joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ad80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c7932
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x4ea6c4]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
push edi
mov eax, dword [0x4ea6c4]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], esi
call fcn.00415060
mov edx, dword [edi + 0xc]
cmp edx, 8
jb 0x41af0d
mov eax, dword [edi + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
xor esi, esi
cmp ecx, esi
mov dword [esp + 0x18], ecx
je 0x41adfb
cmp eax, esi
je 0x41adfb
add edx, 0xfffffff8
cmp edx, eax
jb 0x41af0d
cmp ecx, esi
mov ebx, dword [edi + 8]
mov edi, 8
mov dword [esp + 0x10], esi
ja 0x41ae32
mov al, 1
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.004abc64
mov esp, ebp
pop ebp
ret
xor esi, esi
push esi
mov dword [esp + 0x38], esi
mov word [esp + 0x28], si
push 0x4cb7f8
lea esi, [esp + 0x28]
mov dword [esp + 0x40], 7
call fcn.00401700
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
xor esi, esi
push ecx
mov edx, Ordinal_4
mov dword [esp + 0xa0], esi
call fcn.0041c630
mov byte [esp + 0x98], 2
cmp dword [esp + 0x38], 8
jb 0x41ae8b
mov edx, dword [esp + 0x24]
push edx
call fcn.004abbe4
add esp, 4
mov eax, dword [edi + ebx]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx + 0xc]
add edi, 4
mov dword [esp + 0x34], esi
mov word [esp + 0x24], si
lea esi, [eax + edi]
cmp esi, ecx
mov dword [esp + 0x38], 7
lea ecx, [esp + 0x3c]
ja 0x41aefc
push eax
add edi, ebx
push edi
call fcn.0041cfc0
lea edx, [esp + 0x3c]
mov edi, esi
mov esi, dword [esp + 0x14]
push edx
call fcn.00417b60
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x9c], 0xffffffff
call fcn.0041c6b0
mov eax, dword [esp + 0x10]
add eax, 1
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jb 0x41ae30
jmp 0x41ae0b
push ecx
mov dword [esp + 0x9c], 0xffffffff
call fcn.0041c6b0
xor al, al
jmp 0x41ae0d
Function at 0x41c4a0
Capabilities:
Create thread
Resume thread

Disassembly:
push edi
mov edi, eax
mov eax, dword [edi]
test eax, eax
jne 0x41c4ad
xor al, al
pop edi
ret
cmp dword [eax + 4], 0
je 0x41c4a9
push esi
lea ecx, [eax + 0xc]
push ecx
push 4
push eax
push 0x41c3a0
push 0
push 0
call fcn.004acf89
mov edx, dword [edi]
mov dword [edx + 0x10], eax
mov eax, dword [edi]
add esp, 0x18
cmp dword [eax + 0x10], 0
jne 0x41c502
or esi, 0xffffffff
mov dword [eax + 0x10], esi
mov edi, dword [edi]
mov eax, dword [edi + 0x10]
cmp eax, esi
je 0x41c4f2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], esi
pop esi
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
xor al, al
pop edi
ret
mov byte [eax + 8], 1
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x41c524
mov esi, dword [edi]
call fcn.0041c430
mov edx, dword [edi]
mov byte [edx + 8], 0
pop esi
mov al, 1
pop edi
ret
Function at 0x41ca90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c5208
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ea6c4]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, ecx
push 1
push edi
lea ecx, [esp + 0x30]
call fcn.0041c800
cmp dword [esp + 0x40], 8
mov eax, dword [eax + 0x14]
lea eax, [eax + eax + 0xc]
mov dword [esp + 0x24], eax
jb 0x41cae4
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004abbe4
add esp, 4
xor ebp, ebp
xor esi, esi
mov dword [esp + 0x20], ebp
xor ebx, ebx
mov edi, edi
mov eax, dword [edi + 0x14]
cmp eax, ebp
je 0x41cb55
mov ecx, dword [edi + 0x18]
sub ecx, eax
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jae 0x41cb55
mov eax, dword [edi + 0x14]
cmp eax, ebp
je 0x41cb32
mov ecx, dword [edi + 0x18]
sub ecx, eax
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jb 0x41cb37
call fcn.004ac22f
mov ecx, dword [edi + 0x14]
add ecx, ebx
call fcn.0041ca90
mov edx, dword [esp + 0x20]
lea eax, [edx + eax + 4]
add esi, 1
mov dword [esp + 0x20], eax
add ebx, 0x44
jmp 0x41caf0
xor esi, esi
mov ecx, edi
mov dword [esp + 0x18], esi
call fcn.00404240
test eax, eax
jbe 0x41cc3a
mov dword [esp + 0x28], vtable.GameMgr::GMBuffer_unsigned_char_.0
mov dword [esp + 0x1c], esi
mov eax, dword [edi + 4]
test eax, eax
je 0x41cb9b
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x18], eax
jb 0x41cba0
call fcn.004ac22f
mov ebx, dword [edi + 4]
add ebx, dword [esp + 0x1c]
lea esi, [esp + 0x44]
mov eax, ebx
call fcn.004253f0
cmp dword [esp + 0x5c], 8
mov eax, dword [eax + 0x14]
lea esi, [ebp + eax*2 + 6]
jb 0x41cbcd
mov ecx, dword [esp + 0x48]
push ecx
call fcn.004abbe4
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea edx, [esp + 0x28]
push edx
push ebx
mov dword [esp + 0x70], eax
call fcn.00425100
mov eax, dword [esp + 0x34]
mov dword [esp + 0x68], 0xffffffff
lea ebp, [esi + eax + 4]
mov eax, dword [esp + 0x30]
test eax, eax
mov dword [esp + 0x28], vtable.GameMgr::GMBuffer_unsigned_char_.0
je 0x41cc1b
push eax
call fcn.004ab965
add esp, 4
mov dword [esp + 0x30], 0
mov esi, dword [esp + 0x18]
add dword [esp + 0x1c], 0x70
add esi, 1
mov ecx, edi
mov dword [esp + 0x18], esi
call fcn.00404240
cmp esi, eax
jb 0x41cb76
mov ecx, dword [esp + 0x20]
lea eax, [ecx + ebp]
add eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
Function at 0x423ac0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x178
mov eax, dword [0x4ea6c4]
xor eax, esp
mov dword [esp + 0x170], eax
mov eax, dword [edi]
cmp eax, 0xffffffff
push esi
je 0x423b0d
push 0
lea ecx, [esp + 8]
push ecx
push 0x40
lea edx, [esp + 0x13c]
push edx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x423b0d
mov ecx, dword [esp + 4]
test ecx, ecx
seta al
test al, al
jne 0x423b26
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x170]
xor ecx, esp
call fcn.004abc64
add esp, 0x178
ret
cmp ecx, 0x40
jne 0x423b0d
cmp word [esp + 0x130], 0x5a4d
jne 0x423b0d
mov eax, dword [esp + 0x16c]
cdq
push 0
push edx
push eax
lea esi, [esp + 0x14]
mov eax, edi
call fcn.0040c7f0
test al, al
je 0x423b0d
push 0xf8
lea esi, [esp + 8]
lea eax, [esp + 0x14]
mov ecx, edi
call fcn.0040c710
test al, al
je 0x423b0d
cmp dword [esp + 4], 0xf8
jne 0x423b0d
cmp dword [esp + 0x10], 0x4550
jne 0x423b0d
movzx eax, word [esp + 0x16]
lea eax, [eax + eax*4 - 5]
add eax, eax
push 1
add eax, eax
add eax, eax
push 0
push eax
lea esi, [esp + 0x14]
mov eax, edi
call fcn.0040c7f0
test al, al
je 0x423b0d
push 0x28
lea esi, [esp + 8]
lea eax, [esp + 0x10c]
mov ecx, edi
call fcn.0040c710
test al, al
je 0x423b0d
cmp dword [esp + 4], 0x28
jne 0x423b0d
mov esi, dword [esp + 0x118]
mov ecx, dword [esp + 0x4c]
xor edx, edx
mov eax, esi
div ecx
test edx, edx
jne 0x423be5
mov eax, esi
jmp 0x423beb
add eax, 1
imul eax, ecx
mov ecx, dword [esp + 0x11c]
add ecx, eax
mov eax, dword [esp + 0xac]
test eax, eax
je 0x423c10
mov edx, dword [esp + 0xa8]
test edx, edx
je 0x423c10
add eax, edx
cmp eax, ecx
jae 0x423c12
mov eax, ecx
mov ecx, dword [esp + 0x174]
pop esi
xor ecx, esp
call fcn.004abc64
add esp, 0x178
ret

Function at 0x4258f0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
cmp dword [edi + 0x18], 8
push ebx
push esi
lea esi, [edi + 4]
jb 0x425902
mov eax, dword [esi]
jmp 0x425904
mov eax, esi
lea ecx, [esp + 0x10]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov dword [esp + 0xc], eax
jne 0x42591f
xor al, al
pop esi
pop ebx
add esp, 0x10
ret
push eax
call fcn.004ab8e2
add esp, 4
cmp dword [edi + 0x18], 8
mov ebx, eax
jb 0x425932
mov esi, dword [esi]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push ebx
push edx
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x425917
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push 0x4cbb4c
push ebx
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 0xc]
movzx edx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
push edx
movzx edx, word [eax + 0xa]
mov eax, dword [esp + 0x24]
push ecx
push edx
push str._d._d._d._d
push eax
call fcn.00407230
push ebx
call fcn.004ab965
add esp, 0x1c
pop esi
mov al, 1
pop ebx
add esp, 0x10
ret
Function at 0x42c320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x14]
xor edx, edx
cmp eax, edx
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x20], 0x42bdf0
mov dword [esp + 0x34], 0x42bff0
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x28], 0x42bc80
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x10], edx
je 0x42c37f
cmp esi, edx
je 0x42c37f
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x18]
cmp eax, edx
mov dword [esp + 0x1c], edx
je 0x42c3a3
mov ecx, dword [ecx]
cmp ecx, 0xffffffff
je 0x42c3a3
push edx
lea edx, [esp + 0x20]
push edx
push 5
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
mov eax, dword [esp + 0x1c]
add dword [edi], eax
lea ecx, [esp + 0x20]
adc dword [edi + 4], edx
mov edi, dword [ebx + 0x14]
lea edx, [esp + 0x34]
mov eax, edi
mov dword [edi + 0x1d0], ecx
mov dword [edi + 0x3bd10], 1
mov dword [edi + 0x3bcd4], edx
call fcn.00430580
xor ebx, ebx
cmp eax, ebx
jne 0x42c3ed
mov eax, dword [esp + 0x10]
push eax
mov ecx, edi
call fcn.00430610
add esp, 4
cmp eax, ebx
je 0x42c3f8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp dword [esp + 0x10], ebx
je 0x42c499
mov edx, dword [esi]
mov edi, dword [esi + 4]
mov ecx, edx
or ecx, edi
jne 0x42c417
fld qword [0x4da888]
fld st(0)
jmp 0x42c483
mov ecx, dword [esi + 0x10]
add ecx, dword [esi + 8]
mov eax, dword [esi + 0x14]
adc eax, dword [esi + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, eax
and eax, 0x7fffffff
mov dword [esp + 0x14], eax
fild qword [esp + 0x10]
and ecx, 0x80000000
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
fild qword [esp + 0x10]
mov eax, edi
mov ecx, edi
and eax, 0x7fffffff
fchs
mov dword [esp + 0x10], edx
faddp st(1)
mov dword [esp + 0x14], eax
fld qword [0x4da888]
and ecx, 0x80000000
fmul st(1), st(0)
fild qword [esp + 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
fild qword [esp + 0x10]
fchs
faddp st(1)
fdivp st(2)
fxch st(1)
mov ecx, dword [ebp + 0x14]
fxch st(1)
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
sub esp, 0x10
fstp qword [esp + 8]
fstp qword [esp]
call eax
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x42c4b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x4c7e78
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push ebx
push esi
push edi
mov eax, dword [0x4ea6c4]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov dword [esp + 0x44], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0x70]
push ecx
mov dword [esp + 0x70], 0x42be50
call fcn.00404770
xor ebx, ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov dword [esp + 0xc0], ebx
mov eax, dword [esp + 0x44]
add eax, 0x18
cmp eax, ebx
mov dword [esp + 0x50], 0x42bff0
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], 0x42bc80
mov dword [esp + 0x60], edx
mov dword [esp + 0x64], esi
mov dword [esp + 0x40], ebx
je 0x42c562
mov ecx, dword [ecx]
cmp ecx, 0xffffffff
je 0x42c562
push ebx
lea edx, [esp + 0x44]
push edx
push 5
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x40]
add dword [edi], eax
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x50]
adc dword [edi + 4], ebx
mov edi, dword [ecx + 0x14]
lea edx, [esp + 0x68]
mov dword [edi + 0x3bcd4], eax
mov eax, edi
mov dword [edi + 0x1d0], edx
mov dword [edi + 0x3bd10], 1
call fcn.00430580
cmp eax, ebx
jne 0x42c5ae
lea ecx, [esp + 0x5c]
push ecx
mov ecx, edi
call fcn.00430610
add esp, 4
cmp eax, ebx
je 0x42c5ee
mov eax, dword [esp + 0x70]
cmp eax, ebx
je 0x42c5d4
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x74]
push edx
call fcn.00402790
mov eax, dword [esp + 0x74]
add esp, 4
push eax
call fcn.004abbe4
add esp, 4
xor al, al
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [esi]
mov edi, dword [esi + 4]
mov ecx, edx
or ecx, edi
jne 0x42c603
fld qword [0x4da888]
fld st(0)
jmp 0x42c66f
mov ecx, dword [esi + 0x10]
add ecx, dword [esi + 8]
mov eax, dword [esi + 0x14]
adc eax, dword [esi + 0xc]
mov dword [esp + 0x44], ecx
mov ecx, eax
and eax, 0x7fffffff
mov dword [esp + 0x48], eax
fild qword [esp + 0x44]
and ecx, 0x80000000
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], ebx
fild qword [esp + 0x44]
mov eax, edi
mov ecx, edi
fchs
and eax, 0x7fffffff
faddp st(1)
mov dword [esp + 0x44], edx
fld qword [0x4da888]
mov dword [esp + 0x48], eax
and ecx, 0x80000000
fmul st(1), st(0)
fild qword [esp + 0x44]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], ebx
fild qword [esp + 0x44]
fchs
faddp st(1)
fdivp st(2)
fxch st(1)
mov ecx, dword [ebp + 0x14]
fxch st(1)
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
sub esp, 0x10
fstp qword [esp + 8]
fstp qword [esp]
call eax
mov eax, dword [esp + 0x70]
cmp eax, ebx
je 0x42c6ab
mov ecx, dword [esp + 0x44]
mov edi, dword [esp + 0x74]
push ecx
call fcn.00402790
mov edx, dword [esp + 0x74]
add esp, 4
push edx
call fcn.004abbe4
add esp, 4
mov al, 1
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x42d580
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x42d590
pop edi
pop ebx
ret

Function at 0x42d5c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x42d5d0
pop esi
pop ebp
pop ebx
ret

Function at 0x42d740
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, ecx
xor eax, eax
test edi, edi
lea edx, [eax + 1]
je 0x42d782
push ebx
push ebp
mov ebx, dword [esp + 0x14]
movzx ebx, word [ebx + edx*2]
mov ecx, esi
and ecx, 1
mov ebp, ecx
neg ebp
sar ebp, 4
and ebp, 0x7f
shr ebx, 4
xor ebx, ebp
mov ebp, dword [esp + 0x18]
add eax, dword [ebp + ebx*4]
add edx, edx
shr esi, 1
or edx, ecx
sub edi, 1
jne 0x42d751
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x42d8d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp + 0x10], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
push edi
mov dword [esp + 0x10], ecx
xor edx, edx
lea ebx, [ebx]
cmp edx, dword [esp + 0x20]
jae 0x42da47
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x42d960
mov ebp, dword [esp + 0x1c]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x42d936
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
add edi, eax
mov dword [ecx + edx*4], edi
add edx, 1
cmp edx, 8
jb 0x42d920
cmp edx, 0x10
jae 0x42d9e2
lea eax, [edx - 8]
mov dword [esp + 0x18], eax
cmp edx, dword [esp + 0x20]
jae 0x42da47
or eax, 8
xor edi, edi
cmp eax, 1
je 0x42d9c2
mov ebp, dword [esp + 0x1c]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x42d995
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x24]
add edi, eax
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
add edx, 1
add eax, 1
cmp edx, 0x10
mov dword [esp + 0x18], eax
jb 0x42d981
cmp edx, dword [esp + 0x20]
jae 0x42da47
lea eax, [edx - 0x10]
mov dword [esp + 0x18], eax
nop
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x42da26
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x42da00
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
add edi, eax
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
add edx, 1
add eax, 1
cmp edx, dword [esp + 0x20]
mov dword [esp + 0x18], eax
jb 0x42d9f0
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x42f5c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x42f5e0
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
sub dword [esp + 0xc], 1
jne 0x42f5f0
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
add esi, 1
mov dword [eax], edx
add eax, 4
cmp esi, 0x10
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jb 0x42f5e0
pop esi
pop ebp
mov dword [edi + 0x32590], 0
pop ebx
add esp, 0xc
ret

Function at 0x42f650
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push edi
mov edi, 4
lea ebp, [esi + 0x30ea0]
movzx ebx, byte [esi + edi + 0x306a0]
mov ecx, ebx
mov edx, ebx
and edx, 1
shr ecx, 1
or edx, 2
sub ecx, 1
shl edx, cl
mov eax, edi
push ebp
sub eax, edx
sub edx, ebx
lea edx, [esi + edx*2 + 0x32b0e]
push edx
call fcn.0042d740
mov dword [esp + edi*4 + 0x24], eax
add edi, 1
add esp, 8
cmp edi, 0x80
jb 0x42f664
lea ebp, [esp + 0x1c]
sub ebp, esi
lea eax, [esi + 0x32910]
lea ecx, [esi + 0x31d58]
sub ebp, 0x31d50
lea edi, [esi + 0x31950]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 4
jmp 0x42f6e4
mov ecx, dword [esp + 0xc]
xor ebx, ebx
cmp dword [esi + 0x32594], ebx
jbe 0x42f741
mov edi, edi
mov eax, ebx
or eax, 0x40
xor edx, edx
cmp eax, 1
je 0x42f733
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edx, dword [esi + ebp*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0x42f700
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov dword [edi + ebx*4], edx
add ebx, 1
cmp ebx, dword [esi + 0x32594]
jb 0x42f6f0
mov eax, 0xe
cmp dword [esi + 0x32594], eax
jbe 0x42f768
mov edi, edi
mov edx, eax
shr edx, 1
sub edx, 5
shl edx, 4
add dword [edi + eax*4], edx
add eax, 1
cmp eax, dword [esi + 0x32594]
jb 0x42f750
mov eax, dword [edi]
mov dword [ecx - 8], eax
mov edx, dword [edi + 4]
mov dword [ecx - 4], edx
mov eax, dword [edi + 8]
mov dword [ecx], eax
mov edx, dword [edi + 0xc]
mov dword [ecx + 4], edx
mov eax, 4
add ecx, 8
jmp 0x42f790
movzx edx, byte [esi + eax + 0x306a0]
mov edx, dword [edi + edx*4]
add edx, dword [ecx + ebp]
add eax, 1
mov dword [ecx], edx
add ecx, 4
cmp eax, 0x80
jb 0x42f790
add dword [esp + 0x10], 0x80
add dword [esp + 0xc], 0x200
sub ebp, 0x200
add edi, 0x100
sub dword [esp + 0x18], 1
mov dword [esp + 0x14], ebp
jne 0x42f6e0
pop edi
pop ebp
mov dword [esi + 0x3bcf8], 0
pop ebx
add esp, 0x210
ret
Function at 0x4352c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov dword [eax + 0x30], edx
mov dword [eax + 0x4c], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x2c], 0x20
mov dword [eax + 0x54], 1
mov dword [eax + 0x48], 4
mov dword [eax + 0x58], edx
lea esi, [eax + 0x70]
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
add edx, 1
add esi, 4
cmp edx, 0x100
jb 0x4352e7
pop esi
ret