joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43eab0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebp
push esi
push edi
push 0x800
add eax, 0x1080
push 0
push eax
call fcn.00458750
add esp, 0xc
mov dword [esp + 0xc], 0
mov edi, 0x210
lea esp, [esp]
xor eax, eax
jmp 0x43eaf0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov ebp, 2
mov esi, 1
lea ebx, [ebx]
movsx ecx, byte [esi + str._a__b0]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [esp + 0xc]
jne 0x43eb50
and ecx, 3
test dword [ecx*4 + 0x4976f8], eax
je 0x43eb50
mov edx, dword [esp + 0x14]
sar edx, 3
add edx, dword [esp + 0x1c]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, dword [esp + 0x14]
and edx, 7
mov dl, byte [edx*4 + 0x4976d8]
or byte [ecx], dl
movsx ecx, byte [esi + 0x497400]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [esp + 0xc]
jne 0x43eb8c
and ecx, 3
test dword [ecx*4 + 0x4976f8], eax
je 0x43eb8c
mov edx, esi
sar edx, 3
add edx, dword [esp + 0x1c]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, esi
and edx, 7
mov dl, byte [edx*4 + 0x4976d8]
or byte [ecx], dl
movsx ecx, byte [ebp + 0x497400]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [esp + 0xc]
jne 0x43ebc8
and ecx, 3
test dword [ecx*4 + 0x4976f8], eax
je 0x43ebc8
mov edx, ebp
sar edx, 3
add edx, dword [esp + 0x1c]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, ebp
and edx, 7
mov dl, byte [edx*4 + 0x4976d8]
or byte [ecx], dl
mov ecx, dword [esp + 0x10]
movsx ecx, byte [ecx + 0x497400]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [esp + 0xc]
jne 0x43ec0c
and ecx, 3
test dword [ecx*4 + 0x4976f8], eax
je 0x43ec0c
mov edx, dword [esp + 0x10]
sar edx, 3
add edx, dword [esp + 0x1c]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, dword [esp + 0x10]
and edx, 7
mov dl, byte [edx*4 + 0x4976d8]
or byte [ecx], dl
mov ecx, 4
add dword [esp + 0x14], ecx
add dword [esp + 0x10], ecx
add esi, ecx
add ebp, ecx
cmp esi, 0x41
jl 0x43eb10
inc eax
cmp eax, 0x10
jl 0x43eaf0
inc dword [esp + 0xc]
add edi, 0x10
cmp edi, 0x310
jl 0x43eae0
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x43ec50
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0x28
mov eax, dword [0x498fa4]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
xor ecx, ecx
push edi
xor eax, eax
movsx esi, byte [eax + 0x4976b8]
dec esi
cmp esi, ecx
je 0x43ec7a
inc eax
cmp eax, 0x20
jl 0x43ec66
jmp 0x43ec7e
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 0x20
jl 0x43ec64
lea edi, [esp + 0x15]
mov ebx, 0x4974b8
lea eax, [edx + 0x80]
xor esi, esi
mov dword [esp + 0x10], eax
lea esp, [esp]
mov eax, esi
sar eax, 1
mov ecx, esi
and ecx, 1
and eax, 0xf
shl ecx, 4
or eax, ecx
mov ecx, esi
and ecx, 0x20
or eax, ecx
movsx eax, byte [ebx + eax]
xor edx, edx
test al, 8
je 0x43ecd4
movsx edx, byte [edi - 1]
mov ecx, 0x1f
sub ecx, edx
mov edx, 1
shl edx, cl
test al, 4
je 0x43eceb
movsx ebp, byte [edi]
mov ecx, 0x1f
sub ecx, ebp
mov ebp, 1
shl ebp, cl
or edx, ebp
test al, 2
je 0x43ed03
movsx ebp, byte [edi + 1]
mov ecx, 0x1f
sub ecx, ebp
mov ebp, 1
shl ebp, cl
or edx, ebp
test al, 1
je 0x43ed1b
movsx eax, byte [edi + 2]
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
or edx, eax
mov eax, dword [esp + 0x10]
mov dword [eax], edx
inc esi
add eax, 4
cmp esi, 0x40
mov dword [esp + 0x10], eax
jl 0x43eca0
add ebx, 0x40
add edi, 4
cmp ebx, 0x4976b8
jl 0x43ec93
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00457fc4
add esp, 0x28
ret
Function at 0x43f630
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
lea esi, [ecx + 0x1000]
mov dword [esp + 0x14], 0x10
nop
xor eax, dword [esi]
add esi, 4
mov ebx, eax
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ecx + ebx*4 + 0x400]
mov ebp, eax
shr ebp, 0x18
add ebx, dword [ecx + ebp*4]
mov ebp, eax
shr ebp, 8
and ebp, 0xff
xor ebx, dword [ecx + ebp*4 + 0x800]
mov edi, eax
and eax, 0xff
add ebx, dword [ecx + eax*4 + 0xc00]
xor ebx, edx
sub dword [esp + 0x14], 1
mov eax, ebx
mov edx, edi
jne 0x43f650
mov esi, dword [ecx + 0x1040]
mov ecx, dword [ecx + 0x1044]
xor esi, eax
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax + 4], esi
pop esi
xor ecx, edx
pop ebp
mov dword [eax], ecx
pop ebx
ret

Function at 0x43f6c0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
lea esi, [ecx + 0x1044]
mov dword [esp + 0x14], 0x10
nop
xor eax, dword [esi]
sub esi, 4
mov ebx, eax
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ecx + ebx*4 + 0x400]
mov ebp, eax
shr ebp, 0x18
add ebx, dword [ecx + ebp*4]
mov ebp, eax
shr ebp, 8
and ebp, 0xff
xor ebx, dword [ecx + ebp*4 + 0x800]
mov edi, eax
and eax, 0xff
add ebx, dword [ecx + eax*4 + 0xc00]
xor ebx, edx
sub dword [esp + 0x14], 1
mov eax, ebx
mov edx, edi
jne 0x43f6e0
mov esi, dword [ecx + 0x1004]
mov ecx, dword [ecx + 0x1000]
xor esi, eax
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax + 4], esi
pop esi
xor ecx, edx
pop ebp
mov dword [eax], ecx
pop ebx
ret
Function at 0x442710
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x1c], 0x20
je 0x442721
or eax, 0xffffffff
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [eax + 0xc]
push ebp
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax + 8]
lea eax, [ecx + 4]
lea ebp, [ecx + 8]
mov dword [esp + 0x1c], ebx
mov dword [ecx + 0xc], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [ecx], edx
mov dword [eax], esi
mov dword [ebp], edi
mov ebx, 0x2a
lea ecx, [ecx]
mov edi, dword [eax + 8]
mov edx, dword [eax - 4]
add edx, edi
mov esi, edx
and esi, 7
mov esi, dword [esi*4 + 0x47a914]
shr edx, 3
xor esi, edx
mov edx, dword [eax]
add edx, esi
mov dword [eax + 0xc], esi
mov esi, edx
and esi, 7
mov esi, dword [esi*4 + 0x47a914]
shr edx, 3
xor esi, edx
mov edx, dword [eax + 4]
add edx, esi
mov dword [eax + 0x10], esi
mov esi, edx
and esi, 7
mov esi, dword [esi*4 + 0x47a914]
shr edx, 3
xor esi, edx
mov dword [eax + 0x14], esi
lea edx, [esi + edi]
mov esi, edx
and esi, 7
mov esi, dword [esi*4 + 0x47a914]
shr edx, 3
xor esi, edx
mov edx, dword [eax + 0xc]
add edx, esi
mov dword [eax + 0x18], esi
mov esi, edx
and esi, 7
mov esi, dword [esi*4 + 0x47a914]
shr edx, 3
xor esi, edx
mov edx, dword [eax + 0x10]
add edx, esi
mov dword [eax + 0x1c], esi
mov esi, edx
and esi, 7
shr edx, 3
xor edx, dword [esi*4 + 0x47a914]
add eax, 0x18
sub ebx, 1
mov dword [eax + 8], edx
jne 0x442760
xor eax, eax
mov edx, dword [ecx + eax*4 + 0x164]
add dword [ecx + eax*4], edx
inc eax
cmp eax, 0x17
jb 0x442802
mov edx, dword [ecx + 0xec]
mov esi, dword [ecx + 0x84]
and edx, 0xff7fffff
or edx, 0x1000001
xor eax, eax
lea esp, [esp]
mov edi, dword [ecx + eax*4]
and esi, 0xff7fffff
add esi, edx
and edi, 0xffffff
xor edi, esi
mov dword [ecx + eax*4], edi
inc eax
cmp eax, 0x100
jb 0x442830
mov eax, dword [ecx]
mov edi, 2
mov dword [ecx + 0x400], eax
and esi, 0xff
mov eax, ebp
lea ebx, [edi + 0x3e]
lea edx, [edi - 2]
xor edx, esi
mov edx, dword [ecx + edx*4]
xor edx, esi
and edx, 0xff
mov esi, dword [ecx + edx*4]
mov dword [eax - 8], esi
mov esi, dword [eax - 4]
mov dword [ecx + edx*4], esi
lea esi, [edi - 1]
xor esi, edx
mov esi, dword [ecx + esi*4]
xor esi, edx
and esi, 0xff
mov edx, dword [ecx + esi*4]
mov dword [eax - 4], edx
mov edx, dword [eax]
mov dword [ecx + esi*4], edx
mov edx, edi
xor edx, esi
mov edx, dword [ecx + edx*4]
xor edx, esi
and edx, 0xff
mov esi, dword [ecx + edx*4]
mov dword [eax], esi
mov esi, dword [eax + 4]
mov dword [ecx + edx*4], esi
lea esi, [edi + 1]
xor esi, edx
mov esi, dword [ecx + esi*4]
xor esi, edx
and esi, 0xff
mov edx, dword [ecx + esi*4]
mov dword [eax + 4], edx
mov edx, dword [eax + 8]
add eax, 0x10
add edi, 4
sub ebx, 1
mov dword [ecx + esi*4], edx
jne 0x442866
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop edi
mov dword [ecx + 0x404], eax
mov eax, dword [esp + 0x14]
pop esi
mov dword [ecx + 0x408], edx
mov edx, dword [esp + 0x14]
pop ebp
mov dword [ecx + 0x414], ebx
mov dword [ecx + 0x40c], eax
mov dword [ecx + 0x410], edx
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x443e50
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
push edi
mov eax, 0x49d398
dec eax
mov edi, 0x49d398
mov byte [0x49ce98], 0
mov byte [0x49d398], 1
mov byte [0x49ce99], 0
mov byte [0x49d399], 3
mov byte [0x49ce9b], 1
mov edx, 2
lea esi, [eax + 2]
sub edi, eax
lea esp, [esp]
mov bl, byte [esi]
mov al, bl
call fcn.00443ca0
xor al, bl
mov byte [edi + esi], al
movzx eax, al
mov byte [eax + 0x49ce98], dl
inc edx
inc esi
cmp edx, 0x100
jl 0x443e90
mov byte [0x49d610], 0x63
mov byte [0x49d573], 0
mov ebx, 1
mov al, bl
call fcn.00443e20
movzx ecx, al
mov byte [ebx + 0x49d610], al
mov byte [ecx + 0x49d510], bl
inc ebx
cmp ebx, 0x100
jl 0x443ec4
mov al, 1
mov edx, 0x49d498
lea ebx, [ebx]
movzx ecx, al
mov dword [edx], ecx
call fcn.00443ca0
add edx, 4
cmp edx, 0x49d510
jl 0x443ef0
xor esi, esi
jmp 0x443f10
mov dl, byte [esi + 0x49d610]
mov al, dl
call fcn.00443ca0
mov cl, al
xor cl, dl
mov byte [esp + 0xf], cl
lea ecx, [esp + 0xc]
mov byte [esp + 0xe], dl
mov byte [esp + 0xd], dl
mov byte [esp + 0xc], al
call fcn.0043da90
mov bl, byte [esi + 0x49d510]
mov dword [esi*4 + 0x49cf98], eax
mov al, byte [0x497a08]
mov cl, bl
call fcn.00443cc0
mov byte [esp + 0xf], al
mov al, byte [0x497a09]
mov cl, bl
call fcn.00443cc0
mov byte [esp + 0xe], al
mov al, byte [0x497a0a]
mov cl, bl
call fcn.00443cc0
mov byte [esp + 0xd], al
mov al, byte [0x497a0b]
mov cl, bl
call fcn.00443cc0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.0043da90
mov dword [esi*4 + 0x49d710], eax
inc esi
cmp esi, 0x100
jl 0x443f10
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4442a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x68]
mov ebx, dword [edi + 4]
xor esi, esi
mov dword [esp + 0x20], ebx
test ebx, ebx
jle 0x4442e0
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
lea ebp, [edi + 0x3c]
mov ecx, dword [esp + 0x10]
call fcn.0043da90
xor eax, dword [ebp]
add dword [esp + 0x10], 4
mov dword [esp + esi*4 + 0x24], eax
inc esi
add ebp, 4
cmp esi, ebx
jl 0x4442c3
mov ecx, dword [edi + 8]
cmp ecx, 1
lea esi, [esp + 0x44]
mov edx, ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x14], esi
jle 0x4443a6
dec ecx
mov dword [esp + 0x18], ecx
nop
test ebx, ebx
jle 0x444391
mov ebp, eax
lea ecx, [edi + 0xc]
lea edi, [edi + edx*4 + 0x3c]
sub ebp, esi
add edx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edx
lea ecx, [ecx]
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x49cf98]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x49cf98]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x49cf98]
ror ebx, 8
xor edx, ebx
movzx ebx, byte [esi + ebp]
xor edx, dword [ebx*4 + 0x49cf98]
add edi, 4
xor edx, dword [edi - 4]
add esi, 4
mov dword [esi - 4], edx
add ecx, 3
sub dword [esp + 0x10], 1
jne 0x444320
mov edi, dword [esp + 0x68]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
sub dword [esp + 0x18], 1
mov ecx, eax
mov eax, esi
mov esi, ecx
mov dword [esp + 0x14], esi
jne 0x444300
test ebx, ebx
jle 0x444439
lea edx, [edi + edx*4 + 0x3c]
mov dword [esp + 0x18], edx
mov edx, eax
sub edx, esi
lea ecx, [edi + 0xc]
mov ebp, esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
shr edx, 8
movzx edx, dl
movzx edi, byte [edx + 0x49d610]
movzx edx, byte [ecx + 1]
movzx edx, byte [eax + edx*4 + 2]
movzx edx, byte [edx + 0x49d610]
rol edi, 8
rol edx, 0x10
xor edi, edx
movzx edx, byte [ecx + 2]
movzx edx, byte [eax + edx*4 + 3]
movzx edx, byte [edx + 0x49d610]
ror edx, 8
xor edi, edx
mov edx, dword [esp + 0x20]
movzx edx, byte [edx + ebp]
movzx edx, byte [edx + 0x49d610]
xor edi, edx
mov edx, dword [esp + 0x18]
xor edi, dword [edx]
add edx, 4
mov dword [ebp], edi
add ebp, 4
add ecx, 3
sub dword [esp + 0x14], 1
mov dword [esp + 0x18], edx
jne 0x4443c7
mov edi, dword [esp + 0x68]
xor ebp, ebp
test ebx, ebx
jle 0x444467
mov ecx, dword [esp + 0x6c]
mov ebx, eax
sub ebx, esi
mov eax, dword [esi]
call fcn.0043dab0
mov dword [esi], 0
mov dword [ebx + esi], 0
inc ebp
add esi, 4
add ecx, 4
cmp ebp, dword [edi + 4]
jl 0x444447
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
Function at 0x444470
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x68]
mov ebx, dword [edi + 4]
xor esi, esi
mov dword [esp + 0x20], ebx
test ebx, ebx
jle 0x4444b3
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
lea ebp, [edi + 0x21c]
mov ecx, dword [esp + 0x10]
call fcn.0043da90
xor eax, dword [ebp]
add dword [esp + 0x10], 4
mov dword [esp + esi*4 + 0x24], eax
inc esi
add ebp, 4
cmp esi, ebx
jl 0x444496
mov ecx, dword [edi + 8]
cmp ecx, 1
lea esi, [esp + 0x44]
mov edx, ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x14], esi
jle 0x444578
dec ecx
mov dword [esp + 0x18], ecx
test ebx, ebx
jle 0x444563
mov ebp, eax
lea ecx, [edi + 0x24]
lea edi, [edi + edx*4 + 0x21c]
sub ebp, esi
add edx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x49d710]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x49d710]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x49d710]
ror ebx, 8
xor edx, ebx
movzx ebx, byte [esi + ebp]
xor edx, dword [ebx*4 + 0x49d710]
add edi, 4
xor edx, dword [edi - 4]
add esi, 4
mov dword [esi - 4], edx
add ecx, 3
sub dword [esp + 0x10], 1
jne 0x4444f2
mov edi, dword [esp + 0x68]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
sub dword [esp + 0x18], 1
mov ecx, eax
mov eax, esi
mov esi, ecx
mov dword [esp + 0x14], esi
jne 0x4444d2
test ebx, ebx
jle 0x444612
lea edx, [edi + edx*4 + 0x21c]
mov dword [esp + 0x18], edx
mov edx, eax
sub edx, esi
lea ecx, [edi + 0x24]
mov ebp, esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ebx
lea esp, [esp]
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
shr edx, 8
movzx edx, dl
movzx edi, byte [edx + 0x49d510]
movzx edx, byte [ecx + 1]
movzx edx, byte [eax + edx*4 + 2]
movzx edx, byte [edx + 0x49d510]
rol edi, 8
rol edx, 0x10
xor edi, edx
movzx edx, byte [ecx + 2]
movzx edx, byte [eax + edx*4 + 3]
movzx edx, byte [edx + 0x49d510]
ror edx, 8
xor edi, edx
mov edx, dword [esp + 0x20]
movzx edx, byte [edx + ebp]
movzx edx, byte [edx + 0x49d510]
xor edi, edx
mov edx, dword [esp + 0x18]
xor edi, dword [edx]
add edx, 4
mov dword [ebp], edi
add ebp, 4
add ecx, 3
sub dword [esp + 0x14], 1
mov dword [esp + 0x18], edx
jne 0x4445a0
mov edi, dword [esp + 0x68]
xor ebp, ebp
test ebx, ebx
jle 0x444640
mov ecx, dword [esp + 0x6c]
mov ebx, eax
sub ebx, esi
mov eax, dword [esi]
call fcn.0043dab0
mov dword [esi], 0
mov dword [ebx + esi], 0
inc ebp
add esi, 4
add ecx, 4
cmp ebp, dword [edi + 4]
jl 0x444620
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
Function at 0x4448a0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
push 0x2911
push 0xd
mov eax, esi
xor eax, 0x1fff
push eax
push 0x2911
push 0xd
push eax
push eax
call fcn.00444860
add esp, 0x10
push eax
call fcn.00444860
mov byte [esi + 0x4a0ce0], al
inc esi
add esp, 0x10
cmp esi, 0x2000
jb 0x4448a3
xor esi, esi
lea ecx, [ecx]
push 0xaa7
push 0xb
mov eax, esi
xor eax, 0x7ff
push eax
push 0xaa7
push 0xb
push eax
push eax
call fcn.00444860
add esp, 0x10
push eax
call fcn.00444860
mov byte [esi + 0x4a04e0], al
inc esi
add esp, 0x10
cmp esi, 0x800
jb 0x4448e0
xor eax, eax
pop esi
jmp 0x444920
mov ecx, eax
and ecx, 0xfffffff8
shl ecx, 7
mov edx, eax
and edx, 4
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 2
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 1
or ecx, edx
shl ecx, 7
mov dword [eax*8 + 0x49fce0], ecx
mov ecx, eax
and ecx, 0xffffff80
shl ecx, 7
mov edx, eax
and edx, 0x40
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 0x20
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 0x10
or ecx, edx
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov dword [eax*8 + 0x49fce4], ecx
inc eax
cmp eax, 0x100
jb 0x444920
ret
Function at 0x444990
Capabilities:
Decompress data using quicklz

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [edx]
push ebx
mov ebx, eax
push ebp
mov ebp, dword [esp + 0x14]
mov ecx, dword [ebp]
and eax, ecx
push esi
mov esi, dword [edx + 4]
push edi
mov edi, ecx
not edi
and ebx, edi
mov edx, esi
and esi, edi
or esi, eax
and edx, ecx
or edx, ebx
mov eax, esi
mov edi, esi
shr edi, 0x10
and edi, 0x7ff
movzx edi, byte [edi + 0x4a04e0]
mov ebx, dword [edi*8 + 0x49fce0]
mov edi, dword [edi*8 + 0x49fce4]
shr eax, 0x18
shr edi, 6
mov ecx, edx
shl ecx, 8
or eax, ecx
and eax, 0x1fff
movzx ecx, byte [eax + 0x4a0ce0]
mov eax, dword [ecx*8 + 0x49fce0]
mov ecx, dword [ecx*8 + 0x49fce4]
shr ecx, 7
or ecx, edi
mov edi, esi
shr edi, 8
and edi, 0x1fff
movzx edi, byte [edi + 0x4a0ce0]
shr eax, 7
shr ebx, 6
or eax, ebx
mov ebx, dword [edi*8 + 0x49fce0]
mov edi, dword [edi*8 + 0x49fce4]
shr edi, 5
or ecx, edi
mov edi, esi
and edi, 0x7ff
movzx edi, byte [edi + 0x4a04e0]
shr ebx, 5
or eax, ebx
mov ebx, dword [edi*8 + 0x49fce0]
mov edi, dword [edi*8 + 0x49fce4]
shr edi, 4
or ecx, edi
shl esi, 8
mov edi, edx
shr edi, 0x18
or edi, esi
and edi, 0x7ff
movzx esi, byte [edi + 0x4a04e0]
mov edi, dword [esi*8 + 0x49fce0]
mov esi, dword [esi*8 + 0x49fce4]
shr esi, 3
or ecx, esi
mov esi, edx
shr esi, 0x10
and esi, 0x1fff
movzx esi, byte [esi + 0x4a0ce0]
shr ebx, 4
shr edi, 3
or eax, ebx
or eax, edi
mov edi, dword [esi*8 + 0x49fce0]
mov esi, dword [esi*8 + 0x49fce4]
shr edi, 2
shr esi, 2
or eax, edi
or ecx, esi
mov esi, edx
shr esi, 8
and edx, 0x1fff
movzx edx, byte [edx + 0x4a0ce0]
and esi, 0x7ff
movzx esi, byte [esi + 0x4a04e0]
mov edi, dword [esi*8 + 0x49fce0]
mov esi, dword [esi*8 + 0x49fce4]
shr edi, 1
or eax, edi
or eax, dword [edx*8 + 0x49fce0]
shr esi, 1
or ecx, esi
or ecx, dword [edx*8 + 0x49fce4]
mov esi, dword [ebp + 4]
mov edi, esi
shr edi, 5
and edi, 0x700
mov edx, eax
shr edx, 0x18
or edx, edi
movzx edx, byte [edx + 0x4a04e0]
mov ebx, eax
shr ebx, 0x10
movzx edi, bl
mov ebx, esi
shr ebx, 2
and ebx, 0x700
or edi, ebx
movzx edi, byte [edi + 0x4a04e0]
shl edx, 8
or edx, edi
mov ebx, eax
shr ebx, 8
movzx edi, bl
mov ebx, esi
and ebx, 0x3e0
add ebx, ebx
add ebx, ebx
add ebx, ebx
or edi, ebx
movzx edi, byte [edi + 0x4a0ce0]
shl edx, 8
or edx, edi
and esi, 0x1f
movzx eax, al
shl edx, 8
shl esi, 8
or esi, eax
movzx eax, byte [esi + 0x4a0ce0]
mov esi, dword [esp + 0x14]
or edx, eax
xor dword [esi], edx
mov eax, dword [ebp + 4]
mov edi, eax
shr edi, 0x15
and edi, 0x700
mov edx, ecx
shr edx, 0x18
or edx, edi
movzx edx, byte [edx + 0x4a04e0]
mov ebx, ecx
shr ebx, 0x10
movzx edi, bl
mov ebx, eax
shr ebx, 0x12
and ebx, 0x700
or edi, ebx
movzx edi, byte [edi + 0x4a04e0]
shl edx, 8
or edx, edi
mov ebx, ecx
shr ebx, 8
movzx edi, bl
mov ebx, eax
shr ebx, 0xd
and ebx, 0x1f00
or edi, ebx
movzx edi, byte [edi + 0x4a0ce0]
shl edx, 8
or edx, edi
shr eax, 8
movzx ecx, cl
and eax, 0x1f00
or eax, ecx
movzx eax, byte [eax + 0x4a0ce0]
shl edx, 8
pop edi
or edx, eax
xor dword [esi + 4], edx
pop esi
pop ebp
pop ebx
ret
Function at 0x449910
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
push edi
mov eax, 0x49e018
dec eax
mov edi, 0x49e018
mov byte [0x49db18], 0
mov byte [0x49e018], 1
mov byte [0x49db19], 0
mov byte [0x49e019], 3
mov byte [0x49db1b], 1
mov edx, 2
lea esi, [eax + 2]
sub edi, eax
lea esp, [esp]
mov bl, byte [esi]
mov al, bl
call fcn.00443ca0
xor al, bl
mov byte [edi + esi], al
movzx eax, al
mov byte [eax + 0x49db18], dl
inc edx
inc esi
cmp edx, 0x100
jl 0x449950
mov byte [0x49e290], 0x63
mov byte [0x49e1f3], 0
mov ebx, 1
mov al, bl
call fcn.004498e0
movzx ecx, al
mov byte [ebx + 0x49e290], al
mov byte [ecx + 0x49e190], bl
inc ebx
cmp ebx, 0x100
jl 0x449984
mov al, 1
mov edx, 0x49e118
lea ebx, [ebx]
movzx ecx, al
mov dword [edx], ecx
call fcn.00443ca0
add edx, 4
cmp edx, 0x49e190
jl 0x4499b0
xor esi, esi
jmp 0x4499d0
mov dl, byte [esi + 0x49e290]
mov al, dl
call fcn.00443ca0
mov cl, al
xor cl, dl
mov byte [esp + 0xf], cl
lea ecx, [esp + 0xc]
mov byte [esp + 0xe], dl
mov byte [esp + 0xd], dl
mov byte [esp + 0xc], al
call fcn.0043da90
mov bl, byte [esi + 0x49e190]
mov dword [esi*4 + 0x49dc18], eax
mov al, byte [0x498ac0]
mov cl, bl
call fcn.00449780
mov byte [esp + 0xf], al
mov al, byte [0x498ac1]
mov cl, bl
call fcn.00449780
mov byte [esp + 0xe], al
mov al, byte [0x498ac2]
mov cl, bl
call fcn.00449780
mov byte [esp + 0xd], al
mov al, byte [0x498ac3]
mov cl, bl
call fcn.00449780
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.0043da90
mov dword [esi*4 + 0x49e390], eax
inc esi
cmp esi, 0x100
jl 0x4499d0
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x449d40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x68]
mov ebx, dword [edi + 4]
xor esi, esi
mov dword [esp + 0x20], ebx
test ebx, ebx
jle 0x449d80
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
lea ebp, [edi + 0x3c]
mov ecx, dword [esp + 0x10]
call fcn.0043da90
xor eax, dword [ebp]
add dword [esp + 0x10], 4
mov dword [esp + esi*4 + 0x24], eax
inc esi
add ebp, 4
cmp esi, ebx
jl 0x449d63
mov ecx, dword [edi + 8]
cmp ecx, 1
lea esi, [esp + 0x44]
mov edx, ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x14], esi
jle 0x449e46
dec ecx
mov dword [esp + 0x18], ecx
nop
test ebx, ebx
jle 0x449e31
mov ebp, eax
lea ecx, [edi + 0xc]
lea edi, [edi + edx*4 + 0x3c]
sub ebp, esi
add edx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edx
lea ecx, [ecx]
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x49dc18]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x49dc18]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x49dc18]
ror ebx, 8
xor edx, ebx
movzx ebx, byte [esi + ebp]
xor edx, dword [ebx*4 + 0x49dc18]
add edi, 4
xor edx, dword [edi - 4]
add esi, 4
mov dword [esi - 4], edx
add ecx, 3
sub dword [esp + 0x10], 1
jne 0x449dc0
mov edi, dword [esp + 0x68]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
sub dword [esp + 0x18], 1
mov ecx, eax
mov eax, esi
mov esi, ecx
mov dword [esp + 0x14], esi
jne 0x449da0
test ebx, ebx
jle 0x449ed9
lea edx, [edi + edx*4 + 0x3c]
mov dword [esp + 0x18], edx
mov edx, eax
sub edx, esi
lea ecx, [edi + 0xc]
mov ebp, esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ebx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
shr edx, 8
movzx edx, dl
movzx edi, byte [edx + 0x49e290]
movzx edx, byte [ecx + 1]
movzx edx, byte [eax + edx*4 + 2]
movzx edx, byte [edx + 0x49e290]
rol edi, 8
rol edx, 0x10
xor edi, edx
movzx edx, byte [ecx + 2]
movzx edx, byte [eax + edx*4 + 3]
movzx edx, byte [edx + 0x49e290]
ror edx, 8
xor edi, edx
mov edx, dword [esp + 0x20]
movzx edx, byte [edx + ebp]
movzx edx, byte [edx + 0x49e290]
xor edi, edx
mov edx, dword [esp + 0x18]
xor edi, dword [edx]
add edx, 4
mov dword [ebp], edi
add ebp, 4
add ecx, 3
sub dword [esp + 0x14], 1
mov dword [esp + 0x18], edx
jne 0x449e67
mov edi, dword [esp + 0x68]
xor ebp, ebp
test ebx, ebx
jle 0x449f07
mov ecx, dword [esp + 0x6c]
mov ebx, eax
sub ebx, esi
mov eax, dword [esi]
call fcn.0043dab0
mov dword [esi], 0
mov dword [ebx + esi], 0
inc ebp
add esi, 4
add ecx, 4
cmp ebp, dword [edi + 4]
jl 0x449ee7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret