joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4256b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x4aa06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x60]
push esi
push edi
push 0x2c
push 0
mov edi, 0x18d11a4f
mov dword [ebp - 0x34], ebx
push eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0xdafb1a07
mov dword [ebp - 0x28], 0x375e4b5c
mov dword [ebp - 0x24], 0xd2615747
mov dword [ebp - 0x20], 0x6ac84658
mov dword [ebp - 0x1c], 0xe727cc63
mov dword [ebp - 0x18], 0x438e5ff9
mov dword [ebp - 0x14], 0x987346a
mov dword [ebp - 0x10], 0x45389b1a
mov dword [ebp - 0xc], 0x2544390a
mov dword [ebp - 8], 0x33c27512
call fcn.00460010
add esp, 0xc
mov dword [ebp - 0x60], edi
xor esi, esi
mov ax, word [ebp + esi - 0x2c]
mov ecx, 0xbc8f
xor ax, di
mov word [ebp + esi - 0x5c], ax
mov eax, edi
mul ecx
push 0
push 0x7fffffff
push edx
push eax
call fcn.00487410
add esi, 2
mov edi, eax
cmp esi, 0x28
jb 0x42572c
push 0xb
pop ecx
lea esi, [ebp - 0x60]
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.004211e7
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045da26
leave
ret 4

Function at 0x425f74
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
xor eax, eax
push ebp
push esi
push edi
mov edi, ebx
mov ebp, ecx
xor esi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], edx
mov al, byte [esi + ebp]
mov ecx, 0xbc8f
xor al, dl
mov byte [ebx + esi + 4], al
mov eax, edx
mul ecx
push 0
push 0x7fffffff
push edx
push eax
call fcn.00487410
inc esi
mov edx, eax
cmp esi, 0xc
jb 0x425f8a
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x4261de
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
xor eax, eax
push ebp
push esi
push edi
mov edi, ebx
mov ebp, ecx
xor esi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], edx
mov al, byte [esi + ebp]
mov ecx, 0xbc8f
xor al, dl
mov byte [ebx + esi + 4], al
mov eax, edx
mul ecx
push 0
push 0x7fffffff
push edx
push eax
call fcn.00487410
inc esi
mov edx, eax
cmp esi, 9
jb 0x4261f4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x426b85
Capabilities:
Hash data with md5

Disassembly:
push 0x7c
mov eax, 0x488845
call fcn.0045e463
mov esi, edx
mov dword [ebp - 0x88], ecx
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x1c]
xor eax, eax
mov byte [ebp - 0x81], 0
stosd dword es:[edi], eax
push ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x81]
push eax
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00426e64
xor eax, eax
lea edi, [ebp - 0x28]
mov dword [ebp - 4], eax
mov ecx, esi
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x80], 0x67452301
mov dword [ebp - 0x7c], 0xefcdab89
mov dword [ebp - 0x78], 0x98badcfe
stosd dword es:[edi], eax
mov dword [ebp - 0x74], 0x10325476
stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
call fcn.00426d01
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x80]
mov edx, dword [ebp - 0x28]
sub eax, edx
push eax
call fcn.00427f14
mov eax, dword [ebx + 4]
lea ecx, [ebp - 0x80]
sub eax, dword [ebx]
mov edx, dword [ebx]
push eax
call fcn.00427f14
mov edx, dword [ebp - 0x1c]
pop ecx
pop ecx
lea ecx, [ebp - 0x80]
call fcn.00427fb7
lea ecx, [ebp - 0x28]
call fcn.00419888
lea eax, [ebp - 0x1c]
push eax
push 0x10
mov ecx, eax
call fcn.0041a5e5
mov ebx, dword [ebp - 0x88]
lea edx, [ebp - 0x1c]
mov ecx, ebx
call fcn.00426c7b
mov cx, word [ebx + 6]
mov eax, 0xfff
and cx, ax
mov eax, 0x3000
or cx, ax
mov word [ebx + 6], cx
mov cl, byte [ebx + 8]
and cl, 0x3f
or cl, 0x80
mov byte [ebx + 8], cl
lea ecx, [ebp - 0x1c]
call fcn.00419888
mov eax, ebx
call fcn.0045e40d
ret
Function at 0x427ae6
Capabilities:
Create directory

Disassembly:
push 0x234
mov eax, 0x488945
call fcn.0045e463
mov ebx, ecx
xor eax, eax
mov byte [ebp - 0x219], al
call fcn.004278c7
cmp al, 1
jne 0x427b2d
call fcn.004262d3
test al, al
jne 0x427b15
xor eax, eax
jmp 0x427b22
mov eax, dword [0x4b903c]
push 0x49fc58
push ebx
call eax
test eax, eax
je 0x427b2d
mov cl, 1
jmp 0x427c91
mov edi, ebx
xor esi, esi
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, si
jne 0x427b34
sub edi, ecx
sar edi, 1
lea eax, [edi - 4]
cmp eax, 0xff
ja 0x427c8b
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00460010
add esp, 0xc
mov dword [ebp - 0x220], esi
push 3
pop edx
mov dword [ebp - 0x224], edx
cmp edx, edi
jae 0x427c8b
lea eax, [ebx + edx*2]
push 0x5c
push eax
mov dword [ebp - 0x228], eax
call fcn.0045f3d3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x427bcc
push 0x2f
push dword [ebp - 0x228]
call fcn.0045f3d3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x427bcc
push edi
push ebx
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0046b4bf
add esp, 0x10
push 0x7a
pop eax
mov dword [ebp - 0x220], eax
jmp 0x427bed
sub esi, ebx
lea eax, [ebp - 0x218]
sar esi, 1
push esi
push ebx
push 0x104
push eax
call fcn.0046b4bf
add esp, 0x10
inc esi
mov dword [ebp - 0x224], esi
lea eax, [ebp - 0x218]
push eax
call fcn.0046b4ca
test eax, eax
pop ecx
setne cl
mov byte [ebp - 0x219], cl
test eax, eax
jne 0x427c6d
call fcn.00465b0b
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x22c], 7
mov esi, dword [eax]
xor eax, eax
mov dword [ebp - 0x230], eax
mov word [ebp - 0x240], ax
lea eax, [ebp - 0x218]
push eax
call fcn.004211c2
xor eax, eax
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], eax
call fcn.00427958
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
mov byte [ebp - 0x219], al
call fcn.00421630
push esi
call fcn.00465b1e
pop ecx
mov cl, byte [ebp - 0x219]
mov eax, dword [ebp - 0x220]
mov edx, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x220], eax
cmp eax, 0x7a
jb 0x427b75
jmp 0x427c91
mov cl, byte [ebp - 0x219]
mov al, cl
call fcn.0045e40d
ret

Function at 0x427c99
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x427ca1
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x427cc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x427cc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x427cc6
xor al, al
ret
mov al, 1
ret
Function at 0x429119
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488a68
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x4aa06c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
push 0x1f8
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00460010
and dword [ebp - 0x214], 0
lea eax, [ebp - 0x20c]
push str.cannot_close_file
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x21c]
push esi
push eax
mov dword [ebp - method.fmt::v8::basic_memory_buffer_char__500__class_std::allocator_char__.virtual_0], vtable.fmt::v8::basic_memory_buffer_char__500__class_std::allocator_char__.0
mov dword [ebp - 0x210], 0x1f4
call fcn.0042ab85
push 2
call fcn.0046be70
push eax
push 1
push dword [ebp - 0x214]
push dword [ebp - 0x218]
call fcn.0046c22a
add esp, 0x2c
test eax, eax
je 0x4291c7
push 2
call fcn.0046be70
push eax
push 0xa
call fcn.0046b86b
add esp, 0xc
lea ecx, [ebp - 0x21c]
call fcn.0042adf5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045da26
leave
ret

Function at 0x433c17
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
xor ebp, ebp
mov ebx, ecx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov dword [esi], edx
mov al, byte [edi + ebx]
mov ecx, 0xbc8f
xor al, dl
mov byte [esi + edi + 4], al
mov eax, edx
mul ecx
push ebp
push 0x7fffffff
push edx
push eax
call fcn.00487410
inc edi
mov edx, eax
cmp edi, 0x17
jb 0x433c39
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x433c67
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
xor ebp, ebp
mov ebx, ecx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov dword [esi], edx
mov al, byte [edi + ebx]
mov ecx, 0xbc8f
xor al, dl
mov byte [esi + edi + 4], al
mov eax, edx
mul ecx
push ebp
push 0x7fffffff
push edx
push eax
call fcn.00487410
inc edi
mov edx, eax
cmp edi, 0x15
jb 0x433c89
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x433cb7
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
xor ebp, ebp
mov ebx, ecx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov dword [esi], edx
mov al, byte [edi + ebx]
mov ecx, 0xbc8f
xor al, dl
mov byte [esi + edi + 4], al
mov eax, edx
mul ecx
push ebp
push 0x7fffffff
push edx
push eax
call fcn.00487410
inc edi
mov edx, eax
cmp edi, 0x16
jb 0x433cd9
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x433d07
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, ecx
push edi
push 8
xor eax, eax
mov edi, esi
pop ecx
rep stosd dword es:[edi], eax
mov dword [esi], edx
xor edi, edi
mov al, byte [edi + ebx]
mov ecx, 0xbc8f
xor al, dl
mov byte [esi + edi + 4], al
mov eax, edx
mul ecx
push 0
push 0x7fffffff
push edx
push eax
call fcn.00487410
inc edi
mov edx, eax
cmp edi, 0x1c
jb 0x433d1d
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x433ebf
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
xor ebp, ebp
mov ebx, ecx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov dword [esi], edx
mov al, byte [edi + ebx]
mov ecx, 0xbc8f
xor al, dl
mov byte [esi + edi + 4], al
mov eax, edx
mul ecx
push ebp
push 0x7fffffff
push edx
push eax
call fcn.00487410
inc edi
mov edx, eax
cmp edi, 0x18
jb 0x433ee1
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x433fb7
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, ecx
push edi
push 8
xor eax, eax
mov edi, esi
pop ecx
rep stosd dword es:[edi], eax
mov dword [esi], edx
xor edi, edi
mov al, byte [edi + ebx]
mov ecx, 0xbc8f
xor al, dl
mov byte [esi + edi + 4], al
mov eax, edx
mul ecx
push 0
push 0x7fffffff
push edx
push eax
call fcn.00487410
inc edi
mov edx, eax
cmp edi, 0x1a
jb 0x433fcd
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x434073
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
xor eax, eax
push ebp
push esi
push edi
mov edi, ebx
mov ebp, ecx
xor esi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], edx
mov al, byte [esi + ebp]
mov ecx, 0xbc8f
xor al, dl
mov byte [ebx + esi + 4], al
mov eax, edx
mul ecx
push 0
push 0x7fffffff
push edx
push eax
call fcn.00487410
inc esi
mov edx, eax
cmp esi, 0xb
jb 0x434089
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x4344ce
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
xor eax, eax
push ebp
push esi
push edi
mov edi, ebx
mov ebp, ecx
xor esi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], edx
mov al, byte [esi + ebp]
mov ecx, 0xbc8f
xor al, dl
mov byte [ebx + esi + 4], al
mov eax, edx
mul ecx
push 0
push 0x7fffffff
push edx
push eax
call fcn.00487410
inc esi
mov edx, eax
cmp esi, 0xa
jb 0x4344e4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x4361d1
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, ecx
push edi
push 8
xor eax, eax
mov edi, esi
pop ecx
rep stosd dword es:[edi], eax
mov dword [esi], edx
lea ebx, [esi + 4]
xor edi, edi
mov ax, word [ebp + edi*2]
mov ecx, 0xbc8f
xor ax, dx
mov word [ebx], ax
mov eax, edx
mul ecx
push 0
push 0x7fffffff
push edx
push eax
call fcn.00487410
inc edi
lea ebx, [ebx + 2]
mov edx, eax
cmp edi, 0xd
jb 0x4361eb
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x436bc7
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
push edi
mov ebp, ecx
mov edi, eax
mov dword [esi + 4], eax
lea ebx, [esi + 4]
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi], edx
mov ax, word [ebp + edi*2]
mov ecx, 0xbc8f
xor ax, dx
mov word [ebx], ax
mov eax, edx
mul ecx
push 0
push 0x7fffffff
push edx
push eax
call fcn.00487410
inc edi
lea ebx, [ebx + 2]
mov edx, eax
cmp edi, 8
jb 0x436be6
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x437216
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xb0
mov eax, dword [0x4aa06c]
xor eax, ebp
mov dword [ebp + 0x70], eax
push ebx
mov ebx, dword [ebp + 0x7c]
lea eax, [ebp - 0x38]
push esi
push edi
push 0x50
push 0
mov edi, 0x14360e6f
mov dword [ebp + 0x18], ebx
push eax
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x20], 0xb18b0e38
mov dword [ebp + 0x24], 0xd2476d39
mov dword [ebp + 0x28], 0x60326a4f
mov dword [ebp + 0x2c], 0xbac51f3d
mov dword [ebp + 0x30], 0xe101659d
mov dword [ebp + 0x34], 0xaf041896
mov dword [ebp + 0x38], 0xa156b43b
mov dword [ebp + 0x3c], 0x4813a48b
mov dword [ebp + 0x40], 0xe6f54036
mov dword [ebp + 0x44], 0x7488a328
mov dword [ebp + 0x48], 0x825cdd9f
mov dword [ebp + 0x4c], 0x71383c2a
mov dword [ebp + 0x50], 0x7c7db8d8
mov dword [ebp + 0x54], 0x3159ff5e
mov dword [ebp + 0x58], 0xaf0b59c6
mov dword [ebp + 0x5c], 0x9977cee4
mov dword [ebp + 0x60], 0x14452691
mov dword [ebp + 0x64], 0x2170aa6b
mov dword [ebp + 0x68], 0x8a95a93
mov dword [ebp + 0x6c], 0xb7a4
call fcn.00460010
add esp, 0xc
mov dword [ebp - 0x3c], edi
xor esi, esi
mov ax, word [ebp + esi + 0x20]
mov ecx, 0xbc8f
xor ax, di
mov word [ebp + esi - 0x38], ax
mov eax, edi
mul ecx
push 0
push 0x7fffffff
push edx
push eax
call fcn.00487410
add esi, 2
mov edi, eax
cmp esi, 0x4e
jb 0x4372dd
push 0x15
pop ecx
lea esi, [ebp - 0x3c]
lea edi, [ebp + 0x1c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0x20]
mov ecx, ebx
push eax
call fcn.004211e7
mov ecx, dword [ebp + 0x70]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045da26
add ebp, 0x74
leave
ret 4
Function at 0x437692
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x190
mov eax, dword [0x4aa06c]
xor eax, esp
mov dword [esp + 0x18c], eax
push ebx
mov ebx, dword [esp + 0x198]
lea eax, [esp + 0x10]
push ebp
push esi
push edi
mov ebp, 0xbc
mov dword [esp + 0x14], ebx
push ebp
push 0
mov edi, 0x1436ec6f
mov dword [esp + 0xe4], 0xb3a7ec3f
push eax
mov dword [esp + 0xe4], edi
mov dword [esp + 0xec], 0xbe17c26
mov dword [esp + 0xf0], 0x3516962d
mov dword [esp + 0xf4], 0x6b61a311
mov dword [esp + 0xf8], 0x3512ec3c
mov dword [esp + 0xfc], 0x1d6ddff0
mov dword [esp + 0x100], 0x6cc372fa
mov dword [esp + 0x104], 0x59991e06
mov dword [esp + 0x108], 0x375e4c57
mov dword [esp + 0x10c], 0x1850dc5a
mov dword [esp + 0x110], 0x7c4136fd
mov dword [esp + 0x114], 0xb14db8af
mov dword [esp + 0x118], 0xb251bbc6
mov dword [esp + 0x11c], 0xa1beacce
mov dword [esp + 0x120], 0xf2efb00f
mov dword [esp + 0x124], 0xbebc79a7
mov dword [esp + 0x128], 0xc2d55a81
mov dword [esp + 0x12c], 0x883e023
mov dword [esp + 0x130], 0x19a07c3c
mov dword [esp + 0x134], 0xc27b3658
mov dword [esp + 0x138], 0xb39288b
mov dword [esp + 0x13c], 0xcdeac8d3
mov dword [esp + 0x140], 0x550fbdea
mov dword [esp + 0x144], 0x3b902087
mov dword [esp + 0x148], 0x88ea3404
mov dword [esp + 0x14c], 0x66699863
mov dword [esp + 0x150], 0x84445f0d
mov dword [esp + 0x154], 0x4fad09d3
mov dword [esp + 0x158], 0x9d3e04ed
mov dword [esp + 0x15c], 0xc01b0fc9
mov dword [esp + 0x160], 0xbb20268d
mov dword [esp + 0x164], 0xf16b67b8
mov dword [esp + 0x168], 0xff8cb5b4
mov dword [esp + 0x16c], 0xd5d2a81a
mov dword [esp + 0x170], 0x1520f3f4
mov dword [esp + 0x174], 0x94e3e045
mov dword [esp + 0x178], 0xc365823d
mov dword [esp + 0x17c], 0x6f9a52af
mov dword [esp + 0x180], 0x7f14b494
mov dword [esp + 0x184], 0x6ac772cb
mov dword [esp + 0x188], 0xdd3203ec
mov dword [esp + 0x18c], 0xa168bd0
mov dword [esp + 0x190], 0x46e0d456
mov dword [esp + 0x194], 0x80e7571d
mov dword [esp + 0x198], 0xdef939a3
mov dword [esp + 0x19c], 0xe3908d22
mov dword [esp + 0x1a0], 0xc45f2a3c
call fcn.00460010
add esp, 0xc
mov dword [esp + 0x18], edi
xor esi, esi
mov ax, word [esp + esi + 0xdc]
mov ecx, 0xbc8f
xor ax, di
mov word [esp + esi + 0x1c], ax
mov eax, edi
mul ecx
push 0
push 0x7fffffff
push edx
push eax
call fcn.00487410
add esi, 2
mov edi, eax
cmp esi, ebp
jb 0x4378e1
push 0x30
pop ecx
lea esi, [esp + 0x18]
lea edi, [esp + 0xd8]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xdc]
mov ecx, ebx
push eax
call fcn.004211e7
mov ecx, dword [esp + 0x19c]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045da26
add esp, 0x190
ret 4
Function at 0x437cb6
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x80]
sub esp, 0x100
mov eax, dword [0x4aa06c]
xor eax, ebp
mov dword [ebp + 0x7c], eax
push ebx
mov ebx, dword [ebp + 0x88]
push esi
push edi
push 4
pop eax
mov word [ebp + 0x5c], ax
mov edi, 0x1436a86f
mov eax, 0xb6ac
mov dword [ebp - 4], ebx
push 0x78
mov word [ebp + 0x7a], ax
lea eax, [ebp - 0x7c]
push 0
push eax
mov dword [ebp], edi
mov dword [ebp + 4], 0xb78aa838
mov dword [ebp + 8], 0x4adc6ec1
mov dword [ebp + 0xc], 0xef23259e
mov dword [ebp + 0x10], 0xc38b4af2
mov dword [ebp + 0x14], 0x57bd2d28
mov dword [ebp + 0x18], 0xcb51f116
mov dword [ebp + 0x1c], 0xd93cd0cc
mov dword [ebp + 0x20], 0x4d2c7357
mov dword [ebp + 0x24], 0x17f25d0c
mov dword [ebp + 0x28], 0xeadc50fe
mov dword [ebp + 0x2c], 0xd78cf89c
mov dword [ebp + 0x30], 0x6474d78a
mov dword [ebp + 0x34], 0x50c47324
mov dword [ebp + 0x38], 0x2e231b1e
mov dword [ebp + 0x3c], 0xa950a58f
mov dword [ebp + 0x40], 0x2b133988
mov dword [ebp + 0x44], 0x81e5eee2
mov dword [ebp + 0x48], 0xd9b4504
mov dword [ebp + 0x4c], 0xda902af9
mov dword [ebp + 0x50], 0xcd981d48
mov dword [ebp + 0x54], 0x9c75ef9
mov dword [ebp + 0x58], 0x3954535b
mov dword [ebp + 0x5e], 0x107af39c
mov dword [ebp + 0x62], 0xe704eb44
mov dword [ebp + 0x66], 0xf298c527
mov dword [ebp + 0x6a], 0xe299fc31
mov dword [ebp + 0x6e], 0x164bc673
mov dword [ebp + 0x72], 0x133e9ded
mov dword [ebp + 0x76], 0xc7e4ef1f
call fcn.00460010
add esp, 0xc
mov dword [ebp - 0x80], edi
xor esi, esi
mov ax, word [ebp + esi + 4]
mov ecx, 0xbc8f
xor ax, di
mov word [ebp + esi - 0x7c], ax
mov eax, edi
mul ecx
push 0
push 0x7fffffff
push edx
push eax
call fcn.00487410
add esi, 2
mov edi, eax
cmp esi, 0x78
jb 0x437dcf
push 0x1f
pop ecx
lea esi, [ebp - 0x80]
lea edi, [ebp]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp + 4]
mov ecx, ebx
push eax
call fcn.004211e7
mov ecx, dword [ebp + 0x7c]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045da26
sub ebp, 0xffffff80
leave
ret 4
Function at 0x438507
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xf0
mov eax, dword [0x4aa06c]
xor eax, ebp
mov dword [ebp + 0x70], eax
push ebx
mov ebx, dword [ebp + 0x7c]
mov eax, 0x579c
push esi
push edi
push 0x62
mov word [ebp + 0x68], ax
mov edi, 0x1437746f
pop eax
push 0x70
mov word [ebp + 0x6a], ax
lea eax, [ebp - 0x78]
push 0
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
mov dword [ebp], 0xab847438
mov dword [ebp + 4], 0x8d0f97a8
mov dword [ebp + 8], 0xc0b97781
mov dword [ebp + 0xc], 0xb9795524
mov dword [ebp + 0x10], 0xf11f6a19
mov dword [ebp + 0x14], 0xc115bcb9
mov dword [ebp + 0x18], 0x93e6b69a
mov dword [ebp + 0x1c], 0x726b74be
mov dword [ebp + 0x20], 0x761929ef
mov dword [ebp + 0x24], 0x72b6f3ff
mov dword [ebp + 0x28], 0xc4e8b24c
mov dword [ebp + 0x2c], 0x4bf77aa4
mov dword [ebp + 0x30], 0x74ee4c12
mov dword [ebp + 0x34], 0x884dcf27
mov dword [ebp + 0x38], 0x8653c497
mov dword [ebp + 0x3c], 0xe611f98d
mov dword [ebp + 0x40], 0x44d03374
mov dword [ebp + 0x44], 0xfece161a
mov dword [ebp + 0x48], 0x97061fdf
mov dword [ebp + 0x4c], 0xaac66840
mov dword [ebp + 0x50], 0xe19bde3
mov dword [ebp + 0x54], 0xf725b389
mov dword [ebp + 0x58], 0x186e38db
mov dword [ebp + 0x5c], 0xddf54224
mov dword [ebp + 0x60], 0xe83cee4
mov dword [ebp + 0x64], 0x3918e257
mov dword [ebp + 0x6c], 0xf063
call fcn.00460010
add esp, 0xc
mov dword [ebp - 0x7c], edi
xor esi, esi
mov ax, word [ebp + esi]
mov ecx, 0xbc8f
xor ax, di
mov word [ebp + esi - 0x78], ax
mov eax, edi
mul ecx
push 0
push 0x7fffffff
push edx
push eax
call fcn.00487410
add esi, 2
mov edi, eax
cmp esi, 0x6e
jb 0x43860f
push 0x1d
pop ecx
lea esi, [ebp - 0x7c]
lea edi, [ebp - 4]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp]
mov ecx, ebx
push eax
call fcn.004211e7
mov ecx, dword [ebp + 0x70]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045da26
add ebp, 0x74
leave
ret 4