joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43983a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x420
xor ebx, ebx
push ebx
push esi
call fcn.00458090
add esp, 0xc
push 0xd
pop eax
cmp dword [ebp + 0x10], eax
mov dword [esi + 0x41c], ebx
mov dword [esi + 0x418], ebx
mov dword [esi + 0x414], ebx
mov dword [esi + 0x410], ebx
jle 0x43987a
mov dword [ebp + 0x10], eax
push dword [ebp + 0x10]
lea edi, [esi + 0x400]
push dword [ebp + 0xc]
push edi
call fcn.0045b2d0
add esp, 0xc
mov dword [ebp + 8], 0x7b
xor eax, eax
movsx ecx, byte [edi + eax]
imul ecx, dword [ebp + 8]
add ecx, eax
inc eax
cmp eax, 0xd
mov dword [ebp + 8], ecx
jl 0x439898
lea edx, [esi + 0x300]
mov edi, esi
xor eax, eax
sub edi, edx
lea ecx, [edx + eax]
mov byte [edi + ecx], al
mov byte [ecx], al
inc eax
cmp eax, 0x100
jl 0x4398b7
mov dword [ebp - 0xc], ebx
lea ebx, [esi + 0x200]
mov dword [ebp - 4], 1
sub dword [ebp - 4], esi
mov dword [ebp - 8], ebx
sub dword [ebp - 8], esi
mov dword [ebp + 0x10], 0xff
lea edi, [esi + 0xff]
mov eax, dword [ebp - 0xc]
cdq
push 0xd
pop ecx
idiv ecx
mov ecx, dword [ebp + 8]
imul ecx, ecx, 5
movsx eax, byte [edx + esi + 0x400]
add eax, ecx
mov dword [ebp + 8], eax
cdq
mov ecx, 0xfff1
idiv ecx
mov eax, dword [ebp - 4]
lea ecx, [eax + edi]
movzx eax, dl
mov dword [ebp - 0x10], edx
xor edx, edx
div ecx
movsx ecx, byte [edi]
lea eax, [edx + esi]
mov dl, byte [eax]
mov byte [edi], dl
mov byte [eax], cl
mov eax, dword [ebp - 8]
cmp byte [eax + edi], 0
jne 0x43995e
mov eax, dword [ebp - 0x10]
shr eax, 8
and eax, 0xff
xor edx, edx
div dword [ebp + 0x10]
jmp 0x43994f
lea eax, [edx + 1]
cdq
idiv dword [ebp + 0x10]
cmp byte [ebx + edx], 0
jne 0x439948
mov eax, dword [ebp + 0x10]
mov byte [eax + ebx], dl
mov byte [ebx + edx], al
inc dword [ebp - 0xc]
dec dword [ebp + 0x10]
dec edi
cmp dword [ebp + 0x10], 0xffffffff
jg 0x4398ed
xor eax, eax
movzx ecx, byte [eax + esi]
mov byte [ecx + esi + 0x100], al
inc eax
cmp eax, 0x100
jl 0x43996d
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x439b9a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, ecx
ror eax, 8
push ebx
mov ebx, 0xff00ff00
and eax, ebx
rol ecx, 8
push esi
push edi
mov edi, 0xff00ff
and ecx, edi
or eax, ecx
mov ecx, dword [edx + 4]
mov edx, ecx
ror edx, 8
and edx, ebx
rol ecx, 8
and ecx, edi
or edx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], edx
lea edx, [ecx + 0x1000]
mov dword [ebp + 8], edx
mov dword [ebp - 8], 0x10
mov edx, dword [ebp + 8]
xor eax, dword [edx]
add dword [ebp + 8], 4
mov edx, eax
shr edx, 0x10
and edx, 0xff
mov edx, dword [ecx + edx*4 + 0x400]
mov esi, eax
shr esi, 0x18
add edx, dword [ecx + esi*4]
mov esi, eax
shr esi, 8
and esi, 0xff
xor edx, dword [ecx + esi*4 + 0x800]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
and eax, 0xff
add edx, dword [ecx + eax*4 + 0xc00]
xor edx, dword [ebp - 4]
dec dword [ebp - 8]
mov eax, edx
mov dword [ebp - 4], esi
jne 0x439be7
xor esi, dword [ecx + 0x1044]
mov edx, dword [ecx + 0x1040]
xor edx, eax
mov eax, dword [ebp + 0xc]
mov ecx, esi
ror ecx, 8
and ecx, ebx
rol esi, 8
and esi, edi
or ecx, esi
mov dword [eax], ecx
mov ecx, edx
ror ecx, 8
and ecx, ebx
rol edx, 8
and edx, edi
pop edi
or ecx, edx
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret

Function at 0x439c72
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, ecx
ror eax, 8
push ebx
mov ebx, 0xff00ff00
and eax, ebx
rol ecx, 8
push esi
push edi
mov edi, 0xff00ff
and ecx, edi
or eax, ecx
mov ecx, dword [edx + 4]
mov edx, ecx
ror edx, 8
and edx, ebx
rol ecx, 8
and ecx, edi
or edx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], edx
lea edx, [ecx + 0x1044]
mov dword [ebp + 8], edx
mov dword [ebp - 8], 0x10
mov edx, dword [ebp + 8]
xor eax, dword [edx]
sub dword [ebp + 8], 4
mov edx, eax
shr edx, 0x10
and edx, 0xff
mov edx, dword [ecx + edx*4 + 0x400]
mov esi, eax
shr esi, 0x18
add edx, dword [ecx + esi*4]
mov esi, eax
shr esi, 8
and esi, 0xff
xor edx, dword [ecx + esi*4 + 0x800]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
and eax, 0xff
add edx, dword [ecx + eax*4 + 0xc00]
xor edx, dword [ebp - 4]
dec dword [ebp - 8]
mov eax, edx
mov dword [ebp - 4], esi
jne 0x439cbf
xor esi, dword [ecx + 0x1000]
mov edx, dword [ecx + 0x1004]
xor edx, eax
mov eax, dword [ebp + 0xc]
mov ecx, esi
ror ecx, 8
and ecx, ebx
rol esi, 8
and esi, edi
or ecx, esi
mov dword [eax], ecx
mov ecx, edx
ror ecx, 8
and ecx, ebx
rol edx, 8
and edx, edi
pop edi
or ecx, edx
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret
Function at 0x439d4a
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0x10
push ebx
push esi
push edi
mov esi, eax
lea eax, [edx + 0x800]
xor ecx, ecx
mov edi, 0x100
mov ebx, dword [ecx + 0x4756a8]
mov dword [eax - 0x800], ebx
mov ebx, dword [ecx + 0x475aa8]
mov dword [eax - 0x400], ebx
mov ebx, dword [ecx + 0x475ea8]
mov dword [eax], ebx
mov ebx, dword [ecx + 0x4762a8]
mov dword [eax + 0x400], ebx
add ecx, 4
add eax, 4
dec edi
jne 0x439d65
lea ecx, [edx + 0x1000]
push 0x12
mov eax, 0x4766a8
mov edx, ecx
pop edi
mov ebx, dword [eax]
mov dword [edx], ebx
add eax, 4
add edx, 4
dec edi
jne 0x439daa
movsx edi, word [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x12
movsx ecx, ax
mov eax, ecx
cdq
idiv edi
mov ebx, dword [ebp - 4]
movzx eax, byte [edx + esi]
shl eax, 8
mov dword [ebp - 0xc], eax
lea eax, [ecx + 1]
cdq
idiv edi
movzx eax, byte [edx + esi]
mov edx, dword [ebp - 0xc]
or edx, eax
shl edx, 8
mov dword [ebp - 0xc], edx
lea eax, [ecx + 2]
cdq
idiv edi
movzx eax, byte [edx + esi]
mov edx, dword [ebp - 0xc]
or edx, eax
shl edx, 8
mov dword [ebp - 0xc], edx
lea eax, [ecx + 3]
cdq
idiv edi
movzx eax, byte [edx + esi]
mov edx, dword [ebp - 0xc]
or edx, eax
xor dword [ebx], edx
lea eax, [ecx + 4]
cdq
idiv edi
add ebx, 4
dec dword [ebp - 8]
mov dword [ebp - 4], ebx
movzx eax, dx
jne 0x439dc7
mov ebx, dword [ebp + 8]
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
lea edi, [ebx + 0x1004]
mov dword [ebp - 8], 9
lea esi, [ebp - 0x10]
mov eax, ebx
call fcn.0043e9f5
mov eax, dword [ebp - 0x10]
mov dword [edi - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
add edi, 8
dec dword [ebp - 8]
jne 0x439e43
mov edi, ebx
mov dword [ebp - 4], 4
mov dword [ebp - 8], 0x80
lea esi, [ebp - 0x10]
mov eax, ebx
call fcn.0043e9f5
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], eax
add edi, 8
dec dword [ebp - 8]
jne 0x439e70
dec dword [ebp - 4]
jne 0x439e69
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x43a02d
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ecx, dword [edi]
mov edi, dword [edi + 4]
mov eax, ecx
ror eax, 8
mov esi, 0xff00ff00
and eax, esi
rol ecx, 8
mov edx, 0xff00ff
and ecx, edx
or eax, ecx
mov ecx, edi
ror ecx, 8
and ecx, esi
rol edi, 8
and edi, edx
or ecx, edi
and dword [esp + 0x10], 0
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
and edi, 3
mov edi, dword [ebx + edi*4]
mov ebx, edi
ror ebx, 8
and ebx, esi
rol edi, 8
and edi, edx
or ebx, edi
add ebx, dword [esp + 0x10]
sub dword [esp + 0x10], 0x61c88647
mov edi, ecx
shr edi, 5
mov ebp, ecx
shl ebp, 4
xor edi, ebp
add edi, ecx
xor ebx, edi
mov edi, dword [esp + 0x10]
add eax, ebx
mov ebx, dword [esp + 0x18]
shr edi, 0xb
and edi, 3
mov edi, dword [ebx + edi*4]
mov ebx, edi
ror ebx, 8
and ebx, esi
rol edi, 8
and edi, edx
or ebx, edi
add ebx, dword [esp + 0x10]
mov edi, eax
shr edi, 5
mov ebp, eax
shl ebp, 4
xor edi, ebp
add edi, eax
xor ebx, edi
add ecx, ebx
cmp dword [esp + 0x10], 0xc6ef3720
jne 0x43a066
mov edi, eax
ror edi, 8
and edi, esi
rol eax, 8
and eax, edx
or edi, eax
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
mov edi, ecx
ror edi, 8
and edi, esi
rol ecx, 8
and ecx, edx
or edi, ecx
mov dword [eax + 4], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x43a10a
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [edi]
mov edi, dword [edi + 4]
mov ecx, eax
ror ecx, 8
mov esi, 0xff00ff00
and ecx, esi
rol eax, 8
mov edx, 0xff00ff
and eax, edx
or ecx, eax
mov eax, edi
ror eax, 8
and eax, esi
rol edi, 8
and edi, edx
or eax, edi
mov dword [esp + 0x10], 0xc6ef3720
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
shr edi, 0xb
and edi, 3
mov edi, dword [ebx + edi*4]
mov ebx, edi
ror ebx, 8
and ebx, esi
rol edi, 8
and edi, edx
or ebx, edi
add ebx, dword [esp + 0x10]
add dword [esp + 0x10], 0x61c88647
mov edi, ecx
shr edi, 5
mov ebp, ecx
shl ebp, 4
xor edi, ebp
add edi, ecx
xor ebx, edi
mov edi, dword [esp + 0x10]
sub eax, ebx
mov ebx, dword [esp + 0x18]
and edi, 3
mov edi, dword [ebx + edi*4]
mov ebx, edi
ror ebx, 8
and ebx, esi
rol edi, 8
and edi, edx
or ebx, edi
add ebx, dword [esp + 0x10]
mov edi, eax
shr edi, 5
mov ebp, eax
shl ebp, 4
xor edi, ebp
add edi, eax
xor ebx, edi
sub ecx, ebx
cmp dword [esp + 0x10], 0
jne 0x43a146
mov edi, ecx
ror edi, 8
and edi, esi
rol ecx, 8
and ecx, edx
or edi, ecx
mov ecx, dword [esp + 0x1c]
mov dword [ecx], edi
mov edi, eax
ror edi, 8
and edi, esi
rol eax, 8
and eax, edx
or edi, eax
mov dword [ecx + 4], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x43d69d
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, 0x495598
push edi
mov ecx, eax
dec ecx
push 2
mov dword [ebp - 0xc], eax
sub dword [ebp - 0xc], ecx
mov byte [0x495098], 0
mov byte [0x495598], 1
mov byte [0x495099], 0
mov byte [0x495599], 3
mov byte [0x49509b], 1
pop ebx
lea esi, [ecx + 2]
mov edi, 0x100
mov dl, byte [esi]
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
mov cl, dl
add cl, cl
xor cl, dl
xor cl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + esi], cl
movzx eax, cl
mov byte [eax + 0x495098], bl
inc ebx
inc esi
cmp ebx, edi
jl 0x43d6e2
xor edx, edx
mov byte [0x495810], 0x63
mov byte [0x495773], 0
inc edx
movzx eax, dl
movzx eax, byte [eax + 0x495098]
mov ecx, 0x495697
sub ecx, eax
mov bl, byte [ecx]
mov cl, bl
rol cl, 1
xor bl, cl
rol cl, 1
xor bl, cl
rol cl, 1
mov al, cl
rol al, 1
xor al, bl
xor al, cl
xor al, 0x63
mov byte [edx + 0x495810], al
movzx eax, al
mov byte [eax + 0x495710], dl
inc edx
cmp edx, edi
jl 0x43d71c
mov dl, 1
mov ecx, 0x495698
movzx eax, dl
mov dword [ecx], eax
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
add dl, dl
add ecx, 4
xor dl, al
cmp ecx, 0x495710
jl 0x43d760
xor esi, esi
mov al, byte [esi + 0x495810]
mov byte [ebp - 1], al
and byte [ebp - 1], 0x80
mov cl, al
mov byte [ebp - 6], al
sete dl
add cl, cl
dec dl
and dl, 0x1b
mov bl, cl
xor bl, dl
xor bl, al
cmp byte [ebp - 1], 0
mov byte [ebp - 7], al
sete al
dec al
and al, 0x1b
xor cl, al
mov byte [ebp - 8], cl
lea ecx, [ebp - 8]
mov byte [ebp - 5], bl
call fcn.00442760
mov ebx, dword [0x4903b4]
mov dword [esi*4 + 0x495198], eax
mov al, byte [esi + 0x495710]
mov byte [ebp - 0xc], al
push dword [ebp - 0xc]
movzx eax, bl
push eax
call fcn.0043d5a2
push dword [ebp - 0xc]
mov byte [ebp - 5], al
movzx eax, bh
push eax
call fcn.0043d5a2
push dword [ebp - 0xc]
mov byte [ebp - 6], al
movzx eax, byte [0x4903b6]
push eax
call fcn.0043d5a2
push dword [ebp - 0xc]
mov byte [ebp - 7], al
movzx eax, byte [0x4903b7]
push eax
call fcn.0043d5a2
add esp, 0x20
lea ecx, [ebp - 8]
mov byte [ebp - 8], al
call fcn.00442760
mov dword [esi*4 + 0x495910], eax
inc esi
cmp esi, edi
jl 0x43d780
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43db36
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 4]
push edi
test ebx, ebx
jle 0x43db76
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
lea edi, [esi + 0x3c]
mov ecx, dword [ebp + 8]
call fcn.00442760
xor eax, dword [edi]
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
add dword [ebp + 8], 4
add edi, 4
cmp dword [ebp - 4], ebx
mov dword [ebp + ecx*4 - 0x34], eax
jl 0x43db56
mov ecx, dword [esi + 8]
cmp ecx, 1
lea edi, [ebp - 0x54]
lea eax, [ebp - 0x34]
mov dword [ebp + 8], edi
jle 0x43dc30
dec ecx
mov dword [ebp - 0x10], ecx
cmp dword [esi + 4], 0
jle 0x43dc1d
lea edx, [esi + ebx*4 + 0x3c]
mov dword [ebp - 4], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
add ebx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x495198]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x495198]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x495198]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
xor edx, dword [ebx*4 + 0x495198]
mov ebx, dword [ebp - 4]
xor edx, dword [ebx]
add dword [ebp - 4], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 8]
jne 0x43dbb6
mov ebx, dword [ebp - 0x14]
dec dword [ebp - 0x10]
mov ecx, eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [ebp + 8], edi
jne 0x43db8f
cmp dword [esi + 4], 0
jle 0x43dcb4
lea edx, [esi + ebx*4 + 0x3c]
mov dword [ebp - 8], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
mov dword [ebp - 0x10], edx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
movzx ebx, byte [ebx + 0x495810]
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + 0x495810]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
movzx ebx, byte [ebx + 0x495810]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
movzx ebx, byte [ebx + 0x495810]
xor edx, ebx
mov ebx, dword [ebp - 8]
xor edx, dword [ebx]
add dword [ebp - 8], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 0x10]
jne 0x43dc4e
and dword [ebp - 4], 0
cmp dword [esi + 4], 0
jle 0x43dcfb
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add edx, 2
sub eax, edi
mov ecx, dword [edi]
and dword [edi], 0
and dword [eax + edi], 0
mov ebx, ecx
shr ebx, 8
mov byte [edx - 1], bl
mov byte [edx - 2], cl
mov ebx, ecx
shr ecx, 0x18
shr ebx, 0x10
inc dword [ebp - 4]
mov byte [edx + 1], cl
mov ecx, dword [ebp - 4]
mov byte [edx], bl
add edi, 4
add edx, 4
cmp ecx, dword [esi + 4]
jl 0x43dcc9
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43dd00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 4]
push edi
test ebx, ebx
jle 0x43dd43
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
lea edi, [esi + 0x21c]
mov ecx, dword [ebp + 8]
call fcn.00442760
xor eax, dword [edi]
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
add dword [ebp + 8], 4
add edi, 4
cmp dword [ebp - 4], ebx
mov dword [ebp + ecx*4 - 0x34], eax
jl 0x43dd23
mov ecx, dword [esi + 8]
cmp ecx, 1
lea edi, [ebp - 0x54]
lea eax, [ebp - 0x34]
mov dword [ebp + 8], edi
jle 0x43de00
dec ecx
mov dword [ebp - 0x10], ecx
cmp dword [esi + 4], 0
jle 0x43dded
lea edx, [esi + ebx*4 + 0x21c]
mov dword [ebp - 4], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0x24]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
add ebx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x495910]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x495910]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x495910]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
xor edx, dword [ebx*4 + 0x495910]
mov ebx, dword [ebp - 4]
xor edx, dword [ebx]
add dword [ebp - 4], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 8]
jne 0x43dd86
mov ebx, dword [ebp - 0x14]
dec dword [ebp - 0x10]
mov ecx, eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [ebp + 8], edi
jne 0x43dd5c
cmp dword [esi + 4], 0
jle 0x43de8b
lea edx, [esi + ebx*4 + 0x21c]
mov dword [ebp - 8], edx
mov edx, eax
sub edx, dword [ebp + 8]
lea ecx, [esi + 0x24]
mov dword [ebp - 0xc], edx
mov edx, dword [esi + 4]
mov dword [ebp - 0x10], edx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
movzx ebx, byte [ebx + 0x495710]
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + 0x495710]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
movzx ebx, byte [ebx + 0x495710]
ror ebx, 8
xor edx, ebx
mov ebx, dword [ebp - 0xc]
movzx ebx, byte [ebx + edi]
movzx ebx, byte [ebx + 0x495710]
xor edx, ebx
mov ebx, dword [ebp - 8]
xor edx, dword [ebx]
add dword [ebp - 8], 4
mov dword [edi], edx
add edi, 4
add ecx, 3
dec dword [ebp - 0x10]
jne 0x43de25
and dword [ebp - 4], 0
cmp dword [esi + 4], 0
jle 0x43ded2
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add edx, 2
sub eax, edi
mov ecx, dword [edi]
and dword [edi], 0
and dword [eax + edi], 0
mov ebx, ecx
shr ebx, 8
mov byte [edx - 1], bl
mov byte [edx - 2], cl
mov ebx, ecx
shr ecx, 0x18
shr ebx, 0x10
inc dword [ebp - 4]
mov byte [edx + 1], cl
mov ecx, dword [ebp - 4]
mov byte [edx], bl
add edi, 4
add edx, 4
cmp ecx, dword [esi + 4]
jl 0x43dea0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43e235
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
push 0x800
add eax, 0x880
push 0
push eax
call fcn.00458090
add esp, 0xc
and dword [ebp - 4], 0
mov edi, 0x110
xor ecx, ecx
xor esi, esi
movsx eax, byte [esi + 0x4903b8]
dec eax
mov edx, eax
sar edx, 2
cmp edx, dword [ebp - 4]
jne 0x43e29a
and eax, 3
test dword [eax*4 + 0x4906f0], ecx
je 0x43e29a
mov edx, esi
sar edx, 3
add edx, dword [ebp + 8]
lea eax, [edi + ecx]
lea eax, [edx + eax*8]
mov edx, esi
and edx, 7
mov dl, byte [edx*4 + 0x4906d0]
or byte [eax], dl
inc esi
cmp esi, 0x40
jl 0x43e260
inc ecx
cmp ecx, 0x10
jl 0x43e25e
inc dword [ebp - 4]
add edi, 0x10
cmp edi, 0x210
jl 0x43e25c
pop edi
pop esi
leave
ret

Function at 0x43e2b8
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
push 0x800
add eax, 0x1080
push 0
push eax
call fcn.00458090
add esp, 0xc
and dword [ebp - 4], 0
mov edi, 0x210
xor ecx, ecx
xor esi, esi
movsx eax, byte [esi + 0x4903f8]
dec eax
mov edx, eax
sar edx, 2
cmp edx, dword [ebp - 4]
jne 0x43e31d
and eax, 3
test dword [eax*4 + 0x4906f0], ecx
je 0x43e31d
mov edx, esi
sar edx, 3
add edx, dword [ebp + 8]
lea eax, [edi + ecx]
lea eax, [edx + eax*8]
mov edx, esi
and edx, 7
mov dl, byte [edx*4 + 0x4906d0]
or byte [eax], dl
inc esi
cmp esi, 0x40
jl 0x43e2e3
inc ecx
cmp ecx, 0x10
jl 0x43e2e1
inc dword [ebp - 4]
add edi, 0x10
cmp edi, 0x310
jl 0x43e2df
pop edi
pop esi
leave
ret

Function at 0x43e33b
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x491fb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ecx, ecx
push edi
xor eax, eax
movsx esi, byte [eax + 0x4906b0]
dec esi
cmp esi, ecx
je 0x43e366
inc eax
cmp eax, 0x20
jl 0x43e352
jmp 0x43e36a
mov byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0x20
jl 0x43e350
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], eax
xor edi, edi
lea eax, [edx + 0x80]
xor edx, edx
mov dword [ebp - 0x28], eax
mov eax, edx
sar eax, 1
mov ecx, edx
and ecx, 1
shl ecx, 4
and eax, 0xf
or eax, ecx
mov ecx, edx
xor esi, esi
and ecx, 0x20
or eax, ecx
movsx eax, byte [edi + eax + 0x4904b0]
mov dword [ebp - 0x2c], esi
push 8
pop ebx
mov ecx, esi
sar ebx, cl
test eax, ebx
je 0x43e3c7
mov ecx, dword [ebp - 0x30]
movsx ebx, byte [ecx + esi]
push 0x1f
pop ecx
sub ecx, ebx
xor ebx, ebx
inc ebx
shl ebx, cl
or dword [ebp - 0x2c], ebx
inc esi
cmp esi, 4
jl 0x43e3a8
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x28], 4
inc edx
cmp edx, 0x40
mov dword [ecx], eax
jl 0x43e383
add dword [ebp - 0x30], 4
mov eax, dword [ebp - 0x28]
add edi, 0x40
cmp edi, 0x200
jl 0x43e37e
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00457904
leave
ret
Function at 0x43e41c
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x491fb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x1880
xor edi, edi
push edi
push ebx
call fcn.00458090
mov edx, ebx
call fcn.0043e33b
push ebx
call fcn.0043e235
push ebx
call fcn.0043e2b8
add esp, 0x14
xor ecx, ecx
movsx eax, byte [ecx + str.91__]
mov esi, dword [ebp + 0xc]
dec eax
mov edx, eax
sar edx, 3
movsx edx, byte [edx + esi]
and eax, 7
test dword [eax*4 + 0x4906d0], edx
setne al
mov byte [ebp + ecx - 0x3c], al
inc ecx
cmp ecx, 0x38
jl 0x43e458
movsx eax, byte [edi + 0x490470]
xor ecx, ecx
xor edx, edx
cmp ecx, 0x1c
setge dl
mov esi, eax
dec edx
and edx, 0xffffffe4
add edx, 0x38
cmp eax, edx
jl 0x43e4a4
lea esi, [eax - 0x1c]
mov dl, byte [ebp + esi - 0x3c]
mov byte [ebp + ecx - 0x74], dl
inc ecx
inc eax
cmp ecx, 0x38
jl 0x43e48c
xor ecx, ecx
movsx eax, byte [ecx + 0x490480]
cmp byte [ebp + eax - 0x75], 0
je 0x43e4dc
mov eax, ecx
cdq
push 6
pop esi
idiv esi
mov edx, dword [edx*4 + 0x4906d0]
lea eax, [eax + edi*8]
add eax, ebx
sar edx, 2
or byte [eax], dl
inc ecx
cmp ecx, 0x30
jl 0x43e4b5
inc edi
cmp edi, 0x10
jl 0x43e483
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00457904
leave
ret

Function at 0x43e967
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 0x1000]
mov dword [ebp + 0xc], edx
push edi
mov dword [ebp + 8], 0x10
mov edx, 0xff
mov edi, dword [ebp + 0xc]
xor ecx, dword [edi]
add dword [ebp + 0xc], 4
mov edi, ecx
shr edi, 0x10
and edi, edx
mov edi, dword [eax + edi*4 + 0x400]
mov ebx, ecx
shr ebx, 0x18
add edi, dword [eax + ebx*4]
mov ebx, ecx
shr ebx, 8
and ebx, edx
xor edi, dword [eax + ebx*4 + 0x800]
mov dword [ebp - 8], ecx
and ecx, edx
add edi, dword [eax + ecx*4 + 0xc00]
xor edi, dword [ebp - 4]
dec dword [ebp + 8]
mov ecx, edi
mov edi, dword [ebp - 8]
mov dword [ebp - 4], edi
jne 0x43e992
mov edx, dword [eax + 0x1040]
mov eax, dword [eax + 0x1044]
xor edx, ecx
xor eax, edi
pop edi
mov dword [esi], eax
mov dword [esi + 4], edx
pop esi
pop ebx
leave
ret