joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4962d0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, ecx
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
push esi
push edi
call edx
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
xor eax, eax
mov ecx, 2
mov dword [esp + 0x10], eax
add eax, dword [ebp + 0x24]
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [ecx - 2]
div esi
lea eax, [ecx - 1]
movzx ebx, byte [edx + edi]
xor edx, edx
div esi
shl ebx, 8
movzx eax, byte [edx + edi]
or ebx, eax
xor edx, edx
mov eax, ecx
div esi
shl ebx, 8
lea eax, [ecx + 1]
add ecx, 4
movzx edx, byte [edx + edi]
or ebx, edx
xor edx, edx
div esi
shl ebx, 8
movzx eax, byte [edx + edi]
or ebx, eax
mov eax, dword [esp + 0x1c]
xor dword [eax], ebx
mov eax, dword [esp + 0x10]
add eax, 4
mov dword [esp + 0x10], eax
cmp eax, 0x48
jne 0x4962f2
mov edx, dword [ebp + 0x24]
mov esi, dword [ebp + 0x14]
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ecx
mov edi, edi
mov edi, dword [ebp + 0x24]
mov dword [esp + 0x1c], 8
jmp 0x496370
xor eax, dword [edi]
add edi, 8
mov edx, eax
shr edx, 0x10
movzx edx, dl
mov edx, dword [esi + edx*4 + 0x400]
mov ebx, eax
shr ebx, 0x18
add edx, dword [esi + ebx*4]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [esi + ebx*4 + 0x800]
movzx ebx, al
add edx, dword [esi + ebx*4 + 0xc00]
xor edx, dword [edi - 4]
xor ecx, edx
mov edx, ecx
shr edx, 0x10
movzx edx, dl
mov edx, dword [esi + edx*4 + 0x400]
mov ebx, ecx
shr ebx, 0x18
add edx, dword [esi + ebx*4]
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
xor edx, dword [esi + ebx*4 + 0x800]
movzx ebx, cl
add edx, dword [esi + ebx*4 + 0xc00]
xor eax, edx
dec dword [esp + 0x1c]
jne 0x496370
mov edx, dword [ebp + 0x24]
mov edi, ecx
mov ecx, dword [edx + 0x40]
xor ecx, eax
mov eax, dword [edx + 0x44]
mov edx, dword [esp + 0x18]
xor eax, edi
mov edi, dword [esp + 0x10]
mov dword [edi + edx*4], eax
mov dword [edi + edx*4 + 4], ecx
add edx, 2
mov dword [esp + 0x18], edx
cmp edx, 0x12
jne 0x496360
mov esi, dword [ebp + 0x14]
mov dword [esp + 0x18], 0
jmp 0x496420
mov edi, dword [ebp + 0x24]
mov dword [esp + 0x1c], 8
jmp 0x496430
xor eax, dword [edi]
add edi, 8
mov edx, eax
shr edx, 0x10
movzx edx, dl
mov edx, dword [esi + edx*4 + 0x400]
mov ebx, eax
shr ebx, 0x18
add edx, dword [esi + ebx*4]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [esi + ebx*4 + 0x800]
movzx ebx, al
add edx, dword [esi + ebx*4 + 0xc00]
xor edx, dword [edi - 4]
xor ecx, edx
mov edx, ecx
shr edx, 0x10
movzx edx, dl
mov edx, dword [esi + edx*4 + 0x400]
mov ebx, ecx
shr ebx, 0x18
add edx, dword [esi + ebx*4]
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
xor edx, dword [esi + ebx*4 + 0x800]
movzx ebx, cl
add edx, dword [esi + ebx*4 + 0xc00]
xor eax, edx
dec dword [esp + 0x1c]
jne 0x496430
mov edx, dword [ebp + 0x24]
mov edi, ecx
mov ecx, dword [edx + 0x40]
xor ecx, eax
mov eax, dword [edx + 0x44]
mov edx, dword [esp + 0x18]
xor eax, edi
mov dword [esi + edx*4], eax
mov dword [esi + edx*4 + 4], ecx
add edx, 2
mov dword [esp + 0x18], edx
cmp edx, 0x400
jne 0x496420
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x4964e0
Capabilities:
Encrypt data using blowfish

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
cmp eax, 0x12
jb 0x4964f0
mov eax, 0x12
mov ecx, dword [esi + 0x24]
add eax, eax
add eax, eax
push eax
push 0x4fd0a8
push ecx
call fcn.0045e5f0
mov eax, dword [esi + 0x18]
add esp, 0xc
cmp eax, 0x400
jb 0x496515
mov eax, 0x400
lea edx, [eax*4]
mov eax, dword [esi + 0x14]
push edx
push 0x4fd0f0
push eax
call fcn.0045e5f0
add esp, 0xc
pop esi
ret
Function at 0x49a4f0
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x18]
add esi, 8
mov dword [esp + 0x10], 8
lea esp, [esp]
mov edx, dword [ebp]
mov ecx, dword [esi - 4]
xor ecx, edx
mov eax, edx
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov edx, ecx
shr edx, 0x18
mov edx, dword [edx*4 + 0x500810]
xor edx, dword [ebx*4 + 0x501010]
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x501810]
ror eax, 4
xor eax, dword [esi - 8]
movzx ecx, cl
mov ebx, eax
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x500410]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edx, dword [ebx*4 + 0x500c10]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x501410]
movzx eax, al
xor edx, dword [ecx*4 + 0x502010]
add esi, 0x10
xor edx, dword [eax*4 + 0x501c10]
xor dword [edi], edx
mov eax, dword [esi - 0xc]
xor eax, dword [edi]
mov ecx, dword [edi]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x500810]
xor edx, dword [ebx*4 + 0x501010]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x501810]
ror ecx, 4
xor ecx, dword [esi - 0x10]
movzx eax, al
mov ebx, ecx
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x500410]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
xor edx, dword [ebx*4 + 0x500c10]
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x501410]
movzx ecx, cl
xor edx, dword [eax*4 + 0x502010]
xor edx, dword [ecx*4 + 0x501c10]
xor dword [ebp], edx
dec dword [esp + 0x10]
jne 0x49a510
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x49a620
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x18]
add esi, 0x7c
mov dword [esp + 0x10], 8
lea esp, [esp]
mov edx, dword [ebp]
mov ecx, dword [esi]
xor ecx, edx
mov eax, edx
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov edx, ecx
shr edx, 0x18
mov edx, dword [edx*4 + 0x500810]
xor edx, dword [ebx*4 + 0x501010]
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x501810]
ror eax, 4
xor eax, dword [esi - 4]
movzx ecx, cl
mov ebx, eax
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x500410]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edx, dword [ebx*4 + 0x500c10]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x501410]
movzx eax, al
xor edx, dword [ecx*4 + 0x502010]
sub esi, 0x10
xor edx, dword [eax*4 + 0x501c10]
xor dword [edi], edx
mov eax, dword [esi + 8]
xor eax, dword [edi]
mov ecx, dword [edi]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x500810]
xor edx, dword [ebx*4 + 0x501010]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x501810]
ror ecx, 4
xor ecx, dword [esi + 4]
movzx eax, al
mov ebx, ecx
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x500410]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
xor edx, dword [ebx*4 + 0x500c10]
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x501410]
movzx ecx, cl
xor edx, dword [eax*4 + 0x502010]
xor edx, dword [ecx*4 + 0x501c10]
xor dword [ebp], edx
dec dword [esp + 0x10]
jne 0x49a640
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x49b080
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
cmp esi, 8
jb 0x49b0e3
push edi
mov edi, esi
shr edi, 3
jmp 0x49b0a0
movzx edx, byte [ecx]
xor byte [eax], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx + 2]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 3]
xor byte [eax + 3], dl
movzx edx, byte [ecx + 4]
xor byte [eax + 4], dl
movzx edx, byte [ecx + 5]
xor byte [eax + 5], dl
movzx edx, byte [ecx + 6]
xor byte [eax + 6], dl
movzx edx, byte [ecx + 7]
xor byte [eax + 7], dl
add eax, 8
add ecx, 8
sub esi, 8
dec edi
jne 0x49b0a0
pop edi
test esi, esi
je 0x49b0f9
sub ecx, eax
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x49b0f0
pop esi
ret
Function at 0x49b100
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
jb 0x49b17d
push ebp
mov ebp, edi
shr ebp, 3
lea ecx, [ecx]
movzx edx, byte [ecx]
xor dl, byte [eax]
add ecx, 8
mov byte [esi], dl
movzx edx, byte [ecx - 7]
xor dl, byte [eax + 1]
add eax, 8
mov byte [esi + 1], dl
movzx edx, byte [ecx - 6]
xor dl, byte [eax - 6]
add esi, 8
mov byte [esi - 6], dl
movzx edx, byte [ecx - 5]
xor dl, byte [eax - 5]
sub edi, 8
mov byte [esi - 5], dl
movzx edx, byte [ecx - 4]
xor dl, byte [eax - 4]
mov byte [esi - 4], dl
movzx edx, byte [ecx - 3]
xor dl, byte [eax - 3]
mov byte [esi - 3], dl
movzx edx, byte [ecx - 2]
xor dl, byte [eax - 2]
mov byte [esi - 2], dl
movzx edx, byte [ecx - 1]
xor dl, byte [eax - 1]
dec ebp
mov byte [esi - 1], dl
jne 0x49b120
pop ebp
test edi, edi
je 0x49b192
sub ecx, eax
sub esi, eax
mov dl, byte [ecx + eax]
xor dl, byte [eax]
inc eax
dec edi
mov byte [esi + eax - 1], dl
jne 0x49b185
pop edi
pop esi
ret
Function at 0x49c3d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
call fcn.0049c320
mov ecx, dword [esp + 0x24]
mov edx, 0x10
xor eax, eax
sub ecx, 0x4f9388
sub edx, 0x4f9388
lea esp, [esp]
mov di, word [ecx + eax + 0x4f9388]
mov ebx, dword [esp + 0x10]
rol di, 8
mov word [eax + ebx], di
mov edi, dword [esp + 0x10]
mov bx, word [eax + edi]
xor bx, word [eax + 0x4f9388]
lea ebp, [edx + eax + 0x4f9388]
add eax, 2
mov word [edi + ebp], bx
cmp eax, 0x10
jne 0x49c400
xor ecx, ecx
mov eax, 1
mov dword [esp + 0x24], 8
mov edi, dword [esp + 0x10]
lea edx, [eax - 1]
and edx, 7
mov dx, word [edi + edx*2]
mov edi, dword [esi + 0x14]
rol dx, 2
mov word [ecx + edi], dx
mov ebx, dword [esp + 0x10]
lea edx, [eax + 1]
mov edi, edx
and edi, 7
movzx edi, word [ebx + edi*2 + 0x10]
mov ebx, dword [esi + 0x14]
rol di, 1
mov word [ecx + ebx + 2], di
mov ebx, dword [esp + 0x10]
mov edi, eax
and edi, 7
movzx edi, word [ebx + edi*2]
mov ebx, dword [esi + 0x14]
rol di, 5
mov word [ecx + ebx + 4], di
mov ebp, dword [esp + 0x10]
mov ebx, dword [esi + 0x14]
lea edi, [eax + 3]
and edi, 7
movzx edi, word [ebp + edi*2 + 0x10]
mov word [ecx + ebx + 6], di
mov ebx, dword [esp + 0x10]
lea edi, [eax - 4]
and edi, 7
movzx edi, word [ebx + edi*2]
mov ebx, dword [esi + 0x14]
rol di, 8
mov word [ecx + ebx + 8], di
mov ebp, dword [esp + 0x10]
mov ebx, dword [esi + 0x14]
lea edi, [eax + 2]
and edi, 7
movzx edi, word [ebp + edi*2 + 0x10]
mov word [ecx + ebx + 0xa], di
mov ebx, dword [esp + 0x10]
lea edi, [eax - 3]
and edi, 7
movzx edi, word [ebx + edi*2]
mov ebx, dword [esi + 0x14]
ror di, 3
mov word [ecx + ebx + 0xc], di
mov ebx, dword [esp + 0x10]
mov edi, dword [esi + 0x14]
add eax, 0xfffffffe
and eax, 7
mov ax, word [ebx + eax*2 + 0x10]
mov word [ecx + edi + 0xe], ax
add ecx, 0x10
dec dword [esp + 0x24]
mov eax, edx
jne 0x49c445
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
add eax, eax
push eax
mov eax, dword [esp + 0x14]
push eax
call edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x49c5b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
mov ebx, 2
lea esp, [esp]
movzx edx, byte [edi]
mov edx, dword [edx*4 + 0x504410]
xor dword [esi], edx
mov edx, dword [edi]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x504810]
add edx, dword [esi]
mov dword [esi], edx
movzx edx, byte [edi + 2]
mov edx, dword [edx*4 + 0x504410]
add dword [ecx], edx
movzx edx, byte [edi + 3]
mov edx, dword [edx*4 + 0x504810]
xor dword [eax], edx
mov ebp, dword [edi]
rol ebp, 8
add ebp, dword [eax]
mov dword [edi], ebp
movzx edx, byte [esi]
mov edx, dword [edx*4 + 0x504410]
xor dword [ecx], edx
mov edx, dword [esi]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x504810]
add edx, dword [ecx]
mov dword [ecx], edx
movzx edx, byte [esi + 2]
mov edx, dword [edx*4 + 0x504410]
add dword [eax], edx
movzx edx, byte [esi + 3]
mov edx, dword [edx*4 + 0x504810]
xor dword [edi], edx
mov edx, dword [esi]
rol edx, 8
add edx, dword [ecx]
mov dword [esi], edx
movzx edx, byte [ecx]
mov edx, dword [edx*4 + 0x504410]
xor dword [eax], edx
mov edx, dword [ecx]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x504810]
add edx, dword [eax]
mov dword [eax], edx
movzx edx, byte [ecx + 2]
mov edx, dword [edx*4 + 0x504410]
add dword [edi], edx
movzx edx, byte [ecx + 3]
mov edx, dword [edx*4 + 0x504810]
xor dword [esi], edx
mov edx, dword [ecx]
rol edx, 8
mov dword [ecx], edx
movzx edx, byte [eax]
mov edx, dword [edx*4 + 0x504410]
xor dword [edi], edx
mov edx, dword [eax]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x504810]
add edx, dword [edi]
mov dword [edi], edx
movzx edx, byte [eax + 2]
mov edx, dword [edx*4 + 0x504410]
add dword [esi], edx
movzx edx, byte [eax + 3]
mov edx, dword [edx*4 + 0x504810]
xor dword [ecx], edx
mov edx, dword [eax]
rol edx, 8
dec ebx
mov dword [eax], edx
jne 0x49c5d0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x49c6e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
mov ebx, 2
lea esp, [esp]
movzx edx, byte [esi]
mov edx, dword [edx*4 + 0x504810]
xor dword [edi], edx
movzx edx, byte [esi + 3]
mov edx, dword [edx*4 + 0x504410]
sub dword [ecx], edx
movzx edx, byte [esi + 2]
mov edx, dword [edx*4 + 0x504810]
sub dword [eax], edx
mov edx, dword [esi]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x504410]
xor edx, dword [eax]
mov dword [eax], edx
mov edx, dword [esi]
ror edx, 8
mov dword [esi], edx
movzx edx, byte [edi]
mov edx, dword [edx*4 + 0x504810]
xor dword [ecx], edx
movzx edx, byte [edi + 3]
mov edx, dword [edx*4 + 0x504410]
sub dword [eax], edx
movzx edx, byte [edi + 2]
mov edx, dword [edx*4 + 0x504810]
sub dword [esi], edx
mov edx, dword [edi]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x504410]
xor edx, dword [esi]
mov dword [esi], edx
mov edx, dword [edi]
ror edx, 8
mov dword [edi], edx
sub dword [ecx], edx
movzx edx, byte [ecx]
mov edx, dword [edx*4 + 0x504810]
xor dword [eax], edx
movzx edx, byte [ecx + 3]
mov edx, dword [edx*4 + 0x504410]
sub dword [esi], edx
movzx edx, byte [ecx + 2]
mov edx, dword [edx*4 + 0x504810]
sub dword [edi], edx
mov edx, dword [ecx]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x504410]
xor edx, dword [edi]
mov dword [edi], edx
mov edx, dword [ecx]
ror edx, 8
mov dword [ecx], edx
mov edx, dword [esi]
sub dword [eax], edx
movzx edx, byte [eax]
mov edx, dword [edx*4 + 0x504810]
xor dword [esi], edx
movzx edx, byte [eax + 3]
mov edx, dword [edx*4 + 0x504410]
sub dword [edi], edx
movzx edx, byte [eax + 2]
mov edx, dword [edx*4 + 0x504810]
sub dword [ecx], edx
mov edx, dword [eax]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x504410]
xor edx, dword [ecx]
mov dword [ecx], edx
mov edx, dword [eax]
ror edx, 8
dec ebx
mov dword [eax], edx
jne 0x49c700
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x49d970
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
mov eax, dword [esi]
push edi
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
bswap eax
mov edx, dword [esi + 4]
mov ebx, eax
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
bswap eax
mov ebp, eax
mov eax, dword [esi + 8]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
bswap eax
mov edx, eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
bswap eax
mov ecx, dword [ecx + 0x14]
mov esi, dword [ecx + 4]
mov dword [esp + 0x14], esi
mov esi, dword [ecx + 0xc]
mov dword [esp + 0x18], esi
mov esi, dword [ecx + 8]
mov dword [esp + 0x10], ecx
mov ecx, dword [ecx]
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ecx
mov edi, edi
mov ecx, dword [esp + 0x28]
movzx ecx, byte [ecx + 0x4f9398]
xor ebx, ecx
mov esi, edx
xor esi, ebx
mov ecx, esi
ror ecx, 8
mov edi, esi
rol edi, 8
xor ecx, edi
xor esi, ecx
mov ecx, dword [esp + 0x14]
xor ecx, esi
xor ebp, ecx
mov ecx, dword [esp + 0x18]
xor ecx, esi
xor eax, ecx
mov esi, eax
xor esi, ebp
mov ecx, esi
ror ecx, 8
mov edi, esi
rol edi, 8
xor ecx, edi
mov edi, dword [esp + 0x1c]
xor esi, ecx
xor edi, esi
xor edi, edx
rol edi, 5
mov ecx, eax
rol ecx, 2
mov edx, ecx
mov eax, ebp
not edx
rol eax, 1
mov ebp, edi
not ebp
and edx, ebp
mov ebp, ecx
xor eax, edx
mov ecx, edi
and ecx, eax
xor ecx, dword [esp + 0x20]
mov edx, ebp
xor ecx, esi
xor ecx, ebx
xor edx, ecx
xor edx, edi
xor edx, eax
mov esi, ecx
mov edi, edx
not esi
not edi
and esi, edi
xor eax, esi
mov ebx, edx
and ebx, eax
xor ebx, ebp
ror eax, 1
ror edx, 5
ror ecx, 2
mov ebp, eax
mov eax, ecx
mov ecx, dword [esp + 0x28]
inc ecx
mov dword [esp + 0x28], ecx
cmp ecx, 0x10
jne 0x49d9e0
xor ebx, 0xd4
mov ecx, edx
xor ecx, ebx
mov esi, ecx
ror esi, 8
mov edi, ecx
rol edi, 8
xor esi, edi
xor ecx, esi
mov esi, dword [esp + 0x10]
mov edi, dword [esi + 4]
mov esi, dword [esi + 0xc]
xor esi, ecx
xor eax, esi
xor edi, ecx
xor ebp, edi
mov ecx, eax
xor ecx, ebp
mov esi, ecx
ror esi, 8
mov edi, ecx
rol edi, 8
xor esi, edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
xor ecx, esi
mov esi, dword [eax + 8]
mov eax, dword [eax]
xor esi, ecx
xor esi, edx
xor eax, ecx
xor eax, ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
bswap eax
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
mov eax, dword [esp + 0x20]
bswap eax
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x1c]
bswap eax
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x18]
bswap eax
pop edi
pop esi
pop ebp
mov dword [ecx + 0xc], eax
pop ebx
add esp, 0x14
ret 8
Function at 0x49db20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
mov eax, dword [esi]
push edi
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
bswap eax
mov edx, dword [esi + 4]
mov ebp, eax
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
bswap eax
mov ebx, eax
mov eax, dword [esi + 8]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
bswap eax
mov edx, eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
bswap eax
mov ecx, dword [ecx + 0x24]
mov esi, dword [ecx + 4]
mov dword [esp + 0x14], esi
mov esi, dword [ecx + 0xc]
mov dword [esp + 0x18], esi
mov esi, dword [ecx + 8]
mov dword [esp + 0x10], ecx
mov ecx, dword [ecx]
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ecx
mov edi, edi
mov esi, edx
xor esi, ebp
mov ecx, esi
ror ecx, 8
mov edi, esi
rol edi, 8
xor ecx, edi
xor esi, ecx
mov ecx, dword [esp + 0x14]
xor ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 0x18]
xor ecx, esi
xor eax, ecx
mov esi, eax
xor esi, ebx
mov ecx, esi
ror ecx, 8
mov edi, esi
rol edi, 8
xor ecx, edi
mov edi, dword [esp + 0x1c]
xor esi, ecx
xor edi, esi
xor edi, edx
rol edi, 5
mov ecx, eax
rol ecx, 2
mov edx, ecx
mov eax, ebx
not edx
mov ebx, edi
rol eax, 1
not ebx
and edx, ebx
xor eax, edx
mov ebx, ecx
mov ecx, dword [esp + 0x28]
movzx ecx, byte [ecx + 0x4f9398]
mov edx, edi
and edx, eax
xor ecx, edx
xor ecx, dword [esp + 0x20]
mov edx, ebx
xor ecx, esi
xor ecx, ebp
xor edx, ecx
xor edx, edi
xor edx, eax
mov esi, ecx
mov edi, edx
not esi
not edi
and esi, edi
xor eax, esi
mov ebp, edx
and ebp, eax
xor ebp, ebx
ror eax, 1
ror edx, 5
ror ecx, 2
dec dword [esp + 0x28]
mov ebx, eax
mov eax, ecx
jne 0x49db90
mov ecx, edx
xor ecx, ebp
mov esi, ecx
ror esi, 8
mov edi, ecx
rol edi, 8
xor esi, edi
xor ecx, esi
mov esi, dword [esp + 0x10]
mov edi, dword [esi + 4]
mov esi, dword [esi + 0xc]
xor esi, ecx
xor eax, esi
xor edi, ecx
xor ebx, edi
mov ecx, eax
xor ecx, ebx
mov esi, ecx
ror esi, 8
mov edi, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
rol edi, 8
xor esi, edi
xor ecx, esi
mov esi, dword [eax + 8]
mov eax, dword [eax]
xor eax, ecx
xor esi, ecx
xor esi, edx
xor eax, ebp
xor eax, 0x80
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
bswap eax
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
mov eax, dword [esp + 0x20]
bswap eax
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x1c]
bswap eax
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x18]
bswap eax
pop edi
pop esi
pop ebp
mov dword [ecx + 0xc], eax
pop ebx
add esp, 0x14
ret 8
Function at 0x49dcc0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov eax, dword [edx]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
bswap eax
mov ecx, dword [edx + 4]
mov ebp, eax
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
bswap eax
mov ecx, eax
mov eax, dword [edx + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
bswap eax
mov edx, dword [edx + 0xc]
mov esi, eax
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x18]
bswap eax
mov dword [esp + 0x18], 0
mov edi, edi
mov edx, dword [esp + 0x18]
movzx edx, byte [edx + 0x4f9398]
xor ebp, edx
mov edi, esi
xor edi, ebp
mov edx, edi
ror edx, 8
mov ebx, edi
rol ebx, 8
xor edx, ebx
xor edi, edx
xor ecx, edi
xor eax, edi
mov edi, eax
xor edi, ecx
mov edx, edi
ror edx, 8
mov ebx, edi
rol ebx, 8
xor edx, ebx
xor edi, edx
mov ebx, edi
xor ebx, esi
rol ebx, 5
mov edx, eax
rol edx, 2
mov eax, ecx
mov ecx, edx
rol eax, 1
mov esi, ebx
not esi
not ecx
and ecx, esi
xor eax, ecx
mov ecx, edx
mov edx, ebx
and edx, eax
xor edx, edi
xor edx, ebp
mov esi, ecx
xor esi, edx
xor esi, ebx
xor esi, eax
mov edi, edx
mov ebx, esi
not edi
not ebx
and edi, ebx
xor eax, edi
mov ebp, esi
and ebp, eax
xor ebp, ecx
ror eax, 1
ror esi, 5
ror edx, 2
mov ecx, eax
mov eax, edx
mov edx, dword [esp + 0x18]
inc edx
mov dword [esp + 0x18], edx
cmp edx, 0x10
jne 0x49dd10
mov edx, dword [esp + 0x10]
mov edi, dword [edx + 0x24]
xor ebp, 0xd4
mov dword [edi], ebp
mov edi, dword [edx + 0x24]
mov dword [edi + 4], ecx
mov edi, dword [edx + 0x24]
mov dword [edi + 8], esi
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov edx, esi
xor edx, ebp
mov edi, edx
ror edi, 8
mov ebx, edx
rol ebx, 8
xor edi, ebx
xor edx, edi
xor ecx, edx
xor eax, edx
mov edx, eax
xor edx, ecx
mov edi, edx
ror edi, 8
mov ebx, edx
rol ebx, 8
xor edi, ebx
xor edx, edi
mov edi, dword [esp + 0x10]
mov ebx, edx
xor ebx, ebp
mov ebp, dword [edi + 0x14]
mov dword [ebp], ebx
mov ebx, dword [edi + 0x14]
mov dword [ebx + 4], ecx
mov ecx, dword [edi + 0x14]
xor edx, esi
mov dword [ecx + 8], edx
mov edx, dword [edi + 0x14]
pop edi
pop esi
pop ebp
mov dword [edx + 0xc], eax
pop ebx
pop ecx
ret 8