joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435090
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebp
push esi
push edi
push 0x800
add eax, 0x1080
push 0
push eax
call fcn.00444550
add esp, 0xc
mov dword [esp + 0xc], 0
mov edi, 0x210
lea esp, [esp]
xor eax, eax
jmp 0x4350d0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov ebp, 2
mov esi, 1
lea ebx, [ebx]
movsx ecx, byte [esi + str._a__b0]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [esp + 0xc]
jne 0x435130
and ecx, 3
test dword [ecx*4 + 0x476700], eax
je 0x435130
mov edx, dword [esp + 0x14]
sar edx, 3
add edx, dword [esp + 0x1c]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, dword [esp + 0x14]
and edx, 7
mov dl, byte [edx*4 + 0x4766e0]
or byte [ecx], dl
movsx ecx, byte [esi + 0x476408]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [esp + 0xc]
jne 0x43516c
and ecx, 3
test dword [ecx*4 + 0x476700], eax
je 0x43516c
mov edx, esi
sar edx, 3
add edx, dword [esp + 0x1c]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, esi
and edx, 7
mov dl, byte [edx*4 + 0x4766e0]
or byte [ecx], dl
movsx ecx, byte [ebp + 0x476408]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [esp + 0xc]
jne 0x4351a8
and ecx, 3
test dword [ecx*4 + 0x476700], eax
je 0x4351a8
mov edx, ebp
sar edx, 3
add edx, dword [esp + 0x1c]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, ebp
and edx, 7
mov dl, byte [edx*4 + 0x4766e0]
or byte [ecx], dl
mov ecx, dword [esp + 0x10]
movsx ecx, byte [ecx + 0x476408]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [esp + 0xc]
jne 0x4351ec
and ecx, 3
test dword [ecx*4 + 0x476700], eax
je 0x4351ec
mov edx, dword [esp + 0x10]
sar edx, 3
add edx, dword [esp + 0x1c]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, dword [esp + 0x10]
and edx, 7
mov dl, byte [edx*4 + 0x4766e0]
or byte [ecx], dl
mov ecx, 4
add dword [esp + 0x14], ecx
add dword [esp + 0x10], ecx
add esi, ecx
add ebp, ecx
cmp esi, 0x41
jl 0x4350f0
inc eax
cmp eax, 0x10
jl 0x4350d0
inc dword [esp + 0xc]
add edi, 0x10
cmp edi, 0x310
jl 0x4350c0
pop edi
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x435230
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0x28
mov eax, dword [0x477af4]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
xor ecx, ecx
push edi
xor eax, eax
movsx esi, byte [eax + 0x4766c0]
dec esi
cmp esi, ecx
je 0x43525a
inc eax
cmp eax, 0x20
jl 0x435246
jmp 0x43525e
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 0x20
jl 0x435244
lea edi, [esp + 0x15]
mov ebx, 0x4764c0
lea eax, [edx + 0x80]
Function at 0x435c10
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
lea esi, [ecx + 0x1000]
mov dword [esp + 0x14], 0x10
nop
xor eax, dword [esi]
add esi, 4
mov ebx, eax
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ecx + ebx*4 + 0x400]
mov ebp, eax
shr ebp, 0x18
add ebx, dword [ecx + ebp*4]
mov ebp, eax
shr ebp, 8
and ebp, 0xff
xor ebx, dword [ecx + ebp*4 + 0x800]
mov edi, eax
and eax, 0xff
add ebx, dword [ecx + eax*4 + 0xc00]
xor ebx, edx
sub dword [esp + 0x14], 1
mov eax, ebx
mov edx, edi
jne 0x435c30
mov esi, dword [ecx + 0x1040]
mov ecx, dword [ecx + 0x1044]
xor esi, eax
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax + 4], esi
pop esi
xor ecx, edx
pop ebp
mov dword [eax], ecx
pop ebx
ret

Function at 0x435ca0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov eax, dword [edx]
mov edx, dword [edx + 4]
push ebx
push ebp
push esi
push edi
lea esi, [ecx + 0x1000]
mov dword [esp + 0x10], 0x10
lea esp, [esp]
xor eax, dword [esi]
add esi, 4
mov ebx, eax
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ecx + ebx*4 + 0x400]
mov ebp, eax
shr ebp, 0x18
add ebx, dword [ecx + ebp*4]
mov ebp, eax
shr ebp, 8
and ebp, 0xff
xor ebx, dword [ecx + ebp*4 + 0x800]
mov edi, eax
and eax, 0xff
add ebx, dword [ecx + eax*4 + 0xc00]
xor ebx, edx
sub dword [esp + 0x10], 1
mov eax, ebx
mov edx, edi
jne 0x435cc0
mov esi, dword [ecx + 0x1040]
mov ecx, dword [ecx + 0x1044]
xor esi, eax
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax + 4], esi
pop esi
xor ecx, edx
pop ebp
mov dword [eax], ecx
pop ebx
pop ecx
ret

Function at 0x435d30
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
lea esi, [ecx + 0x1044]
mov dword [esp + 0x14], 0x10
nop
xor eax, dword [esi]
sub esi, 4
mov ebx, eax
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ecx + ebx*4 + 0x400]
mov ebp, eax
shr ebp, 0x18
add ebx, dword [ecx + ebp*4]
mov ebp, eax
shr ebp, 8
and ebp, 0xff
xor ebx, dword [ecx + ebp*4 + 0x800]
mov edi, eax
and eax, 0xff
add ebx, dword [ecx + eax*4 + 0xc00]
xor ebx, edx
sub dword [esp + 0x14], 1
mov eax, ebx
mov edx, edi
jne 0x435d50
mov esi, dword [ecx + 0x1004]
mov ecx, dword [ecx + 0x1000]
xor esi, eax
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax + 4], esi
pop esi
xor ecx, edx
pop ebp
mov dword [eax], ecx
pop ebx
ret
Function at 0x438d70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x1c], 0x20
je 0x438d81
or eax, 0xffffffff
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [eax + 0xc]
push ebp
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax + 8]
lea eax, [ecx + 4]
lea ebp, [ecx + 8]
mov dword [esp + 0x1c], ebx
mov dword [ecx + 0xc], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [ecx], edx
mov dword [eax], esi
mov dword [ebp], edi
mov ebx, 0x2a
lea ecx, [ecx]
mov edi, dword [eax + 8]
mov edx, dword [eax - 4]
add edx, edi
mov esi, edx
and esi, 7
mov esi, dword [esi*4 + 0x46025c]
shr edx, 3
xor esi, edx
mov edx, dword [eax]
add edx, esi
mov dword [eax + 0xc], esi
mov esi, edx
and esi, 7
mov esi, dword [esi*4 + 0x46025c]
shr edx, 3
xor esi, edx
mov edx, dword [eax + 4]
add edx, esi
mov dword [eax + 0x10], esi
mov esi, edx
and esi, 7
mov esi, dword [esi*4 + 0x46025c]
shr edx, 3
xor esi, edx
mov dword [eax + 0x14], esi
lea edx, [esi + edi]
mov esi, edx
and esi, 7
mov esi, dword [esi*4 + 0x46025c]
shr edx, 3
xor esi, edx
mov edx, dword [eax + 0xc]
add edx, esi
mov dword [eax + 0x18], esi
mov esi, edx
and esi, 7
mov esi, dword [esi*4 + 0x46025c]
shr edx, 3
xor esi, edx
mov edx, dword [eax + 0x10]
add edx, esi
mov dword [eax + 0x1c], esi
mov esi, edx
and esi, 7
shr edx, 3
xor edx, dword [esi*4 + 0x46025c]
add eax, 0x18
sub ebx, 1
mov dword [eax + 8], edx
jne 0x438dc0
xor eax, eax
mov edx, dword [ecx + eax*4 + 0x164]
add dword [ecx + eax*4], edx
inc eax
cmp eax, 0x17
jb 0x438e62
mov edx, dword [ecx + 0xec]
mov esi, dword [ecx + 0x84]
and edx, 0xff7fffff
or edx, 0x1000001
xor eax, eax
lea esp, [esp]
mov edi, dword [ecx + eax*4]
and esi, 0xff7fffff
add esi, edx
and edi, 0xffffff
xor edi, esi
mov dword [ecx + eax*4], edi
inc eax
cmp eax, 0x100
jb 0x438e90
mov eax, dword [ecx]
mov edi, 2
mov dword [ecx + 0x400], eax
and esi, 0xff
mov eax, ebp
lea ebx, [edi + 0x3e]
lea edx, [edi - 2]
xor edx, esi
mov edx, dword [ecx + edx*4]
xor edx, esi
and edx, 0xff
mov esi, dword [ecx + edx*4]
mov dword [eax - 8], esi
mov esi, dword [eax - 4]
mov dword [ecx + edx*4], esi
lea esi, [edi - 1]
xor esi, edx
mov esi, dword [ecx + esi*4]
xor esi, edx
and esi, 0xff
mov edx, dword [ecx + esi*4]
mov dword [eax - 4], edx
mov edx, dword [eax]
mov dword [ecx + esi*4], edx
mov edx, edi
xor edx, esi
mov edx, dword [ecx + edx*4]
xor edx, esi
and edx, 0xff
mov esi, dword [ecx + edx*4]
mov dword [eax], esi
mov esi, dword [eax + 4]
mov dword [ecx + edx*4], esi
lea esi, [edi + 1]
xor esi, edx
mov esi, dword [ecx + esi*4]
xor esi, edx
and esi, 0xff
mov edx, dword [ecx + esi*4]
mov dword [eax + 4], edx
mov edx, dword [eax + 8]
add eax, 0x10
add edi, 4
sub ebx, 1
mov dword [ecx + esi*4], edx
jne 0x438ec6
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop edi
mov dword [ecx + 0x404], eax
mov eax, dword [esp + 0x14]
pop esi
mov dword [ecx + 0x408], edx
mov edx, dword [esp + 0x14]
pop ebp
mov dword [ecx + 0x414], ebx
mov dword [ecx + 0x40c], eax
mov dword [ecx + 0x410], edx
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x43a480
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
push edi
mov eax, 0x47bc78
dec eax
mov edi, 0x47bc78
mov byte [0x47b778], 0
mov byte [0x47bc78], 1
mov byte [0x47b779], 0
mov byte [0x47bc79], 3
mov byte [0x47b77b], 1
mov edx, 2
lea esi, [eax + 2]
sub edi, eax
lea esp, [esp]
mov bl, byte [esi]
mov al, bl
call fcn.0043fda0
xor al, bl
mov byte [edi + esi], al
movzx eax, al
mov byte [eax + 0x47b778], dl
inc edx
inc esi
cmp edx, 0x100
jl 0x43a4c0
mov byte [0x47bef0], 0x63
mov byte [0x47be53], 0
mov ebx, 1
mov al, bl
call fcn.0043a450
movzx ecx, al
mov byte [ebx + 0x47bef0], al
mov byte [ecx + 0x47bdf0], bl
inc ebx
cmp ebx, 0x100
jl 0x43a4f4
mov al, 1
mov edx, 0x47bd78
lea ebx, [ebx]
movzx ecx, al
mov dword [edx], ecx
call fcn.0043fda0
add edx, 4
cmp edx, 0x47bdf0
jl 0x43a520
xor esi, esi
jmp 0x43a540
mov dl, byte [esi + 0x47bef0]
mov al, dl
call fcn.0043fda0
mov cl, al
xor cl, dl
mov byte [esp + 0xf], cl
lea ecx, [esp + 0xc]
mov byte [esp + 0xe], dl
mov byte [esp + 0xd], dl
mov byte [esp + 0xc], al
call fcn.00434080
mov bl, byte [esi + 0x47bdf0]
mov dword [esi*4 + 0x47b878], eax
mov al, byte [0x476a10]
mov cl, bl
call fcn.0043a2f0
mov byte [esp + 0xf], al
mov al, byte [0x476a11]
mov cl, bl
call fcn.0043a2f0
mov byte [esp + 0xe], al
mov al, byte [0x476a12]
mov cl, bl
call fcn.0043a2f0
mov byte [esp + 0xd], al
mov al, byte [0x476a13]
mov cl, bl
call fcn.0043a2f0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.00434080
mov dword [esi*4 + 0x47bff0], eax
inc esi
cmp esi, 0x100
jl 0x43a540
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x43a8d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x68]
mov ebx, dword [edi + 4]
xor esi, esi
mov dword [esp + 0x20], ebx
test ebx, ebx
jle 0x43a910
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
lea ebp, [edi + 0x3c]
mov ecx, dword [esp + 0x10]
call fcn.00434080
xor eax, dword [ebp]
add dword [esp + 0x10], 4
mov dword [esp + esi*4 + 0x24], eax
inc esi
add ebp, 4
cmp esi, ebx
jl 0x43a8f3
mov ecx, dword [edi + 8]
cmp ecx, 1
lea esi, [esp + 0x44]
mov edx, ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x14], esi
jle 0x43a9d6
dec ecx
mov dword [esp + 0x18], ecx
nop
test ebx, ebx
jle 0x43a9c1
mov ebp, eax
lea ecx, [edi + 0xc]
lea edi, [edi + edx*4 + 0x3c]
sub ebp, esi
add edx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edx
lea ecx, [ecx]
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x47b878]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x47b878]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x47b878]
ror ebx, 8
xor edx, ebx
movzx ebx, byte [esi + ebp]
xor edx, dword [ebx*4 + 0x47b878]
add edi, 4
xor edx, dword [edi - 4]
add esi, 4
mov dword [esi - 4], edx
add ecx, 3
sub dword [esp + 0x10], 1
jne 0x43a950
mov edi, dword [esp + 0x68]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
sub dword [esp + 0x18], 1
mov ecx, eax
mov eax, esi
mov esi, ecx
mov dword [esp + 0x14], esi
jne 0x43a930
test ebx, ebx
jle 0x43aa69
lea edx, [edi + edx*4 + 0x3c]
mov dword [esp + 0x18], edx
mov edx, eax
sub edx, esi
lea ecx, [edi + 0xc]
mov ebp, esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
shr edx, 8
movzx edx, dl
movzx edi, byte [edx + 0x47bef0]
movzx edx, byte [ecx + 1]
movzx edx, byte [eax + edx*4 + 2]
movzx edx, byte [edx + 0x47bef0]
rol edi, 8
rol edx, 0x10
xor edi, edx
movzx edx, byte [ecx + 2]
movzx edx, byte [eax + edx*4 + 3]
movzx edx, byte [edx + 0x47bef0]
ror edx, 8
xor edi, edx
mov edx, dword [esp + 0x20]
movzx edx, byte [edx + ebp]
movzx edx, byte [edx + 0x47bef0]
xor edi, edx
mov edx, dword [esp + 0x18]
xor edi, dword [edx]
add edx, 4
mov dword [ebp], edi
add ebp, 4
add ecx, 3
sub dword [esp + 0x14], 1
mov dword [esp + 0x18], edx
jne 0x43a9f7
mov edi, dword [esp + 0x68]
xor ebp, ebp
test ebx, ebx
jle 0x43aa97
mov ecx, dword [esp + 0x6c]
mov ebx, eax
sub ebx, esi
mov eax, dword [esi]
call fcn.0043fd80
mov dword [esi], 0
mov dword [ebx + esi], 0
inc ebp
add esi, 4
add ecx, 4
cmp ebp, dword [edi + 4]
jl 0x43aa77
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
Function at 0x43aaa0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x68]
mov ebx, dword [edi + 4]
xor esi, esi
mov dword [esp + 0x20], ebx
test ebx, ebx
jle 0x43aae3
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
lea ebp, [edi + 0x21c]
mov ecx, dword [esp + 0x10]
call fcn.00434080
xor eax, dword [ebp]
add dword [esp + 0x10], 4
mov dword [esp + esi*4 + 0x24], eax
inc esi
add ebp, 4
cmp esi, ebx
jl 0x43aac6
mov ecx, dword [edi + 8]
cmp ecx, 1
lea esi, [esp + 0x44]
mov edx, ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x14], esi
jle 0x43aba8
dec ecx
mov dword [esp + 0x18], ecx
test ebx, ebx
jle 0x43ab93
mov ebp, eax
lea ecx, [edi + 0x24]
lea edi, [edi + edx*4 + 0x21c]
sub ebp, esi
add edx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x47bff0]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x47bff0]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x47bff0]
ror ebx, 8
xor edx, ebx
movzx ebx, byte [esi + ebp]
xor edx, dword [ebx*4 + 0x47bff0]
add edi, 4
xor edx, dword [edi - 4]
add esi, 4
mov dword [esi - 4], edx
add ecx, 3
sub dword [esp + 0x10], 1
jne 0x43ab22
mov edi, dword [esp + 0x68]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
sub dword [esp + 0x18], 1
mov ecx, eax
mov eax, esi
mov esi, ecx
mov dword [esp + 0x14], esi
jne 0x43ab02
test ebx, ebx
jle 0x43ac42
lea edx, [edi + edx*4 + 0x21c]
mov dword [esp + 0x18], edx
mov edx, eax
sub edx, esi
lea ecx, [edi + 0x24]
mov ebp, esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ebx
lea esp, [esp]
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
shr edx, 8
movzx edx, dl
movzx edi, byte [edx + 0x47bdf0]
movzx edx, byte [ecx + 1]
movzx edx, byte [eax + edx*4 + 2]
movzx edx, byte [edx + 0x47bdf0]
rol edi, 8
rol edx, 0x10
xor edi, edx
movzx edx, byte [ecx + 2]
movzx edx, byte [eax + edx*4 + 3]
movzx edx, byte [edx + 0x47bdf0]
ror edx, 8
xor edi, edx
mov edx, dword [esp + 0x20]
movzx edx, byte [edx + ebp]
movzx edx, byte [edx + 0x47bdf0]
xor edi, edx
mov edx, dword [esp + 0x18]
xor edi, dword [edx]
add edx, 4
mov dword [ebp], edi
add ebp, 4
add ecx, 3
sub dword [esp + 0x14], 1
mov dword [esp + 0x18], edx
jne 0x43abd0
mov edi, dword [esp + 0x68]
xor ebp, ebp
test ebx, ebx
jle 0x43ac70
mov ecx, dword [esp + 0x6c]
mov ebx, eax
sub ebx, esi
mov eax, dword [esi]
call fcn.0043fd80
mov dword [esi], 0
mov dword [ebx + esi], 0
inc ebp
add esi, 4
add ecx, 4
cmp ebp, dword [edi + 4]
jl 0x43ac50
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
Function at 0x43aed0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
push 0x2911
push 0xd
mov eax, esi
xor eax, 0x1fff
push eax
push 0x2911
push 0xd
push eax
push eax
call fcn.0043ae90
add esp, 0x10
push eax
call fcn.0043ae90
mov byte [esi + 0x47f340], al
inc esi
add esp, 0x10
cmp esi, 0x2000
jb 0x43aed3
xor esi, esi
lea ecx, [ecx]
push 0xaa7
push 0xb
mov eax, esi
xor eax, 0x7ff
push eax
push 0xaa7
push 0xb
push eax
push eax
call fcn.0043ae90
add esp, 0x10
push eax
call fcn.0043ae90
mov byte [esi + 0x47eb40], al
inc esi
add esp, 0x10
cmp esi, 0x800
jb 0x43af10
xor eax, eax
pop esi
jmp 0x43af50
mov ecx, eax
and ecx, 0xfffffff8
shl ecx, 7
mov edx, eax
and edx, 4
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 2
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 1
or ecx, edx
shl ecx, 7
mov dword [eax*8 + 0x47e340], ecx
mov ecx, eax
and ecx, 0xffffff80
shl ecx, 7
mov edx, eax
and edx, 0x40
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 0x20
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 0x10
or ecx, edx
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov dword [eax*8 + 0x47e344], ecx
inc eax
cmp eax, 0x100
jb 0x43af50
ret
Function at 0x43afd0
Capabilities:
Decompress data using quicklz

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [edx]
push ebx
mov ebx, eax
push ebp
mov ebp, dword [esp + 0x14]
mov ecx, dword [ebp]
and eax, ecx
push esi
mov esi, dword [edx + 4]
push edi
mov edi, ecx
not edi
and ebx, edi
mov edx, esi
and esi, edi
or esi, eax
and edx, ecx
or edx, ebx
mov eax, esi
mov edi, esi
shr edi, 0x10
and edi, 0x7ff
movzx edi, byte [edi + 0x47eb40]
mov ebx, dword [edi*8 + 0x47e340]
mov edi, dword [edi*8 + 0x47e344]
shr eax, 0x18
shr edi, 6
mov ecx, edx
shl ecx, 8
or eax, ecx
and eax, 0x1fff
movzx ecx, byte [eax + 0x47f340]
mov eax, dword [ecx*8 + 0x47e340]
mov ecx, dword [ecx*8 + 0x47e344]
shr ecx, 7
or ecx, edi
mov edi, esi
shr edi, 8
and edi, 0x1fff
movzx edi, byte [edi + 0x47f340]
shr eax, 7
shr ebx, 6
or eax, ebx
mov ebx, dword [edi*8 + 0x47e340]
mov edi, dword [edi*8 + 0x47e344]
shr edi, 5
or ecx, edi
mov edi, esi
and edi, 0x7ff
movzx edi, byte [edi + 0x47eb40]
shr ebx, 5
or eax, ebx
mov ebx, dword [edi*8 + 0x47e340]
mov edi, dword [edi*8 + 0x47e344]
shr edi, 4
or ecx, edi
shl esi, 8
mov edi, edx
shr edi, 0x18
or edi, esi
and edi, 0x7ff
movzx esi, byte [edi + 0x47eb40]
mov edi, dword [esi*8 + 0x47e340]
mov esi, dword [esi*8 + 0x47e344]
shr esi, 3
or ecx, esi
mov esi, edx
shr esi, 0x10
and esi, 0x1fff
movzx esi, byte [esi + 0x47f340]
shr ebx, 4
shr edi, 3
or eax, ebx
or eax, edi
mov edi, dword [esi*8 + 0x47e340]
mov esi, dword [esi*8 + 0x47e344]
shr edi, 2
shr esi, 2
or eax, edi
or ecx, esi
mov esi, edx
shr esi, 8
and edx, 0x1fff
movzx edx, byte [edx + 0x47f340]
and esi, 0x7ff
movzx esi, byte [esi + 0x47eb40]
mov edi, dword [esi*8 + 0x47e340]
mov esi, dword [esi*8 + 0x47e344]
shr edi, 1
or eax, edi
or eax, dword [edx*8 + 0x47e340]
shr esi, 1
or ecx, esi
or ecx, dword [edx*8 + 0x47e344]
mov esi, dword [ebp + 4]
mov edi, esi
shr edi, 5
and edi, 0x700
mov edx, eax
shr edx, 0x18
or edx, edi
movzx edx, byte [edx + 0x47eb40]
mov ebx, eax
shr ebx, 0x10
movzx edi, bl
mov ebx, esi
shr ebx, 2
and ebx, 0x700
or edi, ebx
movzx edi, byte [edi + 0x47eb40]
shl edx, 8
or edx, edi
mov ebx, eax
shr ebx, 8
movzx edi, bl
mov ebx, esi
and ebx, 0x3e0
add ebx, ebx
add ebx, ebx
add ebx, ebx
or edi, ebx
movzx edi, byte [edi + 0x47f340]
shl edx, 8
or edx, edi
and esi, 0x1f
movzx eax, al
shl edx, 8
shl esi, 8
or esi, eax
movzx eax, byte [esi + 0x47f340]
mov esi, dword [esp + 0x14]
or edx, eax
xor dword [esi], edx
mov eax, dword [ebp + 4]
mov edi, eax
shr edi, 0x15
and edi, 0x700
mov edx, ecx
shr edx, 0x18
or edx, edi
movzx edx, byte [edx + 0x47eb40]
mov ebx, ecx
shr ebx, 0x10
movzx edi, bl
mov ebx, eax
shr ebx, 0x12
and ebx, 0x700
or edi, ebx
movzx edi, byte [edi + 0x47eb40]
shl edx, 8
or edx, edi
mov ebx, ecx
shr ebx, 8
movzx edi, bl
mov ebx, eax
shr ebx, 0xd
and ebx, 0x1f00
or edi, ebx
movzx edi, byte [edi + 0x47f340]
shl edx, 8
or edx, edi
shr eax, 8
movzx ecx, cl
and eax, 0x1f00
or eax, ecx
movzx eax, byte [eax + 0x47f340]
shl edx, 8
pop edi
or edx, eax
xor dword [esi + 4], edx
pop esi
pop ebp
pop ebx
ret
Function at 0x43ff60
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
push edi
mov eax, 0x47c8f8
dec eax
mov edi, 0x47c8f8
mov byte [0x47c3f8], 0
mov byte [0x47c8f8], 1
mov byte [0x47c3f9], 0
mov byte [0x47c8f9], 3
mov byte [0x47c3fb], 1
mov edx, 2
lea esi, [eax + 2]
sub edi, eax
lea esp, [esp]
mov bl, byte [esi]
mov al, bl
call fcn.0043fda0
xor al, bl
mov byte [edi + esi], al
movzx eax, al
mov byte [eax + 0x47c3f8], dl
inc edx
inc esi
cmp edx, 0x100
jl 0x43ffa0
mov byte [0x47cb70], 0x63
mov byte [0x47cad3], 0
mov ebx, 1
mov al, bl
call fcn.0043ff20
movzx ecx, al
mov byte [ebx + 0x47cb70], al
mov byte [ecx + 0x47ca70], bl
inc ebx
cmp ebx, 0x100
jl 0x43ffd4
mov al, 1
mov edx, 0x47c9f8
lea ebx, [ebx]
movzx ecx, al
mov dword [edx], ecx
call fcn.0043fda0
add edx, 4
cmp edx, 0x47ca70
jl 0x440000
xor esi, esi
jmp 0x440020
mov dl, byte [esi + 0x47cb70]
mov al, dl
call fcn.0043fda0
mov cl, al
xor cl, dl
mov byte [esp + 0xf], cl
lea ecx, [esp + 0xc]
mov byte [esp + 0xe], dl
mov byte [esp + 0xd], dl
mov byte [esp + 0xc], al
call fcn.00434080
mov bl, byte [esi + 0x47ca70]
mov dword [esi*4 + 0x47c4f8], eax
mov al, byte [0x477ac8]
mov cl, bl
call fcn.0043fdc0
mov byte [esp + 0xf], al
mov al, byte [0x477ac9]
mov cl, bl
call fcn.0043fdc0
mov byte [esp + 0xe], al
mov al, byte [0x477aca]
mov cl, bl
call fcn.0043fdc0
mov byte [esp + 0xd], al
mov al, byte [0x477acb]
mov cl, bl
call fcn.0043fdc0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.00434080
mov dword [esi*4 + 0x47cc70], eax
inc esi
cmp esi, 0x100
jl 0x440020
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x440390
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x68]
mov ebx, dword [edi + 4]
xor esi, esi
mov dword [esp + 0x20], ebx
test ebx, ebx
jle 0x4403d0
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
lea ebp, [edi + 0x3c]
mov ecx, dword [esp + 0x10]
call fcn.00434080
xor eax, dword [ebp]
add dword [esp + 0x10], 4
mov dword [esp + esi*4 + 0x24], eax
inc esi
add ebp, 4
cmp esi, ebx
jl 0x4403b3
mov ecx, dword [edi + 8]
cmp ecx, 1
lea esi, [esp + 0x44]
mov edx, ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x14], esi
jle 0x440496
dec ecx
mov dword [esp + 0x18], ecx
nop
test ebx, ebx
jle 0x440481
mov ebp, eax
lea ecx, [edi + 0xc]
lea edi, [edi + edx*4 + 0x3c]
sub ebp, esi
add edx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edx
lea ecx, [ecx]
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x47c4f8]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x47c4f8]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x47c4f8]
ror ebx, 8
xor edx, ebx
movzx ebx, byte [esi + ebp]
xor edx, dword [ebx*4 + 0x47c4f8]
add edi, 4
xor edx, dword [edi - 4]
add esi, 4
mov dword [esi - 4], edx
add ecx, 3
sub dword [esp + 0x10], 1
jne 0x440410
mov edi, dword [esp + 0x68]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
sub dword [esp + 0x18], 1
mov ecx, eax
mov eax, esi
mov esi, ecx
mov dword [esp + 0x14], esi
jne 0x4403f0
test ebx, ebx
jle 0x440529
lea edx, [edi + edx*4 + 0x3c]
mov dword [esp + 0x18], edx
mov edx, eax
sub edx, esi
lea ecx, [edi + 0xc]
mov ebp, esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
shr edx, 8
movzx edx, dl
movzx edi, byte [edx + 0x47cb70]
movzx edx, byte [ecx + 1]
movzx edx, byte [eax + edx*4 + 2]
movzx edx, byte [edx + 0x47cb70]
rol edi, 8
rol edx, 0x10
xor edi, edx
movzx edx, byte [ecx + 2]
movzx edx, byte [eax + edx*4 + 3]
movzx edx, byte [edx + 0x47cb70]
ror edx, 8
xor edi, edx
mov edx, dword [esp + 0x20]
movzx edx, byte [edx + ebp]
movzx edx, byte [edx + 0x47cb70]
xor edi, edx
mov edx, dword [esp + 0x18]
xor edi, dword [edx]
add edx, 4
mov dword [ebp], edi
add ebp, 4
add ecx, 3
sub dword [esp + 0x14], 1
mov dword [esp + 0x18], edx
jne 0x4404b7
mov edi, dword [esp + 0x68]
xor ebp, ebp
test ebx, ebx
jle 0x440557
mov ecx, dword [esp + 0x6c]
mov ebx, eax
sub ebx, esi
mov eax, dword [esi]
call fcn.0043fd80
mov dword [esi], 0
mov dword [ebx + esi], 0
inc ebp
add esi, 4
add ecx, 4
cmp ebp, dword [edi + 4]
jl 0x440537
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret