joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f49a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0x18]
lea edx, [eax + 1]
mov dword [ebp - 4], 0
movzx ecx, byte [edx + 3]
movzx ebx, byte [eax]
movzx eax, byte [edx]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 1]
shl eax, 0x10
or ebx, eax
movzx eax, byte [edx + 2]
shl eax, 0x18
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 8
or ecx, eax
mov dword [ebp - 0xc], ebx
movzx eax, byte [edx + 5]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 6]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 0x18], bl
mov eax, ebx
shl ecx, 0x10
shr eax, 8
or edx, ecx
mov byte [ebp - 0x17], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x16], al
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 0x15], al
mov eax, edx
shr eax, 8
mov byte [ebp - 0x13], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x12], al
mov eax, edx
shr eax, 0x18
mov edi, dword [ebp + 0x1c]
mov byte [ebp - 0x11], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], edx
mov esi, dword [edi]
mov byte [ebp - 0x14], dl
test eax, eax
je 0x4f4b0d
mov edi, dword [ebp + 0xc]
sub dword [ebp + 8], edi
nop word [eax + eax]
dec eax
mov dword [ebp + 0x10], eax
test esi, esi
jne 0x4f4aae
push 1
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push eax
call fcn.004ad640
mov ebx, dword [ebp - 0xc]
add esp, 0xc
mov edx, dword [ebp - 8]
mov eax, ebx
shr eax, 8
mov ecx, dword [ebp - 4]
mov byte [ebp - 0x17], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x16], al
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 0x15], al
mov eax, edx
shr eax, 8
mov byte [ebp - 0x13], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x12], al
mov eax, edx
shr eax, 0x18
inc ecx
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x11], al
mov dword [ebp - 4], ecx
jmp 0x4f4ab1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov al, byte [eax + edi]
xor al, byte [ebp + esi - 0x18]
inc esi
mov byte [edi], al
and esi, 7
mov eax, dword [ebp + 0x10]
inc edi
test eax, eax
jne 0x4f4a50
test ecx, ecx
je 0x4f4b01
mov edi, dword [ebp + 0x18]
mov eax, ebx
shr eax, 8
mov byte [edi], bl
mov byte [edi + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 2], al
mov eax, edx
shr ebx, 0x18
mov byte [edi + 3], bl
shr eax, 8
mov byte [edi + 4], dl
mov byte [edi + 5], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [edi + 6], al
mov byte [edi + 7], dl
mov eax, dword [ebp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f5550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
push ebx
push esi
push edi
movzx ebx, byte [eax]
lea edi, [eax + 1]
mov edx, edi
mov esi, dword [ebp + 0x24]
mov dword [ebp - 0x10], edi
movzx eax, byte [edx]
shl eax, 8
or ebx, eax
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 1]
shl eax, 0x10
or ebx, eax
mov esi, dword [esi]
movzx eax, byte [edx + 2]
shl eax, 0x18
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 8
or ecx, eax
mov dword [ebp - 0xc], ebx
movzx eax, byte [edx + 5]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 6]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 0x1c], bl
mov eax, ebx
shl ecx, 0x10
shr eax, 8
or edx, ecx
mov byte [ebp - 0x1b], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x1a], al
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 0x19], al
mov eax, edx
shr eax, 8
mov byte [ebp - 0x17], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x16], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 0x15], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], edx
mov byte [ebp - 0x18], dl
test eax, eax
je 0x4f56b4
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub edi, ecx
nop
dec eax
mov dword [ebp + 0x10], eax
test esi, esi
jne 0x4f565f
push dword [ebp + 0x1c]
lea eax, [ebp - 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
call fcn.004af690
mov ebx, dword [ebp - 0xc]
add esp, 0x10
mov edx, dword [ebp - 8]
mov eax, ebx
shr eax, 8
mov byte [ebp - 0x1b], al
mov eax, ebx
mov ecx, dword [ebp + 0xc]
shr eax, 0x10
mov byte [ebp - 0x1a], al
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 0x19], al
mov eax, edx
shr eax, 8
mov byte [ebp - 0x17], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x16], al
mov eax, edx
shr eax, 0x18
inc dword [ebp - 4]
mov byte [ebp - 0x1c], bl
mov byte [ebp - 0x18], dl
mov byte [ebp - 0x15], al
mov al, byte [edi + ecx]
xor al, byte [ebp + esi - 0x1c]
inc esi
mov byte [ecx], al
and esi, 7
mov eax, dword [ebp + 0x10]
inc ecx
mov dword [ebp + 0xc], ecx
test eax, eax
jne 0x4f5600
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0x10]
test eax, eax
je 0x4f56b4
mov eax, dword [ebp + 0x20]
mov byte [eax], bl
mov eax, ebx
shr eax, 8
mov byte [edi], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 1], al
mov eax, edx
shr ebx, 0x18
mov byte [edi + 2], bl
shr eax, 8
mov byte [edi + 3], dl
mov byte [edi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [edi + 5], al
mov byte [edi + 6], dl
mov eax, dword [ebp + 0x24]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f6e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0x18]
lea edx, [eax + 1]
mov dword [ebp - 4], 0
movzx ecx, byte [edx + 3]
movzx ebx, byte [eax]
movzx eax, byte [edx]
shl eax, 0x10
shl ebx, 0x18
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [ebp - 0xc], ebx
movzx eax, byte [edx + 6]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 0x15], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [ebp - 0x18], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x17], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0x16], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 0x14], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x13], al
mov eax, edx
shr eax, 8
mov edi, dword [ebp + 0x1c]
mov byte [ebp - 0x12], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], edx
mov esi, dword [edi]
mov byte [ebp - 0x11], dl
test eax, eax
je 0x4f6f8f
mov edi, dword [ebp + 0xc]
sub dword [ebp + 8], edi
nop word [eax + eax]
dec eax
mov dword [ebp + 0x10], eax
test esi, esi
jne 0x4f6f2c
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push eax
call fcn.004f6460
mov ebx, dword [ebp - 0xc]
add esp, 8
mov edx, dword [ebp - 8]
mov eax, ebx
shr eax, 0x18
mov ecx, dword [ebp - 4]
mov byte [ebp - 0x18], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x17], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0x16], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 0x14], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x13], al
mov eax, edx
shr eax, 8
inc ecx
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x12], al
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], ecx
jmp 0x4f6f2f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov al, byte [eax + edi]
xor al, byte [ebp + esi - 0x18]
inc esi
mov byte [edi], al
and esi, 7
mov eax, dword [ebp + 0x10]
inc edi
test eax, eax
jne 0x4f6ed0
test ecx, ecx
je 0x4f6f83
mov edi, dword [ebp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [edi], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 1], al
mov eax, ebx
shr eax, 8
mov byte [edi + 2], al
mov eax, edx
shr eax, 0x18
mov byte [edi + 3], bl
mov byte [edi + 4], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 5], al
mov eax, edx
shr eax, 8
mov byte [edi + 6], al
mov byte [edi + 7], dl
mov eax, dword [ebp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f6fa0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x400
push edi
mov edi, 0x80
mov edx, ebx
mov ecx, edi
cmp dword [ebp + 0xc], ecx
mov byte [esi], 0
cmovle ecx, dword [ebp + 0xc]
test eax, eax
cmovg edx, eax
cmp edx, ebx
cmovg edx, ebx
mov dword [ebp + 0xc], edx
test ecx, ecx
jle 0x4f6ff1
sub dword [ebp + 0x10], esi
mov edx, esi
mov esi, dword [ebp + 0x10]
mov ebx, ecx
nop
mov al, byte [esi + edx]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x4f6fe0
mov esi, dword [ebp + 8]
movzx ebx, byte [ecx + esi - 1]
cmp ecx, edi
jge 0x4f701a
mov edx, esi
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
add eax, ebx
movzx eax, al
movzx ebx, byte [eax + 0x5ce3f0]
mov byte [ecx + esi], bl
inc ecx
cmp ecx, edi
jl 0x4f7000
mov ecx, dword [ebp + 0xc]
mov edx, 0xff
lea ebx, [ecx + 7]
neg ecx
sar ebx, 3
and ecx, 7
sub edi, ebx
sar edx, cl
add esi, edi
movzx eax, byte [esi]
and edx, eax
movzx ecx, byte [edx + 0x5ce3f0]
mov byte [esi], cl
test edi, edi
je 0x4f705d
movzx eax, byte [esi + ebx - 1]
lea esi, [esi - 1]
xor eax, ecx
movzx ecx, byte [eax + 0x5ce3f0]
mov byte [esi], cl
sub edi, 1
jne 0x4f7045
mov edx, dword [ebp + 8]
mov edi, 0x40
lea esi, [edx + 0xfc]
add edx, 0x7e
nop
movzx ecx, byte [edx + 1]
lea esi, [esi - 4]
movzx eax, byte [edx]
lea edx, [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [esi + 4], ecx
sub edi, 1
jne 0x4f7070
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4f7aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0x18]
lea edx, [eax + 1]
mov dword [ebp - 4], 0
movzx ecx, byte [edx + 3]
movzx ebx, byte [eax]
movzx eax, byte [edx]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 1]
shl eax, 0x10
or ebx, eax
movzx eax, byte [edx + 2]
shl eax, 0x18
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 8
or ecx, eax
mov dword [ebp - 0xc], ebx
movzx eax, byte [edx + 5]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 6]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 0x18], bl
mov eax, ebx
shl ecx, 0x10
shr eax, 8
or edx, ecx
mov byte [ebp - 0x17], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x16], al
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 0x15], al
mov eax, edx
shr eax, 8
mov byte [ebp - 0x13], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x12], al
mov eax, edx
shr eax, 0x18
mov edi, dword [ebp + 0x1c]
mov byte [ebp - 0x11], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], edx
mov esi, dword [edi]
mov byte [ebp - 0x14], dl
test eax, eax
je 0x4f7c0b
mov edi, dword [ebp + 0xc]
sub dword [ebp + 8], edi
nop word [eax + eax]
dec eax
mov dword [ebp + 0x10], eax
test esi, esi
jne 0x4f7bac
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push eax
call fcn.004f7770
mov ebx, dword [ebp - 0xc]
add esp, 8
mov edx, dword [ebp - 8]
mov eax, ebx
shr eax, 8
mov ecx, dword [ebp - 4]
mov byte [ebp - 0x17], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x16], al
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 0x15], al
mov eax, edx
shr eax, 8
mov byte [ebp - 0x13], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x12], al
mov eax, edx
shr eax, 0x18
inc ecx
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x11], al
mov dword [ebp - 4], ecx
jmp 0x4f7baf
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov al, byte [eax + edi]
xor al, byte [ebp + esi - 0x18]
inc esi
mov byte [edi], al
and esi, 7
mov eax, dword [ebp + 0x10]
inc edi
test eax, eax
jne 0x4f7b50
test ecx, ecx
je 0x4f7bff
mov edi, dword [ebp + 0x18]
mov eax, ebx
shr eax, 8
mov byte [edi], bl
mov byte [edi + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 2], al
mov eax, edx
shr ebx, 0x18
mov byte [edi + 3], bl
shr eax, 8
mov byte [edi + 4], dl
mov byte [edi + 5], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [edi + 6], al
mov byte [edi + 7], dl
mov eax, dword [ebp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f8010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x20]
mov dword [ebp + 0x10], ecx
mov edi, dword [edi]
test edi, edi
je 0x4f8048
mov edx, dword [ebp + 0x1c]
test esi, esi
je 0x4f8048
mov al, byte [edi + edx]
dec esi
xor al, byte [ecx]
inc edi
mov byte [ebx], al
inc ecx
inc ebx
mov dword [ebp + 0x10], ecx
and edi, 0xf
jne 0x4f8031
cmp esi, 0x10
jb 0x4f80c7
mov edx, dword [ebp + 0x1c]
mov eax, ecx
sub eax, edx
xor edi, edi
mov dword [ebp - 8], eax
mov eax, esi
shr eax, 4
mov dword [ebp - 0xc], edi
mov edi, ebx
mov dword [ebp - 4], eax
sub edi, edx
shl eax, 4
add ebx, eax
add ecx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp + 0x10], ecx
jmp 0x4f8083
mov edx, dword [ebp + 0x1c]
push dword [ebp + 0x14]
push edx
push dword [ebp + 0x18]
call dword [ebp + 0x24]
push dword [ebp + 0x18]
call fcn.004f8260
mov eax, dword [ebp + 0x1c]
add esp, 0x10
mov edx, 4
mov ecx, dword [ebx + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [edi + eax - 4], ecx
sub edx, 1
jne 0x4f80a0
sub esi, 0x10
add edi, 0x10
add ebx, 0x10
sub dword [ebp - 4], 1
jne 0x4f8080
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
test esi, esi
je 0x4f8103
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call dword [ebp + 0x24]
push dword [ebp + 0x18]
call fcn.004f8260
mov eax, dword [ebp + 0x1c]
add esp, 0x10
mov edx, dword [ebp + 0x10]
sub ebx, eax
sub edx, eax
lea ecx, [edi + eax]
add edi, esi
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub esi, 1
jne 0x4f80f1
mov eax, dword [ebp + 0x20]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f8110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x20]
mov dword [ebp - 8], esi
mov dword [ebp + 0x10], ecx
mov edi, dword [edi]
mov dword [ebp - 0xc], edi
test edi, edi
je 0x4f8154
mov edx, dword [ebp + 0x1c]
test esi, esi
je 0x4f8154
mov al, byte [edi + edx]
dec esi
xor al, byte [ecx]
inc edi
mov byte [ebx], al
inc ecx
inc ebx
mov dword [ebp + 0x10], ecx
and edi, 0xf
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
jne 0x4f8137
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
mov edx, dword [eax + 0xc]
bswap edx
mov dword [ebp - 4], edx
cmp esi, 0x10
jb 0x4f81dc
mov edi, esi
shr edi, 4
add edx, edi
mov dword [ebp - 4], edx
cmp edx, edi
jae 0x4f817c
sub edi, edx
xor edx, edx
mov dword [ebp - 4], edx
push eax
push dword [ebp + 0x14]
push edi
push ebx
push ecx
call dword [ebp + 0x24]
mov edx, dword [ebp - 4]
add esp, 0x14
mov ecx, dword [ebp + 0x18]
mov eax, edx
bswap eax
mov dword [ecx + 0xc], eax
test edx, edx
jne 0x4f81bf
mov esi, dword [ebp + 0x18]
mov edx, 0xc
mov ecx, 1
movzx eax, byte [edx + esi - 1]
dec edx
add ecx, eax
mov byte [edx + esi], cl
shr ecx, 8
test edx, edx
jne 0x4f81a7
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
shl edi, 4
sub esi, edi
add ecx, edi
add ebx, edi
mov dword [ebp - 8], esi
mov dword [ebp + 0x10], ecx
cmp esi, 0x10
jae 0x4f8167
mov edi, dword [ebp - 0xc]
test esi, esi
je 0x4f8252
mov ecx, dword [ebp + 0x1c]
xorps xmm0, xmm0
push eax
push dword [ebp + 0x14]
push 1
push ecx
push ecx
movups xmmword [ecx], xmm0
call dword [ebp + 0x24]
mov eax, dword [ebp - 4]
add esp, 0x14
mov ecx, dword [ebp + 0x18]
add eax, 1
bswap eax
mov dword [ecx + 0xc], eax
jne 0x4f8229
mov esi, dword [ebp + 0x18]
mov edx, 0xc
mov ecx, 1
movzx eax, byte [edx + esi - 1]
dec edx
add ecx, eax
mov byte [edx + esi], cl
shr ecx, 8
test edx, edx
jne 0x4f8214
mov esi, dword [ebp - 8]
mov eax, dword [ebp + 0x1c]
sub ebx, eax
mov edx, dword [ebp + 0x10]
sub edx, eax
lea ecx, [edi + eax]
add edi, esi
nop dword [eax + eax]
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub esi, 1
jne 0x4f8240
mov eax, dword [ebp + 0x20]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f8290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0x10], ecx
mov esi, dword [esi]
test esi, esi
je 0x4f82c8
mov edx, dword [ebp + 0x18]
test edi, edi
je 0x4f82c8
mov al, byte [esi + edx]
dec edi
xor al, byte [ecx]
inc esi
mov byte [ebx], al
inc ecx
inc ebx
mov dword [ebp + 0x10], ecx
and esi, 0xf
jne 0x4f82b1
cmp edi, 0x10
jb 0x4f8347
mov edx, dword [ebp + 0x18]
mov eax, ebx
sub eax, edx
mov dword [ebp - 0xc], eax
mov eax, ecx
sub eax, edx
mov dword [ebp - 4], eax
mov eax, edi
shr eax, 4
mov dword [ebp - 8], eax
shl eax, 4
add ebx, eax
add ecx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp + 0x10], ecx
jmp 0x4f82fb
mov edx, dword [ebp + 0x18]
push dword [ebp + 0x14]
push edx
push edx
call dword [ebp + 0x20]
add esp, 0xc
cmp esi, 0x10
jae 0x4f8332
mov eax, dword [ebp + 0x18]
mov edx, 0xf
sub edx, esi
add eax, esi
mov esi, dword [ebp - 4]
shr edx, 2
inc edx
nop
mov ecx, dword [esi + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
sub edx, 1
jne 0x4f8320
add dword [ebp - 4], 0x10
sub edi, 0x10
add ebx, 0x10
xor esi, esi
sub dword [ebp - 8], 1
jne 0x4f82f8
mov ebx, dword [ebp - 0x10]
test edi, edi
je 0x4f8382
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
push eax
push eax
call dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 0x10]
sub ebx, eax
sub edx, eax
lea ecx, [esi + eax]
add esi, edi
nop dword [eax + eax]
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub edi, 1
jne 0x4f8370
mov eax, dword [ebp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f87b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x164]
mov edx, dword [edi + 0x160]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x38]
or eax, dword [edi + 0x3c]
je 0x4f87db
mov eax, 0xfffffffe
pop edi
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
mov eax, esi
add eax, dword [edi + 0x30]
adc ecx, dword [edi + 0x34]
cmp ecx, 0x20000000
ja 0x4f889d
jb 0x4f87ff
test eax, eax
jne 0x4f889d
push ebx
mov ebx, dword [edi + 0x16c]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
test ebx, ebx
je 0x4f8843
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test esi, esi
je 0x4f882d
mov al, byte [ecx]
dec esi
xor byte [ebx + edi + 0x40], al
inc ecx
inc ebx
mov dword [ebp - 4], ecx
and ebx, 0xf
jne 0x4f8816
jmp 0x4f8831
test ebx, ebx
jne 0x4f888e
lea eax, [edi + 0x60]
push eax
lea eax, [edi + 0x40]
push eax
call edx
mov eax, dword [ebp - 4]
add esp, 8
jmp 0x4f8849
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, esi
and ecx, 0xfffffff0
mov dword [ebp - 0xc], ecx
je 0x4f886b
push ecx
push eax
lea eax, [edi + 0x60]
push eax
lea eax, [edi + 0x40]
push eax
call dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add esp, 0x10
add dword [ebp - 4], eax
sub esi, eax
test esi, esi
je 0x4f888e
xor ecx, ecx
mov ebx, esi
test esi, esi
je 0x4f888e
lea edx, [edi + 0x40]
mov edi, dword [ebp - 4]
nop dword [eax]
mov al, byte [ecx + edi]
xor byte [edx + ecx], al
inc ecx
cmp ecx, esi
jb 0x4f8880
mov edi, dword [ebp + 8]
mov dword [edi + 0x16c], ebx
xor eax, eax
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4f9370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [esi + 0x160]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], ebx
mov dword [esi + 0x16c], 0
mov dword [esi + 0x168], 0
cmp edi, 0xc
jne 0x4f9413
mov eax, dword [ebp + 0xc]
mov edi, 1
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov byte [esi + 0xf], 1
jmp 0x4f9540
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edi
cmp edi, 0x10
jb 0x4f9485
mov ebx, edx
mov dword [ebp + 0x10], edx
mov eax, edi
lea ecx, [esi + 0xf]
sub ebx, esi
shr eax, 4
mov dword [ebp - 8], eax
lea eax, [ebx + ecx]
cmp esi, eax
ja 0x4f9452
cmp ecx, edx
jb 0x4f9452
mov ecx, esi
mov edx, 0x10
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x4f9442
jmp 0x4f945f
movups xmm1, xmmword [esi]
movups xmm0, xmmword [edx]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
lea eax, [esi + 0x60]
push eax
push esi
call dword [ebp - 4]
mov edx, dword [ebp + 0x10]
lea ecx, [esi + 0xf]
add edx, 0x10
add esp, 8
add ebx, 0x10
mov dword [ebp + 0x10], edx
sub edi, 0x10
sub dword [ebp - 8], 1
jne 0x4f9430
mov ebx, dword [ebp - 4]
test edi, edi
je 0x4f951b
xor ebx, ebx
test edi, edi
je 0x4f950e
cmp edi, 0x20
jb 0x4f94f3
lea eax, [edx - 1]
lea ecx, [esi - 1]
add eax, edi
add ecx, edi
cmp esi, eax
ja 0x4f94ae
cmp ecx, edx
jae 0x4f94f3
mov ecx, edi
mov eax, esi
and ecx, 0xffffffe0
mov dword [ebp + 0x10], ecx
mov ecx, edx
sub ecx, esi
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp - 8]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + esi - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [edx + ebx + 0x10]
add ebx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp ebx, ecx
jb 0x4f94c5
mov esi, dword [ebp + 8]
cmp ebx, edi
jae 0x4f950e
sub edx, esi
lea ecx, [ebx + esi]
sub edi, ebx
nop
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edi, 1
jne 0x4f9500
mov ebx, dword [ebp - 4]
lea eax, [esi + 0x60]
push eax
push esi
call ebx
add esp, 8
mov eax, dword [ebp - 0xc]
xor ecx, ecx
shld ecx, eax, 3
shl eax, 3
bswap eax
xor dword [esi + 0xc], eax
lea eax, [esi + 0x60]
push eax
bswap ecx
xor dword [esi + 8], ecx
push esi
call ebx
mov edi, dword [esi + 0xc]
add esp, 8
bswap edi
push dword [esi + 0x174]
lea eax, [esi + 0x20]
push eax
mov eax, dword [esi + 0x170]
push esi
call eax
add esp, 0xc
inc edi
bswap edi
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret