joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4392c0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
mov esi, dword [esp + 0x28]
movzx edx, word [esi + 6]
movzx ecx, word [esi + 2]
movzx eax, word [esi + 4]
movzx esi, word [esi]
push edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x20], 0
lea edi, [ebx + 4]
mov esi, edx
not esi
and esi, ecx
mov ecx, eax
and ecx, edx
add esi, ecx
add si, word [edi - 4]
add si, word [esp + 0x10]
rol si, 1
movzx esi, si
mov ecx, esi
not ecx
and ecx, eax
mov ebp, esi
and ebp, edx
add ecx, ebp
add cx, word [edi - 2]
mov dword [esp + 0x10], esi
add cx, word [esp + 0x14]
rol cx, 2
movzx ecx, cx
mov ebp, ecx
not ebp
and ebp, edx
mov edx, esi
and edx, ecx
add ebp, eax
add edx, ebp
add dx, word [edi]
mov dword [esp + 0x14], ecx
rol dx, 3
movzx eax, dx
mov edx, eax
not edx
and edx, esi
mov esi, ecx
and esi, eax
add edx, esi
add dx, word [edi + 2]
mov esi, dword [esp + 0x20]
add dx, word [esp + 0x18]
mov dword [esp + 0x1c], eax
rol dx, 5
movzx edx, dx
mov dword [esp + 0x18], edx
cmp si, 4
je 0x439380
cmp si, 0xa
jne 0x4393c4
and edx, 0x3f
mov ax, word [ebx + edx*2]
add word [esp + 0x10], ax
mov ecx, dword [esp + 0x10]
and ecx, 0x3f
movzx edx, word [ebx + ecx*2]
add word [esp + 0x14], dx
mov ecx, dword [esp + 0x14]
mov eax, ecx
and eax, 0x3f
movzx edx, word [ebx + eax*2]
add word [esp + 0x1c], dx
mov eax, dword [esp + 0x1c]
mov edx, eax
and edx, 0x3f
movzx edx, word [ebx + edx*2]
add word [esp + 0x18], dx
mov edx, dword [esp + 0x18]
inc esi
add edi, 8
mov dword [esp + 0x20], esi
cmp si, 0x10
jb 0x4392f5
mov eax, dword [esp + 0x2c]
movzx ecx, word [esp + 0x10]
movzx edx, word [esp + 0x14]
pop edi
mov word [eax], cx
movzx ecx, word [esp + 0x18]
mov word [eax + 2], dx
movzx edx, word [esp + 0x14]
pop esi
pop ebp
mov word [eax + 4], cx
mov word [eax + 6], dx
pop ebx
add esp, 0x14
ret
Function at 0x439410
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x20]
movzx edx, word [eax + 2]
movzx ecx, word [eax + 6]
push ebx
movzx ebx, word [eax + 4]
push ebp
push esi
push edi
movzx edi, word [eax]
mov eax, dword [esp + 0x2c]
add eax, 0x7c
mov dword [esp + 0x1c], ecx
mov si, word [esp + 0x1c]
mov dword [esp + 0x10], edx
mov dword [esp + 0x20], eax
mov cx, dx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], 0xf
mov ax, di
mov dx, bx
jmp 0x439464
mov ebx, dword [esp + 0x18]
ror si, 5
mov ebp, ebx
not ebp
and ebp, edi
sub si, bp
mov ebp, dword [esp + 0x10]
and ebp, ebx
mov ebx, dword [esp + 0x20]
sub si, bp
sub si, word [ebx + 2]
mov ebp, dword [esp + 0x10]
movzx esi, si
not ebp
and ebp, esi
ror dx, 3
sub dx, bp
mov ebp, edi
and ebp, dword [esp + 0x10]
mov dword [esp + 0x1c], esi
sub dx, bp
sub dx, word [ebx]
mov ebp, edi
movzx edx, dx
and edi, esi
ror cx, 2
not ebp
and ebp, edx
sub cx, bp
mov ebp, dword [esp + 0x24]
sub cx, di
sub cx, word [ebx - 2]
mov edi, esi
movzx ecx, cx
not edi
and edi, ecx
ror ax, 1
sub ax, di
mov edi, edx
and edi, esi
sub ax, di
sub ax, word [ebx - 4]
mov dword [esp + 0x18], edx
movzx edi, ax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
cmp bp, 5
je 0x4394f6
cmp bp, 0xb
jne 0x439548
mov ebx, dword [esp + 0x2c]
mov si, word [esp + 0x1c]
mov ax, word [esp + 0x14]
and edx, 0x3f
sub si, word [ebx + edx*2]
mov dx, word [esp + 0x18]
and ecx, 0x3f
sub dx, word [ebx + ecx*2]
mov cx, word [esp + 0x10]
and edi, 0x3f
sub cx, word [ebx + edi*2]
mov word [esp + 0x1c], si
mov edi, dword [esp + 0x1c]
and edi, 0x3f
sub ax, word [ebx + edi*2]
mov word [esp + 0x18], dx
mov word [esp + 0x14], ax
mov edi, dword [esp + 0x14]
mov word [esp + 0x10], cx
jmp 0x43955c
mov ax, word [esp + 0x14]
mov cx, word [esp + 0x10]
mov dx, word [esp + 0x18]
mov si, word [esp + 0x1c]
sub dword [esp + 0x20], 8
mov bx, bp
add ebp, 0xffff
mov dword [esp + 0x24], ebp
test bx, bx
jne 0x439460
mov edi, dword [esp + 0x30]
mov word [edi + 6], si
mov word [edi], ax
mov word [edi + 2], cx
mov word [edi + 4], dx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4397a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
push 0x420
xor ebp, ebp
push ebp
push edi
call fcn.00458750
mov eax, dword [esp + 0x30]
add esp, 0xc
cmp eax, 0xd
mov dword [edi + 0x41c], ebp
mov dword [edi + 0x418], ebp
mov dword [edi + 0x414], ebp
mov dword [edi + 0x410], ebp
jle 0x4397e2
mov eax, 0xd
push eax
mov eax, dword [esp + 0x24]
push eax
lea ebx, [edi + 0x400]
push ebx
call fcn.0045ba00
add esp, 0xc
mov esi, 0x7b
xor eax, eax
mov edi, edi
movsx ecx, byte [ebx + eax]
imul ecx, esi
add ecx, eax
inc eax
cmp eax, 0xd
mov esi, ecx
jl 0x439800
lea edx, [edi + 0x300]
mov ebx, edi
xor eax, eax
sub ebx, edx
lea ecx, [ecx]
lea ecx, [edx + eax]
mov byte [ebx + ecx], al
mov byte [ecx], al
inc eax
cmp eax, 0x100
jl 0x439820
mov ebx, 1
xor ecx, ecx
lea eax, [edi + 0x200]
sub ebx, edi
sub eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], 0xff
lea ebp, [edi + 0xff]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
jmp 0x439864
mov ebx, dword [esp + 0x10]
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0xd
sub ecx, eax
movsx ecx, byte [ecx + edi + 0x400]
lea edx, [esi + esi*4]
add ecx, edx
mov esi, ecx
mov eax, 0x80078071
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0xfff1
sub ecx, eax
add ebx, ebp
movzx eax, cl
xor edx, edx
div ebx
movsx eax, byte [ebp]
mov bl, byte [edx + edi]
mov byte [ebp], bl
mov ebx, dword [esp + 0x1c]
mov byte [edx + edi], al
mov edx, dword [esp + 0x14]
cmp byte [edx + ebp], 0
jne 0x4398fe
mov eax, ecx
shr eax, 8
and eax, 0xff
xor edx, edx
div ebx
cmp byte [edi + edx + 0x200], 0
je 0x4398f0
lea eax, [edx + 1]
cdq
idiv ebx
cmp byte [edi + edx + 0x200], 0
jne 0x4398e0
mov byte [ebx + edi + 0x200], dl
mov byte [edi + edx + 0x200], bl
mov ecx, dword [esp + 0x24]
dec ebx
inc ecx
dec ebp
cmp ebx, 0xffffffff
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], ebx
jg 0x439860
xor eax, eax
jmp 0x439920
movzx ecx, byte [eax + edi]
mov byte [ecx + edi + 0x100], al
inc eax
cmp eax, 0x100
jl 0x439920
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x439c50
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [edx]
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or eax, ecx
mov ecx, dword [edx + 4]
mov edx, ecx
ror edx, 8
and edx, 0xff00ff00
rol ecx, 8
push ebx
and ecx, 0xff00ff
push ebp
push esi
or edx, ecx
mov ecx, dword [esp + 0x10]
push edi
lea esi, [ecx + 0x1000]
mov dword [esp + 0x14], 0x10
lea ebx, [ebx]
xor eax, dword [esi]
add esi, 4
mov ebx, eax
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ecx + ebx*4 + 0x400]
mov ebp, eax
shr ebp, 0x18
add ebx, dword [ecx + ebp*4]
mov ebp, eax
shr ebp, 8
and ebp, 0xff
xor ebx, dword [ecx + ebp*4 + 0x800]
mov edi, eax
and eax, 0xff
add ebx, dword [ecx + eax*4 + 0xc00]
xor ebx, edx
sub dword [esp + 0x14], 1
mov eax, ebx
mov edx, edi
jne 0x439ca0
xor edx, dword [ecx + 0x1044]
mov esi, dword [ecx + 0x1040]
xor esi, eax
mov eax, dword [esp + 0x18]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov edx, esi
ror edx, 8
and edx, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
pop edi
or edx, esi
pop esi
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret

Function at 0x439d40
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov eax, dword [edx]
mov edx, dword [edx + 4]
push ebx
push ebp
push esi
push edi
lea esi, [ecx + 0x1000]
mov dword [esp + 0x10], 0x10
lea esp, [esp]
xor eax, dword [esi]
add esi, 4
mov ebx, eax
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ecx + ebx*4 + 0x400]
mov ebp, eax
shr ebp, 0x18
add ebx, dword [ecx + ebp*4]
mov ebp, eax
shr ebp, 8
and ebp, 0xff
xor ebx, dword [ecx + ebp*4 + 0x800]
mov edi, eax
and eax, 0xff
add ebx, dword [ecx + eax*4 + 0xc00]
xor ebx, edx
sub dword [esp + 0x10], 1
mov eax, ebx
mov edx, edi
jne 0x439d60
mov esi, dword [ecx + 0x1040]
mov ecx, dword [ecx + 0x1044]
xor esi, eax
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax + 4], esi
pop esi
xor ecx, edx
pop ebp
mov dword [eax], ecx
pop ebx
pop ecx
ret
Function at 0x439dd0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [edx]
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or eax, ecx
mov ecx, dword [edx + 4]
mov edx, ecx
ror edx, 8
and edx, 0xff00ff00
rol ecx, 8
push ebx
and ecx, 0xff00ff
push ebp
push esi
or edx, ecx
mov ecx, dword [esp + 0x10]
push edi
lea esi, [ecx + 0x1044]
mov dword [esp + 0x14], 0x10
lea ebx, [ebx]
xor eax, dword [esi]
sub esi, 4
mov ebx, eax
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ecx + ebx*4 + 0x400]
mov ebp, eax
shr ebp, 0x18
add ebx, dword [ecx + ebp*4]
mov ebp, eax
shr ebp, 8
and ebp, 0xff
xor ebx, dword [ecx + ebp*4 + 0x800]
mov edi, eax
and eax, 0xff
add ebx, dword [ecx + eax*4 + 0xc00]
xor ebx, edx
sub dword [esp + 0x14], 1
mov eax, ebx
mov edx, edi
jne 0x439e20
xor edx, dword [ecx + 0x1000]
mov esi, dword [ecx + 0x1004]
xor esi, eax
mov eax, dword [esp + 0x18]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov edx, esi
ror edx, 8
and edx, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
pop edi
or edx, esi
pop esi
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret
Function at 0x439ec0
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 0x800]
xor eax, eax
mov edx, 0x100
nop
mov edi, dword [eax + 0x4797c0]
mov dword [ecx - 0x800], edi
mov edi, dword [eax + 0x479bc0]
mov dword [ecx - 0x400], edi
mov edi, dword [eax + 0x479fc0]
mov dword [ecx], edi
mov edi, dword [eax + 0x47a3c0]
mov dword [ecx + 0x400], edi
add eax, 4
add ecx, 4
sub edx, 1
jne 0x439ee0
lea edi, [esi + 0x1000]
mov eax, 0x47a7c0
mov ecx, edi
mov edx, 0x12
lea esp, [esp]
mov esi, dword [eax]
mov dword [ecx], esi
add eax, 4
add ecx, 4
sub edx, 1
jne 0x439f30
movsx esi, word [ebp + 0x10]
xor eax, eax
mov dword [esp + 0xc], 0x12
lea ecx, [ecx]
movsx ecx, ax
mov eax, ecx
cdq
idiv esi
add edi, 4
movzx eax, byte [edx + ebx]
shl eax, 8
mov dword [esp + 0x10], eax
lea eax, [ecx + 1]
cdq
idiv esi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0xc]
movzx edx, byte [edx + eax]
mov eax, dword [esp + 0x10]
or eax, edx
shl eax, 8
mov dword [esp + 0x10], eax
lea eax, [ecx + 2]
cdq
idiv esi
mov eax, dword [ebp + 0xc]
movzx edx, byte [edx + eax]
mov eax, dword [esp + 0x10]
or eax, edx
shl eax, 8
mov dword [esp + 0x10], eax
lea eax, [ecx + 3]
cdq
idiv esi
movzx eax, byte [edx + ebx]
mov edx, dword [esp + 0x10]
or edx, eax
xor dword [edi - 4], edx
lea eax, [ecx + 4]
cdq
idiv esi
sub dword [esp + 0xc], 1
movzx eax, dx
jne 0x439f50
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea esi, [edi + 0x1004]
lea ebx, [eax + 9]
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call fcn.00439d40
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esi - 4], edx
mov dword [esi], eax
add esp, 4
add esi, 8
sub ebx, 1
jne 0x439fd6
mov esi, edi
mov dword [esp + 0xc], 4
mov ebx, 0x80
lea esp, [esp]
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call fcn.00439d40
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esi], edx
mov dword [esi + 4], eax
add esp, 4
add esi, 8
sub ebx, 1
jne 0x43a010
sub dword [esp + 0xc], 1
jne 0x43a004
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a2a0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or eax, ecx
mov ecx, edx
ror ecx, 8
push ebx
and ecx, 0xff00ff00
push ebp
rol edx, 8
and edx, 0xff00ff
push esi
push edi
mov edi, dword [esp + 0x14]
or ecx, edx
xor edx, edx
mov edi, edi
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
mov ebx, esi
ror ebx, 8
and ebx, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
or ebx, esi
add ebx, edx
mov esi, ecx
shr esi, 5
mov ebp, ecx
shl ebp, 4
xor esi, ebp
add esi, ecx
xor ebx, esi
sub edx, 0x61c88647
add eax, ebx
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
mov ebx, esi
ror ebx, 8
and ebx, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
or ebx, esi
mov esi, eax
shr esi, 5
mov ebp, eax
shl ebp, 4
xor esi, ebp
add ebx, edx
add esi, eax
xor ebx, esi
add ecx, ebx
cmp edx, 0xc6ef3720
jne 0x43a2e0
mov edx, eax
ror edx, 8
and edx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or edx, eax
mov eax, dword [esp + 0x18]
mov dword [eax], edx
mov edx, ecx
ror edx, 8
and edx, 0xff00ff00
pop edi
rol ecx, 8
pop esi
and ecx, 0xff00ff
or edx, ecx
pop ebp
mov dword [eax + 4], edx
pop ebx
ret

Function at 0x43a390
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [edx]
mov edx, dword [edx + 4]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, edx
ror eax, 8
push ebx
and eax, 0xff00ff00
rol edx, 8
push ebp
and edx, 0xff00ff
push esi
push edi
mov edi, dword [esp + 0x14]
or eax, edx
mov edx, 0xc6ef3720
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
mov ebx, esi
ror ebx, 8
and ebx, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
or ebx, esi
add ebx, edx
mov esi, ecx
shr esi, 5
mov ebp, ecx
shl ebp, 4
xor esi, ebp
add esi, ecx
xor ebx, esi
add edx, 0x61c88647
sub eax, ebx
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
mov ebx, esi
ror ebx, 8
and ebx, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
or ebx, esi
mov esi, eax
shr esi, 5
mov ebp, eax
shl ebp, 4
xor esi, ebp
add ebx, edx
add esi, eax
xor ebx, esi
sub ecx, ebx
test edx, edx
jne 0x43a3d0
mov edx, ecx
ror edx, 8
and edx, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or edx, ecx
mov ecx, dword [esp + 0x18]
mov dword [ecx], edx
mov edx, eax
ror edx, 8
and edx, 0xff00ff00
pop edi
rol eax, 8
pop esi
and eax, 0xff00ff
or edx, eax
pop ebp
mov dword [ecx + 4], edx
pop ebx
ret
Function at 0x43dc60
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
push edi
mov eax, 0x49c718
dec eax
mov edi, 0x49c718
mov byte [0x49c218], 0
mov byte [0x49c718], 1
mov byte [0x49c219], 0
mov byte [0x49c719], 3
mov byte [0x49c21b], 1
mov edx, 2
lea esi, [eax + 2]
sub edi, eax
lea esp, [esp]
mov bl, byte [esi]
mov al, bl
call fcn.00443ca0
xor al, bl
mov byte [edi + esi], al
movzx eax, al
mov byte [eax + 0x49c218], dl
inc edx
inc esi
cmp edx, 0x100
jl 0x43dca0
mov byte [0x49c990], 0x63
mov byte [0x49c8f3], 0
mov ebx, 1
mov al, bl
call fcn.0043dc30
movzx ecx, al
mov byte [ebx + 0x49c990], al
mov byte [ecx + 0x49c890], bl
inc ebx
cmp ebx, 0x100
jl 0x43dcd4
mov al, 1
mov edx, 0x49c818
lea ebx, [ebx]
movzx ecx, al
mov dword [edx], ecx
call fcn.00443ca0
add edx, 4
cmp edx, 0x49c890
jl 0x43dd00
xor esi, esi
jmp 0x43dd20
mov dl, byte [esi + 0x49c990]
mov al, dl
call fcn.00443ca0
mov cl, al
xor cl, dl
mov byte [esp + 0xf], cl
lea ecx, [esp + 0xc]
mov byte [esp + 0xe], dl
mov byte [esp + 0xd], dl
mov byte [esp + 0xc], al
call fcn.0043da90
mov bl, byte [esi + 0x49c890]
mov dword [esi*4 + 0x49c318], eax
mov al, byte [0x4973bc]
mov cl, bl
call fcn.0043dad0
mov byte [esp + 0xf], al
mov al, byte [0x4973bd]
mov cl, bl
call fcn.0043dad0
mov byte [esp + 0xe], al
mov al, byte [0x4973be]
mov cl, bl
call fcn.0043dad0
mov byte [esp + 0xd], al
mov al, byte [0x4973bf]
mov cl, bl
call fcn.0043dad0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.0043da90
mov dword [esi*4 + 0x49ca90], eax
inc esi
cmp esi, 0x100
jl 0x43dd20
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x43e0e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x68]
mov ebx, dword [edi + 4]
xor esi, esi
mov dword [esp + 0x20], ebx
test ebx, ebx
jle 0x43e120
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
lea ebp, [edi + 0x3c]
mov ecx, dword [esp + 0x10]
call fcn.0043da90
xor eax, dword [ebp]
add dword [esp + 0x10], 4
mov dword [esp + esi*4 + 0x24], eax
inc esi
add ebp, 4
cmp esi, ebx
jl 0x43e103
mov ecx, dword [edi + 8]
cmp ecx, 1
lea esi, [esp + 0x44]
mov edx, ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x14], esi
jle 0x43e1e6
dec ecx
mov dword [esp + 0x18], ecx
nop
test ebx, ebx
jle 0x43e1d1
mov ebp, eax
lea ecx, [edi + 0xc]
lea edi, [edi + edx*4 + 0x3c]
sub ebp, esi
add edx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edx
lea ecx, [ecx]
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x49c318]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x49c318]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x49c318]
ror ebx, 8
xor edx, ebx
movzx ebx, byte [esi + ebp]
xor edx, dword [ebx*4 + 0x49c318]
add edi, 4
xor edx, dword [edi - 4]
add esi, 4
mov dword [esi - 4], edx
add ecx, 3
sub dword [esp + 0x10], 1
jne 0x43e160
mov edi, dword [esp + 0x68]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
sub dword [esp + 0x18], 1
mov ecx, eax
mov eax, esi
mov esi, ecx
mov dword [esp + 0x14], esi
jne 0x43e140
test ebx, ebx
jle 0x43e279
lea edx, [edi + edx*4 + 0x3c]
mov dword [esp + 0x18], edx
mov edx, eax
sub edx, esi
lea ecx, [edi + 0xc]
mov ebp, esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
shr edx, 8
movzx edx, dl
movzx edi, byte [edx + 0x49c990]
movzx edx, byte [ecx + 1]
movzx edx, byte [eax + edx*4 + 2]
movzx edx, byte [edx + 0x49c990]
rol edi, 8
rol edx, 0x10
xor edi, edx
movzx edx, byte [ecx + 2]
movzx edx, byte [eax + edx*4 + 3]
movzx edx, byte [edx + 0x49c990]
ror edx, 8
xor edi, edx
mov edx, dword [esp + 0x20]
movzx edx, byte [edx + ebp]
movzx edx, byte [edx + 0x49c990]
xor edi, edx
mov edx, dword [esp + 0x18]
xor edi, dword [edx]
add edx, 4
mov dword [ebp], edi
add ebp, 4
add ecx, 3
sub dword [esp + 0x14], 1
mov dword [esp + 0x18], edx
jne 0x43e207
mov edi, dword [esp + 0x68]
xor ebp, ebp
test ebx, ebx
jle 0x43e2a7
mov ecx, dword [esp + 0x6c]
mov ebx, eax
sub ebx, esi
mov eax, dword [esi]
call fcn.0043dab0
mov dword [esi], 0
mov dword [ebx + esi], 0
inc ebp
add esi, 4
add ecx, 4
cmp ebp, dword [edi + 4]
jl 0x43e287
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
Function at 0x43e2b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x68]
mov ebx, dword [edi + 4]
xor esi, esi
mov dword [esp + 0x20], ebx
test ebx, ebx
jle 0x43e2f3
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
lea ebp, [edi + 0x21c]
mov ecx, dword [esp + 0x10]
call fcn.0043da90
xor eax, dword [ebp]
add dword [esp + 0x10], 4
mov dword [esp + esi*4 + 0x24], eax
inc esi
add ebp, 4
cmp esi, ebx
jl 0x43e2d6
mov ecx, dword [edi + 8]
cmp ecx, 1
lea esi, [esp + 0x44]
mov edx, ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x14], esi
jle 0x43e3b8
dec ecx
mov dword [esp + 0x18], ecx
test ebx, ebx
jle 0x43e3a3
mov ebp, eax
lea ecx, [edi + 0x24]
lea edi, [edi + edx*4 + 0x21c]
sub ebp, esi
add edx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x49ca90]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x49ca90]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x49ca90]
ror ebx, 8
xor edx, ebx
movzx ebx, byte [esi + ebp]
xor edx, dword [ebx*4 + 0x49ca90]
add edi, 4
xor edx, dword [edi - 4]
add esi, 4
mov dword [esi - 4], edx
add ecx, 3
sub dword [esp + 0x10], 1
jne 0x43e332
mov edi, dword [esp + 0x68]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
sub dword [esp + 0x18], 1
mov ecx, eax
mov eax, esi
mov esi, ecx
mov dword [esp + 0x14], esi
jne 0x43e312
test ebx, ebx
jle 0x43e452
lea edx, [edi + edx*4 + 0x21c]
mov dword [esp + 0x18], edx
mov edx, eax
sub edx, esi
lea ecx, [edi + 0x24]
mov ebp, esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ebx
lea esp, [esp]
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
shr edx, 8
movzx edx, dl
movzx edi, byte [edx + 0x49c890]
movzx edx, byte [ecx + 1]
movzx edx, byte [eax + edx*4 + 2]
movzx edx, byte [edx + 0x49c890]
rol edi, 8
rol edx, 0x10
xor edi, edx
movzx edx, byte [ecx + 2]
movzx edx, byte [eax + edx*4 + 3]
movzx edx, byte [edx + 0x49c890]
ror edx, 8
xor edi, edx
mov edx, dword [esp + 0x20]
movzx edx, byte [edx + ebp]
movzx edx, byte [edx + 0x49c890]
xor edi, edx
mov edx, dword [esp + 0x18]
xor edi, dword [edx]
add edx, 4
mov dword [ebp], edi
add ebp, 4
add ecx, 3
sub dword [esp + 0x14], 1
mov dword [esp + 0x18], edx
jne 0x43e3e0
mov edi, dword [esp + 0x68]
xor ebp, ebp
test ebx, ebx
jle 0x43e480
mov ecx, dword [esp + 0x6c]
mov ebx, eax
sub ebx, esi
mov eax, dword [esi]
call fcn.0043dab0
mov dword [esi], 0
mov dword [ebx + esi], 0
inc ebp
add esi, 4
add ecx, 4
cmp ebp, dword [edi + 4]
jl 0x43e460
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
Function at 0x43e910
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebp
push esi
push edi
push 0x800
add eax, 0x880
push 0
push eax
call fcn.00458750
add esp, 0xc
mov dword [esp + 0xc], 0
mov edi, 0x110
lea esp, [esp]
xor eax, eax
jmp 0x43e950
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov ebp, 2
mov esi, 1
lea ebx, [ebx]
movsx ecx, byte [esi + 0x4973bf]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [esp + 0xc]
jne 0x43e9b0
and ecx, 3
test dword [ecx*4 + 0x4976f8], eax
je 0x43e9b0
mov edx, dword [esp + 0x14]
sar edx, 3
add edx, dword [esp + 0x1c]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, dword [esp + 0x14]
and edx, 7
mov dl, byte [edx*4 + 0x4976d8]
or byte [ecx], dl
movsx ecx, byte [esi + 0x4973c0]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [esp + 0xc]
jne 0x43e9ec
and ecx, 3
test dword [ecx*4 + 0x4976f8], eax
je 0x43e9ec
mov edx, esi
sar edx, 3
add edx, dword [esp + 0x1c]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, esi
and edx, 7
mov dl, byte [edx*4 + 0x4976d8]
or byte [ecx], dl
movsx ecx, byte [ebp + 0x4973c0]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [esp + 0xc]
jne 0x43ea28
and ecx, 3
test dword [ecx*4 + 0x4976f8], eax
je 0x43ea28
mov edx, ebp
sar edx, 3
add edx, dword [esp + 0x1c]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, ebp
and edx, 7
mov dl, byte [edx*4 + 0x4976d8]
or byte [ecx], dl
mov ecx, dword [esp + 0x10]
movsx ecx, byte [ecx + 0x4973c0]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [esp + 0xc]
jne 0x43ea6c
and ecx, 3
test dword [ecx*4 + 0x4976f8], eax
je 0x43ea6c
mov edx, dword [esp + 0x10]
sar edx, 3
add edx, dword [esp + 0x1c]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, dword [esp + 0x10]
and edx, 7
mov dl, byte [edx*4 + 0x4976d8]
or byte [ecx], dl
mov ecx, 4
add dword [esp + 0x14], ecx
add dword [esp + 0x10], ecx
add esi, ecx
add ebp, ecx
cmp esi, 0x41
jl 0x43e970
inc eax
cmp eax, 0x10
jl 0x43e950
inc dword [esp + 0xc]
add edi, 0x10
cmp edi, 0x210
jl 0x43e940
pop edi
pop esi
pop ebp
add esp, 0xc
ret