joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f950
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
mov esi, dword [esp + 0x28]
movzx edx, word [esi + 6]
movzx ecx, word [esi + 2]
movzx eax, word [esi + 4]
movzx esi, word [esi]
push edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x20], 0
lea edi, [ebx + 4]
mov esi, edx
not esi
and esi, ecx
mov ecx, eax
and ecx, edx
add esi, ecx
add si, word [edi - 4]
add si, word [esp + 0x10]
rol si, 1
movzx esi, si
mov ecx, esi
not ecx
and ecx, eax
mov ebp, esi
and ebp, edx
add ecx, ebp
add cx, word [edi - 2]
mov dword [esp + 0x10], esi
add cx, word [esp + 0x14]
rol cx, 2
movzx ecx, cx
mov ebp, ecx
not ebp
and ebp, edx
mov edx, esi
and edx, ecx
add ebp, eax
add edx, ebp
add dx, word [edi]
mov dword [esp + 0x14], ecx
rol dx, 3
movzx eax, dx
mov edx, eax
not edx
and edx, esi
mov esi, ecx
and esi, eax
add edx, esi
add dx, word [edi + 2]
mov esi, dword [esp + 0x20]
add dx, word [esp + 0x18]
mov dword [esp + 0x1c], eax
rol dx, 5
movzx edx, dx
mov dword [esp + 0x18], edx
cmp si, 4
je 0x42fa10
cmp si, 0xa
jne 0x42fa54
and edx, 0x3f
mov ax, word [ebx + edx*2]
add word [esp + 0x10], ax
mov ecx, dword [esp + 0x10]
and ecx, 0x3f
movzx edx, word [ebx + ecx*2]
add word [esp + 0x14], dx
mov ecx, dword [esp + 0x14]
mov eax, ecx
and eax, 0x3f
movzx edx, word [ebx + eax*2]
add word [esp + 0x1c], dx
mov eax, dword [esp + 0x1c]
mov edx, eax
and edx, 0x3f
movzx edx, word [ebx + edx*2]
add word [esp + 0x18], dx
mov edx, dword [esp + 0x18]
inc esi
add edi, 8
mov dword [esp + 0x20], esi
cmp si, 0x10
jb 0x42f985
mov eax, dword [esp + 0x2c]
movzx ecx, word [esp + 0x10]
movzx edx, word [esp + 0x14]
pop edi
mov word [eax], cx
movzx ecx, word [esp + 0x18]
mov word [eax + 2], dx
movzx edx, word [esp + 0x14]
pop esi
pop ebp
mov word [eax + 4], cx
mov word [eax + 6], dx
pop ebx
add esp, 0x14
ret
Function at 0x42faa0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x20]
movzx edx, word [eax + 2]
movzx ecx, word [eax + 6]
push ebx
movzx ebx, word [eax + 4]
push ebp
push esi
push edi
movzx edi, word [eax]
mov eax, dword [esp + 0x2c]
add eax, 0x7c
mov dword [esp + 0x1c], ecx
mov si, word [esp + 0x1c]
mov dword [esp + 0x10], edx
mov dword [esp + 0x20], eax
mov cx, dx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], 0xf
mov ax, di
mov dx, bx
jmp 0x42faf4
mov ebx, dword [esp + 0x18]
ror si, 5
mov ebp, ebx
not ebp
and ebp, edi
sub si, bp
mov ebp, dword [esp + 0x10]
and ebp, ebx
mov ebx, dword [esp + 0x20]
sub si, bp
sub si, word [ebx + 2]
mov ebp, dword [esp + 0x10]
movzx esi, si
not ebp
and ebp, esi
ror dx, 3
sub dx, bp
mov ebp, edi
and ebp, dword [esp + 0x10]
mov dword [esp + 0x1c], esi
sub dx, bp
sub dx, word [ebx]
mov ebp, edi
movzx edx, dx
and edi, esi
ror cx, 2
not ebp
and ebp, edx
sub cx, bp
mov ebp, dword [esp + 0x24]
sub cx, di
sub cx, word [ebx - 2]
mov edi, esi
movzx ecx, cx
not edi
and edi, ecx
ror ax, 1
sub ax, di
mov edi, edx
and edi, esi
sub ax, di
sub ax, word [ebx - 4]
mov dword [esp + 0x18], edx
movzx edi, ax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
cmp bp, 5
je 0x42fb86
cmp bp, 0xb
jne 0x42fbd8
mov ebx, dword [esp + 0x2c]
mov si, word [esp + 0x1c]
mov ax, word [esp + 0x14]
and edx, 0x3f
sub si, word [ebx + edx*2]
mov dx, word [esp + 0x18]
and ecx, 0x3f
sub dx, word [ebx + ecx*2]
mov cx, word [esp + 0x10]
and edi, 0x3f
sub cx, word [ebx + edi*2]
mov word [esp + 0x1c], si
mov edi, dword [esp + 0x1c]
and edi, 0x3f
sub ax, word [ebx + edi*2]
mov word [esp + 0x18], dx
mov word [esp + 0x14], ax
mov edi, dword [esp + 0x14]
mov word [esp + 0x10], cx
jmp 0x42fbec
mov ax, word [esp + 0x14]
mov cx, word [esp + 0x10]
mov dx, word [esp + 0x18]
mov si, word [esp + 0x1c]
sub dword [esp + 0x20], 8
mov bx, bp
add ebp, 0xffff
mov dword [esp + 0x24], ebp
test bx, bx
jne 0x42faf0
mov edi, dword [esp + 0x30]
mov word [edi + 6], si
mov word [edi], ax
mov word [edi + 2], cx
mov word [edi + 4], dx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x42fe40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
push 0x420
xor ebp, ebp
push ebp
push edi
call fcn.00444550
mov eax, dword [esp + 0x30]
add esp, 0xc
cmp eax, 0xd
mov dword [edi + 0x41c], ebp
mov dword [edi + 0x418], ebp
mov dword [edi + 0x414], ebp
mov dword [edi + 0x410], ebp
jle 0x42fe82
mov eax, 0xd
push eax
mov eax, dword [esp + 0x24]
push eax
lea ebx, [edi + 0x400]
push ebx
call fcn.00447420
add esp, 0xc
mov esi, 0x7b
xor eax, eax
mov edi, edi
movsx ecx, byte [ebx + eax]
imul ecx, esi
add ecx, eax
inc eax
cmp eax, 0xd
mov esi, ecx
jl 0x42fea0
lea edx, [edi + 0x300]
mov ebx, edi
xor eax, eax
sub ebx, edx
lea ecx, [ecx]
lea ecx, [edx + eax]
mov byte [ebx + ecx], al
mov byte [ecx], al
inc eax
cmp eax, 0x100
jl 0x42fec0
mov ebx, 1
xor ecx, ecx
lea eax, [edi + 0x200]
sub ebx, edi
sub eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], 0xff
lea ebp, [edi + 0xff]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
jmp 0x42ff04
mov ebx, dword [esp + 0x10]
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0xd
sub ecx, eax
movsx ecx, byte [ecx + edi + 0x400]
lea edx, [esi + esi*4]
add ecx, edx
mov esi, ecx
mov eax, 0x80078071
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0xfff1
sub ecx, eax
add ebx, ebp
movzx eax, cl
xor edx, edx
div ebx
movsx eax, byte [ebp]
mov bl, byte [edx + edi]
mov byte [ebp], bl
mov ebx, dword [esp + 0x1c]
mov byte [edx + edi], al
mov edx, dword [esp + 0x14]
cmp byte [edx + ebp], 0
jne 0x42ff9e
mov eax, ecx
shr eax, 8
and eax, 0xff
xor edx, edx
div ebx
cmp byte [edi + edx + 0x200], 0
je 0x42ff90
lea eax, [edx + 1]
cdq
idiv ebx
cmp byte [edi + edx + 0x200], 0
jne 0x42ff80
mov byte [ebx + edi + 0x200], dl
mov byte [edi + edx + 0x200], bl
mov ecx, dword [esp + 0x24]
dec ebx
inc ecx
dec ebp
cmp ebx, 0xffffffff
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], ebx
jg 0x42ff00
xor eax, eax
jmp 0x42ffc0
movzx ecx, byte [eax + edi]
mov byte [ecx + edi + 0x100], al
inc eax
cmp eax, 0x100
jl 0x42ffc0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x4302f0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [edx]
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or eax, ecx
mov ecx, dword [edx + 4]
mov edx, ecx
ror edx, 8
and edx, 0xff00ff00
rol ecx, 8
push ebx
and ecx, 0xff00ff
push ebp
push esi
or edx, ecx
mov ecx, dword [esp + 0x10]
push edi
lea esi, [ecx + 0x1000]
mov dword [esp + 0x14], 0x10
lea ebx, [ebx]
xor eax, dword [esi]
add esi, 4
mov ebx, eax
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ecx + ebx*4 + 0x400]
mov ebp, eax
shr ebp, 0x18
add ebx, dword [ecx + ebp*4]
mov ebp, eax
shr ebp, 8
and ebp, 0xff
xor ebx, dword [ecx + ebp*4 + 0x800]
mov edi, eax
and eax, 0xff
add ebx, dword [ecx + eax*4 + 0xc00]
xor ebx, edx
sub dword [esp + 0x14], 1
mov eax, ebx
mov edx, edi
jne 0x430340
xor edx, dword [ecx + 0x1044]
mov esi, dword [ecx + 0x1040]
xor esi, eax
mov eax, dword [esp + 0x18]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov edx, esi
ror edx, 8
and edx, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
pop edi
or edx, esi
pop esi
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret

Function at 0x4303e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [edx]
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or eax, ecx
mov ecx, dword [edx + 4]
mov edx, ecx
ror edx, 8
and edx, 0xff00ff00
rol ecx, 8
push ebx
and ecx, 0xff00ff
push ebp
push esi
or edx, ecx
mov ecx, dword [esp + 0x10]
push edi
lea esi, [ecx + 0x1044]
mov dword [esp + 0x14], 0x10
lea ebx, [ebx]
xor eax, dword [esi]
sub esi, 4
mov ebx, eax
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ecx + ebx*4 + 0x400]
mov ebp, eax
shr ebp, 0x18
add ebx, dword [ecx + ebp*4]
mov ebp, eax
shr ebp, 8
and ebp, 0xff
xor ebx, dword [ecx + ebp*4 + 0x800]
mov edi, eax
and eax, 0xff
add ebx, dword [ecx + eax*4 + 0xc00]
xor ebx, edx
sub dword [esp + 0x14], 1
mov eax, ebx
mov edx, edi
jne 0x430430
xor edx, dword [ecx + 0x1000]
mov esi, dword [ecx + 0x1004]
xor esi, eax
mov eax, dword [esp + 0x18]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov edx, esi
ror edx, 8
and edx, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
pop edi
or edx, esi
pop esi
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret
Function at 0x4304d0
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 0x800]
xor eax, eax
mov edx, pe_nt_image_headers32
nop
mov edi, dword [eax + 0x45f108]
mov dword [ecx - 0x800], edi
mov edi, dword [eax + 0x45f508]
mov dword [ecx - 0x400], edi
mov edi, dword [eax + 0x45f908]
mov dword [ecx], edi
mov edi, dword [eax + 0x45fd08]
mov dword [ecx + 0x400], edi
add eax, 4
add ecx, 4
sub edx, 1
jne 0x4304f0
lea edi, [esi + 0x1000]
mov eax, 0x460108
mov ecx, edi
mov edx, 0x12
lea esp, [esp]
mov esi, dword [eax]
mov dword [ecx], esi
add eax, 4
add ecx, 4
sub edx, 1
jne 0x430540
movsx esi, word [ebp + 0x10]
xor eax, eax
mov dword [esp + 0xc], 0x12
lea ecx, [ecx]
movsx ecx, ax
mov eax, ecx
cdq
idiv esi
add edi, 4
movzx eax, byte [edx + ebx]
shl eax, 8
mov dword [esp + 0x10], eax
lea eax, [ecx + 1]
cdq
idiv esi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0xc]
movzx edx, byte [edx + eax]
mov eax, dword [esp + 0x10]
or eax, edx
shl eax, 8
mov dword [esp + 0x10], eax
lea eax, [ecx + 2]
cdq
idiv esi
mov eax, dword [ebp + 0xc]
movzx edx, byte [edx + eax]
mov eax, dword [esp + 0x10]
or eax, edx
shl eax, 8
mov dword [esp + 0x10], eax
lea eax, [ecx + 3]
cdq
idiv esi
movzx eax, byte [edx + ebx]
mov edx, dword [esp + 0x10]
or edx, eax
xor dword [edi - 4], edx
lea eax, [ecx + 4]
cdq
idiv esi
sub dword [esp + 0xc], 1
movzx eax, dx
jne 0x430560
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea esi, [edi + 0x1004]
lea ebx, [eax + 9]
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call fcn.00435ca0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esi - 4], edx
mov dword [esi], eax
add esp, 4
add esi, 8
sub ebx, 1
jne 0x4305e6
mov esi, edi
mov dword [esp + 0xc], 4
mov ebx, 0x80
lea esp, [esp]
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call fcn.00435ca0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esi], edx
mov dword [esi + 4], eax
add esp, 4
add esi, 8
sub ebx, 1
jne 0x430620
sub dword [esp + 0xc], 1
jne 0x430614
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430890
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or eax, ecx
mov ecx, edx
ror ecx, 8
push ebx
and ecx, 0xff00ff00
push ebp
rol edx, 8
and edx, 0xff00ff
push esi
push edi
mov edi, dword [esp + 0x14]
or ecx, edx
xor edx, edx
mov edi, edi
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
mov ebx, esi
ror ebx, 8
and ebx, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
or ebx, esi
add ebx, edx
mov esi, ecx
shr esi, 5
mov ebp, ecx
shl ebp, 4
xor esi, ebp
add esi, ecx
xor ebx, esi
sub edx, 0x61c88647
add eax, ebx
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
mov ebx, esi
ror ebx, 8
and ebx, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
or ebx, esi
mov esi, eax
shr esi, 5
mov ebp, eax
shl ebp, 4
xor esi, ebp
add ebx, edx
add esi, eax
xor ebx, esi
add ecx, ebx
cmp edx, 0xc6ef3720
jne 0x4308d0
mov edx, eax
ror edx, 8
and edx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or edx, eax
mov eax, dword [esp + 0x18]
mov dword [eax], edx
mov edx, ecx
ror edx, 8
and edx, 0xff00ff00
pop edi
rol ecx, 8
pop esi
and ecx, 0xff00ff
or edx, ecx
pop ebp
mov dword [eax + 4], edx
pop ebx
ret

Function at 0x430980
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [edx]
mov edx, dword [edx + 4]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, edx
ror eax, 8
push ebx
and eax, 0xff00ff00
rol edx, 8
push ebp
and edx, 0xff00ff
push esi
push edi
mov edi, dword [esp + 0x14]
or eax, edx
mov edx, 0xc6ef3720
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
mov ebx, esi
ror ebx, 8
and ebx, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
or ebx, esi
add ebx, edx
mov esi, ecx
shr esi, 5
mov ebp, ecx
shl ebp, 4
xor esi, ebp
add esi, ecx
xor ebx, esi
add edx, 0x61c88647
sub eax, ebx
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
mov ebx, esi
ror ebx, 8
and ebx, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
or ebx, esi
mov esi, eax
shr esi, 5
mov ebp, eax
shl ebp, 4
xor esi, ebp
add ebx, edx
add esi, eax
xor ebx, esi
sub ecx, ebx
test edx, edx
jne 0x4309c0
mov edx, ecx
ror edx, 8
and edx, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or edx, ecx
mov ecx, dword [esp + 0x18]
mov dword [ecx], edx
mov edx, eax
ror edx, 8
and edx, 0xff00ff00
pop edi
rol eax, 8
pop esi
and eax, 0xff00ff
or edx, eax
pop ebp
mov dword [ecx + 4], edx
pop ebx
ret
Function at 0x434230
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
push edi
mov eax, 0x47aff8
dec eax
mov edi, 0x47aff8
mov byte [0x47aaf8], 0
mov byte [0x47aff8], 1
mov byte [0x47aaf9], 0
mov byte [0x47aff9], 3
mov byte [0x47aafb], 1
mov edx, 2
lea esi, [eax + 2]
sub edi, eax
lea esp, [esp]
mov bl, byte [esi]
mov al, bl
call fcn.0043fda0
xor al, bl
mov byte [edi + esi], al
movzx eax, al
mov byte [eax + 0x47aaf8], dl
inc edx
inc esi
cmp edx, 0x100
jl 0x434270
mov byte [0x47b270], 0x63
mov byte [0x47b1d3], 0
mov ebx, 1
mov al, bl
call fcn.00434200
movzx ecx, al
mov byte [ebx + 0x47b270], al
mov byte [ecx + 0x47b170], bl
inc ebx
cmp ebx, 0x100
jl 0x4342a4
mov al, 1
mov edx, 0x47b0f8
lea ebx, [ebx]
movzx ecx, al
mov dword [edx], ecx
call fcn.0043fda0
add edx, 4
cmp edx, 0x47b170
jl 0x4342d0
xor esi, esi
jmp 0x4342f0
mov dl, byte [esi + 0x47b270]
mov al, dl
call fcn.0043fda0
mov cl, al
xor cl, dl
mov byte [esp + 0xf], cl
lea ecx, [esp + 0xc]
mov byte [esp + 0xe], dl
mov byte [esp + 0xd], dl
mov byte [esp + 0xc], al
call fcn.00434080
mov bl, byte [esi + 0x47b170]
mov dword [esi*4 + 0x47abf8], eax
mov al, byte [0x4763c4]
mov cl, bl
call fcn.004340a0
mov byte [esp + 0xf], al
mov al, byte [0x4763c5]
mov cl, bl
call fcn.004340a0
mov byte [esp + 0xe], al
mov al, byte [0x4763c6]
mov cl, bl
call fcn.004340a0
mov byte [esp + 0xd], al
mov al, byte [0x4763c7]
mov cl, bl
call fcn.004340a0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.00434080
mov dword [esi*4 + 0x47b370], eax
inc esi
cmp esi, 0x100
jl 0x4342f0
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4346b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x68]
mov ebx, dword [edi + 4]
xor esi, esi
mov dword [esp + 0x20], ebx
test ebx, ebx
jle 0x4346f0
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
lea ebp, [edi + 0x3c]
mov ecx, dword [esp + 0x10]
call fcn.00434080
xor eax, dword [ebp]
add dword [esp + 0x10], 4
mov dword [esp + esi*4 + 0x24], eax
inc esi
add ebp, 4
cmp esi, ebx
jl 0x4346d3
mov ecx, dword [edi + 8]
cmp ecx, 1
lea esi, [esp + 0x44]
mov edx, ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x14], esi
jle 0x4347b6
dec ecx
mov dword [esp + 0x18], ecx
nop
test ebx, ebx
jle 0x4347a1
mov ebp, eax
lea ecx, [edi + 0xc]
lea edi, [edi + edx*4 + 0x3c]
sub ebp, esi
add edx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edx
lea ecx, [ecx]
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x47abf8]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x47abf8]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x47abf8]
ror ebx, 8
xor edx, ebx
movzx ebx, byte [esi + ebp]
xor edx, dword [ebx*4 + 0x47abf8]
add edi, 4
xor edx, dword [edi - 4]
add esi, 4
mov dword [esi - 4], edx
add ecx, 3
sub dword [esp + 0x10], 1
jne 0x434730
mov edi, dword [esp + 0x68]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
sub dword [esp + 0x18], 1
mov ecx, eax
mov eax, esi
mov esi, ecx
mov dword [esp + 0x14], esi
jne 0x434710
test ebx, ebx
jle 0x434849
lea edx, [edi + edx*4 + 0x3c]
mov dword [esp + 0x18], edx
mov edx, eax
sub edx, esi
lea ecx, [edi + 0xc]
mov ebp, esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
shr edx, 8
movzx edx, dl
movzx edi, byte [edx + 0x47b270]
movzx edx, byte [ecx + 1]
movzx edx, byte [eax + edx*4 + 2]
movzx edx, byte [edx + 0x47b270]
rol edi, 8
rol edx, 0x10
xor edi, edx
movzx edx, byte [ecx + 2]
movzx edx, byte [eax + edx*4 + 3]
movzx edx, byte [edx + 0x47b270]
ror edx, 8
xor edi, edx
mov edx, dword [esp + 0x20]
movzx edx, byte [edx + ebp]
movzx edx, byte [edx + 0x47b270]
xor edi, edx
mov edx, dword [esp + 0x18]
xor edi, dword [edx]
add edx, 4
mov dword [ebp], edi
add ebp, 4
add ecx, 3
sub dword [esp + 0x14], 1
mov dword [esp + 0x18], edx
jne 0x4347d7
mov edi, dword [esp + 0x68]
xor ebp, ebp
test ebx, ebx
jle 0x434877
mov ecx, dword [esp + 0x6c]
mov ebx, eax
sub ebx, esi
mov eax, dword [esi]
call fcn.0043fd80
mov dword [esi], 0
mov dword [ebx + esi], 0
inc ebp
add esi, 4
add ecx, 4
cmp ebp, dword [edi + 4]
jl 0x434857
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
Function at 0x434880
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x68]
mov ebx, dword [edi + 4]
xor esi, esi
mov dword [esp + 0x20], ebx
test ebx, ebx
jle 0x4348c3
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
lea ebp, [edi + 0x21c]
mov ecx, dword [esp + 0x10]
call fcn.00434080
xor eax, dword [ebp]
add dword [esp + 0x10], 4
mov dword [esp + esi*4 + 0x24], eax
inc esi
add ebp, 4
cmp esi, ebx
jl 0x4348a6
mov ecx, dword [edi + 8]
cmp ecx, 1
lea esi, [esp + 0x44]
mov edx, ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x14], esi
jle 0x434988
dec ecx
mov dword [esp + 0x18], ecx
test ebx, ebx
jle 0x434973
mov ebp, eax
lea ecx, [edi + 0x24]
lea edi, [edi + edx*4 + 0x21c]
sub ebp, esi
add edx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x47b370]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x47b370]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x47b370]
ror ebx, 8
xor edx, ebx
movzx ebx, byte [esi + ebp]
xor edx, dword [ebx*4 + 0x47b370]
add edi, 4
xor edx, dword [edi - 4]
add esi, 4
mov dword [esi - 4], edx
add ecx, 3
sub dword [esp + 0x10], 1
jne 0x434902
mov edi, dword [esp + 0x68]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
sub dword [esp + 0x18], 1
mov ecx, eax
mov eax, esi
mov esi, ecx
mov dword [esp + 0x14], esi
jne 0x4348e2
test ebx, ebx
jle 0x434a22
lea edx, [edi + edx*4 + 0x21c]
mov dword [esp + 0x18], edx
mov edx, eax
sub edx, esi
lea ecx, [edi + 0x24]
mov ebp, esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ebx
lea esp, [esp]
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
shr edx, 8
movzx edx, dl
movzx edi, byte [edx + 0x47b170]
movzx edx, byte [ecx + 1]
movzx edx, byte [eax + edx*4 + 2]
movzx edx, byte [edx + 0x47b170]
rol edi, 8
rol edx, 0x10
xor edi, edx
movzx edx, byte [ecx + 2]
movzx edx, byte [eax + edx*4 + 3]
movzx edx, byte [edx + 0x47b170]
ror edx, 8
xor edi, edx
mov edx, dword [esp + 0x20]
movzx edx, byte [edx + ebp]
movzx edx, byte [edx + 0x47b170]
xor edi, edx
mov edx, dword [esp + 0x18]
xor edi, dword [edx]
add edx, 4
mov dword [ebp], edi
add ebp, 4
add ecx, 3
sub dword [esp + 0x14], 1
mov dword [esp + 0x18], edx
jne 0x4349b0
mov edi, dword [esp + 0x68]
xor ebp, ebp
test ebx, ebx
jle 0x434a50
mov ecx, dword [esp + 0x6c]
mov ebx, eax
sub ebx, esi
mov eax, dword [esi]
call fcn.0043fd80
mov dword [esi], 0
mov dword [ebx + esi], 0
inc ebp
add esi, 4
add ecx, 4
cmp ebp, dword [edi + 4]
jl 0x434a30
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
Function at 0x434ef0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebp
push esi
push edi
push 0x800
add eax, 0x880
push 0
push eax
call fcn.00444550
add esp, 0xc
mov dword [esp + 0xc], 0
mov edi, 0x110
lea esp, [esp]
xor eax, eax
jmp 0x434f30
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov ebp, 2
mov esi, 1
lea ebx, [ebx]
movsx ecx, byte [esi + 0x4763c7]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [esp + 0xc]
jne 0x434f90
and ecx, 3
test dword [ecx*4 + 0x476700], eax
je 0x434f90
mov edx, dword [esp + 0x14]
sar edx, 3
add edx, dword [esp + 0x1c]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, dword [esp + 0x14]
and edx, 7
mov dl, byte [edx*4 + 0x4766e0]
or byte [ecx], dl
movsx ecx, byte [esi + 0x4763c8]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [esp + 0xc]
jne 0x434fcc
and ecx, 3
test dword [ecx*4 + 0x476700], eax
je 0x434fcc
mov edx, esi
sar edx, 3
add edx, dword [esp + 0x1c]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, esi
and edx, 7
mov dl, byte [edx*4 + 0x4766e0]
or byte [ecx], dl
movsx ecx, byte [ebp + 0x4763c8]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [esp + 0xc]
jne 0x435008
and ecx, 3
test dword [ecx*4 + 0x476700], eax
je 0x435008
mov edx, ebp
sar edx, 3
add edx, dword [esp + 0x1c]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, ebp
and edx, 7
mov dl, byte [edx*4 + 0x4766e0]
or byte [ecx], dl
mov ecx, dword [esp + 0x10]
movsx ecx, byte [ecx + 0x4763c8]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [esp + 0xc]
jne 0x43504c
and ecx, 3
test dword [ecx*4 + 0x476700], eax
je 0x43504c
mov edx, dword [esp + 0x10]
sar edx, 3
add edx, dword [esp + 0x1c]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, dword [esp + 0x10]
and edx, 7
mov dl, byte [edx*4 + 0x4766e0]
or byte [ecx], dl
mov ecx, 4
add dword [esp + 0x14], ecx
add dword [esp + 0x10], ecx
add esi, ecx
add ebp, ecx
cmp esi, 0x41
jl 0x434f50
inc eax
cmp eax, 0x10
jl 0x434f30
inc dword [esp + 0xc]
add edi, 0x10
cmp edi, 0x210
jl 0x434f20
pop edi
pop esi
pop ebp
add esp, 0xc
ret