joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47de40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5080e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x30
lea edi, [ebp - 0x34]
mov dword [ebp - 0x40], edx
mov eax, edi
mov dword [ebp - 0x38], ecx
push 0
push eax
call fcn.004bc0b0
mov edx, dword [ebp - 0x38]
mov esi, 1
add esp, 0xc
mov ebx, 3
sub esi, edx
lea eax, [edx + 0x20]
lea ecx, [edx + 0xf]
mov dword [ebp - 0x3c], eax
mov eax, ecx
add byte [eax], 1
jne 0x47de92
dec eax
lea ecx, [esi + eax]
test ecx, ecx
jg 0x47de85
mov ecx, dword [ebp - 0x3c]
push edi
call fcn.00491430
mov edx, dword [ebp - 0x38]
add esp, 4
add edi, 0x10
lea ecx, [edx + 0xf]
sub ebx, 1
jne 0x47de83
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x34]
pop edi
pop esi
xor edx, edx
sub ecx, eax
pop ebx
nop dword [eax]
lea eax, [ebp - 0x34]
add eax, edx
add edx, 0x10
movups xmm0, xmmword [eax]
movups xmm1, xmmword [ecx + eax]
pxor xmm1, xmm0
movups xmmword [eax], xmm1
cmp edx, 0x30
jl 0x47dec0
mov ecx, dword [ebp - 0x3c]
lea edx, [ebp - 0x34]
push 0x100
call fcn.00490270
mov ecx, dword [ebp - 0x38]
add esp, 4
movups xmm0, xmmword [ebp - 0x14]
xor eax, eax
movups xmmword [ecx], xmm0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b992a
mov esp, ebp
pop ebp
ret

Function at 0x4808a0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
test edx, edx
push ebx
mov ecx, 0x367cd507
mov dword [ebp - 0xc], 0xc1059ed8
mov dword [eax], 0
mov ebx, 0xa54ff53a
mov dword [eax + 4], 0
mov edx, 0x9b05688c
mov eax, 0xbb67ae85
cmovne eax, ecx
mov ecx, 0x3070dd17
mov dword [ebp - 0x10], eax
mov eax, 0x3c6ef372
cmovne eax, ecx
mov ecx, 0x5be0cd19
mov dword [ebp - 0x14], eax
mov eax, 0xf70e5939
cmovne ebx, eax
mov eax, 0xffc00b31
push esi
push edi
mov edi, 0x510e527f
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
cmovne edi, eax
mov eax, 0x64f98fa7
mov esi, 0x1f83d9ab
cmovne esi, eax
test ebx, ebx
mov ebx, dword [ebp - 4]
mov eax, 0x68581511
cmovne edx, eax
mov eax, 0xbefa4fa4
cmovne ecx, eax
mov eax, 0x6a09e667
cmovne eax, dword [ebp - 0xc]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], edi
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], esi
pop edi
mov dword [eax + 0x24], ecx
mov ecx, dword [ebp - 8]
pop esi
mov dword [eax + 0x68], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x483ae0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 0x30], edx
mov dword [ecx + 0xc], 0
push ebx
push esi
push edi
test edx, edx
jne 0x483b75
mov eax, 0x137e2179
mov dword [ebp - 0x20], 0x2b3e6c1f
mov esi, 0x5be0cd19
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esi
mov edi, 0xfb41bd6b
mov ebx, 0x1f83d9ab
mov dword [ebp - 0x24], 0x9b05688c
mov dword [ebp - 0x1c], 0x510e527f
mov edx, 0xade682d1
mov dword [ebp - 0x14], 0x5f1d36f1
mov eax, 0xfe94f82b
mov dword [ebp - 0x18], 0xa54ff53a
mov esi, 0xf3bcc908
mov dword [ebp - 0x10], 0x3c6ef372
mov dword [ebp - 8], 0x84caa73b
mov dword [ebp - 0xc], 0xbb67ae85
mov dword [ebp - 4], 0x6a09e667
jmp 0x483bdd
mov eax, 0xbefa4fa4
mov dword [ebp - 0x20], 0x68581511
mov esi, 0x47b5481d
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esi
mov edi, 0x64f98fa7
mov ebx, 0xdb0c2e0d
mov dword [ebp - 0x24], 0x8eb44a87
mov edx, 0xffc00b31
mov dword [ebp - 0x1c], 0x67332667
mov dword [ebp - 0x14], 0xf70e5939
mov eax, 0x3070dd17
mov dword [ebp - 0x18], 0x152fecd8
mov esi, 0xc1059ed8
mov dword [ebp - 0x10], 0x9159015a
mov dword [ebp - 8], 0x367cd507
mov dword [ebp - 0xc], 0x629a292a
mov dword [ebp - 4], 0xcbbb9d5d
mov dword [ecx + 0x10], esi
mov esi, dword [ebp - 4]
mov dword [ecx + 0x14], esi
mov esi, dword [ebp - 8]
mov dword [ecx + 0x18], esi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 0x1c], esi
mov esi, dword [ebp - 0x2c]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ecx + 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ecx + 0x30], edx
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 0x34], edx
mov edx, dword [ebp - 0x20]
mov dword [ecx + 0x38], edx
mov edx, dword [ebp - 0x24]
mov dword [ecx + 0x3c], edx
mov edx, dword [ebp - 0x30]
mov dword [ecx + 0x40], edi
mov dword [ecx + 0x44], ebx
mov dword [ecx + 0x48], eax
pop edi
mov dword [ecx + 0x4c], esi
pop esi
mov dword [ecx + 0xd0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48d080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov eax, ecx
xor dl, dl
xor edi, edi
mov dword [ebp - 4], eax
test esi, esi
je 0x48d136
cmp esi, 0x20
jb 0x48d11f
mov ecx, esi
mov edx, ebx
and ecx, 0xffffffe0
add eax, 0x10
sub edx, dword [ebp - 4]
xorps xmm3, xmm3
xorps xmm2, xmm2
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [edi + ebx]
add edi, 0x20
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [edx + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, ecx
jb 0x48d0b5
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd edx, xmm2
cmp edi, esi
jae 0x48d136
mov eax, dword [ebp - 4]
sub ebx, dword [ebp - 4]
add eax, edi
sub esi, edi
mov cl, byte [eax + ebx]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x48d126
pop edi
pop esi
movzx eax, dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x490020
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x5080e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov edx, 1
nop dword [eax]
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movzx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
movzx edx, cl
cmp esi, 0x100
jl 0x490040
mov esi, 1
mov edx, 0x559400
nop dword [eax]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movzx ecx, al
lea eax, [esi + esi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx esi, cl
cmp edx, 0x559428
jl 0x490080
mov eax, 1
mov byte [0x558e00], 0x63
mov byte [0x559363], 0
mov dword [ebp - 0x808], eax
nop dword [eax]
mov ecx, dword [ebp + eax*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
add eax, eax
shr ecx, 7
or ecx, eax
movzx edx, cl
mov ecx, edx
shr ecx, 7
lea eax, [edx + edx]
or ecx, eax
xor ecx, 0x63
movzx eax, cl
xor eax, edx
xor ebx, eax
mov eax, dword [ebp - 0x808]
mov byte [eax + 0x558e00], bl
mov byte [ebx + 0x559300], al
inc eax
mov dword [ebp - 0x808], eax
cmp eax, 0x100
jl 0x4900c0
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 0x80c], ebx
nop
movzx edx, byte [esi + 0x558e00]
mov eax, edx
and al, 0x80
movzx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0x55a828], ecx
rol ecx, 8
mov dword [esi*4 + 0x55a428], ecx
rol ecx, 8
mov dword [esi*4 + 0x559828], ecx
rol ecx, 8
mov dword [esi*4 + 0x559428], ecx
movzx ecx, byte [esi + 0x559300]
test ecx, ecx
je 0x490200
mov ecx, dword [ebp + ecx*4 - 0x404]
mov eax, dword [ebp - 0x3cc]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e0]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d0]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x80c]
mov eax, dword [ebp + edx*4 - 0x804]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x3d8]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x49020c
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x808], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 0x808]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x55a028], eax
rol eax, 8
mov dword [esi*4 + 0x559c28], eax
rol eax, 8
mov dword [esi*4 + 0x55ac28], eax
rol eax, 8
mov dword [esi*4 + 0x558f00], eax
inc esi
cmp esi, 0x100
jl 0x490140
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b992a
mov esp, ebp
pop ebp
ret
Function at 0x4911f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x5080e8]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
push 0x118
lea eax, [esp + 0x14]
mov esi, edx
push 0
push eax
mov ebx, ecx
call fcn.004bc0b0
push dword [ebp + 8]
lea edi, [ebx + 8]
mov edx, esi
lea ecx, [esp + 0x20]
mov dword [ebx + 4], edi
call fcn.00490270
mov edx, eax
add esp, 0x10
mov dword [esp + 0xc], edx
test edx, edx
jne 0x4913f4
mov ecx, dword [esp + 0x10]
mov dword [ebx], ecx
shl ecx, 4
add ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [edi + 0xc], eax
add edi, 0x10
mov esi, dword [ebx]
dec esi
test esi, esi
jle 0x4913de
nop dword [eax + eax]
movzx eax, byte [ecx + 3]
dec esi
movzx edx, byte [eax + 0x558e00]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x558f00]
movzx eax, byte [eax + 0x558e00]
xor edx, dword [eax*4 + 0x55ac28]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x558e00]
xor edx, dword [eax*4 + 0x559c28]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x558e00]
xor edx, dword [eax*4 + 0x55a028]
mov dword [edi], edx
mov ebx, dword [ecx + 4]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x558e00]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x55ac28]
movzx eax, byte [eax + 0x558e00]
xor edx, dword [eax*4 + 0x559c28]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x558e00]
xor edx, dword [eax*4 + 0x558f00]
movzx eax, bl
movzx eax, byte [eax + 0x558e00]
xor edx, dword [eax*4 + 0x55a028]
mov dword [edi + 4], edx
mov ebx, dword [ecx + 8]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x558e00]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x55ac28]
movzx eax, byte [eax + 0x558e00]
xor edx, dword [eax*4 + 0x559c28]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x558e00]
xor edx, dword [eax*4 + 0x558f00]
movzx eax, bl
movzx eax, byte [eax + 0x558e00]
xor edx, dword [eax*4 + 0x55a028]
mov dword [edi + 8], edx
mov ebx, dword [ecx + 0xc]
mov eax, ebx
shr eax, 0x10
sub ecx, 0x10
movzx eax, al
movzx edx, byte [eax + 0x558e00]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x55ac28]
movzx eax, byte [eax + 0x558e00]
xor edx, dword [eax*4 + 0x559c28]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x558e00]
xor edx, dword [eax*4 + 0x558f00]
movzx eax, bl
movzx eax, byte [eax + 0x558e00]
xor edx, dword [eax*4 + 0x55a028]
mov dword [edi + 0xc], edx
add edi, 0x10
test esi, esi
jg 0x491280
mov edx, dword [esp + 0xc]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0xc], eax
mov eax, 0x118
lea ecx, [esp + 0x10]
nop dword [eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x491400
mov ecx, dword [esp + 0x12c]
mov eax, edx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004b992a
mov esp, ebp
pop ebp
ret
Function at 0x491f50
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov eax, ecx
mov dword [ebp - 4], eax
push edi
mov edi, 0x4f6010
mov edx, edi
test eax, eax
je 0x491fd4
cmp dword [0x4f6010], 0
je 0x491fd4
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x491fca
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x491f95
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x491f9a
add edx, 4
add eax, 4
sub esi, 4
jae 0x491f84
cmp esi, 0xfffffffc
je 0x491fdd
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x491fc7
cmp esi, 0xfffffffd
je 0x491fdd
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x491fc7
cmp esi, 0xfffffffe
je 0x491fdd
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x491fc7
cmp esi, 0xffffffff
je 0x491fdd
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x491fdd
mov eax, dword [ebp - 4]
add edi, 0x18
mov edx, edi
cmp dword [edi], 0
jne 0x491f73
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4934a0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
xorps xmm0, xmm0
movq qword [eax], xmm0
push eax
mov dword [eax + 8], 0
lea eax, [ebp - 0xc]
push eax
call fcn.00492bb0
add esp, 8
test eax, eax
je 0x4934d1
add eax, 0xffffc580
mov esp, ebp
pop ebp
ret
cmp dword [0x4f6160], 0
push ebx
push esi
push edi
mov edi, 0x4f6160
mov edx, edi
je 0x493545
mov ebx, dword [ebp - 8]
cmp dword [edx + 4], ebx
jne 0x49353b
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [ebp - 4]
sub esi, 4
jb 0x493509
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x49350e
add edx, 4
add eax, 4
sub esi, 4
jae 0x4934f8
cmp esi, 0xfffffffc
je 0x493551
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x49353b
cmp esi, 0xfffffffd
je 0x493551
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x49353b
cmp esi, 0xfffffffe
je 0x493551
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x49353b
cmp esi, 0xffffffff
je 0x493551
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x493551
add edi, 0x14
mov edx, edi
cmp dword [edi], 0
jne 0x4934e7
pop edi
pop esi
mov eax, 0xffffc380
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x493545
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0x10]
mov dword [eax], ecx
cmp ecx, 1
jne 0x493582
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
cmp eax, 5
je 0x493570
test eax, eax
jne 0x493576
cmp dword [ecx + 4], 0
je 0x493582
pop edi
pop esi
mov eax, 0xffffc580
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x494870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5080e8]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x2c], edx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [ebx + 0x138]
mov ecx, dword [ebx + 0x13c]
mov esi, dword [ebx + 0x144]
shld ecx, eax, 3
shl eax, 3
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x140]
shld esi, eax, 3
mov dword [ebp - 0x20], ecx
shl eax, 3
mov dword [ebp - 0x24], eax
lea eax, [edi - 4]
mov dword [ebp - 0x1c], esi
cmp eax, 0xc
ja 0x4949e6
push edi
lea eax, [ebx + 0x148]
push eax
push edx
call fcn.004bbb30
mov eax, dword [ebp - 0x28]
add esp, 0xc
or eax, dword [ebp - 0x20]
mov ecx, esi
mov edx, dword [ebp - 0x24]
jne 0x4948f1
mov eax, edx
or eax, ecx
je 0x4949d3
mov esi, dword [ebp - 0x1c]
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0x18], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0x17], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 0x16], al
mov eax, esi
mov byte [ebp - 0x15], cl
mov ecx, edx
shrd ecx, eax, 0x18
mov eax, esi
mov byte [ebp - 0x11], dl
mov byte [ebp - 0x14], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
mov edx, dword [ebp - 0x28]
shrd eax, esi, 8
mov esi, dword [ebp - 0x20]
mov byte [ebp - 0x12], al
mov byte [ebp - 0x13], cl
mov ecx, dword [ebp - 0x20]
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0x10], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xf], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xe], al
mov eax, esi
mov byte [ebp - 0xd], cl
mov ecx, edx
shrd ecx, eax, 0x18
mov eax, esi
mov byte [ebp - 9], dl
mov byte [ebp - 0xc], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
lea edx, [ebp - 0x17]
shrd eax, esi, 8
mov byte [ebp - 0xb], cl
mov esi, 4
mov byte [ebp - 0xa], al
lea eax, [ebx + 0x169]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
sub esi, 1
jne 0x494985
lea esi, [ebx + 0x168]
mov ecx, ebx
push esi
mov edx, esi
call fcn.004941f0
add esp, 4
xor ecx, ecx
test edi, edi
je 0x4949d3
mov edx, dword [ebp - 0x2c]
mov al, byte [esi + ecx]
xor byte [edx + ecx], al
inc ecx
cmp ecx, edi
jb 0x4949c8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004b992a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov eax, 0xffffffec
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b992a
mov esp, ebp
pop ebp
ret
Function at 0x494a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5080e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x24]
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov esi, edx
mov edx, dword [ebp + 0x20]
push ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
xor edx, edx
push ecx
mov ecx, ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], edi
call fcn.004943d0
add esp, 0x10
test eax, eax
jne 0x494b83
push edi
push dword [ebp - 0x18]
mov edx, esi
mov ecx, ebx
call fcn.004946d0
add esp, 8
test eax, eax
jne 0x494b83
push dword [ebp + 0x1c]
lea edx, [ebp - 0x14]
mov ecx, ebx
call fcn.00494870
add esp, 4
test eax, eax
jne 0x494b83
mov ecx, dword [ebp + 0x1c]
xor ebx, ebx
test ecx, ecx
je 0x494b81
cmp ecx, 8
jb 0x494b30
mov edx, ecx
lea edi, [ebp - 0x14]
and edx, 0xfffffff8
lea esi, [ebp - 0x10]
mov dword [ebp - 0x18], edx
xorps xmm4, xmm4
mov edx, dword [ebp + 0x18]
xorps xmm3, xmm3
sub edi, edx
mov ebx, edx
sub esi, edx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x24], esi
mov esi, edi
movd xmm2, dword [esi + ebx]
lea ebx, [ebx + 8]
movd xmm1, dword [ebx - 8]
xorps xmm0, xmm0
mov edi, dword [ebp - 0x24]
add eax, 8
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [ebx - 4]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [edi + ebx - 8]
mov edi, dword [ebp - 0x1c]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp eax, edx
jb 0x494ab1
mov esi, dword [ebp - 0x28]
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ebx, xmm3
cmp eax, ecx
jae 0x494b51
mov edi, dword [ebp + 0x18]
lea ecx, [ebp - 0x14]
sub edi, ecx
lea ecx, [ebp - 0x14]
add ecx, eax
inc eax
movzx edx, byte [edi + ecx]
movzx ecx, byte [ecx]
xor edx, ecx
or ebx, edx
cmp eax, dword [ebp + 0x1c]
jb 0x494b38
mov edi, dword [ebp - 0x1c]
test ebx, ebx
je 0x494b81
test esi, esi
je 0x494b6b
nop dword [eax]
mov byte [edi], 0
lea edi, [edi + 1]
sub esi, 1
jne 0x494b60
mov eax, 0xffffffee
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b992a
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b992a
mov esp, ebp
pop ebp
ret
Function at 0x496a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x5080e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push 0x40
mov dword [ebp - 0x50], eax
mov esi, ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], edx
push 0
push eax
call fcn.004bc0b0
mov eax, dword [ebx]
add esp, 0xc
mov dword [ebp - 0x4c], 0
test eax, eax
jne 0x496ac1
xor al, al
jmp 0x496ac4
mov al, byte [eax + 8]
mov edx, dword [ebp - 0x48]
movzx eax, al
mov dword [ebp - 0x54], eax
test edx, edx
je 0x496bce
push edi
cmp edx, eax
mov edi, edx
cmovae edi, eax
mov eax, dword [ebx]
test eax, eax
je 0x496b34
push dword [ebx + 4]
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebx]
add esp, 4
test eax, eax
je 0x496b31
push dword [ebp + 0xc]
mov eax, dword [eax + 0x14]
push dword [ebp - 0x50]
push dword [ebx + 4]
call eax
mov eax, dword [ebx]
add esp, 0xc
test eax, eax
je 0x496b31
mov eax, dword [eax + 0x14]
lea ecx, [ebp - 0x4c]
push 4
push ecx
push dword [ebx + 4]
call eax
mov eax, dword [ebx]
add esp, 0xc
test eax, eax
je 0x496b31
mov eax, dword [eax + 0x18]
lea ecx, [ebp - 0x44]
push ecx
push dword [ebx + 4]
call eax
add esp, 8
mov edx, dword [ebp - 0x48]
xor ecx, ecx
test edi, edi
je 0x496bbc
cmp edi, 0x40
jb 0x496bb0
lea eax, [ebp + edi - 0x45]
cmp esi, eax
ja 0x496b5b
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], eax
lea eax, [esi - 1]
add eax, edi
cmp eax, dword [ebp - 0x48]
jae 0x496bb0
mov eax, edi
and eax, 0xffffffc0
movups xmm0, xmmword [esi]
movups xmm1, xmmword [ebp + ecx - 0x44]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
movups xmm0, xmmword [esi + 0x10]
movups xmm1, xmmword [ebp + ecx - 0x34]
pxor xmm1, xmm0
movups xmmword [esi + 0x10], xmm1
movups xmm0, xmmword [esi + 0x20]
movups xmm1, xmmword [ebp + ecx - 0x24]
pxor xmm1, xmm0
movups xmmword [esi + 0x20], xmm1
movups xmm0, xmmword [esi + 0x30]
movups xmm1, xmmword [ebp + ecx - 0x14]
add ecx, 0x40
pxor xmm1, xmm0
movups xmmword [esi + 0x30], xmm1
add esi, 0x40
cmp ecx, eax
jb 0x496b60
cmp ecx, edi
jae 0x496bbc
mov al, byte [ebp + ecx - 0x44]
inc ecx
xor byte [esi], al
inc esi
cmp ecx, edi
jb 0x496bb0
inc byte [ebp - 0x49]
sub edx, edi
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x48], edx
jne 0x496ad6
pop edi
pop esi
mov eax, 0x40
lea ecx, [ebp - 0x44]
pop ebx
nop dword [eax + eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x496be0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b992a
mov esp, ebp
pop ebp
ret