joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49fd0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
test edi, edi
jne 0x49fd31
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x49fe7d
mov eax, dword [ebx + 0x1210]
mov edx, eax
add edx, edi
shr edx, 3
add edx, edx
add edx, edx
add edx, edx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 0xc]
jae 0x49fd60
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
jmp 0x49fe7d
test eax, eax
jbe 0x49fe02
mov edx, 8
sub edx, eax
mov dword [ebp - 8], edx
cmp edi, dword [ebp - 8]
jae 0x49fd92
lea edx, [ebx + eax + 0x1208]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.0040312c
add dword [ebx + 0x1210], edi
xor edi, edi
jmp 0x49fe02
lea edx, [ebx + eax + 0x1208]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.0040312c
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
sub edi, dword [ebp - 8]
mov eax, dword [ebx + 0x1208]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x120c]
mov dword [ebp - 0x10], eax
mov ecx, esi
mov edx, ebx
lea eax, [ebx + 0x1208]
call fcn.0049fad4
lea eax, [ebx + 0x1200]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x1204]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x1200], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x1204], eax
xor eax, eax
mov dword [ebx + 0x1210], eax
cmp edi, 8
jb 0x49fe59
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049fad4
lea eax, [ebx + 0x1200]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x1204]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x1200], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x1204], eax
add dword [ebp - 4], 8
sub edi, 8
cmp edi, 8
jae 0x49fe07
test edi, edi
jbe 0x49fe73
lea edx, [ebx + 0x1208]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.0040312c
mov dword [ebx + 0x1210], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a5560
Capabilities:
Encrypt data using camellia

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov edi, ecx
mov esi, dword [eax]
xor esi, dword [edx]
mov eax, dword [eax + 4]
xor eax, dword [edx + 4]
mov edx, eax
shr edx, 0x18
movzx edx, dl
movzx edx, byte [edx + 0x5dd2c8]
mov byte [esp], dl
mov edx, eax
shr edx, 0x10
movzx edx, dl
movzx edx, byte [edx + 0x5dd3c8]
mov byte [esp + 1], dl
mov edx, eax
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + 0x5dd4c8]
mov byte [esp + 2], dl
movzx eax, al
movzx eax, byte [eax + 0x5dd5c8]
mov byte [esp + 3], al
mov eax, esi
shr eax, 0x18
movzx eax, al
movzx eax, byte [eax + 0x5dd3c8]
mov edx, esi
shr edx, 0x10
movzx edx, dl
movzx edx, byte [edx + 0x5dd4c8]
mov ecx, esi
shr ecx, 8
movzx ecx, cl
movzx ecx, byte [ecx + 0x5dd5c8]
mov ebx, esi
movzx ebx, bl
movzx ebx, byte [ebx + 0x5dd2c8]
mov byte [esp + 4], bl
movzx ebx, byte [esp]
xor bl, byte [esp + 2]
xor bl, byte [esp + 3]
xor bl, dl
xor bl, cl
xor bl, byte [esp + 4]
mov byte [esp + 5], bl
movzx ebx, byte [esp]
xor bl, byte [esp + 1]
xor bl, byte [esp + 3]
xor bl, al
xor bl, cl
xor bl, byte [esp + 4]
mov byte [esp + 6], bl
movzx ebx, byte [esp]
xor bl, byte [esp + 1]
xor bl, byte [esp + 2]
xor bl, al
xor bl, dl
xor bl, byte [esp + 4]
mov byte [esp + 7], bl
movzx ebx, byte [esp + 1]
xor bl, byte [esp + 2]
xor bl, byte [esp + 3]
xor bl, al
xor bl, dl
xor bl, cl
mov byte [esp + 8], bl
movzx ebx, byte [esp]
xor bl, byte [esp + 1]
xor bl, dl
xor bl, cl
xor bl, byte [esp + 4]
mov byte [esp + 9], bl
movzx ebx, byte [esp + 1]
xor bl, byte [esp + 2]
xor bl, al
xor bl, cl
xor bl, byte [esp + 4]
mov byte [esp + 0xa], bl
movzx ebx, byte [esp + 2]
xor bl, byte [esp + 3]
xor bl, al
xor bl, dl
xor bl, byte [esp + 4]
mov byte [esp + 0xb], bl
movzx ebx, byte [esp]
xor bl, byte [esp + 3]
xor al, bl
xor dl, al
xor cl, dl
mov eax, ecx
movzx eax, al
movzx edx, byte [esp + 0xb]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0xa]
shl edx, 0x10
or eax, edx
movzx edx, byte [esp + 9]
shl edx, 0x18
or eax, edx
mov dword [edi], eax
movzx eax, byte [esp + 8]
movzx edx, byte [esp + 7]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 6]
shl edx, 0x10
or eax, edx
movzx edx, byte [esp + 5]
shl edx, 0x18
or eax, edx
mov dword [edi + 4], eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4a6794
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov esi, edx
mov ebp, eax
mov edi, 0x5dd6f8
mov ecx, ebp
and cl, 0xff
mov eax, ebp
shr eax, 8
and al, 0xff
mov edx, ebp
shr edx, 0x10
and dl, 0xff
mov ebx, ebp
shr ebx, 0x18
mov byte [esp + 4], bl
cmp dword [esp], 0xc0
jbe 0x4a6814
movzx ecx, cl
movzx ecx, byte [edi + ecx + 0x100]
mov ebx, esi
add ebx, 0xc
xor cl, byte [ebx]
movzx eax, al
movzx eax, byte [edi + eax]
mov ebx, esi
add ebx, 0xd
xor al, byte [ebx]
movzx edx, dl
movzx edx, byte [edi + edx]
mov ebx, esi
add ebx, 0xe
xor dl, byte [ebx]
movzx ebx, byte [esp + 4]
movzx ebx, byte [edi + ebx + 0x100]
mov ebp, esi
add ebp, 0xf
xor bl, byte [ebp]
mov byte [esp + 4], bl
cmp dword [esp], 0x80
jbe 0x4a6864
movzx ecx, cl
movzx ecx, byte [edi + ecx + 0x100]
mov ebx, esi
add ebx, 8
xor cl, byte [ebx]
movzx eax, al
movzx eax, byte [edi + eax + 0x100]
mov ebx, esi
add ebx, 9
xor al, byte [ebx]
movzx edx, dl
movzx edx, byte [edi + edx]
mov ebx, esi
add ebx, 0xa
xor dl, byte [ebx]
movzx ebx, byte [esp + 4]
movzx ebx, byte [edi + ebx]
mov ebp, esi
add ebp, 0xb
xor bl, byte [ebp]
mov byte [esp + 4], bl
movzx ecx, cl
movzx ecx, byte [edi + ecx]
mov ebx, esi
add ebx, 4
xor cl, byte [ebx]
movzx eax, al
movzx eax, byte [edi + eax + 0x100]
mov ebx, esi
add ebx, 5
xor al, byte [ebx]
movzx edx, dl
movzx edx, byte [edi + edx]
mov ebx, esi
add ebx, 6
xor dl, byte [ebx]
movzx ebx, byte [esp + 4]
movzx ebx, byte [edi + ebx + 0x100]
mov ebp, esi
add ebp, 7
xor bl, byte [ebp]
mov byte [esp + 4], bl
movzx ecx, cl
movzx ecx, byte [edi + ecx]
xor cl, byte [esi]
movzx ecx, cl
movzx ecx, byte [edi + ecx + 0x100]
movzx eax, al
movzx eax, byte [edi + eax]
mov ebx, esi
inc ebx
xor al, byte [ebx]
movzx eax, al
movzx eax, byte [edi + eax]
movzx edx, dl
movzx edx, byte [edi + edx + 0x100]
mov ebx, esi
add ebx, 2
xor dl, byte [ebx]
movzx edx, dl
movzx edx, byte [edi + edx + 0x100]
movzx ebx, byte [esp + 4]
movzx ebx, byte [edi + ebx + 0x100]
add esi, 3
xor bl, byte [esi]
movzx ebx, bl
movzx ebx, byte [edi + ebx]
mov byte [esp + 4], bl
movzx ebx, al
movzx ebx, byte [ebx + 0x5dda18]
xor bl, cl
movzx esi, dl
xor bl, byte [esi + 0x5dd918]
movzx esi, byte [esp + 4]
xor bl, byte [esi + 0x5dd918]
mov byte [esp + 5], bl
movzx ebx, cl
movzx ebx, byte [ebx + 0x5dd918]
movzx esi, al
xor bl, byte [esi + 0x5dda18]
movzx esi, dl
xor bl, byte [esi + 0x5dda18]
xor bl, byte [esp + 4]
mov byte [esp + 6], bl
movzx ebx, cl
movzx ebx, byte [ebx + 0x5dda18]
movzx esi, al
xor bl, byte [esi + 0x5dd918]
xor bl, dl
movzx esi, byte [esp + 4]
xor bl, byte [esi + 0x5dda18]
mov byte [esp + 7], bl
movzx ecx, cl
xor al, byte [ecx + 0x5dda18]
movzx edx, dl
xor al, byte [edx + 0x5dda18]
movzx edx, byte [esp + 4]
xor al, byte [edx + 0x5dd918]
movzx edx, byte [esp + 5]
movzx ecx, byte [esp + 6]
shl ecx, 8
or edx, ecx
movzx ecx, byte [esp + 7]
shl ecx, 0x10
or edx, ecx
movzx eax, al
shl eax, 0x18
or edx, eax
mov eax, edx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a69c0
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov esi, edx
mov ebp, eax
mov edi, 0x5dd6f8
mov ecx, ebp
and cl, 0xff
mov eax, ebp
shr eax, 8
and al, 0xff
mov edx, ebp
shr edx, 0x10
and dl, 0xff
mov ebx, ebp
shr ebx, 0x18
mov byte [esp + 4], bl
cmp dword [esp], 0xc0
jbe 0x4a6a40
movzx ecx, cl
movzx ecx, byte [edi + ecx + 0x100]
mov ebx, esi
add ebx, 0xc
xor cl, byte [ebx]
movzx eax, al
movzx eax, byte [edi + eax]
mov ebx, esi
add ebx, 0xd
xor al, byte [ebx]
movzx edx, dl
movzx edx, byte [edi + edx]
mov ebx, esi
add ebx, 0xe
xor dl, byte [ebx]
movzx ebx, byte [esp + 4]
movzx ebx, byte [edi + ebx + 0x100]
mov ebp, esi
add ebp, 0xf
xor bl, byte [ebp]
mov byte [esp + 4], bl
cmp dword [esp], 0x80
jbe 0x4a6a90
movzx ecx, cl
movzx ecx, byte [edi + ecx + 0x100]
mov ebx, esi
add ebx, 8
xor cl, byte [ebx]
movzx eax, al
movzx eax, byte [edi + eax + 0x100]
mov ebx, esi
add ebx, 9
xor al, byte [ebx]
movzx edx, dl
movzx edx, byte [edi + edx]
mov ebx, esi
add ebx, 0xa
xor dl, byte [ebx]
movzx ebx, byte [esp + 4]
movzx ebx, byte [edi + ebx]
mov ebp, esi
add ebp, 0xb
xor bl, byte [ebp]
mov byte [esp + 4], bl
movzx ecx, cl
movzx ecx, byte [edi + ecx]
mov ebx, esi
add ebx, 4
xor cl, byte [ebx]
movzx eax, al
movzx eax, byte [edi + eax + 0x100]
mov ebx, esi
add ebx, 5
xor al, byte [ebx]
movzx edx, dl
movzx edx, byte [edi + edx]
mov ebx, esi
add ebx, 6
xor dl, byte [ebx]
movzx ebx, byte [esp + 4]
movzx ebx, byte [edi + ebx + 0x100]
mov ebp, esi
add ebp, 7
xor bl, byte [ebp]
mov byte [esp + 4], bl
movzx ecx, cl
movzx ecx, byte [edi + ecx]
xor cl, byte [esi]
movzx ecx, cl
movzx ecx, byte [edi + ecx + 0x100]
movzx eax, al
movzx eax, byte [edi + eax]
mov ebx, esi
inc ebx
xor al, byte [ebx]
movzx eax, al
movzx eax, byte [edi + eax]
movzx edx, dl
movzx edx, byte [edi + edx + 0x100]
mov ebx, esi
add ebx, 2
xor dl, byte [ebx]
movzx edx, dl
movzx edx, byte [edi + edx + 0x100]
movzx ebx, byte [esp + 4]
movzx ebx, byte [edi + ebx + 0x100]
add esi, 3
xor bl, byte [esi]
movzx ebx, bl
movzx ebx, byte [edi + ebx]
mov byte [esp + 4], bl
movzx ecx, cl
movzx eax, al
shl eax, 8
or ecx, eax
movzx eax, dl
shl eax, 0x10
or ecx, eax
movzx eax, byte [esp + 4]
shl eax, 0x18
or ecx, eax
mov eax, ecx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4a7cc8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
mov bp, 0x10
mov esi, dword [esp]
mov eax, dword [esi]
xor dword [ebx], eax
mov edx, dword [ebx]
mov eax, dword [esp]
call fcn.004a7c74
xor dword [edi], eax
mov eax, dword [ebx]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], eax
add esi, 4
dec bp
jne 0x4a7cdb
mov eax, dword [ebx]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x40]
xor dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x44]
xor dword [ebx], eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a7d70
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp + 4], edx
mov dword [esp], eax
mov edi, 4
mov ecx, 0x5ddb60
mov eax, dword [esp]
add eax, 0x48
mov dword [esp + 0x10], eax
mov ebx, pe_nt_image_headers32
mov eax, ecx
mov edx, dword [esp + 0x10]
mov esi, dword [eax]
mov dword [edx], esi
add edx, 4
add eax, 4
dec ebx
jne 0x4a7d9d
add dword [esp + 0x10], 0x400
add ecx, 0x400
dec edi
jne 0x4a7d92
xor ebx, ebx
mov edi, 0x12
mov dword [esp + 0x14], 0x5ddb18
mov eax, dword [esp]
mov dword [esp + 0x18], eax
xor ebp, ebp
mov esi, 4
shl ebp, 8
mov eax, dword [esp + 4]
movzx eax, byte [eax + ebx]
or ebp, eax
inc ebx
mov eax, dword [esp + 4]
call fcn.00406ae0
cmp ebx, eax
jl 0x4a7df5
xor ebx, ebx
dec esi
jne 0x4a7dd8
mov eax, dword [esp + 0x14]
xor ebp, dword [eax]
mov eax, dword [esp + 0x18]
mov dword [eax], ebp
add dword [esp + 0x18], 4
add dword [esp + 0x14], 4
dec edi
jne 0x4a7dd1
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0xc], eax
xor edi, edi
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
mov eax, dword [esp]
call fcn.004a7cc8
mov eax, dword [esp]
mov edx, dword [esp + 8]
mov dword [eax + edi*4], edx
mov eax, dword [esp]
mov edx, dword [esp + 0xc]
mov dword [eax + edi*4 + 4], edx
add edi, 2
cmp edi, 0x12
jl 0x4a7e1f
mov edi, 4
mov esi, dword [esp]
xor ebx, ebx
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
mov eax, dword [esp]
call fcn.004a7cc8
mov eax, dword [esp + 8]
mov dword [esi + ebx*4 + 0x48], eax
mov eax, dword [esp + 0xc]
mov dword [esi + ebx*4 + 0x4c], eax
add ebx, 2
cmp ebx, 0x100
jl 0x4a7e56
add esi, 0x400
dec edi
jne 0x4a7e54
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a81a4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
movzx edx, byte [eax + 1]
movzx ecx, byte [eax]
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x4a8218
inc ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0
inc edx
movzx esi, dl
movzx ecx, byte [eax + esi + 2]
add byte [ebp - 0xd], cl
movzx ebx, byte [ebp - 0xd]
movzx ebx, byte [eax + ebx + 2]
push ebx
pop ebx
mov byte [eax + esi + 2], bl
movzx ebx, byte [ebp - 0xd]
mov byte [eax + ebx + 2], cl
add cl, byte [eax + esi + 2]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
movzx ebx, byte [ebx + esi]
movzx ecx, cl
xor bl, byte [eax + ecx + 2]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov byte [ecx + esi], bl
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x4a81cf
movzx ecx, byte [ebp - 0xd]
mov byte [eax], cl
mov byte [eax + 1], dl
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4a822c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
movzx edx, byte [eax + 1]
movzx ecx, byte [eax]
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x4a82a0
inc ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0
inc edx
movzx esi, dl
movzx ecx, byte [eax + esi + 2]
add byte [ebp - 0xd], cl
movzx ebx, byte [ebp - 0xd]
movzx ebx, byte [eax + ebx + 2]
push ebx
pop ebx
mov byte [eax + esi + 2], bl
movzx ebx, byte [ebp - 0xd]
mov byte [eax + ebx + 2], cl
add cl, byte [eax + esi + 2]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
movzx ebx, byte [ebx + esi]
movzx ecx, cl
xor bl, byte [eax + ecx + 2]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov byte [ecx + esi], bl
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x4a8257
movzx ecx, byte [ebp - 0xd]
mov byte [eax], cl
mov byte [eax + 1], dl
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a87e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test edi, edi
jne 0x4a8805
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x4a894e
mov eax, dword [ebx + 0x90]
mov edx, eax
add edx, edi
shr edx, 3
add edx, edx
add edx, edx
add edx, edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 8]
jae 0x4a8834
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
xor eax, eax
jmp 0x4a894e
test eax, eax
jbe 0x4a88d5
mov edx, 8
sub edx, eax
mov dword [ebp - 4], edx
cmp edi, dword [ebp - 4]
jae 0x4a8865
lea edx, [ebx + eax + 0x88]
mov eax, esi
mov ecx, edi
call fcn.0040312c
add dword [ebx + 0x90], edi
xor edi, edi
jmp 0x4a88d5
lea edx, [ebx + eax + 0x88]
mov eax, esi
mov ecx, dword [ebp - 4]
call fcn.0040312c
sub edi, dword [ebp - 4]
lea eax, [ebx + 0x88]
mov eax, dword [eax]
lea edx, [ebx + 0x80]
xor eax, dword [edx]
lea edx, [ebp - 0x10]
mov dword [edx], eax
lea eax, [ebx + 0x8c]
mov eax, dword [eax]
lea edx, [ebx + 0x84]
xor eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.004a8470
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebx + 0x80], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x84], edx
add dword [ebp + 0xc], 8
mov eax, dword [ebp - 4]
add esi, eax
xor eax, eax
mov dword [ebx + 0x90], eax
cmp edi, 8
jb 0x4a892b
mov eax, dword [esi]
lea edx, [ebx + 0x80]
xor eax, dword [edx]
lea edx, [ebp - 0x10]
mov dword [edx], eax
add esi, 4
mov eax, dword [esi]
lea edx, [ebx + 0x84]
xor eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [edx], eax
add esi, 4
mov ecx, dword [ebp + 0xc]
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.004a8470
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebx + 0x80], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x84], edx
add dword [ebp + 0xc], 8
sub edi, 8
cmp edi, 8
jae 0x4a88da
test edi, edi
jbe 0x4a8944
lea edx, [ebx + 0x88]
mov eax, esi
mov ecx, edi
call fcn.0040312c
mov dword [ebx + 0x90], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a8958
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
test edi, edi
jne 0x4a897d
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x4a8ac9
mov eax, dword [ebx + 0x90]
mov edx, eax
add edx, edi
shr edx, 3
add edx, edx
add edx, edx
add edx, edx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 0xc]
jae 0x4a89ac
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
jmp 0x4a8ac9
test eax, eax
jbe 0x4a8a4e
mov edx, 8
sub edx, eax
mov dword [ebp - 8], edx
cmp edi, dword [ebp - 8]
jae 0x4a89de
lea edx, [ebx + eax + 0x88]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.0040312c
add dword [ebx + 0x90], edi
xor edi, edi
jmp 0x4a8a4e
lea edx, [ebx + eax + 0x88]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.0040312c
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
sub edi, dword [ebp - 8]
mov eax, dword [ebx + 0x88]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x8c]
mov dword [ebp - 0x10], eax
mov ecx, esi
mov edx, ebx
lea eax, [ebx + 0x88]
call fcn.004a85fc
lea eax, [ebx + 0x80]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x84]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x80], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x84], eax
xor eax, eax
mov dword [ebx + 0x90], eax
cmp edi, 8
jb 0x4a8aa5
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004a85fc
lea eax, [ebx + 0x80]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x84]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x80], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x84], eax
add dword [ebp - 4], 8
sub edi, 8
cmp edi, 8
jae 0x4a8a53
test edi, edi
jbe 0x4a8abf
lea edx, [ebx + 0x88]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.0040312c
mov dword [ebx + 0x90], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a8d9c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + 0x5decd8]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + 0x5decd8]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x5decd8]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x5decd8]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x5dec5c]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x4a8dc7
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4a8e88
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + 0x5decd8]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + 0x5decd8]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x5decd8]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x5decd8]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x5dec5c]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x4a8ec3
add esp, 0xc
pop edi
pop esi
pop ebx
ret