joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dbbb
Capabilities:
Get hostname
Get user security identifier

Disassembly:
sub esp, 0xa0
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0xa8]
push ebx
push esi
push 0x80
mov dword [esp + 0x20], eax
xor esi, esi
lea eax, [esp + 0x26]
xor edx, edx
push esi
push eax
mov dword [esp + 0x24], ecx
xor bl, bl
mov dword [esp + 0x20], 0x41
mov word [esp + 0x2c], dx
call fcn.0046c6ab
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
push esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.DLL_GetComputerNameExW]
test eax, eax
je 0x41dcdb
push ebp
mov ebp, dword [sym.imp.ADVAPI32.DLL_LookupAccountNameW]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
lea edx, [esp + 0x18]
push edx
push esi
lea eax, [esp + 0x38]
push eax
push esi
call ebp
test eax, eax
jne 0x41dc61
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x41dcda
mov ecx, dword [esp + 0xc]
push edi
push ecx
call fcn.0046b5ff
mov esi, eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b5ff
add esp, 8
mov edi, eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push edi
lea edx, [esp + 0x1c]
push edx
push esi
lea eax, [esp + 0x3c]
push eax
push 0
call ebp
test eax, eax
je 0x41dcbf
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov dword [ecx], esi
mov dword [eax], edx
mov bl, 1
jmp 0x41dccc
test esi, esi
je 0x41dccc
push esi
call fcn.0046d412
add esp, 4
test edi, edi
je 0x41dcd9
push edi
call fcn.0046d412
add esp, 4
pop edi
pop ebp
mov ecx, dword [esp + 0xa4]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.0046c68f
add esp, 0xa0
ret

Function at 0x41dcfb
Capabilities:
Get common file path
Get disk information

Disassembly:
sub esp, 0x214
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp + 0x210], eax
push 0x104
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
jne 0x41dd38
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0046c68f
add esp, 0x214
ret
xor eax, eax
push eax
push eax
push eax
push eax
lea ecx, [esp + 0x10]
push ecx
push eax
push eax
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x26], 0x5c003a
mov word [esp + 0x2a], ax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
mov ecx, dword [esp + 0x210]
mov eax, dword [esp]
xor ecx, esp
call fcn.0046c68f
add esp, 0x214
ret
Function at 0x41e10b
Capabilities:
Get common file path

Disassembly:
sub esp, 0x540
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp + 0x53c], eax
push 0x104
lea eax, [esp + 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
jne 0x41e14b
mov ecx, dword [esp + 0x53c]
xor ecx, esp
call fcn.0046c68f
add esp, 0x540
ret
push ebp
push esi
push 0x52787a
lea ecx, [esp + 0x340]
push 0x208
push ecx
call fcn.0046e8d4
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x34c]
push 0x208
push eax
mov byte [esp + 0x14e], 0
call fcn.0046e417
add esp, 0x18
xor ebp, ebp
push ebp
push ebp
push 3
push ebp
push 3
push ebp
lea ecx, [esp + 0x354]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
jne 0x41e1c5
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x53c]
xor ecx, esp
call fcn.0046c68f
add esp, 0x540
ret
push ebx
push edi
push 0x20
call fcn.0046b5ff
mov ebx, dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
add esp, 4
push ebp
lea edx, [esp + 0x18]
push edx
push 0x20
mov edi, eax
push edi
push ebp
push ebp
push 0x560000
push esi
call ebx
test eax, eax
jne 0x41e231
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x41e22a
push edi
call fcn.0046d412
mov eax, dword [esp + 0x18]
push eax
call fcn.0046b5ff
mov edx, dword [esp + 0x1c]
add esp, 8
push ebp
lea ecx, [esp + 0x18]
push ecx
push edx
mov edi, eax
push edi
push ebp
push ebp
push 0x560000
push esi
call ebx
test eax, eax
jne 0x41e231
xor eax, eax
jmp 0x41e311
mov dword [esp + 0x10], ebp
cmp dword [edi], ebp
jbe 0x41e2fd
lea ebx, [edi + 8]
mov eax, dword [ebx]
push eax
lea ecx, [esp + 0x3c]
push 0x527866
push ecx
call fcn.0041dd9b
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0
lea edx, [esp + 0x50]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41e2dc
push 0
lea eax, [esp + 0x20]
push eax
push 0x18
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0x70000
push esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x41e2e6
mov eax, dword [esp + 0x34]
mul dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push 0
push ecx
push edx
push eax
call fcn.0046e93b
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push ecx
push edx
push eax
call fcn.0046e93b
shrd eax, edx, 0x14
add dword [esp + 0x10], eax
push esi
shr edx, 0x14
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc ebp
add ebx, 0x18
cmp ebp, dword [edi]
jb 0x41e240
jmp 0x41e2f9
mov dword [esp + 0x10], 0
jmp 0x41e2f2
mov dword [esp + 0x10], 0
test esi, esi
je 0x41e2f9
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [esp + 0x18]
push edi
call fcn.0046d412
add esp, 4
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x54c]
pop edi
pop ebx
pop esi
pop ebp
xor ecx, esp
call fcn.0046c68f
add esp, 0x540
ret
Function at 0x41f68b
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx]
test eax, eax
jne 0x41f696
xor al, al
ret 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push ecx
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
neg eax
sbb eax, eax
neg eax
ret 0xc

Function at 0x41f6bb
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx]
test eax, eax
jne 0x41f6c6
xor al, al
ret 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push ecx
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
neg eax
sbb eax, eax
neg eax
ret 0xc

Function at 0x41ff0b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
dec eax
cmp eax, 8
ja case.default.0x41ff19
jmp dword [eax*4 + 0x41ffcb]
mov eax, dword [esp + 0xc]
push 1
push eax
mov eax, dword [esp + 0x10]
push eax
push eax
call fcn.0042dfab
add esp, 0x10
ret
mov eax, dword [esp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], eax
jmp fcn.0042c22d
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push 1
push edx
push eax
call fcn.0042973b
add esp, 0xc
ret
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push 1
push ecx
push eax
push eax
call fcn.0042966b
add esp, 0x10
ret
mov eax, dword [esp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], eax
jmp fcn.0042429b
push esi
push 1
push 9
call fcn.0041f90b
mov esi, dword [esp + 0x18]
add esp, 4
lea eax, [esi + eax*2]
push eax
push 9
call fcn.0041f90b
add esp, 4
add eax, esi
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push eax
call fcn.0042959b
add esp, 0x18
pop esi
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push eax
push eax
push ecx
call fcn.00422beb
add esp, 0xc
ret

Function at 0x41fffb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
dec eax
cmp eax, 8
ja case.default.0x420009
jmp dword [eax*4 + 0x4200cb]
mov eax, dword [esp + 0xc]
push 0
push eax
mov eax, dword [esp + 0x10]
push eax
push eax
call fcn.0042dfab
add esp, 0x10
ret
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
add ecx, 0xf4
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], eax
jmp fcn.0042d00b
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push 0
push edx
push eax
call fcn.0042973b
add esp, 0xc
ret
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push 0
push ecx
push eax
push eax
call fcn.0042966b
add esp, 0x10
ret
mov eax, dword [esp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], eax
jmp fcn.0042497b
push esi
push 0
push 9
call fcn.0041f90b
mov esi, dword [esp + 0x18]
add esp, 4
lea eax, [esi + eax*2]
push eax
push 9
call fcn.0041f90b
add esp, 4
add eax, esi
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push eax
call fcn.0042959b
add esp, 0x18
pop esi
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push eax
push eax
push ecx
call fcn.0042358b
add esp, 0xc
ret
Function at 0x42219b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
or eax, 0xffffffff
test ecx, ecx
je 0x4221c5
mov edx, dword [esp + 4]
push esi
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x592fdc]
inc edx
dec ecx
jne 0x4221ab
pop esi
not eax
ret

Function at 0x42223b
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
xor eax, eax
push edi
mov dl, al
shr dl, 4
movzx edi, dl
mov cl, al
and cl, 0xf
movzx esi, cl
mov byte [esp + 0xf], cl
mov ecx, edi
movzx edi, byte [edi + 0x5933f4]
xor ecx, esi
movzx esi, byte [esi + 0x5933e4]
mov cl, byte [ecx + 0x593404]
xor edi, esi
movzx esi, byte [edi + 0x593424]
movzx ebx, byte [esi + 0x5933e4]
movzx ecx, cl
movzx edi, byte [ecx + 0x5933f4]
xor ecx, esi
xor edi, ebx
mov bl, byte [edi + 0x593464]
movzx esi, dl
shl bl, 4
or bl, byte [ecx + 0x593444]
movzx ecx, byte [esp + 0xf]
mov edx, esi
movzx esi, byte [esi + 0x5933f4]
xor edx, ecx
movzx ecx, byte [ecx + 0x5933e4]
mov dl, byte [edx + 0x593414]
xor esi, ecx
movzx esi, byte [esi + 0x593434]
movzx edi, byte [esi + 0x5933e4]
movzx ecx, dl
movzx edx, byte [ecx + 0x5933f4]
xor edx, edi
movzx edx, byte [edx + 0x593474]
shl dl, 4
xor ecx, esi
or dl, byte [ecx + 0x593454]
mov byte [eax + 0x5a51ec], bl
mov byte [eax + 0x5a52ec], dl
inc eax
cmp eax, 0x100
jb 0x422241
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x42943b
Capabilities:
Encrypt data using blowfish

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push esi
push 0x1048
push 0x59555c
push ebx
call fcn.0046bc9b
mov ecx, dword [esp + 0x24]
add esp, 0xc
cmp ecx, 0x48
jle 0x429465
mov ecx, 0x48
push edi
mov edi, dword [esp + 0x20]
mov eax, edi
add ecx, edi
lea esi, [ebx + 8]
mov dword [esp + 0x18], 6
push ebp
nop
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x429485
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x429494
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4294a3
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4294b2
mov eax, edi
xor dword [esi - 8], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4294bf
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4294ce
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4294dd
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4294ec
mov eax, edi
xor dword [esi - 4], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4294f9
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x429508
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x429517
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x429526
mov eax, edi
xor dword [esi], edx
add esi, 0xc
dec dword [esp + 0x1c]
jne 0x42947b
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
xor esi, esi
pop ebp
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.00430a3b
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ebx + esi*4], ecx
mov dword [ebx + esi*4 + 4], edx
add esi, 2
add esp, 8
cmp esi, 0x12
jl 0x429542
xor esi, esi
pop edi
nop
lea eax, [esp + 8]
push ebx
push eax
call fcn.00430a3b
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [ebx + esi*4 + 0x48], ecx
mov dword [ebx + esi*4 + 0x4c], edx
add esi, 2
add esp, 8
cmp esi, 0x400
jl 0x42956b
pop esi
pop ebx
add esp, 8
ret
Function at 0x42959b
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
movzx edx, byte [eax + 1]
movzx ecx, byte [eax]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 2]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 3]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 4]
mov dword [esp], ecx
movzx ecx, byte [eax + 7]
push esi
movzx esi, byte [eax + 5]
movzx eax, byte [eax + 6]
shl ecx, 8
shl esi, 8
or ecx, eax
or edx, esi
shl ecx, 0x10
or ecx, edx
cmp dword [esp + 0x24], 0
mov dword [esp + 8], ecx
pop esi
je 0x42960a
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.0042bffb
jmp 0x429623
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.0042c11b
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov byte [eax], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 2], dl
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, dword [esp + 0x14]
mov edx, ecx
shr edx, 8
mov byte [eax + 4], cl
mov byte [eax + 5], dl
mov edx, ecx
shr edx, 0x10
add esp, 0x10
shr ecx, 0x18
mov byte [eax + 6], dl
mov byte [eax + 7], cl
add esp, 8
ret
Function at 0x42e37b
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
push 0x1000
push 0
push esi
call fcn.0046c6ab
add esp, 0xc
xor ebp, ebp
mov dword [esp + 0x14], ebp
test ebp, ebp
jne 0x42e435
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov dword [esi + 0x180], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x184], edx
mov edi, 4
lea ecx, [edi + 0x10]
lea eax, [edi + 8]
shl eax, 5
mov edx, dword [eax + esi]
shl ecx, 4
add ecx, esi
mov dword [ecx], edx
mov eax, dword [eax + esi + 4]
push ecx
mov dword [ecx + 4], eax
call fcn.0042e0cb
sar edi, 1
add esp, 4
test edi, edi
jg 0x42e3be
mov ecx, dword [esi + 0x110]
mov edx, dword [esi + 0x114]
lea eax, [esi + 0x80]
push eax
mov dword [eax], ecx
mov dword [eax + 4], edx
call fcn.0042e0cb
add esp, 4
mov edi, 4
mov ecx, edi
mov eax, edi
shl eax, 5
mov edx, dword [eax + esi]
shl ecx, 4
add ecx, esi
mov dword [ecx], edx
mov eax, dword [eax + esi + 4]
push ecx
mov dword [ecx + 4], eax
call fcn.0042e0cb
sar edi, 1
add esp, 4
test edi, edi
jg 0x42e40c
jmp 0x42e4a5
cmp ebp, 1
jle 0x42e4a5
lea ecx, [ebp - 2]
shl ecx, 4
mov eax, ebp
shl eax, 4
mov edi, 8
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], eax
jmp 0x42e463
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
add ecx, edi
add ecx, ecx
mov edx, dword [esi + ecx*8]
mov ecx, dword [esi + ecx*8 + 4]
add eax, edi
shl eax, 4
add eax, esi
mov dword [eax + 4], ecx
mov ebx, ecx
mov ebp, edx
shl ecx, 8
shr ebp, 0x18
or ebp, ecx
mov dword [eax], edx
shr ebx, 0x18
mov dword [eax + 4], ebp
movzx ecx, word [ebx*2 + 0x52847e]
shl edx, 8
xor ecx, edx
sar edi, 1
mov dword [eax], ecx
test edi, edi
jg 0x42e45b
mov ebp, dword [esp + 0x14]
mov edx, ebp
shl edx, 8
mov ebx, ebp
lea eax, [edx + esi + 0x10]
shl ebx, 4
mov edi, 2
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ebx
mov ecx, dword [esp + 0x18]
lea edx, [ebx + edi]
shl edx, 4
add edx, esi
lea eax, [edx + 0x10]
cmp edi, 1
jle 0x42e50e
lea ebx, [edi - 1]
lea esp, [esp]
mov ebp, dword [ecx]
xor ebp, dword [edx]
add eax, 0x10
mov dword [eax - 0x10], ebp
mov ebp, dword [ecx + 4]
xor ebp, dword [edx + 4]
add ecx, 0x10
mov dword [eax - 0xc], ebp
mov ebp, dword [ecx - 8]
xor ebp, dword [edx + 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
xor ebp, dword [edx + 0xc]
dec ebx
mov dword [eax - 4], ebp
jne 0x42e4db
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
add edi, edi
cmp edi, 0x10
jl 0x42e4c0
inc ebp
mov dword [esp + 0x14], ebp
cmp ebp, 0x10
jl 0x42e39c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x42f36b
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x198
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp + 0x194], eax
mov eax, dword [esp + 0x1ac]
push ebx
mov ebx, dword [esp + 0x1a8]
push esi
mov esi, dword [esp + 0x1a8]
push edi
mov edi, dword [esp + 0x1a8]
mov dword [esp + 0xc], eax
cmp esi, 0x40
jle 0x42f3e7
lea ecx, [esp + 0xc8]
push ecx
call fcn.0043378b
lea edx, [esp + 0xcc]
push edx
push esi
push edi
call fcn.004337cb
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0x1a0]
push ecx
call fcn.0043387b
add esp, 0x18
lea edi, [esp + 0x18c]
mov esi, 0x14
lea edx, [esp + 0x10]
push edx
call fcn.0043378b
add esp, 4
xor eax, eax
test esi, esi
jle 0x42f420
push ebp
mov ebp, edi
lea ecx, [esp + 0x128]
sub ebp, ecx
jmp 0x42f40b
lea ecx, [esp + eax + 0x128]
mov dl, byte [ecx + ebp]
xor dl, 0x36
inc eax
mov byte [ecx], dl
cmp eax, esi
jl 0x42f40b
pop ebp
cmp esi, 0x40
jge 0x42f43f
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x128]
push 0x36
push eax
call fcn.0046c6ab
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x128]
push 0x40
push eax
call fcn.004337cb
mov edx, dword [esp + 0x1c0]
lea ecx, [esp + 0x1c]
push ecx
push edx
push ebx
call fcn.004337cb
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x194]
push ecx
call fcn.0043387b
lea edx, [esp + 0x8c]
push edx
call fcn.0043378b
add esp, 0x24
xor eax, eax
test esi, esi
jle 0x42f4af
lea ecx, [esp + 0x124]
sub edi, ecx
lea esp, [esp]
lea ecx, [esp + eax + 0x124]
mov dl, byte [edi + ecx]
xor dl, 0x5c
inc eax
mov byte [ecx], dl
cmp eax, esi
jl 0x42f49b
cmp esi, 0x40
jge 0x42f4ce
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x128]
push 0x5c
push eax
call fcn.0046c6ab
add esp, 0xc
lea edx, [esp + 0x6c]
push edx
lea eax, [esp + 0x128]
push 0x40
push eax
call fcn.004337cb
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x188]
push 0x14
push edx
call fcn.004337cb
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x180]
push ecx
call fcn.0043387b
mov eax, dword [esp + 0x1dc]
add esp, 0x20
pop edi
pop esi
pop ebx
cmp eax, 0x14
jle 0x42f522
mov eax, 0x14
test eax, eax
jle 0x42f53c
push eax
mov eax, dword [esp + 4]
lea edx, [esp + 0x15c]
push edx
push eax
call fcn.0046bc9b
add esp, 0xc
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0046c68f
add esp, 0x198
ret
Function at 0x42f85b
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xd0
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0xdc]
mov ecx, dword [esp + 0xec]
mov dword [esp + 8], eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
push ebx
shr eax, 0x1f
add eax, edx
push ebp
mov ebp, dword [esp + 0xdc]
push esi
mov esi, dword [esp + 0xf4]
lea edx, [eax + eax*4]
add edx, edx
push edi
add edx, edx
mov edi, ecx
sub edi, edx
je 0x42f8b2
inc eax
mov edi, dword [esp + 0xe8]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
sub ecx, edx
add ecx, 0x14
mov ebx, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ecx
cmp eax, ebx
jle 0x42f9c3
nop
mov eax, dword [esp + 0xf0]
mov ecx, dword [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x64]
mov dword [esp + 0x18], 0
push edx
mov byte [esp + 0x1f], bl
call fcn.0046bc9b
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xfc]
push 0x14
mov dword [esp + eax + 0x6c], ecx
lea edx, [esp + 0x44]
push edx
add eax, 4
push eax
lea eax, [esp + 0x74]
push eax
push edi
push ebp
call fcn.0042f36b
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x118]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x48], edx
mov edx, dword [esp + 0x68]
add esp, 0x24
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
cmp eax, 1
jle 0x42f993
dec eax
mov dword [esp + 0x10], eax
push 0x14
lea eax, [esp + 0x4c]
push eax
push 0x14
lea ecx, [esp + 0x40]
push ecx
push edi
push ebp
call fcn.0042f36b
add esp, 0x18
xor eax, eax
nop
mov cl, byte [esp + eax + 0x48]
xor byte [esp + eax + 0x20], cl
mov byte [esp + eax + 0x34], cl
inc eax
cmp eax, 0x14
jl 0x42f97b
dec dword [esp + 0x10]
jne 0x42f960
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esi], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], eax
inc ebx
add esi, 0x14
cmp ebx, dword [esp + 0x14]
jl 0x42f8db
mov edx, dword [esp + 0xf4]
mov eax, dword [esp + 0xf0]
push ebx
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
push ecx
push edi
push ebp
call fcn.0042f55b
mov edx, dword [esp + 0x38]
push edx
lea eax, [esp + 0x40]
push eax
push esi
call fcn.0046bc9b
mov ecx, dword [esp + 0x104]
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046c68f
add esp, 0xd0
ret
Function at 0x42fa1b
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x164
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp + 0x160], eax
mov eax, dword [esp + 0x170]
push ebx
mov ebx, dword [esp + 0x170]
push ebp
mov ebp, dword [esp + 0x180]
push edi
mov edi, dword [esp + 0x174]
mov dword [esp + 0xc], eax
cmp ebx, 0x40
jle 0x42fa91
lea ecx, [esp + 0x70]
push ecx
call fcn.0043397b
push ebx
lea edx, [esp + 0x78]
push edi
push edx
call fcn.004353cb
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0xe4]
push ecx
call fcn.0043548b
add esp, 0x18
lea edi, [esp + 0xd0]
mov ebx, 0x14
push 0x41
lea edx, [esp + 0xe8]
push 0x36
push edx
call fcn.0046c6ab
push 0x41
lea eax, [esp + 0x138]
push 0x5c
push eax
call fcn.0046c6ab
add esp, 0x18
test ebx, ebx
jle 0x42fadc
push esi
lea edx, [esp + 0xe8]
lea esi, [esp + 0x12c]
sub edx, edi
mov eax, edi
sub esi, edi
mov cl, byte [eax]
xor byte [edx + eax], cl
xor byte [esi + eax], cl
inc eax
dec ebx
jne 0x42facf
pop esi
lea ecx, [esp + 0x10]
push ecx
call fcn.0043397b
push 0x40
lea edx, [esp + 0xec]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.004353cb
mov ecx, dword [esp + 0x190]
mov edx, dword [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x28]
push eax
call fcn.004353cb
lea ecx, [esp + 0x2c]
push ecx
push ebp
call fcn.0043548b
lea edx, [esp + 0x34]
push edx
call fcn.0043397b
push 0x40
lea eax, [esp + 0x154]
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.004353cb
push 0x14
lea edx, [esp + 0x48]
push ebp
push edx
call fcn.004353cb
add esp, 0x40
lea eax, [esp + 0x10]
push eax
push ebp
call fcn.0043548b
mov ecx, dword [esp + 0x174]
add esp, 8
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046c68f
add esp, 0x164
ret