joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40effc
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc00
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.00404798
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.00404c58
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x400
jge 0x40f041
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.00404888
jmp 0x40f05a
mov edx, ebx
dec edx
mov eax, esi
call fcn.00404de4
push ebx
mov eax, dword [esi]
call fcn.00404c58
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
add esp, 0x400
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40f720
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
add esp, 0xffffffb8
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x40
push pe_nt_image_headers32
mov ebx, fcn.00402d90
push ebx
call sub.kernel32.dll_VirtualProtect
mov eax, ebx
cmp byte [eax], 0xe9
je 0x40f7a8
cmp word [eax], 0x25ff
jne 0x40f75b
mov byte [eax], 0xe9
mov eax, ebx
sub esi, eax
sub esi, 5
inc eax
mov dword [eax], esi
jmp 0x40f7a8
lea edx, [esp + 0x10]
mov eax, esi
mov ecx, 0x38
call fcn.00402d90
mov eax, esi
sub eax, ebx
add dword [esp + 0x1e], eax
add dword [esp + 0x24], eax
add dword [esp + 0x2f], eax
add dword [esp + 0x3e], eax
add dword [esp + 0x43], eax
lea eax, [esp + 0x10]
mov dword [esp], eax
mov eax, fcn.00402d90
mov dword [esp + 4], eax
xor eax, eax
mov edx, dword [esp]
mov dl, byte [edx + eax]
mov ecx, dword [esp + 4]
mov byte [ecx + eax], dl
inc eax
cmp eax, 0x38
jne 0x40f795
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
push pe_nt_image_headers32
push fcn.00402d90
call sub.kernel32.dll_VirtualProtect
push 0x38
push fcn.00402d90
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
add esp, 0x48
pop esi
pop ebx
ret

Function at 0x40f7fc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
lea eax, [esp + 4]
push eax
push 0x40
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40f84c
mov dword [esp], ebx
mov eax, dword [esp]
mov byte [eax], 0xe9
sub esi, ebx
sub esi, 5
mov eax, dword [esp]
mov dword [eax + 1], esi
push 5
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x41f86c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041f6c4
dec esi
jne 0x41f88e
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x4209e8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
lea ebx, [ebp - 0xc]
mov esi, 0x4a18b0
cmp dword [esi], 0
jne 0x420a8e
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [0x4a18ac]
mov dword [eax], edx
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, 0x49d4d0
mov ecx, 2
call fcn.00402d90
mov edx, 0x4209c0
mov eax, dword [ebp - 8]
add eax, 5
call fcn.004209e0
mov edx, dword [ebp - 8]
mov dword [edx + 6], eax
mov eax, dword [ebp - 8]
add eax, 0xa
mov dword [ebx], eax
mov eax, dword [ebx]
mov byte [eax], 0xe8
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, dword [ebx]
call fcn.004209e0
mov edx, dword [ebx]
mov dword [edx + 1], eax
mov eax, dword [ebx]
mov edx, dword [esi]
mov dword [eax + 5], edx
mov eax, dword [ebx]
mov dword [esi], eax
add dword [ebx], 0xd
mov eax, dword [ebx]
sub eax, dword [ebp - 8]
cmp eax, 0xffc
jl 0x420a55
mov eax, dword [ebp - 8]
mov dword [0x4a18ac], eax
mov eax, dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [esi]
mov dword [ebx], eax
mov eax, dword [ebx]
mov eax, dword [eax + 5]
mov dword [esi], eax
mov eax, dword [ebx]
mov edx, dword [ebp + 8]
mov dword [eax + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 9], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x422574
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404c58
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4225cc
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4a069c]
mov dl, 1
mov eax, dword [0x42212c]
call fcn.0040d128
call fcn.00404084
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00422234
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4238f0
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4238f9
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c48
mov eax, dword [ebp - 8]
call fcn.00404c48
xor eax, eax
push ebp
push 0x423b18
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 9], 1
cmc
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.00404c58
mov esi, eax
push esi
mov eax, dword [ebp - 4]
call fcn.00404c58
mov edi, eax
push edi
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, ebx
xor al, 1
and al, byte [ebp + 0xc]
je 0x423af0
push dword [ebp - 8]
push 0x423b34
lea edx, [ebp - 0x18]
mov eax, 8
call fcn.00421e60
push dword [ebp - 0x18]
push 0x423b40
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404b18
mov eax, dword [ebp - 0x10]
call fcn.00404c58
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.00404990
mov eax, dword [ebp - 0x1c]
push eax
mov edx, esi
lea eax, [ebp - 0x20]
call fcn.00404990
mov eax, dword [ebp - 0x20]
pop edx
call fcn.00409978
test al, al
je 0x423af0
cmp byte [ebp - 9], 1
cmc
sbb eax, eax
push eax
push esi
push edi
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x423abf
mov eax, dword [ebp + 8]
call fcn.004096f8
test al, al
je 0x423a2d
lea edx, [ebp - 0x24]
mov eax, dword [ebp + 8]
call fcn.00423c7c
push dword [ebp - 0x24]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.00409b40
push dword [ebp - 0x28]
push 0x423b34
lea edx, [ebp - 0x2c]
mov eax, 8
call fcn.00421e60
push dword [ebp - 0x2c]
push 0x423b40
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404b18
jmp 0x423a6d
lea eax, [ebp - 0x30]
call fcn.00423c48
push dword [ebp - 0x30]
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 8]
call fcn.00409b40
push dword [ebp - 0x34]
push 0x423b34
lea edx, [ebp - 0x38]
mov eax, 8
call fcn.00421e60
push dword [ebp - 0x38]
push 0x423b40
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404b18
mov eax, dword [ebp - 0x14]
call fcn.00404c58
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404c58
push eax
call sub.kernel32.dll_MoveFileA
test eax, eax
je 0x423a93
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x14]
call fcn.00404830
mov eax, dword [ebp - 0x10]
call fcn.00409960
test al, al
jne 0x423af0
mov eax, dword [ebp - 0x10]
call fcn.00409804
test al, al
je 0x423ab5
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.0040981c
mov eax, dword [ebp - 0x10]
call fcn.00409960
jmp 0x423af0
mov eax, dword [ebp - 8]
call fcn.00404c58
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00404990
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404c58
mov edx, eax
lea eax, [ebp - 0x40]
call fcn.00404990
mov eax, dword [ebp - 0x40]
pop edx
call fcn.00409978
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423b1f
lea eax, [ebp - 0x40]
mov edx, 0xd
call fcn.004047bc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047bc
ret
Function at 0x423c20
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404888
add esp, 0x108
pop ebx
ret

Function at 0x4243b0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404798
test esi, esi
jne 0x4243eb
push 0x1000
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404888
jmp 0x42440c
call sub.kernel32.dll_GetCommandLineA_1
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.0042424c
mov dword [esp], eax
test esi, esi
je 0x42440c
cmp dword [ebx], 0
je 0x42440c
dec esi
jmp 0x4243f3
add esp, 0x1004
pop esi
pop ebx
ret

Function at 0x42ff30
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
test ebx, ebx
je 0x42ffeb
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42ffe4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, ebx
call fcn.00404c58
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42ffc6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x42ffa9
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ffcd
cmp dword [ebp - 0xc], 0
je 0x42ffc5
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42fff4
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov ebx, edx
mov esi, eax
mov byte [ebp - 1], 0
test esi, esi
je 0x4300ff
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4300f8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, esi
call fcn.00404c58
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4300da
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x4300bd
lea eax, [ebp - 0x28]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ControlService
test eax, eax
je 0x430071
cmp dword [ebp - 0x24], 1
je 0x430075
xor eax, eax
jmp 0x430077
mov al, 1
mov byte [ebp - 1], al
test bl, bl
je 0x4300bd
call fcn.00423e60
mov ebx, eax
jmp 0x43009a
cmp dword [ebp - 0x24], 1
jne 0x430093
mov byte [ebp - 1], 1
jmp 0x4300bd
push 0x32
call sub.kernel32.dll_Sleep_1
cmp byte [ebp - 1], 0
jne 0x4300bd
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4300bd
call fcn.00423e60
sub eax, ebx
cmp eax, 0x14
jb 0x430087
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4300e1
cmp dword [ebp - 0xc], 0
je 0x4300d9
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4302e4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd78
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x288], ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4304d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404798
test ebx, ebx
je 0x4304b0
push ebx
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4304b0
xor edx, edx
push ebp
push 0x4304a9
push dword fs:[edx]
mov dword fs:[edx], esp
mov word [ebp - 0xc], 0
xor eax, eax
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 6
jae 0x4303d3
push 0
push 0x18
lea eax, [ebp - 0x44]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
jne 0x430438
lea eax, [ebp - 0x10]
push eax
push 0x14c
lea eax, [ebp - 0x1ac]
push eax
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x430438
lea eax, [ebp - 0x10]
push eax
push 0x48
lea eax, [ebp - 0x284]
push eax
mov eax, dword [ebp - 0x19c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x430438
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 8], eax
jmp 0x430438
push 0
push 0x18
lea eax, [ebp - 0x2c]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
jne 0x430438
lea eax, [ebp - 0x10]
push eax
push 0x1c
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x430438
lea eax, [ebp - 0x10]
push eax
push 0x90
lea eax, [ebp - 0x23c]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x430438
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 8], eax
mov ax, word [ebp - 0xc]
test ax, ax
jbe 0x430492
cmp dword [ebp - 8], 0
je 0x430492
movzx edx, ax
shr edx, 1
lea eax, [ebp - 0x14]
call fcn.00405178
lea eax, [ebp - 0x10]
push eax
movzx eax, word [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404fdc
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x430492
lea edx, [ebp - 0x288]
mov eax, dword [ebp - 0x14]
call fcn.00408f68
mov edx, dword [ebp - 0x288]
mov eax, esi
call fcn.00404a20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4304b0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4304d8
lea eax, [ebp - 0x288]
call fcn.00404e78
lea eax, [ebp - 0x14]
call fcn.00404e78
ret
Function at 0x4307f0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov byte [esp], dl
mov edi, eax
mov dword [esp + 4], 0xffffffff
push edi
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
jbe 0x4308a9
lea eax, [esp + 4]
push eax
push esi
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [esp + 4]
push eax
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x430846
push 0xffffffffffffffff
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.kernel32.dll_CloseHandle
cmp byte [esp], 0
je 0x4308ab
call fcn.00423e60
mov ebp, eax
jmp 0x43088d
push edi
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
jne 0x43086f
mov bl, 1
jmp 0x4308ab
mov eax, dword [esp + 4]
push eax
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
jne 0x430886
push 0xffffffffffffffff
push esi
call sub.kernel32.dll_TerminateProcess
push 0x32
call sub.kernel32.dll_Sleep_1
test bl, bl
jne 0x4308ab
push edi
call sub.kernel32.dll_GetProcessVersion
test eax, eax
je 0x4308ab
call fcn.00423e60
sub eax, ebp
cmp eax, 0x14
jb 0x43085b
jmp 0x4308ab
mov bl, 1
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x431330
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x49dc94]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x49dc94]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x49dc94]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x49dc94]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x49d818]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x43135b
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x431428
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x49dc94]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x49dc94]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x49dc94]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x49dc94]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x49d818]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x431463
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x431544
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x49dc94]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x49dc94]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x49dc94]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x49dc94]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x49d818]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
xor ecx, ecx
mov cl, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + 0x49dc94]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x49dc94]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x49dc94]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x49dc94]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x43158f
add esp, 0xc
pop edi
pop esi
pop ebx
ret