joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f8090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.005dfa60
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov edx, dword [eax + 0x60]
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov ecx, dword [edx + 0x70]
mov dword [ebp - 4], edx
test ecx, ecx
je 0x4f80ff
test edi, edi
je 0x4f80df
lea eax, [edx + 0x30]
add eax, ecx
mov dword [ebp + 8], eax
cmp ecx, 0x40
jae 0x4f80df
mov al, byte [eax]
inc ecx
xor al, byte [esi]
inc esi
mov byte [ebx], al
inc ebx
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
sub edi, 1
jne 0x4f80c5
mov dword [edx + 0x70], ecx
test edi, edi
je 0x4f81cc
cmp ecx, 0x40
jne 0x4f80ff
mov dword [edx + 0x70], 0
add dword [edx + 0x20], 1
jne 0x4f80ff
inc dword [edx + 0x24]
mov eax, edi
and eax, 0x3f
sub edi, eax
mov dword [ebp - 8], eax
lea eax, [edx + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [eax]
mov dword [ebp + 8], eax
cmp edi, 0x40
jb 0x4f8177
nop dword [eax]
push dword [ebp - 0xc]
mov ecx, edi
xor edx, edx
shr ecx, 6
add eax, ecx
cmp eax, ecx
cmovae edx, eax
neg dword [ebp + 8]
cmp eax, ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
cmovae eax, ecx
push edx
shl eax, 6
push eax
push esi
push ebx
mov dword [ebp + 8], eax
call fcn.0043e900
mov eax, dword [ebp + 8]
add esp, 0x14
mov ecx, dword [ebp - 0xc]
sub edi, eax
mov edx, dword [ebp - 4]
add esi, eax
add ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
test eax, eax
jne 0x4f816f
inc dword [edx + 0x24]
mov dword [ebp + 8], eax
cmp edi, 0x40
jae 0x4f8120
cmp dword [ebp - 8], 0
je 0x4f81cc
push 0x40
lea eax, [edx + 0x30]
push 0
push eax
mov dword [ebp + 8], eax
call fcn.005e1a80
push dword [ebp - 0xc]
mov edi, dword [ebp - 4]
push edi
push 0x40
lea eax, [edi + 0x30]
push eax
push eax
call fcn.0043e900
mov eax, dword [ebp - 8]
add esp, 0x20
xor edx, edx
test eax, eax
je 0x4f81c9
sub esi, ebx
mov edi, eax
mov eax, dword [ebp + 8]
lea ecx, [edx + ebx]
mov al, byte [eax + edx]
inc edx
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, edi
jb 0x4f81b0
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edi + 0x70], eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50b030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
lea ecx, [edx + 0x3c]
movd xmm0, ebx
pshufd xmm4, xmm0, 0
lea eax, [esi + 0x3c]
cmp edx, eax
ja 0x50b080
cmp ecx, esi
jb 0x50b080
push edi
sub esi, edx
mov edi, 0x10
nop dword [eax]
mov ecx, dword [edx + esi]
lea edx, [edx + 4]
mov eax, dword [edx - 4]
xor eax, ecx
and eax, ebx
xor ecx, eax
mov dword [edx + esi - 4], ecx
xor dword [edx - 4], eax
sub edi, 1
jne 0x50b060
pop edi
pop esi
pop ebx
pop ebp
ret
sub esi, edx
mov eax, 4
nop word [eax + eax]
lea edx, [edx + 0x10]
movups xmm1, xmmword [esi + edx - 0x10]
movups xmm3, xmmword [edx - 0x10]
movaps xmm2, xmm1
pxor xmm2, xmm3
pand xmm2, xmm4
movaps xmm0, xmm2
pxor xmm2, xmm3
pxor xmm0, xmm1
movups xmmword [esi + edx - 0x10], xmm0
movups xmmword [edx - 0x10], xmm2
sub eax, 1
jne 0x50b090
pop esi
pop ebx
pop ebp
ret
Function at 0x525e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24
call fcn.005dfa60
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
test esi, esi
je 0x52601e
push edi
cmp esi, 0x10
jb 0x525f00
mov eax, esi
shr eax, 4
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 8]
mov eax, ecx
sub edi, ecx
mov edx, 4
mov ecx, ebx
sub ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov esi, ecx
nop dword [eax]
mov ecx, dword [edi + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [esi + eax - 4], ecx
sub edx, 1
jne 0x525eb0
push dword [ebp + 0xc]
push ebx
push ebx
call dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, ebx
mov ecx, dword [ebp - 4]
sub esi, 0x10
mov dword [ebp - 8], ebx
add ecx, 0x10
add esp, 0xc
mov dword [ebp + 8], esi
add ebx, 0x10
mov dword [ebp - 4], ecx
sub dword [ebp - 0xc], 1
mov edx, esi
jne 0x525e93
mov dword [ebp - 8], eax
mov dword [ebp + 8], edx
mov dword [ebp - 4], ecx
test edx, edx
je 0x526010
mov esi, eax
mov dword [ebp - 0xc], eax
sub esi, dword [ebp - 4]
lea edi, [ebx + 2]
mov dword [ebp - 0x18], esi
xor edx, edx
mov esi, ebx
inc ecx
sub esi, dword [ebp - 4]
mov dword [ebp - 0x1c], esi
mov esi, 1
sub esi, dword [ebp - 4]
mov dword [ebp - 0x20], esi
mov esi, 2
sub esi, dword [ebp - 4]
sub dword [ebp - 0xc], ebx
mov dword [ebp - 0x24], esi
mov esi, ebx
not esi
mov dword [ebp - 0x14], esi
mov esi, dword [ebp + 8]
nop dword [eax]
cmp edx, esi
jae 0x525fbf
add eax, edx
mov dword [ebp - 0x10], eax
mov esi, eax
mov al, byte [ecx - 1]
xor al, byte [esi]
mov esi, dword [ebp + 8]
mov byte [edi - 2], al
mov eax, dword [ebp - 0x14]
add eax, edi
cmp eax, esi
jae 0x525fb9
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov al, byte [ecx + eax]
xor al, byte [ecx]
mov byte [ecx + esi], al
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp + 8]
add eax, ecx
cmp eax, esi
jae 0x525fb4
mov eax, dword [ebp - 0xc]
mov al, byte [eax + edi]
xor al, byte [ecx + 1]
mov byte [edi], al
mov eax, dword [ebp - 0x24]
add eax, ecx
cmp eax, esi
jae 0x525faf
mov esi, dword [ebp - 0x10]
add edx, 4
mov al, byte [ecx + 2]
add ecx, 4
xor al, byte [esi + 3]
mov esi, dword [ebp + 8]
mov byte [edi + 1], al
add edi, 4
mov eax, dword [ebp - 8]
cmp edx, 0x10
jb 0x525f40
jmp 0x525fe1
add edx, 3
jmp 0x525fba
add edx, 2
jmp 0x525fba
inc edx
cmp edx, 0x10
jae 0x525fe1
mov esi, dword [ebp - 0xc]
lea ecx, [edx + ebx]
mov edi, 0x10
sub edi, edx
nop dword [eax]
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edi, 1
jne 0x525fd0
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
push ebx
call dword [ebp + 0x14]
add esp, 0xc
mov eax, ebx
mov dword [ebp - 8], eax
cmp esi, 0x10
jbe 0x526010
mov ecx, dword [ebp - 4]
sub esi, 0x10
add ecx, 0x10
mov dword [ebp + 8], esi
add ebx, 0x10
mov dword [ebp - 4], ecx
test esi, esi
jne 0x525f00
mov ecx, dword [ebp + 0x10]
pop edi
cmp ecx, eax
je 0x52601e
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x526340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.005dfa60
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, edx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov esi, dword [esi]
test esi, esi
je 0x52637b
mov edx, dword [ebp + 0x10]
test edi, edi
je 0x52637b
mov al, byte [esi + edx]
dec edi
xor al, byte [ecx]
inc esi
mov byte [ebx], al
inc ecx
inc ebx
mov dword [ebp - 4], ecx
and esi, 0xf
jne 0x526364
cmp edi, 0x10
jb 0x5263fd
mov edx, dword [ebp + 0x10]
mov eax, ebx
sub eax, edx
mov dword [ebp - 0xc], eax
mov eax, ecx
sub eax, edx
mov dword [ebp + 8], eax
mov eax, edi
shr eax, 4
mov dword [ebp - 8], eax
shl eax, 4
add ebx, eax
add ecx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
jmp 0x5263b3
mov edx, dword [ebp + 0x10]
push dword [ebp + 0xc]
push edx
push edx
call dword [ebp + 0x18]
add esp, 0xc
cmp esi, 0x10
jae 0x5263e8
mov eax, dword [ebp + 0x10]
mov edx, 0xf
sub edx, esi
add eax, esi
mov esi, dword [ebp + 8]
shr edx, 2
inc edx
mov ecx, dword [esi + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
sub edx, 1
jne 0x5263d6
add dword [ebp + 8], 0x10
sub edi, 0x10
add ebx, 0x10
xor esi, esi
sub dword [ebp - 8], 1
jne 0x5263b0
mov ebx, dword [ebp - 0x10]
test edi, edi
je 0x526432
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push eax
push eax
call dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp - 4]
sub ebx, eax
sub edx, eax
lea ecx, [esi + eax]
add esi, edi
nop
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub edi, 1
jne 0x526420
mov eax, dword [ebp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x526440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.005dfa60
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, dword [edi]
test edi, edi
je 0x526481
mov edx, dword [ebp + 0x14]
test esi, esi
je 0x526481
mov al, byte [edi + edx]
dec esi
xor al, byte [ecx]
inc edi
mov byte [ebx], al
inc ecx
inc ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
and edi, 0xf
jne 0x526467
cmp esi, 0x10
jb 0x526517
mov edx, dword [ebp + 0x14]
mov eax, ecx
sub eax, edx
xor edi, edi
mov dword [ebp + 8], eax
mov eax, esi
shr eax, 4
mov dword [ebp - 0x10], edi
mov edi, ebx
mov dword [ebp - 0xc], eax
sub edi, edx
shl eax, 4
add ebx, eax
add ecx, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
jmp 0x5264b7
mov edx, dword [ebp + 0x14]
push dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
push edx
push ebx
call dword [ebp + 0x1c]
add esp, 0xc
mov edx, 0x10
mov ecx, 1
nop
movzx eax, byte [edx + ebx - 1]
dec edx
add ecx, eax
mov byte [edx + ebx], cl
shr ecx, 8
test edx, edx
jne 0x5264d0
mov eax, dword [ebp + 0x14]
mov edx, 4
mov ebx, dword [ebp + 8]
nop dword [eax]
mov ecx, dword [ebx + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [edi + eax - 4], ecx
sub edx, 1
jne 0x5264f0
add ebx, 0x10
sub esi, 0x10
add edi, 0x10
mov dword [ebp + 8], ebx
sub dword [ebp - 0xc], 1
jne 0x5264b4
mov edi, dword [ebp - 0x10]
test esi, esi
je 0x526572
push dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebp + 0x14]
push ebx
call dword [ebp + 0x1c]
add esp, 0xc
mov edx, 0x10
mov ecx, 1
movzx eax, byte [edx + ebx - 1]
dec edx
add ecx, eax
mov byte [edx + ebx], cl
shr ecx, 8
test edx, edx
jne 0x526535
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 4]
sub edx, eax
sub ebx, eax
lea ecx, [edi + eax]
add edi, esi
nop dword [eax]
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub esi, 1
jne 0x526560
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x526580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.005dfa60
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov edi, dword [ebp + 0x18]
mov edx, ecx
mov dword [ebp - 4], edx
mov edi, dword [edi]
mov dword [ebp - 8], edi
test edi, edi
je 0x5265ca
mov ecx, dword [ebp + 0x14]
nop dword [eax]
test esi, esi
je 0x5265ca
mov al, byte [edi + ecx]
dec esi
xor al, byte [edx]
inc edi
mov byte [ebx], al
inc edx
inc ebx
mov dword [ebp - 4], edx
and edi, 0xf
mov dword [ebp - 8], edi
jne 0x5265b0
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0xc]
bswap ecx
mov dword [ebp + 8], ecx
cmp esi, 0x10
jb 0x526660
mov edi, eax
mov eax, dword [ebp + 8]
mov ecx, esi
mov edx, dword [ebp + 8]
shr ecx, 4
neg edx
add eax, ecx
cmp eax, ecx
push edi
push dword [ebp + 0xc]
cmovae edx, ecx
mov dword [ebp - 0xc], edx
xor edx, edx
push dword [ebp - 0xc]
cmp eax, ecx
mov ecx, edx
mov edx, dword [ebp - 4]
cmovae ecx, eax
push ebx
push edx
mov dword [ebp + 8], ecx
call dword [ebp + 0x1c]
mov ecx, dword [ebp + 8]
add esp, 0x14
mov eax, ecx
bswap eax
mov dword [edi + 0xc], eax
test ecx, ecx
jne 0x526645
mov edx, 0xc
mov eax, 1
nop dword [eax]
movzx ecx, byte [edx + edi - 1]
dec edx
add eax, ecx
mov byte [edx + edi], al
shr eax, 8
test edx, edx
jne 0x526630
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 4
add dword [ebp - 4], eax
sub esi, eax
add ebx, eax
cmp esi, 0x10
jae 0x5265e0
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp + 8], ecx
test esi, esi
je 0x5266d2
mov ecx, dword [ebp + 0x14]
xorps xmm0, xmm0
push eax
push dword [ebp + 0xc]
push 1
push ecx
push ecx
movups xmmword [ecx], xmm0
call dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
add esp, 0x14
mov edx, dword [ebp + 0x10]
add eax, 1
bswap eax
mov dword [edx + 0xc], eax
jne 0x5266aa
mov edi, 0xc
mov ecx, 1
movzx eax, byte [edi + edx - 1]
dec edi
add ecx, eax
mov byte [edi + edx], cl
shr ecx, 8
test edi, edi
jne 0x526695
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 0x14]
sub ebx, eax
mov edx, dword [ebp - 4]
sub edx, eax
lea ecx, [edi + eax]
add edi, esi
nop dword [eax]
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub esi, 1
jne 0x5266c0
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x526e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30
call fcn.005dfa60
mov eax, dword [0x6a704c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [eax]
movzx ebx, byte [ecx]
push edi
lea edi, [ecx + 1]
mov dword [ebp - 0x1c], edx
mov edx, edi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edi
movzx eax, byte [edx]
shl eax, 8
or ebx, eax
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 1]
shl eax, 0x10
or ebx, eax
movzx eax, byte [edx + 2]
shl eax, 0x18
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 8
or ecx, eax
mov dword [ebp - 0x14], ebx
movzx eax, byte [edx + 5]
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx + 6]
mov edx, dword [ebp - 0x18]
shl ecx, 8
or ecx, eax
mov byte [ebp - 0xc], bl
mov eax, ebx
shl ecx, 0x10
shr eax, 8
or edx, ecx
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xa], al
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 9], al
mov eax, edx
shr eax, 8
mov byte [ebp - 7], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 6], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 5], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], edx
mov byte [ebp - 8], dl
test eax, eax
je 0x526fa4
mov ecx, dword [ebp - 0x20]
sub dword [ebp - 0x1c], ecx
xor edi, edi
dec eax
mov dword [ebp + 8], eax
test esi, esi
jne 0x526f4c
push 1
push dword [ebp - 0x28]
lea eax, [ebp - 0x14]
push eax
call fcn.00402b00
mov ebx, dword [ebp - 0x14]
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xb], al
mov eax, ebx
mov ecx, dword [ebp - 0x20]
shr eax, 0x10
mov byte [ebp - 0xa], al
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 9], al
mov eax, edx
shr eax, 8
mov byte [ebp - 7], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 6], al
mov eax, edx
shr eax, 0x18
inc edi
mov byte [ebp - 0xc], bl
mov dword [ebp - 0x18], edx
mov byte [ebp - 8], dl
mov byte [ebp - 5], al
mov al, byte [ebp + esi - 0xc]
inc esi
mov edx, dword [ebp - 0x1c]
and esi, 7
xor al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
test eax, eax
jne 0x526ef0
test edi, edi
mov edi, dword [ebp - 0x2c]
je 0x526fa4
mov eax, dword [ebp - 0x30]
mov byte [edi + 3], dl
mov byte [eax], bl
mov eax, ebx
shr eax, 8
mov byte [edi], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 1], al
mov eax, edx
shr eax, 8
mov byte [edi + 4], al
mov eax, edx
shr ebx, 0x18
shr eax, 0x10
shr edx, 0x18
mov byte [edi + 2], bl
mov byte [edi + 5], al
mov byte [edi + 6], dl
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax], esi
pop esi
pop ebx
call fcn.005df097
mov esp, ebp
pop ebp
ret
Function at 0x528580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18
call fcn.005dfa60
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x14], esi
push edi
mov edi, edx
mov eax, dword [esi + 0x160]
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], eax
mov dword [esi + 0x16c], 0
mov dword [esi + 0x168], 0
cmp ebx, 0xc
jne 0x5285f5
movq xmm0, qword [edi]
movq qword [esi], xmm0
mov eax, dword [edi + 8]
lea edi, [ebx - 0xb]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x1000000
jmp 0x5286e9
mov dword [esi + 0x40], 0
lea edx, [esi + 0x40]
mov dword [edx + 4], 0
lea eax, [esi + 0x60]
mov dword [esi + 0x48], 0
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], edx
mov dword [esi + 0x4c], 0
mov dword [ebp - 0xc], eax
cmp ebx, 0x10
jb 0x528688
mov eax, ebx
lea ecx, [esi + 0x41]
shr eax, 4
mov dword [ebp - 0x10], ecx
mov dword [ebp + 8], eax
lea edx, [edi + 2]
mov eax, ecx
mov esi, 4
nop dword [eax]
movzx ecx, byte [edx - 2]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 5]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 4]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 2], cl
sub esi, 1
jne 0x528640
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
add esp, 8
add edi, 0x10
sub ebx, 0x10
sub dword [ebp + 8], 1
jne 0x528633
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
test ebx, ebx
je 0x5286aa
mov ecx, edx
nop
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub ebx, 1
jne 0x528690
lea eax, [esi + 0x60]
push eax
push edx
call dword [ebp - 4]
add esp, 8
mov eax, dword [ebp - 0x18]
lea ebx, [esi + 0x40]
xor ecx, ecx
shld ecx, eax, 3
shl eax, 3
bswap eax
xor dword [esi + 0x4c], eax
lea eax, [esi + 0x60]
push eax
bswap ecx
xor dword [esi + 0x48], ecx
push ebx
call dword [ebp - 4]
mov edi, dword [esi + 0x4c]
add esp, 8
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov dword [esi + 8], eax
bswap edi
mov dword [esi + 0xc], ecx
mov dword [esi + 0x40], 0
lea eax, [esi + 0x20]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
push dword [esi + 0x174]
push eax
mov eax, dword [esi + 0x170]
push esi
call eax
add esp, 0xc
inc edi
bswap edi
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x528730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14
call fcn.005dfa60
mov eax, dword [ecx + 0x160]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 0x164]
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x38]
or eax, dword [ecx + 0x3c]
push esi
push edi
mov edi, edx
mov dword [ebp - 0x14], ecx
je 0x52876b
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, esi
add eax, dword [ecx + 0x30]
adc edx, dword [ecx + 0x34]
cmp edx, 0x20000000
ja 0x52882c
jb 0x52878e
test eax, eax
jne 0x52882c
mov dword [ecx + 0x34], edx
mov edx, dword [ecx + 0x16c]
mov dword [ecx + 0x30], eax
mov dword [ebp - 4], edx
test edx, edx
je 0x5287e1
test esi, esi
je 0x5287d2
mov al, byte [edi]
dec esi
xor byte [edx + ecx + 0x40], al
inc edi
inc edx
and edx, 0xf
mov dword [ebp - 4], edx
jne 0x5287a1
lea eax, [ecx + 0x60]
lea ebx, [ecx + 0x40]
mov dword [ebp - 0xc], eax
push eax
push ebx
call dword [ebp - 8]
mov eax, dword [ebp - 4]
add esp, 8
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jmp 0x5287e7
mov dword [ecx + 0x16c], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ecx + 0x60]
lea ebx, [ecx + 0x40]
mov eax, esi
and eax, 0xfffffff0
mov dword [ebp - 0xc], eax
je 0x528801
push eax
push edi
push edx
push ebx
call dword [ebp - 0x10]
add edi, dword [ebp - 0xc]
add esp, 0x10
sub esi, dword [ebp - 0xc]
test esi, esi
je 0x528817
mov dword [ebp - 4], esi
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ebx], al
lea ebx, [ebx + 1]
sub esi, 1
jne 0x528808
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x16c], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52a000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x48
call fcn.005dfa60
mov eax, dword [0x6a704c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x34], eax
mov dl, byte [esi]
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x40], esi
mov byte [ebp - 0x1d], dl
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
push edi
lea edi, [esi + 0x10]
test dl, 0x40
jne 0x52a055
push eax
push edi
push esi
call ecx
mov dl, byte [ebp - 0x1d]
add esp, 0xc
movzx eax, dl
xor ecx, ecx
and eax, 7
mov edx, 0xf
sub edx, eax
mov byte [esi], al
mov dword [ebp - 0x44], edx
cmp edx, 0xf
jae 0x52a083
nop
movzx eax, byte [esi + edx]
or ecx, eax
mov byte [esi + edx], 0
inc edx
shl ecx, 8
cmp edx, 0xf
jb 0x52a070
movzx eax, byte [esi + 0xf]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebx
je 0x52a0a5
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005df097
mov esp, ebp
pop ebp
ret
mov eax, ebx
shr eax, 4
mov dword [ebp - 0x38], eax
test eax, eax
je 0x52a0e1
push edi
push esi
push dword [ebp - 0x2c]
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x24]
call dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
add esp, 0x18
shl eax, 4
add dword [ebp - 0x24], eax
add dword [ebp - 0x28], eax
sub ebx, eax
je 0x52a142
shr eax, 4
mov ecx, esi
mov edx, eax
call fcn.00529cb0
jmp 0x52a0f3
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, ebx
test eax, eax
je 0x52a142
push dword [ebp - 0x2c]
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [ebp - 0x30]
add esp, 0xc
test ebx, ebx
je 0x52a12f
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
mov eax, ecx
sub esi, eax
sub edx, eax
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edi, [edi + 1]
mov byte [edx + ecx - 1], al
xor byte [edi - 1], al
sub ebx, 1
jne 0x52a114
mov esi, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x2c]
lea eax, [esi + 0x10]
mov edi, dword [ebp - 0x30]
push ebx
push eax
push eax
call edi
add esp, 0xc
jmp 0x52a148
mov edi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x44]
cmp ecx, 0x10
jae 0x52a166
mov eax, 0x10
sub eax, ecx
push eax
lea eax, [ecx + esi]
push 0
push eax
call fcn.005e1a80
add esp, 0xc
push ebx
lea eax, [ebp - 0x1c]
push eax
push esi
call edi
mov eax, dword [ebp - 0x1c]
add esp, 0xc
xor dword [esi + 0x10], eax
mov eax, dword [ebp - 0x18]
xor dword [esi + 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [esi + 0x18], eax
mov eax, dword [ebp - 0x10]
xor dword [esi + 0x1c], eax
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 8]
pop edi
mov byte [esi], al
xor ecx, ebp
pop esi
xor eax, eax
pop ebx
call fcn.005df097
mov esp, ebp
pop ebp
ret