joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429eb0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x420
xor esi, esi
push esi
push edi
call fcn.004212c0
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [edi + 0x41c], esi
mov dword [edi + 0x418], esi
mov dword [edi + 0x414], esi
mov dword [edi + 0x410], esi
cmp eax, 0xd
jle 0x429ef2
mov eax, 0xd
push eax
mov eax, dword [ebp + 0xc]
push eax
lea ebx, [edi + 0x400]
push ebx
call fcn.0041b140
add esp, 0xc
mov esi, 0x7b
xor eax, eax
lea ecx, [ecx]
movsx ecx, byte [ebx + eax]
imul esi, ecx
add esi, eax
inc eax
cmp eax, 0xd
jl 0x429f10
lea edx, [edi + 0x300]
mov ebx, edi
xor eax, eax
sub ebx, edx
jmp 0x429f30
lea ecx, [edx + eax]
mov byte [ebx + ecx], al
mov byte [ecx], al
inc eax
cmp eax, 0x100
jl 0x429f30
mov edx, 1
xor ebx, ebx
lea eax, [edi + 0x200]
sub edx, edi
mov ecx, 0xff
sub eax, edi
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, 0x4ec4ec4f
imul ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0xd
sub ebx, eax
movsx edx, byte [ebx + edi + 0x400]
lea esi, [esi + esi*4]
add esi, edx
mov eax, 0x80078071
imul esi
mov ebx, dword [ebp - 4]
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xfff1
mov eax, esi
sub eax, edx
mov dword [ebp - 0xc], eax
add ecx, edi
movzx eax, al
lea ebx, [ebx + ecx]
xor edx, edx
div ebx
movsx eax, byte [ecx]
mov bl, byte [edx + edi]
mov byte [ecx], bl
mov byte [edx + edi], al
mov eax, dword [ebp - 8]
cmp byte [eax + ecx], 0
mov ecx, dword [ebp + 8]
jne 0x42a002
mov eax, dword [ebp - 0xc]
shr eax, 8
and eax, 0xff
xor edx, edx
div ecx
cmp byte [edi + edx + 0x200], 0
je 0x429ff4
lea eax, [edx + 1]
cdq
idiv ecx
cmp byte [edi + edx + 0x200], 0
jne 0x429fe4
mov byte [ecx + edi + 0x200], dl
mov byte [edi + edx + 0x200], cl
mov ebx, dword [ebp + 0x10]
dec ecx
inc ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], ecx
cmp ecx, 0xffffffff
jg 0x429f62
xor eax, eax
jmp 0x42a020
movzx ecx, byte [eax + edi]
mov byte [ecx + edi + 0x100], al
inc eax
cmp eax, 0x100
jl 0x42a020
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or eax, ecx
mov ecx, dword [edx + 4]
mov edx, ecx
ror edx, 8
and edx, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
push ebx
push esi
or edx, ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ecx + 0x1000]
mov dword [ebp + 8], 0x10
lea ebx, [ebx]
xor eax, dword [esi]
add esi, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [ecx + edi*4 + 0x400]
mov ebx, eax
shr ebx, 0x18
add edi, dword [ecx + ebx*4]
mov ebx, eax
shr ebx, 8
and ebx, 0xff
xor edi, dword [ecx + ebx*4 + 0x800]
mov dword [ebp - 4], eax
and eax, 0xff
add edi, dword [ecx + eax*4 + 0xc00]
xor edi, edx
dec dword [ebp + 8]
mov edx, dword [ebp - 4]
mov eax, edi
jne 0x42a390
xor edx, dword [ecx + 0x1044]
mov esi, dword [ecx + 0x1040]
xor esi, eax
mov eax, dword [ebp + 0xc]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov edx, esi
ror edx, 8
and edx, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
pop edi
or edx, esi
pop esi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42a430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or eax, ecx
mov ecx, dword [edx + 4]
mov edx, ecx
ror edx, 8
and edx, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
push ebx
push esi
or edx, ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ecx + 0x1044]
mov dword [ebp + 8], 0x10
lea ebx, [ebx]
xor eax, dword [esi]
sub esi, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [ecx + edi*4 + 0x400]
mov ebx, eax
shr ebx, 0x18
add edi, dword [ecx + ebx*4]
mov ebx, eax
shr ebx, 8
and ebx, 0xff
xor edi, dword [ecx + ebx*4 + 0x800]
mov dword [ebp - 4], eax
and eax, 0xff
add edi, dword [ecx + eax*4 + 0xc00]
xor edi, edx
dec dword [ebp + 8]
mov edx, dword [ebp - 4]
mov eax, edi
jne 0x42a480
xor edx, dword [ecx + 0x1000]
mov esi, dword [ecx + 0x1004]
xor esi, eax
mov eax, dword [ebp + 0xc]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov edx, esi
ror edx, 8
and edx, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
pop edi
or edx, esi
pop esi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a520
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 0x800]
xor eax, eax
mov edx, pe_nt_image_headers32
lea esp, [esp]
mov edi, dword [eax + 0x44beb8]
mov dword [ecx - 0x800], edi
mov edi, dword [eax + 0x44c2b8]
mov dword [ecx - 0x400], edi
mov edi, dword [eax + 0x44c6b8]
mov dword [ecx], edi
mov edi, dword [eax + 0x44cab8]
mov dword [ecx + 0x400], edi
add eax, 4
add ecx, 4
dec edx
jne 0x42a540
lea edi, [esi + 0x1000]
mov eax, 0x44ceb8
mov ecx, edi
mov edx, 0x12
mov esi, dword [eax]
mov dword [ecx], esi
add eax, 4
add ecx, 4
dec edx
jne 0x42a587
movsx esi, word [ebp + 0x10]
xor eax, eax
mov dword [ebp - 4], 0x12
movsx ecx, ax
mov eax, ecx
cdq
idiv esi
add edi, 4
movzx eax, byte [edx + ebx]
shl eax, 8
mov dword [ebp - 8], eax
lea eax, [ecx + 1]
cdq
idiv esi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0xc]
movzx edx, byte [edx + eax]
mov eax, dword [ebp - 8]
or eax, edx
shl eax, 8
mov dword [ebp - 8], eax
lea eax, [ecx + 2]
cdq
idiv esi
mov eax, dword [ebp + 0xc]
movzx edx, byte [edx + eax]
mov eax, dword [ebp - 8]
or eax, edx
shl eax, 8
mov dword [ebp - 8], eax
lea eax, [ecx + 3]
cdq
idiv esi
movzx eax, byte [edx + ebx]
mov edx, dword [ebp - 8]
or edx, eax
xor dword [edi - 4], edx
lea eax, [ecx + 4]
cdq
idiv esi
dec dword [ebp - 4]
movzx eax, dx
jne 0x42a5a1
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea esi, [edi + 0x1004]
lea ebx, [eax + 9]
lea ecx, [ecx]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, edi
call fcn.0042fa20
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov dword [esi - 4], edx
mov dword [esi], eax
add esp, 4
add esi, 8
dec ebx
jne 0x42a620
mov esi, edi
mov dword [ebp - 4], 4
jmp 0x42a650
mov ebx, 0x80
lea ecx, [ebp - 0xc]
push ecx
mov ecx, edi
call fcn.0042fa20
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov dword [esi], edx
mov dword [esi + 4], eax
add esp, 4
add esi, 8
dec ebx
jne 0x42a655
dec dword [ebp - 4]
jne 0x42a650
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a8d0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or eax, ecx
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
push ebx
and edx, 0xff00ff
push esi
or ecx, edx
xor edx, edx
push edi
jmp 0x42a910
mov edi, dword [ebp + 8]
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
mov edi, esi
ror edi, 8
and edi, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
or edi, esi
add edi, edx
mov esi, ecx
shr esi, 5
mov ebx, ecx
shl ebx, 4
xor esi, ebx
add esi, ecx
xor edi, esi
add eax, edi
mov edi, dword [ebp + 8]
sub edx, 0x61c88647
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
mov edi, esi
ror edi, 8
and edi, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
or edi, esi
mov esi, eax
shr esi, 5
mov ebx, eax
shl ebx, 4
xor esi, ebx
add edi, edx
add esi, eax
xor edi, esi
add ecx, edi
cmp edx, 0xc6ef3720
jne 0x42a910
mov edx, eax
ror edx, 8
and edx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov edx, ecx
ror edx, 8
and edx, 0xff00ff00
rol ecx, 8
pop edi
and ecx, 0xff00ff
or edx, ecx
pop esi
mov dword [eax + 4], edx
pop ebx
pop ebp
ret

Function at 0x42a9d0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov edx, dword [edx + 4]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, edx
ror eax, 8
and eax, 0xff00ff00
rol edx, 8
push ebx
and edx, 0xff00ff
push esi
or eax, edx
mov edx, 0xc6ef3720
push edi
lea ecx, [ecx]
mov edi, dword [ebp + 8]
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
mov edi, esi
ror edi, 8
and edi, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
or edi, esi
add edi, edx
mov esi, ecx
shr esi, 5
mov ebx, ecx
shl ebx, 4
xor esi, ebx
add esi, ecx
xor edi, esi
sub eax, edi
mov edi, dword [ebp + 8]
add edx, 0x61c88647
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
mov edi, esi
ror edi, 8
and edi, 0xff00ff00
rol esi, 8
and esi, 0xff00ff
or edi, esi
mov esi, eax
shr esi, 5
mov ebx, eax
shl ebx, 4
xor esi, ebx
add edi, edx
add esi, eax
xor edi, esi
sub ecx, edi
test edx, edx
jne 0x42aa10
mov edx, ecx
ror edx, 8
and edx, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or edx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
mov edx, eax
ror edx, 8
and edx, 0xff00ff00
rol eax, 8
pop edi
and eax, 0xff00ff
or edx, eax
pop esi
mov dword [ecx + 4], edx
pop ebx
pop ebp
ret
Function at 0x42e110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, 0x45edf8
dec eax
mov edi, 0x45edf8
mov word [0x45e8f8], 0
mov word [0x45edf8], 0x301
mov byte [0x45e8fb], 1
mov edx, 2
lea esi, [eax + 2]
sub edi, eax
mov bl, byte [esi]
mov al, bl
call fcn.00433dd0
xor al, bl
mov byte [edi + esi], al
movzx eax, al
mov byte [eax + 0x45e8f8], dl
inc edx
inc esi
cmp edx, 0x100
jl 0x42e145
mov byte [0x45f070], 0x63
mov byte [0x45efd3], 0
mov ebx, 1
lea esp, [esp]
mov al, bl
call fcn.0042e0e0
movzx ecx, al
mov byte [ebx + 0x45f070], al
mov byte [ecx + 0x45ef70], bl
inc ebx
cmp ebx, 0x100
jl 0x42e180
mov al, 1
mov edx, 0x45eef8
movzx ecx, al
mov dword [edx], ecx
call fcn.00433dd0
add edx, 4
cmp edx, 0x45ef70
jl 0x42e1a6
xor esi, esi
lea ecx, [ecx]
mov dl, byte [esi + 0x45f070]
mov al, dl
call fcn.00433dd0
mov cl, al
xor cl, dl
mov byte [ebp - 1], cl
lea ecx, [ebp - 4]
mov byte [ebp - 2], dl
mov byte [ebp - 3], dl
mov byte [ebp - 4], al
call fcn.00433d90
mov bl, byte [esi + 0x45ef70]
mov dword [esi*4 + 0x45e9f8], eax
mov al, byte [0x45b2bc]
mov cl, bl
call fcn.0042df90
mov byte [ebp - 1], al
mov al, byte [0x45b2bd]
mov cl, bl
call fcn.0042df90
mov byte [ebp - 2], al
mov al, byte [0x45b2be]
mov cl, bl
call fcn.0042df90
mov byte [ebp - 3], al
mov al, byte [0x45b2bf]
mov cl, bl
call fcn.0042df90
lea ecx, [ebp - 4]
mov byte [ebp - 4], al
call fcn.00433d90
mov dword [esi*4 + 0x45f170], eax
inc esi
cmp esi, 0x100
jl 0x42e1c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42ed30
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
push edi
push 0x800
add eax, 0x880
push 0
push eax
call fcn.004212c0
add esp, 0xc
mov dword [ebp - 4], 0
mov edi, 0x110
lea esp, [esp]
xor eax, eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 3
mov dword [ebp - 8], 2
mov esi, 1
lea esp, [esp]
movsx ecx, byte [esi + 0x45b2bf]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [ebp - 4]
jne 0x42edbc
and ecx, 3
test dword [ecx*4 + 0x45b5f8], eax
je 0x42edbc
mov edx, dword [ebp - 0x10]
sar edx, 3
add edx, dword [ebp + 8]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, dword [ebp - 0x10]
and edx, 7
mov dl, byte [edx*4 + 0x45b5d8]
or byte [ecx], dl
movsx ecx, byte [esi + 0x45b2c0]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [ebp - 4]
jne 0x42edf6
and ecx, 3
test dword [ecx*4 + 0x45b5f8], eax
je 0x42edf6
mov edx, esi
sar edx, 3
add edx, dword [ebp + 8]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, esi
and edx, 7
mov dl, byte [edx*4 + 0x45b5d8]
or byte [ecx], dl
mov ecx, dword [ebp - 8]
movsx ecx, byte [ecx + 0x45b2c0]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [ebp - 4]
jne 0x42ee35
and ecx, 3
test dword [ecx*4 + 0x45b5f8], eax
je 0x42ee35
mov edx, dword [ebp - 8]
sar edx, 3
add edx, dword [ebp + 8]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, dword [ebp - 8]
and edx, 7
mov dl, byte [edx*4 + 0x45b5d8]
or byte [ecx], dl
mov ecx, dword [ebp - 0xc]
movsx ecx, byte [ecx + 0x45b2c0]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [ebp - 4]
jne 0x42ee74
and ecx, 3
test dword [ecx*4 + 0x45b5f8], eax
je 0x42ee74
mov edx, dword [ebp - 0xc]
sar edx, 3
add edx, dword [ebp + 8]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, dword [ebp - 0xc]
and edx, 7
mov dl, byte [edx*4 + 0x45b5d8]
or byte [ecx], dl
mov ecx, 4
add dword [ebp - 0x10], ecx
add dword [ebp - 8], ecx
add dword [ebp - 0xc], ecx
add esi, ecx
cmp esi, 0x41
jl 0x42ed80
inc eax
cmp eax, 0x10
jl 0x42ed62
inc dword [ebp - 4]
add edi, 0x10
cmp edi, 0x210
jl 0x42ed60
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42eeb0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
push edi
push 0x800
add eax, 0x1080
push 0
push eax
call fcn.004212c0
add esp, 0xc
mov dword [ebp - 4], 0
mov edi, 0x210
lea esp, [esp]
xor eax, eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 3
mov dword [ebp - 8], 2
mov esi, 1
lea esp, [esp]
movsx ecx, byte [esi + str._a__b0]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [ebp - 4]
jne 0x42ef3c
and ecx, 3
test dword [ecx*4 + 0x45b5f8], eax
je 0x42ef3c
mov edx, dword [ebp - 0x10]
sar edx, 3
add edx, dword [ebp + 8]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, dword [ebp - 0x10]
and edx, 7
mov dl, byte [edx*4 + 0x45b5d8]
or byte [ecx], dl
movsx ecx, byte [esi + 0x45b300]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [ebp - 4]
jne 0x42ef76
and ecx, 3
test dword [ecx*4 + 0x45b5f8], eax
je 0x42ef76
mov edx, esi
sar edx, 3
add edx, dword [ebp + 8]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, esi
and edx, 7
mov dl, byte [edx*4 + 0x45b5d8]
or byte [ecx], dl
mov ecx, dword [ebp - 8]
movsx ecx, byte [ecx + 0x45b300]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [ebp - 4]
jne 0x42efb5
and ecx, 3
test dword [ecx*4 + 0x45b5f8], eax
je 0x42efb5
mov edx, dword [ebp - 8]
sar edx, 3
add edx, dword [ebp + 8]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, dword [ebp - 8]
and edx, 7
mov dl, byte [edx*4 + 0x45b5d8]
or byte [ecx], dl
mov ecx, dword [ebp - 0xc]
movsx ecx, byte [ecx + 0x45b300]
dec ecx
mov edx, ecx
sar edx, 2
cmp edx, dword [ebp - 4]
jne 0x42eff4
and ecx, 3
test dword [ecx*4 + 0x45b5f8], eax
je 0x42eff4
mov edx, dword [ebp - 0xc]
sar edx, 3
add edx, dword [ebp + 8]
lea ecx, [edi + eax]
lea ecx, [edx + ecx*8]
mov edx, dword [ebp - 0xc]
and edx, 7
mov dl, byte [edx*4 + 0x45b5d8]
or byte [ecx], dl
mov ecx, 4
add dword [ebp - 0x10], ecx
add dword [ebp - 8], ecx
add dword [ebp - 0xc], ecx
add esi, ecx
cmp esi, 0x41
jl 0x42ef00
inc eax
cmp eax, 0x10
jl 0x42eee2
inc dword [ebp - 4]
add edi, 0x10
cmp edi, 0x310
jl 0x42eee0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42f030
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x45a024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ecx, ecx
push edi
xor eax, eax
jmp 0x42f050
movsx esi, byte [eax + 0x45b5b8]
dec esi
cmp esi, ecx
je 0x42f064
inc eax
cmp eax, 0x20
jl 0x42f050
jmp 0x42f068
mov byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0x20
jl 0x42f045
lea edi, [ebp - 0x23]
mov dword [ebp - 0x28], 0x45b3b8
lea eax, [edx + 0x80]
mov edi, edi
xor esi, esi
mov dword [ebp - 0x2c], eax
mov eax, esi
sar eax, 1
mov ecx, esi
and ecx, 1
shl ecx, 4
and eax, 0xf
or eax, ecx
mov ecx, esi
and ecx, 0x20
or eax, ecx
mov ecx, dword [ebp - 0x28]
movsx eax, byte [ecx + eax]
xor edx, edx
test al, 8
je 0x42f0bc
movsx edx, byte [edi - 1]
mov ecx, 0x1f
sub ecx, edx
mov edx, 1
shl edx, cl
test al, 4
je 0x42f0d3
movsx ebx, byte [edi]
mov ecx, 0x1f
sub ecx, ebx
mov ebx, 1
shl ebx, cl
or edx, ebx
test al, 2
je 0x42f0eb
movsx ebx, byte [edi + 1]
mov ecx, 0x1f
sub ecx, ebx
mov ebx, 1
shl ebx, cl
or edx, ebx
test al, 1
je 0x42f103
movsx eax, byte [edi + 2]
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
or edx, eax
mov eax, dword [ebp - 0x2c]
mov dword [eax], edx
inc esi
add eax, 4
mov dword [ebp - 0x2c], eax
cmp esi, 0x40
jl 0x42f085
mov ecx, dword [ebp - 0x28]
add ecx, 0x40
add edi, 4
mov dword [ebp - 0x28], ecx
cmp ecx, 0x45b5b8
jl 0x42f080
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041af7a
mov esp, ebp
pop ebp
ret
Function at 0x42f990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
lea esi, [ecx + 0x1000]
mov dword [ebp + 8], 0x10
nop
xor eax, dword [esi]
add esi, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [ecx + edi*4 + 0x400]
mov ebx, eax
shr ebx, 0x18
add edi, dword [ecx + ebx*4]
mov ebx, eax
shr ebx, 8
and ebx, 0xff
xor edi, dword [ecx + ebx*4 + 0x800]
mov dword [ebp - 4], eax
and eax, 0xff
add edi, dword [ecx + eax*4 + 0xc00]
xor edi, edx
dec dword [ebp + 8]
mov edx, dword [ebp - 4]
mov eax, edi
jne 0x42f9b0
mov esi, dword [ecx + 0x1040]
mov ecx, dword [ecx + 0x1044]
xor esi, eax
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax + 4], esi
xor ecx, edx
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42fa20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov edx, dword [edx + 4]
push ebx
push esi
push edi
lea esi, [ecx + 0x1000]
mov dword [ebp - 4], 0x10
mov edi, edi
xor eax, dword [esi]
add esi, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [ecx + edi*4 + 0x400]
mov ebx, eax
shr ebx, 0x18
add edi, dword [ecx + ebx*4]
mov ebx, eax
shr ebx, 8
and ebx, 0xff
xor edi, dword [ecx + ebx*4 + 0x800]
mov dword [ebp - 8], eax
and eax, 0xff
add edi, dword [ecx + eax*4 + 0xc00]
xor edi, edx
dec dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, edi
jne 0x42fa40
mov esi, dword [ecx + 0x1040]
mov ecx, dword [ecx + 0x1044]
xor esi, eax
mov eax, dword [ebp + 8]
pop edi
mov dword [eax + 4], esi
xor ecx, edx
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42fab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
lea esi, [ecx + 0x1044]
mov dword [ebp + 8], 0x10
nop
xor eax, dword [esi]
sub esi, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [ecx + edi*4 + 0x400]
mov ebx, eax
shr ebx, 0x18
add edi, dword [ecx + ebx*4]
mov ebx, eax
shr ebx, 8
and ebx, 0xff
xor edi, dword [ecx + ebx*4 + 0x800]
mov dword [ebp - 4], eax
and eax, 0xff
add edi, dword [ecx + eax*4 + 0xc00]
xor edi, edx
dec dword [ebp + 8]
mov edx, dword [ebp - 4]
mov eax, edi
jne 0x42fad0
mov esi, dword [ecx + 0x1004]
mov ecx, dword [ecx + 0x1000]
xor esi, eax
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax + 4], esi
xor ecx, edx
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, 0x45fa78
dec eax
mov edi, 0x45fa78
mov word [0x45f578], 0
mov word [0x45fa78], 0x301
mov byte [0x45f57b], 1
mov edx, 2
lea esi, [eax + 2]
sub edi, eax
mov bl, byte [esi]
mov al, bl
call fcn.00433dd0
xor al, bl
mov byte [edi + esi], al
movzx eax, al
mov byte [eax + 0x45f578], dl
inc edx
inc esi
cmp edx, 0x100
jl 0x433fa5
mov byte [0x45fcf0], 0x63
mov byte [0x45fc53], 0
mov ebx, 1
lea esp, [esp]
mov al, bl
call fcn.00433f40
movzx ecx, al
mov byte [ebx + 0x45fcf0], al
mov byte [ecx + 0x45fbf0], bl
inc ebx
cmp ebx, 0x100
jl 0x433fe0
mov al, 1
mov edx, 0x45fb78
movzx ecx, al
mov dword [edx], ecx
call fcn.00433dd0
add edx, 4
cmp edx, 0x45fbf0
jl 0x434006
xor esi, esi
lea ecx, [ecx]
mov dl, byte [esi + 0x45fcf0]
mov al, dl
call fcn.00433dd0
mov cl, al
xor cl, dl
mov byte [ebp - 1], cl
lea ecx, [ebp - 4]
mov byte [ebp - 2], dl
mov byte [ebp - 3], dl
mov byte [ebp - 4], al
call fcn.00433d90
mov bl, byte [esi + 0x45fbf0]
mov dword [esi*4 + 0x45f678], eax
mov al, byte [0x45b908]
mov cl, bl
call fcn.00433df0
mov byte [ebp - 1], al
mov al, byte [0x45b909]
mov cl, bl
call fcn.00433df0
mov byte [ebp - 2], al
mov al, byte [0x45b90a]
mov cl, bl
call fcn.00433df0
mov byte [ebp - 3], al
mov al, byte [0x45b90b]
mov cl, bl
call fcn.00433df0
lea ecx, [ebp - 4]
mov byte [ebp - 4], al
call fcn.00433d90
mov dword [esi*4 + 0x45fdf0], eax
inc esi
cmp esi, 0x100
jl 0x434020
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4349f0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
push 0x2911
push 0xd
mov eax, esi
xor eax, 0x1fff
push eax
push 0x2911
push 0xd
push eax
push eax
call fcn.004349b0
add esp, 0x10
push eax
call fcn.004349b0
mov byte [esi + 0x468160], al
inc esi
add esp, 0x10
cmp esi, 0x2000
jb 0x4349f3
xor esi, esi
lea ecx, [ecx]
push 0xaa7
push 0xb
mov eax, esi
xor eax, 0x7ff
push eax
push 0xaa7
push 0xb
push eax
push eax
call fcn.004349b0
add esp, 0x10
push eax
call fcn.004349b0
mov byte [esi + 0x467960], al
inc esi
add esp, 0x10
cmp esi, 0x800
jb 0x434a30
xor eax, eax
pop esi
jmp 0x434a70
mov ecx, eax
and ecx, 0xfffffff8
shl ecx, 7
mov edx, eax
and edx, 4
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 2
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 1
or ecx, edx
shl ecx, 7
mov dword [eax*8 + 0x467160], ecx
mov ecx, eax
and ecx, 0xffffff80
shl ecx, 7
mov edx, eax
and edx, 0x40
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 0x20
or ecx, edx
shl ecx, 7
mov edx, eax
and edx, 0x10
or ecx, edx
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov dword [eax*8 + 0x467164], ecx
inc eax
cmp eax, 0x100
jb 0x434a70
ret