ebp + 0xc], edx
push edi
mov dword [ebp + 8], 0x10
mov edx, 0xff
mov edi, dword [ebp + 0xc]
xor ecx, dword [edi]
add dword [ebp + 0xc], 4
mov edi, ecx
shr edi, 0x10
and edi, edx
mov edi, dword [eax + edi*4 + 0x400]
mov ebx, ecx
shr ebx, 0x18
add edi, dword [eax + ebx*4]
mov ebx, ecx
shr ebx, 8
and ebx, edx
xor edi, dword [eax + ebx*4 + 0x800]
mov dword [ebp - 8], ecx
and ecx, edx
add edi, dword [eax + ecx*4 + 0xc00]
xor edi, dword [ebp - 4]
dec dword [ebp + 8]
mov ecx, edi
mov edi, dword [ebp - 8]
mov dword [ebp - 4], edi
jne 0x43f537
mov edx, dword [eax + 0x1040]
mov eax, dword [eax + 0x1044]
xor edx, ecx
xor eax, edi
pop edi
mov dword [esi], eax
mov dword [esi + 4], edx
pop esi
pop ebx
leave
ret
Function at 0x43f59a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x1044]
mov dword [ebp + 0xc], edx
push edi
mov dword [ebp + 8], 0x10
mov edx, 0xff
mov edi, dword [ebp + 0xc]
xor ecx, dword [edi]
sub dword [ebp + 0xc], 4
mov edi, ecx
shr edi, 0x10
and edi, edx
mov edi, dword [eax + edi*4 + 0x400]
mov ebx, ecx
shr ebx, 0x18
add edi, dword [eax + ebx*4]
mov ebx, ecx
shr ebx, 8
and ebx, edx
xor edi, dword [eax + ebx*4 + 0x800]
mov dword [ebp - 8], ecx
and ecx, edx
add edi, dword [eax + ecx*4 + 0xc00]
xor edi, dword [ebp - 4]
dec dword [ebp + 8]
mov ecx, edi
mov edi, dword [ebp - 8]
mov dword [ebp - 4], edi
jne 0x43f5c5
mov edx, dword [eax + 0x1004]
mov eax, dword [eax + 0x1000]
xor edx, ecx
xor eax, edi
pop edi
mov dword [esi], eax
mov dword [esi + 4], edx
pop esi
pop ebx
leave
ret
Function at 0x44213c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x10], 0x20
je 0x44214d
or eax, 0xffffffff
leave
ret
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
lea esi, [ebp - 0x10]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [eax + 0xc]
mov esi, 0xfc
mov ecx, dword [edx - 0xc]
add ecx, dword [edx]
add edx, 4
mov edi, ecx
and edi, 7
shr ecx, 3
xor ecx, dword [edi*4 + 0x4777fc]
dec esi
mov dword [edx], ecx
jne 0x44217e
xor edx, edx
mov esi, dword [eax + edx*4 + 0x164]
lea ecx, [eax + edx*4]
add dword [ecx], esi
inc edx
cmp edx, 0x17
jb 0x44219c
mov edx, dword [eax + 0xec]
mov ecx, dword [eax + 0x84]
and edx, 0xff7fffff
or edx, 0x1000001
and dword [ebp + 0x10], 0
mov esi, 0x100
mov edi, dword [ebp + 0x10]
lea edi, [eax + edi*4]
mov ebx, dword [edi]
and ecx, 0xff7fffff
add ecx, edx
and ebx, 0xffffff
xor ebx, ecx
inc dword [ebp + 0x10]
mov dword [edi], ebx
cmp dword [ebp + 0x10], esi
jb 0x4421cf
mov edx, dword [eax]
mov dword [eax + 0x400], edx
mov edx, 0xff
and ecx, edx
and dword [ebp + 0x10], 0
mov edi, dword [ebp + 0x10]
mov ebx, ecx
xor ebx, edi
mov ebx, dword [eax + ebx*4]
xor ebx, ecx
and ebx, edx
mov ecx, ebx
mov ebx, dword [eax + ecx*4]
shl edi, 2
inc dword [ebp + 0x10]
mov dword [edi + eax], ebx
mov edi, dword [edi + eax + 4]
mov dword [eax + ecx*4], edi
cmp dword [ebp + 0x10], esi
jb 0x442204
mov ecx, dword [ebp - 0x10]
and dword [eax + 0x414], 0
mov dword [eax + 0x404], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x408], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 0x40c], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax + 0x410], ecx
xor eax, eax
pop ebx
leave
ret
Function at 0x4425f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 0x24
xor ebx, ebx
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.00458bb0
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shr eax, 2
add esp, 0xc
xor esi, esi
cmp eax, ebx
jbe 0x442635
mov edx, dword [ebp + 0xc]
lea edx, [edx + eax*4 - 4]
mov edi, dword [edx]
mov dword [ebp + esi*4 - 0x24], edi
inc esi
sub edx, 4
cmp esi, eax
jb 0x442627
mov eax, dword [ebp + 8]
mov dword [eax + 0x210], ecx
mov byte [ebp + ecx - 0x24], bl
xor edi, edi
cmp dword [eax + 0x210], ebx
jbe 0x442673
mov edx, eax
lea ecx, [ebp - 0x24]
sub edx, ecx
mov esi, dword [eax + 0x210]
lea ecx, [ebp + edi - 0x24]
mov bl, byte [ecx]
lea esi, [ebp + esi - 0x24]
xor byte [esi], bl
mov bl, byte [ecx]
inc edi
mov byte [edx + ecx], bl
cmp edi, dword [eax + 0x210]
jb 0x442653
xor esi, esi
cmp dword [eax + 0x210], esi
jbe 0x442720
mov dword [ebp + 0x10], 0x23
lea edi, [eax + 0x10]
mov edx, 0xff
xor ecx, ecx
rol byte [ebp + ecx - 0x24], 3
inc ecx
cmp ecx, dword [eax + 0x210]
jbe 0x442692
lea ecx, [esi + 1]
mov dword [ebp + 8], ecx
cmp esi, 0x10
jae 0x4426df
xor esi, esi
mov ebx, dword [ebp + 0x10]
add ebx, esi
and ebx, edx
movzx ebx, byte [ebx + 0x491700]
mov bl, byte [ebx + 0x491700]
add bl, byte [ebp + ecx - 0x24]
mov byte [edi + esi], bl
mov ebx, ecx
sub ebx, dword [eax + 0x210]
inc ecx
neg ebx
sbb ebx, ebx
and ecx, ebx
inc esi
cmp esi, 0x10
jb 0x4426ad
jmp 0x44270a
xor esi, esi
mov ebx, dword [ebp + 0x10]
add ebx, esi
and ebx, edx
mov bl, byte [ebx + 0x491700]
add bl, byte [ebp + ecx - 0x24]
mov byte [edi + esi], bl
mov ebx, ecx
sub ebx, dword [eax + 0x210]
inc ecx
neg ebx
sbb ebx, ebx
and ecx, ebx
inc esi
cmp esi, 0x10
jb 0x4426e1
mov esi, dword [ebp + 8]
add dword [ebp + 0x10], 0x11
add edi, 0x10
cmp esi, dword [eax + 0x210]
jb 0x442690
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x443373
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, 0x497218
push edi
mov ecx, eax
dec ecx
push 2
mov dword [ebp - 0xc], eax
sub dword [ebp - 0xc], ecx
mov byte [0x496d18], 0
mov byte [0x497218], 1
mov byte [0x496d19], 0
mov byte [0x497219], 3
mov byte [0x496d1b], 1
pop ebx
lea esi, [ecx + 2]
mov edi, 0x100
mov dl, byte [esi]
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
mov cl, dl
add cl, cl
xor cl, dl
xor cl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + esi], cl
movzx eax, cl
mov byte [eax + 0x496d18], bl
inc ebx
inc esi
cmp ebx, edi
jl 0x4433b8
xor edx, edx
mov byte [0x497490], 0x63
mov byte [0x4973f3], 0
inc edx
movzx eax, dl
movzx eax, byte [eax + 0x496d18]
mov ecx, 0x497317
sub ecx, eax
mov bl, byte [ecx]
mov cl, bl
rol cl, 1
xor bl, cl
rol cl, 1
xor bl, cl
rol cl, 1
mov al, cl
rol al, 1
xor al, bl
xor al, cl
xor al, 0x63
mov byte [edx + 0x497490], al
movzx eax, al
mov byte [eax + 0x497390], dl
inc edx
cmp edx, edi
jl 0x4433f2
mov dl, 1
mov ecx, 0x497318
movzx eax, dl
mov dword [ecx], eax
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
add dl, dl
add ecx, 4
xor dl, al
cmp ecx, 0x497390
jl 0x443436
xor esi, esi
mov al, byte [esi + 0x497490]
mov byte [ebp - 1], al
and byte [ebp - 1], 0x80
mov cl, al
mov byte [ebp - 6], al
sete dl
add cl, cl
dec dl
and dl, 0x1b
mov bl, cl
xor bl, dl
xor bl, al
cmp byte [ebp - 1], 0
mov byte [ebp - 7], al
sete al
dec al
and al, 0x1b
xor cl, al
mov byte [ebp - 8], cl
lea ecx, [ebp - 8]
mov byte [ebp - 5], bl
call fcn.0043e122
mov ebx, dword [0x491a00]
mov dword [esi*4 + 0x496e18], eax
mov al, byte [esi + 0x497390]
mov byte [ebp - 0xc], al
push dword [ebp - 0xc]
movzx eax, bl
push eax
call fcn.00443278
push dword [ebp - 0xc]
mov byte [ebp - 5], al
movzx eax, bh
push eax
call fcn.00443278
push dword [ebp - 0xc]
mov byte [ebp - 6], al
movzx eax, byte [0x491a02]
push eax
call fcn.00443278
push dword [ebp - 0xc]
mov byte [ebp - 7], al
movzx eax, byte [0x491a03]
push eax
call fcn.00443278
add esp, 0x20
lea ecx, [ebp - 8]
mov byte [ebp - 8], al
call fcn.0043e122
mov dword [esi*4 + 0x497590], eax
inc esi
cmp esi, edi
jl 0x443456
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4437e7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 4]
push edi
test ebx, ebx
jle 0x443827
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
lea edi, [esi + 0x3c]
mov ecx, dword [ebp + 8]
call fcn.0043e122
xor eax, dword [edi]
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
add dword [ebp + 8], 4
add edi, 4
cmp dword [ebp - 4], ebx
mov dword [ebp + ecx*4 - 0x34], eax
jl 0x443807
mov ecx, dword [esi + 8]
cmp ecx, 1
lea edi, [ebp - 0x54]
lea eax, [ebp - 0x34]
mov dword [ebp + 8], edi
jle 0x4438e1
dec ecx
mov dword [ebp - 0x10], ecx
cmp dword [esi + 4], 0
jle 0x4438ce
lea edx, [esi + ebx*4 + 0x3c]
mov dword [ebp - 4], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
add ebx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x496e18]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x496e18]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x496e18]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
xor edx, dword [ebx*4 + 0x496e18]
mov ebx, dword [ebp - 4]
xor edx, dword [ebx]
add dword [ebp - 4], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 8]
jne 0x443867
mov ebx, dword [ebp - 0x14]
dec dword [ebp - 0x10]
mov ecx, eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [ebp + 8], edi
jne 0x443840
cmp dword [esi + 4], 0
jle 0x443965
lea edx, [esi + ebx*4 + 0x3c]
mov dword [ebp - 8], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
mov dword [ebp - 0x10], edx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
movzx ebx, byte [ebx + 0x497490]
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + 0x497490]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
movzx ebx, byte [ebx + 0x497490]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
movzx ebx, byte [ebx + 0x497490]
xor edx, ebx
mov ebx, dword [ebp - 8]
xor edx, dword [ebx]
add dword [ebp - 8], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 0x10]
jne 0x4438ff
and dword [ebp - 4], 0
cmp dword [esi + 4], 0
jle 0x4439ac
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add edx, 2
sub eax, edi
mov ecx, dword [edi]
and dword [edi], 0
and dword [eax + edi], 0
mov ebx, ecx
shr ebx, 8
mov byte [edx - 1], bl
mov byte [edx - 2], cl
mov ebx, ecx
shr ecx, 0x18
shr ebx, 0x10
inc dword [ebp - 4]
mov byte [edx + 1], cl
mov ecx, dword [ebp - 4]
mov byte [edx], bl
add edi, 4
add edx, 4
cmp ecx, dword [esi + 4]
jl 0x44397a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4439b1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 4]
push edi
test ebx, ebx
jle 0x4439f4
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
lea edi, [esi + 0x21c]
mov ecx, dword [ebp + 8]
call fcn.0043e122
xor eax, dword [edi]
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
add dword [ebp + 8], 4
add edi, 4
cmp dword [ebp - 4], ebx
mov dword [ebp + ecx*4 - 0x34], eax
jl 0x4439d4
mov ecx, dword [esi + 8]
cmp ecx, 1
lea edi, [ebp - 0x54]
lea eax, [ebp - 0x34]
mov dword [ebp + 8], edi
jle 0x443ab1
dec ecx
mov dword [ebp - 0x10], ecx
cmp dword [esi + 4], 0
jle 0x443a9e
lea edx, [esi + ebx*4 + 0x21c]
mov dword [ebp - 4], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0x24]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
add ebx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x497590]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x497590]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x497590]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
xor edx, dword [ebx*4 + 0x497590]
mov ebx, dword [ebp - 4]
xor edx, dword [ebx]
add dword [ebp - 4], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 8]
jne 0x443a37
mov ebx, dword [ebp - 0x14]
dec dword [ebp - 0x10]
mov ecx, eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [ebp + 8], edi
jne 0x443a0d
cmp dword [esi + 4], 0
jle 0x443b3c
lea edx, [esi + ebx*4 + 0x21c]
mov dword [ebp - 8], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0x24]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
mov dword [ebp - 0x10], edx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
movzx ebx, byte [ebx + 0x497390]
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + 0x497390]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
movzx ebx, byte [ebx + 0x497390]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
movzx ebx, byte [ebx + 0x497390]
xor edx, ebx
mov ebx, dword [ebp - 8]
xor edx, dword [ebx]
add dword [ebp - 8], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 0x10]
jne 0x443ad6
and dword [ebp - 4], 0
cmp dword [esi + 4], 0
jle 0x443b83
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add edx, 2
sub eax, edi
mov ecx, dword [edi]
and dword [edi], 0
and dword [eax + edi], 0
mov ebx, ecx
shr ebx, 8
mov byte [edx - 1], bl
mov byte [edx - 2], cl
mov ebx, ecx
shr ecx, 0x18
shr ebx, 0x10
inc dword [ebp - 4]
mov byte [edx + 1], cl
mov ecx, dword [ebp - 4]
mov byte [edx], bl
add edi, 4
add edx, 4
cmp ecx, dword [esi + 4]
jl 0x443b51
pop edi
pop esi
pop ebx
leave
ret