joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4629e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4658c8
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov dword [esp + 0x18], edi
mov ecx, ebx
call fcn.0046206c
mov dword [ebx], 0x4658b4
lea ebx, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, ebx
call fcn.0046206c
or eax, 0xffffffff
push 0x474730
mov dword [ebx], 0x465878
push edi
mov dword [esi], 0x46588c
mov dword [esi + 0x54], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0x10
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x38], 0xc0c0c0
mov dword [esi + 0x3c], edi
call dword [fcn.00465124]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x58], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x403b60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x462bfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x465928
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x403bf0
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x403bb7
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [fcn.004650cc]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x403be1
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.00462006
jmp 0x403bf6
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.00462006
jmp 0x403bf6
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x465848
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.00461fee
mov ecx, esi
mov dword [edi], 0x465834
mov dword [esp + 0x1c], 0xffffffff
call fcn.00462000
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4097e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4632b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.00404840
mov dword [esp + 0xc], 0x4658f8
push 0x808080
mov dword [esp + 0x30], 0
call dword [fcn.004650c0]
push eax
lea ecx, [esp + 0x10]
call fcn.00462024
test eax, eax
je 0x409838
mov eax, dword [esp + 0x10]
push eax
call dword [0x465060]
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x4099e8
mov eax, dword [esi + 0x80]
test eax, eax
je 0x4099e8
push ebp
push edi
lea ecx, [esp + 0x1c]
call fcn.00462012
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 1
call fcn.00404840
mov dword [esp + 0xc], 0x465820
mov edi, dword [esp + 0x3c]
mov byte [esp + 0x34], 2
test edi, edi
jne 0x409883
xor eax, eax
jmp 0x409886
mov eax, dword [edi + 4]
push eax
call dword [0x4650d4]
push eax
lea ecx, [esp + 0x20]
call fcn.0046200c
mov eax, dword [esi + 0x90]
mov ecx, dword [esi + 0x88]
mov ebp, dword [esi + 0x84]
sub eax, ecx
mov ecx, dword [esi + 0x8c]
push eax
sub ecx, ebp
push ecx
mov ecx, dword [edi + 4]
push ecx
call dword [fcn.00465090]
push eax
lea ecx, [esp + 0x10]
call fcn.00462024
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
neg eax
sbb eax, eax
and eax, edx
mov edx, dword [esp + 0x20]
push eax
push edx
call fcn.00462006
mov edx, dword [esi + 0x7c]
push 0xcc0020
push 0
push edx
mov edx, dword [esi + 0x80]
mov ecx, dword [esi + 0x84]
mov ebp, eax
mov eax, dword [esi + 0x88]
push edx
mov edx, dword [esi + 0x90]
sub edx, eax
push edx
mov edx, dword [esi + 0x8c]
sub edx, ecx
push edx
mov edx, dword [esi + 0x90]
push eax
sub edx, eax
push ecx
push edx
mov edx, dword [esi + 0x8c]
sub edx, ecx
push edx
push eax
mov eax, dword [esp + 0x4c]
push ecx
push eax
call dword [0x465064]
mov eax, dword [esi + 0x94]
test eax, eax
je 0x409953
mov ecx, dword [esi + 0x98]
test ecx, ecx
je 0x409953
lea edx, [esp + 0x1c]
push edx
call fcn.0040be60
mov ecx, dword [esi + 0x90]
mov edx, dword [esi + 0x88]
mov eax, dword [esi + 0x84]
sub ecx, edx
mov edx, dword [esi + 0x8c]
mov esi, dword [esp + 0x20]
sub edx, eax
lea eax, [esp + 0x1c]
neg eax
sbb eax, eax
push 0xcc0020
and eax, esi
push 0
push 0
push eax
mov eax, dword [edi + 4]
push ecx
push edx
push 0
push 0
push eax
call dword [fcn.004650cc]
test ebp, ebp
je 0x40999e
mov ebp, dword [ebp + 4]
mov ecx, dword [edi + 4]
push ebp
push ecx
call fcn.00462006
lea ecx, [esp + 0xc]
call fcn.00461fee
lea ecx, [esp + 0x1c]
call fcn.00462168
mov dword [esp + 0xc], 0x465848
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 3
call fcn.00461fee
lea ecx, [esp + 0x1c]
mov dword [esp + 0xc], 0x465834
mov byte [esp + 0x34], 0
call fcn.00462000
pop edi
pop ebp
mov dword [esp + 0xc], 0x465848
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 4
call fcn.00461fee
mov ecx, dword [esp + 0x24]
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x414a54
Capabilities:
Packed with generic packer

Disassembly:
shr ah, 0x40
jmp 0x40f110
push ebp
mov ebp, esp
mov eax, dword [0x46b758]
js 0x42b8ae
jns 0x40f125
nop
cpuid
ret
jns 0x42b8ae
add eax, 0x40eec022
xor eax, 0x24648d3e
add al, 0xe9
div byte [eax + eax]
add byte [edi], cl
mov byte [ebp - 0x6f], dh
add byte [eax], al
xor ecx, ecx
jb 0x414a52
push 0x42d408
ret
Function at 0x41ad25
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call dword [ebp + 0x4c]
shl si, 0x20
mov ecx, dword [ebp + 0x30]
mov edx, dword [ebp + 0x34]
mov esi, dword [ebp + 0x44]
mov edi, dword [ebp + 0x48]
jno 0x41598e
jo 0x416a79
dec ecx
cpuid
ret
jo 0x41598e
pop dword [esp - 4]
mov ebx, dword [ebp + 0x38]
jne 0x416a5d
je 0x41ad38
xchg byte [edx], ah
popfd
ja 0x41ad48
je 0x416a5d
test byte [edi], bl
mov ebp, 0xe305ffff
add eax, 0x418b66e3
add ah, byte [esi - 0x7f]
shr dword [eax + 0x62], 0x66
sub ecx, 0xc1816268
add al, byte [eax]
add byte [eax], al
bound esp, qword [esi - 0x7f]
jmp 0xc1c30fb8
cmp ax, 0xffff
jne 0x420877
je 0x42f587
cpuid
cld
ret
mov cl, cl
cmp word [edx + edx + 0x46b5d8], 0xffff
je 0x432d04
jne 0x42f59f
inc esi
and byte [edi + 0x6a], bh
add bh, bh
imul al
push ebp
dec ebp
invalid
push 2
push esi
call fcn.004142fd
add esp, 8
mov ax, 2
pop edi
push 0x432cf6
ret

Function at 0x41c73b
Capabilities:
Encode data using base64

Disassembly:
mov bp, bp
lea esp, [esp + 4]
mov eax, dword [esi]
mov edx, dword [0x46b40c]
lea ecx, [ebp + 8]
xchg si, di
xchg di, si
jne 0x432ee5
je 0x41c75b
int1
xor al, 0x5c
je 0x432ee5
xor eax, 0x3dfb8006
pop edi
pop esi
xchg edi, ebp
xchg ebp, edi
jne 0x42f0ca
shr di, 0x40
je 0x41c8e6
cpuid
ret
je 0x42f0ca
jmp dword [esi]
dec edi
mov ah, byte [esi - 0x77]
jmp dword [esi - 9]
lds esp, [ebx - 0x77]
in eax, dx
ja 0x42121b
jbe 0x421066
adc al, 0xe
cwde
arpl word [edi], cx
xchg byte [edi + 0x34000001], ch
mov cs, word [ebp + 0x10086]
add bl, ch
jbe 0x42121b
xor al, 0x8e
lea eax, [esi + 0x100]
jmp 0x421075
push eax
jmp 0x421078
push edi
xchg si, cx
xchg cx, si
call fcn.00423068
add esp, 4
push eax
call fcn.00410001
add esp, 0xc
shl ebp, 0x20
jmp 0x42109c
push esi
jne 0x426788
je 0x4210a8
push ecx
int1
je 0x426788
invalid
neg byte [edi]
jmp dword [esi]
call dword [fcn.00465150]
jmp 0x4141c3
pop ebp
xchg al, ch
xchg ch, al
ret
pop ebx
pop ebp
ret
push 0
push ecx
push pe_nt_image_headers32
jmp 0x432eee
push eax
mov ecx, ecx
push pe_nt_image_headers32
jmp 0x432ef8
push eax
push 0x9c40244c
push edx
call fcn.0042ac85
mov edi, eax
mov eax, dword [esi]
push 0
push 0
push eax
call fcn.00410813
add esi, 0x59af8d0
sub esi, 0x59af8d0
add esp, 0x38
cmc
cmc
test edi, edi
jb 0x428a74
jne 0x432f7a
je 0x432f3c
sub ch, ah
pop esi
xchg edx, eax
mov ecx, dword [esi]
jmp 0x432f3f
push ecx
call fcn.0042f0cf
add esp, 4
test al, al
jb 0x421049
jne 0x432f7a
je 0x432f60
cpuid
nop
ret
mov edx, dword [esi]
push 0xe
push edx
call fcn.004142fd
add esp, 8
pop edi
pop esi
pop ebx
mov di, di
pop ebp
ret
cmp dword [0x46b40c], ebx
je 0x41c8d0
jne 0x432f8b
test ah, 0x8b
push es
mov eax, dword [esi]
push eax
xchg ecx, eax
xchg ecx, eax
call fcn.0042ddbd
add esp, 4
add eax, 0
test al, al
jb 0x421056
jne 0x41c8d0
je 0x432fb3
mov dh, 0xc2
mov ecx, dword [0x46b40c]
push ecx
call dword [fcn.00465158]
mov dword [0x46b40c], ebx
push 0x41c8d0
ret
Function at 0x421387
Capabilities:
Packed with generic packer

Disassembly:
add esi, 8
pop dword [esp - 4]
mov eax, dword [esi + 4]
jmp 0x41ec20

Function at 0x42be3e
Capabilities:
Packed with generic packer

Disassembly:
add esp, 4
and byte [ebp + ebx], al
jb 0x421a94
jmp dword [esi]

Function at 0x42c24a
Capabilities:
Packed with generic packer

Disassembly:
push edi
call fcn.0042dec2
add esp, 4
and eax, 0xffff
jb 0x4133e2
shr edx, 0x40
mov dword [esi + 0x2c], eax
xchg cl, dh
xchg dh, cl
jmp fcn.00419f9b
pop dword [esp - 4]
mov dword [esi + 0x30], ebx
jno 0x40ef31
jo 0x42c25d
nop
cpuid
ret 0x800f
jo 0x40ef31
fmul dword [edi - 0x73]
insd dword es:[edi], dx
add byte [esi - 0x3f], ah
jmp 0x154aaf

Function at 0x42e218
Capabilities:
Packed with generic packer

Disassembly:
pop dword [esp - 4]
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
and byte [ebx], al
jb 0x431ee0
call fcn.0040f45e
fmul st(0)
fild qword [esi + 0x43]
add byte [ebx], cl
add byte [eax], al
add byte [eax + eax], ch
add byte [eax], al
test dword [edx], ebx
inc edx
add byte [eax], al
popal
add byte [eax + 0x30], al
add byte [ecx], ah
add byte [eax], al
or byte [eax], al
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax + eax], ch
add byte [eax], al
mov bh, 0xa2
inc ecx
add byte [ebp - 0x74], al
inc edx
add byte [ebx + 0x21004367], al
mov eax, dword [0x24b40041]
inc ecx
add byte [ebp - 0x7fffbcd4], cl
loop 0x42e2bd
add ch, bh
cpuid
ret
Function at 0x431cd0
Capabilities:
Packed with generic packer

Disassembly:
shr ax, 0x40
mov eax, dword [esi + 4]
lea esi, [esi + 8]
setns byte [ebp + eax]
xchg cl, bl
xchg bl, cl
ja 0x421eb3
jbe 0x411a13
jno 0x411a42
out dx, al
int 0xf
xchg byte [edx - 0x27fffefc], bl
popal
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
cmp ebx, ebx
jbe 0x421eb3
xchg edx, ecx
xchg cx, dx
shr si, 0x40
mov eax, dword [esi + 4]
xchg ch, ah
xchg ah, ch
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
cmp dword [ebx], eax
shr dx, 0x40
xchg dl, al
xchg al, dl
jmp dword [esi]
test ax, ax
jb 0x41565a
je 0x412d3f
jne 0x4141f7
cpuid
nop
ret
mov al, byte [0x474d54]
ja 0x4100b1
jbe 0x414208
cpuid
ret
jbe 0x4100b1
xor eax, 0x66916674
xchg ecx, eax
aad 0x54
mov ecx, ecx
jne 0x4343ca
shr ebp, 0x40
je 0x415654
mov byte [0xf9a3760], al
test byte [eax - 0x13], dh
add dword [eax], eax
je 0x4343ca
add eax, 0xebe58919
push esi
mov esi, dword [ebp + 0xc]
ja 0x420e71
jbe 0x415670
mov esp, 0xf54f389
xchg bl, bh
mov bh, 0
add byte [edx + 0xf013c5f], al
and dword [edi], 0x70fffff2
add al, 0xa8
pop esi
jbe 0x420e71
sbb byte [edi + 0x3c], 1
jno 0x4148a7
jo 0x415686
test al, 0x5e
outsd dx, dword [esi]
push eax
jo 0x4148a7
xor eax, 0x24448f8d
cld
push edi
push 3
jno 0x41fb09
jo 0x420e7f
mov edx, 0x84800f40
in al, dx
invalid
jo 0x41fb09
fcomp st(6)
jmp dword [esi]
add esp, 4
test al, al
jb 0x415641
je 0x431d17
jne 0x431ce8
or eax, 0x100685c
add byte [eax], al
push pe_nt_image_headers32
push 0
push 0x474dac
mov byte [0x46b774], 0
call fcn.00429f37
push 8
push 0
shr ah, 0x40
push 0x474eac
call fcn.00429f37
add esp, 0x18
push 0x474eac
push 0x474dac
jmp 0x431d22
push esi
call 0x42e6be
sub dl, 0
add esp, 0xc
and eax, eax
jae 0x431d3a
nop
cpuid
ret 0x830f
jae 0x4141e2
invalid
js 0x4119f4
xchg ebx, eax
xchg ebx, eax
jns 0x4343d8
cpuid
nop
ret
jns 0x4119f4
cmp byte [edi - 0x7224769a], 0x76
or al, 0x29
inc esp
sbb eax, 0xe9c08900
mov esi, 0x34ffffb3
jmp 0x8d4ba282

Function at 0x436e9a
Capabilities:
Encode data using xor

Disassembly:
ja 0x415125
jbe 0x427d83
call 0xfe291dc
xchg byte [ebx + edx*8 - 0x297d0002], bl
xchg esi, ebp
jbe 0x415125
adc dh, 0x87
out dx, al
xchg ebp, esi
mov byte [esi + 0xba], cl
mov byte [esi + 0xbb], 0
mov word [esi + 0xbc], dx
jno 0x41fd78
jo 0x427dae
cmp cl, byte [esi]
int1
jo 0x41fd78
sub byte [esi - 0x74d3ba75], 0x5d
pop dword [esp - 4]
mov byte [esi + 0xba], cl
jno 0x427d77
jo 0x436eae
xor eax, 0xc3800fc8
push cs
invalid
jo 0x427d77
and eax, 0x24448f69
cld
Function at 0x4374a0
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [esp + 8]
push ebx
and ax, 0x8000
push esi
mov dx, word [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ax, 1
sbb eax, eax
add dx, dx
inc eax
or ax, dx
mov word [esp + 0x10], ax
xor byte [esp + 0x11], al
mov ax, word [esp + 0x10]
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
mov esi, 0x55
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
mov eax, 0x58
mov dl, byte [esp + 0x10]
mov bl, byte [esp + 0x10]
and dl, 0x80
add bl, bl
shr dl, 7
add ecx, 2
or dl, bl
mov byte [esp + 0x10], dl
mov dl, byte [esp + 0x11]
and dl, 1
mov bl, byte [esp + 0x11]
shl dl, 7
shr bl, 1
or dl, bl
mov byte [esp + 0x11], dl
mov bl, byte [esp + 0x10]
xor byte [esp + 0x11], bl
mov dx, word [esp + 0x10]
not dx
mov word [esp + 0x10], dx
xor word [ecx - 2], dx
add word [esp + 0x10], si
dec eax
jne 0x437523
pop esi
pop ebx
ret

Function at 0x438ee0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov cl, byte [esp + 8]
push ebx
mov edx, dword [esp + 0x10]
push esi
xor si, si
push edi
cmp dword [esp + 0x1c], 0
push ebp
je 0x438f0a
movzx eax, si
inc si
xor byte [eax + edx], cl
movzx ebx, si
cmp ebx, dword [esp + 0x20]
jb 0x438ef9
xor ax, ax
mov al, cl
and ax, 0xf
mov word [esp + 0x12], ax
mov di, word [esp + 0x20]
xor cl, cl
dec di
mov esi, edx
cmp word [esp + 0x20], 0
je 0x438f4c
mov al, byte [esi]
mov ebp, esi
inc esi
mov bl, cl
shl bl, 7
mov cl, al
shr al, 1
and cl, 1
or al, bl
mov byte [ebp], al
mov bp, di
dec di
test bp, bp
jne 0x438f2b
test cl, cl
je 0x438f53
or byte [edx], 0x80
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x438f18
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x4392b0
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
sub esp, 8
mov al, byte [esp + 0xc]
push ebx
and ax, 0xf
push esi
mov word [esp + 0xa], ax
push edi
mov eax, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
lea ecx, [eax + ebp - 1]
mov dword [esp + 0x14], ecx
xor dl, dl
mov edi, dword [esp + 0x14]
test bp, bp
lea esi, [ebp - 1]
je 0x439301
mov bl, byte [edi]
mov eax, edi
dec edi
mov cl, dl
mov dl, bl
add bl, bl
shr dl, 7
or bl, cl
mov byte [eax], bl
mov ax, si
dec si
test ax, ax
jne 0x4392e5
test dl, dl
je 0x43930c
mov eax, dword [esp + 0x14]
or byte [eax], 1
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x4392d7
xor si, si
test ebp, ebp
je 0x439339
mov dl, byte [esp + 0x1c]
mov eax, dword [esp + 0x20]
movzx ecx, si
inc si
xor byte [ecx + eax], dl
movzx ecx, si
cmp ecx, ebp
jb 0x439322
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x43cea0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x88
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov esi, dword [esp + 0x98]
push ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
jne 0x43ced0
mov dword [esp + 0x18], 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x24], eax
je 0x43cfc2
mov eax, dword [esp + 0x10]
xor dword [esi], eax
mov ecx, dword [esp + 0x14]
xor dword [esi + 4], ecx
cmp dword [esp + 0x20], 0
jne 0x43cf92
cmp dword [esp + 0x1c], 2
push 0
jbe 0x43cf73
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.0043d070
add esp, 0xc
cmp dword [0x46bc84], 0
jne 0x43d05d
mov eax, dword [esp + 0x28]
lea ebx, [esp + 0x30]
mov edi, 0x19
mov dword [esp + 0x30], eax
mov eax, dword [ebx]
mov cl, 0x20
add eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [ebx + 4], eax
add ebx, 4
mov eax, dword [esp + 0x28]
mov edx, dword [ebx - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x34], eax
dec edi
jne 0x43cf44
jmp 0x43cfa0
push 0
push esi
call fcn.0043d070
add esp, 0xc
cmp dword [0x46bc84], 0
je 0x43cfa0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
lea eax, [esp + 0x30]
push eax
push esi
call fcn.0043d3b0
add esp, 8
mov eax, dword [esi]
add esi, 8
mov dword [esp + 0x10], eax
inc dword [esp + 0x20]
mov ecx, dword [esi - 4]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
cmp eax, dword [esp + 0x24]
jb 0x43cef7
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x43cfd8
mov cl, byte [esi + eax]
xor byte [esp + eax + 0x10], cl
inc eax
cmp eax, dword [esp + 0x18]
jb 0x43cfca
cmp dword [esp + 0x1c], 2
jbe 0x43cff3
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.0043d3b0
add esp, 8
jmp 0x43d018
cmp dword [esp + 0x1c], 1
jne 0x43d007
mov eax, dword [esi]
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x10]
push 0
push 0
push eax
call fcn.0043d070
add esp, 0xc
cmp dword [esp + 0x1c], 1
jbe 0x43d050
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x43d037
mov dl, byte [esi + eax - 8]
lea ecx, [esi + eax]
inc eax
mov byte [ecx], dl
cmp eax, dword [esp + 0x18]
jb 0x43d027
mov eax, dword [esp + 0x10]
mov dword [esi - 8], eax
mov ecx, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi - 4], ecx
pop esi
pop ebx
add esp, 0x88
ret
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
Function at 0x43d3b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
push esi
push edi
mov eax, dword [edx]
push ebp
mov esi, dword [esp + 0x14]
add edx, 8
mov ebp, 0xc
add dword [esi + 4], eax
mov ecx, dword [edx - 4]
add dword [esi], ecx
mov ebx, dword [esi]
mov edi, dword [esi + 4]
xor edi, ebx
mov cl, 0x20
shr ebx, 4
mov eax, edi
and bl, 0x1f
add edx, 8
sub cl, bl
shr eax, cl
mov cl, bl
shl edi, cl
or eax, edi
mov cl, 0x20
sub eax, dword [edx - 8]
mov dword [esi + 4], eax
mov edi, dword [esi]
xor edi, eax
shr eax, 7
mov ebx, edi
and al, 0x1f
sub cl, al
shr ebx, cl
mov cl, al
shl edi, cl
or ebx, edi
add ebx, dword [edx - 4]
dec ebp
mov dword [esi], ebx
jne 0x43d3ce
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x43d420
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x90
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov ebx, dword [esp + 0xa0]
push ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jne 0x43d450
mov dword [esp + 0x10], 8
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
cmp dword [esp + 0x14], 1
jbe 0x43d545
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x14]
sub eax, 2
mov dword [esp + 0x2c], eax
je 0x43d545
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x28], 0
jne 0x43d505
lea eax, [esp + 0x30]
push 0
push eax
push ebx
call fcn.0043d070
add esp, 0xc
cmp dword [0x46bc84], 0
jne 0x43d642
mov eax, dword [esp + 0x30]
lea edi, [esp + 0x38]
mov esi, 0x19
mov dword [esp + 0x38], eax
mov eax, dword [edi]
mov cl, 0x20
add eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov dword [edi + 4], eax
add edi, 4
mov eax, dword [esp + 0x30]
mov edx, dword [edi - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x3c], eax
dec esi
jne 0x43d4d6
jmp 0x43d513
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.0043d650
add esp, 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor dword [ebx], eax
mov edx, dword [esp + 0x20]
xor dword [ebx + 4], ecx
mov eax, dword [esp + 0x24]
add ebx, 8
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
inc dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0x2c]
jb 0x43d494
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x10], eax
je 0x43d56e
mov eax, dword [esp + 0x10]
lea esi, [ebx + 8]
lea edi, [esp + 0x18]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x14], 1
jne 0x43d596
push 0
push 0
push ebx
call fcn.0043d070
add esp, 0xc
cmp dword [0x46bc84], 0
je 0x43d5cc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
cmp dword [esp + 0x14], 2
jne 0x43d5be
push 0
push 0
push ebx
call fcn.0043d070
add esp, 0xc
cmp dword [0x46bc84], 0
je 0x43d5cc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.0043d650
add esp, 8
cmp dword [esp + 0x14], 1
jbe 0x43d635
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
xor dword [esp + 0x18], eax
xor dword [esp + 0x1c], ecx
xor ecx, ecx
cmp dword [esp + 0x10], ecx
je 0x43d5ff
mov dl, byte [ebx + ecx + 8]
lea eax, [ebx + ecx]
inc ecx
mov byte [eax], dl
cmp ecx, dword [esp + 0x10]
mov dl, byte [esp + ecx + 0x17]
mov byte [eax + 8], dl
jb 0x43d5e8
cmp dword [esp + 0x14], 2
jne 0x43d627
push 0
push 0
push ebx
call fcn.0043d070
add esp, 0xc
cmp dword [0x46bc84], 0
je 0x43d635
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.0043d650
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
xor dword [ebx], eax
xor dword [ebx + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
Function at 0x43d650
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0xc
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
push ebp
add edi, 0x64
mov ebp, dword [esi]
mov eax, dword [esi + 4]
sub ebp, dword [edi]
mov edx, eax
shr edx, 7
mov ebx, ebp
and dl, 0x1f
mov cl, 0x20
sub cl, dl
sub edi, 8
shl ebx, cl
mov cl, dl
shr ebp, cl
or ebx, ebp
mov cl, 0x20
xor ebx, eax
mov eax, ebx
mov dword [esi], ebx
shr eax, 4
mov edx, dword [edi + 4]
add edx, dword [esi + 4]
and al, 0x1f
mov ebp, edx
sub cl, al
shl ebp, cl
mov cl, al
shr edx, cl
or ebp, edx
xor ebp, ebx
dec dword [esp + 0x10]
mov dword [esi + 4], ebp
jne 0x43d66a
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
mov ecx, dword [eax + 4]
sub dword [esi], ecx
mov edx, dword [eax]
sub dword [esi + 4], edx
pop esi
pop ebx
add esp, 4
ret