joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4389b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478e03
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4a100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov bl, byte [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], 0x73626770
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov byte [esi + 0x18], 1
mov byte [esi + 0x19], bl
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x28]
mov dword [esi], vtable.AP4_SbgpAtom.0
mov dword [ecx], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], vtable.AP4_Array_struct_AP4_SbgpAtom::Entry_.0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
xor eax, eax
mov byte [ebp - 4], 1
cmp byte [esi + 0x18], al
mov edx, 8
push ecx
mov ecx, dword [ebp + 0x14]
setne al
lea eax, [eax*4 + 8]
sub edi, eax
xor eax, eax
cmp dword [esi + 0xc], 1
cmove eax, edx
sub edi, eax
call fcn.0040bdb0
sub edi, 4
cmp bl, 1
mov ebx, dword [ebp + 0x14]
jb 0x438a8f
lea eax, [esi + 0x2c]
mov ecx, ebx
push eax
call fcn.0040bdb0
sub edi, 4
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
mov ecx, ebx
call fcn.0040bdb0
test eax, eax
jne 0x438b6d
sub edi, 4
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
lea ecx, [edi*8]
cmp dword [ebp + 8], ecx
jb 0x438b6d
cmp edi, dword [esi + 0x38]
je 0x438b33
jb 0x438b30
cmp edi, dword [esi + 0x34]
jbe 0x438b19
push ecx
call fcn.004717ef
mov ecx, dword [esi + 0x38]
add esp, 4
mov ebx, eax
test ecx, ecx
je 0x438b13
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x438b13
xor edx, edx
test ecx, ecx
je 0x438b0a
nop dword [eax]
mov ecx, dword [esi + 0x3c]
mov eax, dword [ecx + edx*8]
mov dword [ebx + edx*8], eax
mov eax, dword [ecx + edx*8 + 4]
mov dword [ebx + edx*8 + 4], eax
inc edx
cmp edx, dword [esi + 0x38]
jb 0x438af0
mov eax, dword [esi + 0x3c]
push eax
call fcn.0047181f
add esp, 4
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x34], edi
mov ecx, dword [esi + 0x38]
cmp ecx, edi
jae 0x438b30
mov eax, dword [esi + 0x3c]
xorps xmm0, xmm0
movq qword [eax + ecx*8], xmm0
inc ecx
cmp ecx, edi
jb 0x438b20
mov dword [esi + 0x38], edi
xor ebx, ebx
test edi, edi
je 0x438b6d
nop dword [eax]
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push eax
call fcn.0040bdb0
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
call fcn.0040bdb0
mov ecx, dword [esi + 0x3c]
mov eax, dword [ebp - 0x18]
mov dword [ecx + ebx*8], eax
mov eax, dword [ebp - 0x14]
mov dword [ecx + ebx*8 + 4], eax
inc ebx
cmp ebx, edi
jb 0x438b40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x438f20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478e73
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4a100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0x7363686d
mov dword [esi + 0xc], 0x14
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov word [esi + 0x18], 1
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x34]
mov dword [ebp - 4], 0
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [esi], vtable.AP4_SchmAtom.0
mov byte [esi + 0x28], 0
mov dword [esi + 0x30], eax
mov dword [ecx], 0x4a7274
mov dword [ecx + 4], 0
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 1
test eax, eax
je 0x438fc5
push eax
call fcn.0043a290
mov eax, dword [esi + 0x38]
inc eax
mov dword [esi + 0x1c], 1
add dword [esi + 0xc], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x439480
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478ea3
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4a100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov al, byte [ebp + 0xc]
mov esi, dword [ebp + 8]
mov byte [edi + 0x19], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], 0x73677064
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [edi + 0x18], 1
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 0
lea eax, [edi + 0x28]
mov dword [edi], vtable.AP4_SgpdAtom.0
mov dword [eax], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], vtable.AP4_List_class_AP4_DataBuffer_.0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov ecx, dword [ebp + 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.0040bdb0
add esi, 0xfffffff0
cmp byte [ebp + 0xc], 1
mov dword [ebp + 8], esi
jb 0x439542
mov ecx, dword [ebp + 0x14]
lea eax, [edi + 0x2c]
push eax
call fcn.0040bdb0
sub esi, 4
mov dword [ebp + 8], esi
mov ecx, dword [ebp + 0x14]
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], 0
call fcn.0040bdb0
test eax, eax
jne 0x439674
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub eax, 4
mov dword [ebp + 8], eax
mov dword [ebp + 0x10], ecx
test ecx, ecx
je 0x439674
cmp byte [edi + 0x19], 0
mov esi, dword [edi + 0x2c]
mov dword [ebp - 0x10], esi
jne 0x439584
mov esi, eax
jmp 0x4395a4
test esi, esi
jne 0x43959c
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x10]
push eax
call fcn.0040bdb0
mov ecx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp + 8]
cmp esi, eax
ja 0x439668
push 0x14
call fcn.004717ef
mov dword [ebp + 0xc], eax
xorps xmm0, xmm0
add esp, 4
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax], vtable.AP4_DataBuffer.0
mov byte [eax + 4], 1
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
test esi, esi
je 0x4395ff
push esi
mov ecx, eax
call fcn.00421500
test eax, eax
mov eax, dword [ebp + 0xc]
jne 0x4395f3
mov dword [eax + 0x10], esi
mov ecx, dword [ebp + 0x14]
push esi
push dword [eax + 8]
call fcn.0040b9b0
push 0xc
call fcn.004717ef
mov ecx, eax
xorps xmm0, xmm0
mov dword [ebp - 0x10], ecx
add esp, 4
mov eax, dword [ebp + 0xc]
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x43964b
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0
mov eax, dword [edi + 0x3c]
mov dword [eax + 4], ecx
mov dword [edi + 0x3c], ecx
jmp 0x43965f
mov dword [edi + 0x38], ecx
mov dword [edi + 0x3c], ecx
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
inc dword [edi + 0x34]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
jne 0x439574
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43b9f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479063
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4a100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov al, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov byte [esi + 0x19], al
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], 0x73747a32
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov byte [esi + 0x18], 1
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.AP4_Stz2Atom.0
mov byte [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], vtable.AP4_Array_unsigned_int_.0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov byte [ebp - 4], 1
cmp ecx, 0x14
jb 0x43bba1
mov edi, dword [ebp + 0x14]
lea eax, [ebp + 0xf]
push eax
mov ecx, edi
call fcn.0040bf70
lea eax, [ebp + 0xf]
mov ecx, edi
push eax
call fcn.0040bf70
lea eax, [ebp + 0xf]
mov ecx, edi
push eax
call fcn.0040bf70
lea eax, [ebp + 0xf]
mov ecx, edi
push eax
call fcn.0040bf70
mov bl, byte [ebp + 0xf]
cmp bl, 4
je 0x43bad3
cmp bl, 8
je 0x43bad3
cmp bl, 0x10
jne 0x43bba1
lea eax, [ebp + 0x10]
mov ecx, edi
push eax
call fcn.0040bdb0
movzx ecx, byte [ebp + 0xf]
mov eax, dword [ebp + 8]
mov byte [esi + 0x28], bl
add eax, 0xffffffec
mov ebx, dword [ebp + 0x10]
imul ecx, ebx
mov dword [esi + 0x2c], ebx
add ecx, 7
shr ecx, 3
mov dword [ebp + 0xc], ecx
cmp ecx, eax
ja 0x43bba1
push ecx
call fcn.004717e6
mov ecx, dword [ebp + 0x14]
add esp, 4
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0040b9b0
test eax, eax
jne 0x43bb98
push ebx
lea ecx, [esi + 0x30]
call fcn.00412f40
mov al, byte [esi + 0x28]
cmp al, 4
je 0x43bb72
cmp al, 8
je 0x43bb5b
cmp al, 0x10
jne 0x43bb98
xor edx, edx
test ebx, ebx
je 0x43bb98
nop
movzx ecx, byte [edi + edx*2]
movzx eax, byte [edi + edx*2 + 1]
shl ecx, 8
or ecx, eax
mov eax, dword [esi + 0x3c]
mov dword [eax + edx*4], ecx
inc edx
cmp edx, ebx
jb 0x43bb40
jmp 0x43bb98
xor edx, edx
test ebx, ebx
je 0x43bb98
mov eax, dword [esi + 0x3c]
movzx ecx, byte [edx + edi]
mov dword [eax + edx*4], ecx
inc edx
cmp edx, ebx
jb 0x43bb61
jmp 0x43bb98
xor edx, edx
test ebx, ebx
je 0x43bb98
mov eax, edx
shr eax, 1
movzx ecx, byte [eax + edi]
mov eax, dword [esi + 0x3c]
test dl, 1
jne 0x43bb8d
shr ecx, 4
jmp 0x43bb90
and ecx, 0xf
mov dword [eax + edx*4], ecx
inc edx
cmp edx, ebx
jb 0x43bb78
push edi
call fcn.004717e1
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43ebb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [edx + 0x104], 0x11
movzx edi, byte [ecx + 3]
movzx eax, byte [ecx + 2]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ecx]
shl edi, 8
or edi, eax
mov dword [edx], edi
movzx ebx, byte [ecx + 7]
movzx eax, byte [ecx + 6]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 5]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 4]
shl ebx, 8
or ebx, eax
mov dword [edx + 4], ebx
movzx eax, byte [ecx + 0xa]
mov dword [ebp + 8], ebx
movzx ebx, byte [ecx + 0xb]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 9]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 8]
shl ebx, 8
or ebx, eax
mov dword [edx + 8], ebx
movzx eax, byte [ecx + 0xe]
mov dword [ebp - 4], ebx
movzx ebx, byte [ecx + 0xf]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 0xd]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 0xc]
shl ebx, 8
or ebx, eax
lea eax, [edx + 0x14]
mov dword [edx + 0xc], ebx
xor esi, esi
mov dword [edx + 0x100], 0xa
nop
mov ecx, ebx
lea eax, [eax + 0x10]
shr ecx, 0x10
movzx edx, cl
mov ecx, ebx
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x482508]
xor edx, dword [ecx*4 + str.cwko0]
mov ecx, ebx
shr ecx, 0x18
xor edx, dword [ecx*4 + 0x482908]
movzx ecx, bl
xor edx, dword [ecx*4 + 0x482d08]
xor edx, dword [esi + 0x484108]
add esi, 4
xor edx, edi
mov dword [eax - 0x14], edx
mov edi, edx
xor edx, dword [ebp + 8]
mov dword [eax - 0x10], edx
mov dword [ebp + 8], edx
xor edx, dword [ebp - 4]
xor ebx, edx
mov dword [eax - 0xc], edx
mov dword [eax - 8], ebx
mov dword [ebp - 4], edx
cmp esi, 0x28
jb 0x43ec60
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ecd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [edi + 0x104], 0x12
lea esi, [edi + 0x14]
movzx edx, byte [ecx + 3]
movzx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 1]
shl edx, 8
or edx, eax
movzx eax, byte [ecx]
shl edx, 8
or edx, eax
mov dword [edi], edx
movzx eax, byte [ecx + 6]
mov dword [ebp - 0xc], edx
movzx edx, byte [ecx + 7]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 5]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 4]
shl edx, 8
or edx, eax
mov dword [edi + 4], edx
movzx eax, byte [ecx + 0xa]
mov dword [ebp - 4], edx
movzx edx, byte [ecx + 0xb]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 9]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 8]
shl edx, 8
or edx, eax
mov dword [edi + 8], edx
movzx eax, byte [ecx + 0xe]
mov dword [ebp - 8], edx
movzx edx, byte [ecx + 0xf]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xd]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xc]
shl edx, 8
or edx, eax
xor ebx, ebx
mov dword [edi + 0xc], edx
mov dword [edi + 0x100], 0xa
mov edi, dword [ebp - 0xc]
mov eax, edx
lea esi, [esi + 0x10]
shr eax, 0x10
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x482508]
xor ecx, dword [eax*4 + str.cwko0]
mov eax, edx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x482908]
movzx eax, dl
xor ecx, dword [eax*4 + 0x482d08]
xor ecx, dword [ebx + 0x484108]
add ebx, 4
xor ecx, edi
mov dword [esi - 0x14], ecx
mov edi, ecx
xor ecx, dword [ebp - 4]
mov dword [esi - 0x10], ecx
mov dword [ebp - 4], ecx
xor ecx, dword [ebp - 8]
xor edx, ecx
mov dword [esi - 0xc], ecx
mov dword [esi - 8], edx
mov dword [ebp - 8], ecx
cmp ebx, 0x28
jb 0x43ed87
mov edi, dword [ebp + 8]
mov eax, 4
mov ecx, dword [edi + 0x100]
shl ecx, 2
cmp ecx, eax
jbe 0x43ee48
nop
mov ebx, dword [edi + eax*4]
mov ecx, ebx
shr ecx, 0x10
movzx edx, cl
mov ecx, ebx
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x483908]
xor edx, dword [ecx*4 + 0x483508]
mov ecx, ebx
shr ecx, 0x18
xor edx, dword [ecx*4 + 0x483d08]
movzx ecx, bl
xor edx, dword [ecx*4 + 0x483108]
mov dword [edi + eax*4], edx
inc eax
mov ecx, dword [edi + 0x100]
shl ecx, 2
cmp eax, ecx
jb 0x43ee00
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4a100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x2c], ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test al, 0xf
je 0x43f56c
pop esi
mov eax, 0xfffffffd
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047179f
mov esp, ebp
pop ebp
ret 0x10
test edx, edx
je 0x43f575
movups xmm1, xmmword [edx]
jmp 0x43f578
xorps xmm1, xmm1
shr eax, 4
mov dword [ebp + 0xc], eax
movups xmmword [ebp - 0x14], xmm1
test eax, eax
je 0x43f66b
cmp dword [ecx + 4], 0
push edi
jne 0x43f605
mov edi, ebx
lea eax, [ebp - 0x14]
lea ecx, [ebx + 0xf]
sub edi, eax
mov dword [ebp - 0x28], ecx
nop
lea eax, [ebp - 0x24]
xor edx, edx
cmp eax, ecx
ja 0x43f5c6
lea eax, [ebp - 0x15]
cmp eax, ebx
jb 0x43f5c6
lea eax, [ebp - 0x14]
add eax, edx
mov cl, byte [edi + eax]
xor cl, byte [eax]
mov byte [ebp + edx - 0x24], cl
inc edx
cmp edx, 0x10
jb 0x43f5b0
jmp 0x43f5d1
movups xmm0, xmmword [ebx]
pxor xmm0, xmm1
movups xmmword [ebp - 0x24], xmm0
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
mov edx, esi
push dword [eax + 0xc]
call fcn.0043ee60
movups xmm1, xmmword [esi]
mov ecx, dword [ebp - 0x28]
add esp, 4
add ecx, 0x10
add ebx, 0x10
add edi, 0x10
mov dword [ebp - 0x28], ecx
add esi, 0x10
sub dword [ebp + 0xc], 1
movups xmmword [ebp - 0x14], xmm1
jne 0x43f5a0
jmp 0x43f66a
lea edi, [ebp - 0x14]
sub edi, esi
nop word [eax + eax]
push dword [ecx + 0xc]
mov edx, esi
mov ecx, ebx
call fcn.0043f1c0
lea eax, [ebp - 5]
add esp, 4
cmp esi, eax
ja 0x43f647
lea eax, [esi + 0xf]
lea ecx, [ebp - 0x14]
cmp eax, ecx
jb 0x43f647
mov eax, esi
mov edx, 0x10
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x43f637
jmp 0x43f651
movups xmm0, xmmword [esi]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
movups xmm1, xmmword [ebx]
mov ecx, dword [ebp - 0x2c]
add esi, 0x10
sub edi, 0x10
add ebx, 0x10
sub dword [ebp + 0xc], 1
movups xmmword [ebp - 0x14], xmm1
jne 0x43f610
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0047179f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43f680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x4a100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x2c], ebx
test eax, eax
je 0x43f6a6
movups xmm0, xmmword [eax]
jmp 0x43f6a9
xorps xmm0, xmm0
cmp dword [ebp + 0xc], 0
movups xmmword [ebp - 0x24], xmm0
je 0x43f800
lea edx, [ebp - 0x14]
mov eax, ebx
sub eax, edx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, edi
sub eax, edx
mov dword [ebp - 0x28], eax
push esi
nop dword [eax]
push dword [ecx + 0xc]
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x24]
call fcn.0043ee60
mov esi, dword [ebp + 0xc]
add esp, 4
cmp esi, 0x10
mov eax, 0x10
cmovae esi, eax
xor eax, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x43f7b8
cmp esi, 0x40
jb 0x43f796
lea edx, [esi - 1]
lea ecx, [ebp + esi - 0x15]
add edx, ebx
cmp ebx, ecx
ja 0x43f71d
lea ecx, [ebp - 0x14]
cmp edx, ecx
jae 0x43f796
lea ecx, [esi - 1]
add ecx, edi
cmp ebx, ecx
ja 0x43f72a
cmp edx, edi
jae 0x43f796
mov edx, esi
lea ecx, [ebx + 0x10]
mov esi, edi
mov dword [ebp - 0x38], ecx
and edx, 0xffffffc0
sub esi, ebx
mov dword [ebp - 0x34], esi
mov ebx, esi
mov esi, ecx
movups xmm0, xmmword [ebp + eax - 0x14]
movups xmm1, xmmword [edi + eax]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp + eax - 4]
movups xmmword [esi + eax - 0x10], xmm1
movups xmm1, xmmword [ebx + ecx]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp + eax + 0xc]
movups xmmword [ecx], xmm1
movups xmm1, xmmword [edi + eax + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp + eax + 0x1c]
movups xmmword [ecx + 0x10], xmm1
movups xmm1, xmmword [edi + eax + 0x30]
add eax, 0x40
pxor xmm1, xmm0
movups xmmword [ecx + 0x20], xmm1
add ecx, 0x40
cmp eax, edx
jb 0x43f740
mov esi, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x2c]
cmp eax, esi
jae 0x43f7b8
mov edi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x28]
lea edx, [ebp - 0x14]
add edx, eax
inc eax
mov cl, byte [ebx + edx]
xor cl, byte [edx]
mov byte [edi + edx], cl
cmp eax, esi
jb 0x43f7a0
mov edi, dword [ebp + 8]
mov ebx, dword [ebp - 0x2c]
sub dword [ebp + 0xc], esi
je 0x43f7fe
mov eax, 0xf
mov cl, byte [ebp + eax - 0x24]
cmp cl, 0xff
jne 0x43f7dc
cmp eax, 0x10
jae 0x43f813
mov byte [ebp + eax - 0x24], 0
sub eax, 1
jne 0x43f7c2
jmp 0x43f7e2
inc cl
mov byte [ebp + eax - 0x24], cl
add dword [ebp - 0x28], 0x10
add edi, 0x10
mov ecx, dword [ebp - 0x40]
add ebx, 0x10
add dword [ebp - 0x30], 0x10
mov dword [ebp + 8], edi
mov dword [ebp - 0x2c], ebx
jmp 0x43f6d0
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop ebx
call fcn.0047179f
mov esp, ebp
pop ebp
ret 0x10
call fcn.00471945
int3
Function at 0x43fd80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x4a100c]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, ecx
mov dword [esp + 0x14], eax
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
cmp dword [esi + 0x38], 0
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x28], ebx
jne 0x43fdd8
mov eax, 0xfffffff2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.0047179f
mov esp, ebp
pop ebp
ret 0x14
test ebx, ebx
je 0x43fdfd
mov eax, dword [ebx]
mov dword [ebx], ecx
cmp eax, ecx
jae 0x43fdfd
mov eax, 0xffffffeb
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.0047179f
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [esi + 8]
mov eax, edx
and eax, 0xf
or eax, 0
je 0x43ff0a
mov eax, edx
and eax, 0xf
cmp byte [esi + 0x34], 0
mov dword [esp + 0x1c], eax
jne 0x43fea1
sub edx, eax
mov dword [esp + 0x2c], 0
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0x3c]
push ecx
sbb eax, 0
mov dword [esp + 0x34], 0
push eax
push edx
mov ecx, esi
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
call fcn.0043fc80
mov ecx, dword [esi + 0x38]
lea eax, [esp + 0x3c]
push eax
lea eax, [esi + 0x24]
push eax
mov edx, dword [ecx]
lea eax, [esp + 0x34]
push 0x10
push eax
call dword [edx + 8]
test eax, eax
je 0x43fe95
test ebx, ebx
je 0x43ff4a
mov dword [ebx], 0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.0047179f
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov byte [esi + 0x34], 1
mov edi, 0x10
sub edi, eax
cmp edi, ecx
cmova edi, ecx
xor edx, edx
test edi, edi
je 0x43feee
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
sub eax, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
add eax, 0x24
add eax, esi
mov esi, eax
mov al, byte [esi + edx]
lea ecx, [ecx + 1]
xor al, byte [ebx + ecx - 1]
inc edx
mov byte [ecx - 1], al
cmp edx, edi
jb 0x43fed0
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
add dword [esi + 8], edi
mov edx, dword [esi + 8]
adc dword [esi + 0xc], 0
add dword [esp + 0x18], edi
add dword [esp + 0x10], edi
sub ecx, edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
mov eax, dword [esi + 0xc]
test ecx, ecx
je 0x43ff48
lea ecx, [esp + 0x3c]
mov byte [esi + 0x34], 0
push ecx
push eax
push edx
mov ecx, esi
call fcn.0043fc80
mov ecx, dword [esi + 0x38]
lea edx, [esp + 0x3c]
push edx
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [ecx]
push edi
push dword [esp + 0x24]
call dword [eax + 8]
test eax, eax
jne 0x43fe73
add dword [esi + 8], edi
adc dword [esi + 0xc], eax
xor eax, eax
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047179f
mov esp, ebp
pop ebp
ret 0x14
Function at 0x44ef70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47a068
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4a100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [reloc.WS2_32.dll_htonl]
push 0x456
call esi
mov edx, dword [edi + 0x48]
push 1
mov dword [edx], eax
call esi
mov ecx, dword [edi + 0x48]
push 8
mov dword [ecx + 4], eax
call esi
mov ecx, dword [edi + 0x48]
push 0
mov dword [ecx + 8], eax
call esi
mov ecx, dword [edi + 0x48]
mov dword [ebp - 0x18], 0
mov dword [ecx + 0xc], eax
mov dword [edi + 0x4c], 0x10
call fcn.00473780
mov ecx, dword [edi + 0x4c]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x48]
push ecx
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x20]
mov eax, dword [edi + 0x30]
push ecx
add eax, 4
push eax
call fcn.004520e0
cmp dword [ebp - 0x18], 0
je 0x44f067
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x38]
call fcn.0044e480
push eax
push str.Send_audio_dec_failed_with_error:_
mov dword [ebp - 4], 0
push ecx
mov ecx, dword [0x4a73d8]
call fcn.004522b0
mov edx, dword [ebp - 0x24]
cmp edx, 0x10
jb 0x44f063
mov ecx, dword [ebp - 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44f059
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x44f059
call dword [0x47d304]
push edx
push ecx
call fcn.004717b0
add esp, 8
xor al, al
jmp 0x44f069
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047179f
mov esp, ebp
pop ebp
ret