joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f8a0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
bswap eax
mov ecx, dword [ecx + 4]
mov edx, eax
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
bswap eax
mov edi, dword [ebp + 0x24]
mov dword [esp + 0x18], 8
xor edx, dword [edi]
add edi, 8
mov ecx, edx
shr ecx, 0x10
movzx ecx, cl
mov ecx, dword [esi + ecx*4 + 0x400]
mov ebx, edx
shr ebx, 0x18
add ecx, dword [esi + ebx*4]
mov ebx, edx
shr ebx, 8
movzx ebx, bl
xor ecx, dword [esi + ebx*4 + 0x800]
movzx ebx, dl
add ecx, dword [esi + ebx*4 + 0xc00]
xor ecx, dword [edi - 4]
xor eax, ecx
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
mov ecx, dword [esi + ecx*4 + 0x400]
mov ebx, eax
shr ebx, 0x18
add ecx, dword [esi + ebx*4]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor ecx, dword [esi + ebx*4 + 0x800]
movzx ebx, al
add ecx, dword [esi + ebx*4 + 0xc00]
xor edx, ecx
dec dword [esp + 0x18]
jne 0x48f8d4
mov ebp, dword [ebp + 0x24]
xor edx, dword [ebp + 0x40]
xor eax, dword [ebp + 0x44]
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
bswap eax
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
mov eax, dword [esp + 0x10]
bswap eax
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
pop ebx
pop ecx
ret 8

Function at 0x48f980
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
bswap eax
mov ecx, dword [ecx + 4]
mov edx, eax
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
bswap eax
mov edi, dword [ebp + 0x24]
add edi, 0x44
mov dword [esp + 0x18], 8
xor edx, dword [edi]
sub edi, 8
mov ecx, edx
shr ecx, 0x10
movzx ecx, cl
mov ecx, dword [esi + ecx*4 + 0x400]
mov ebx, edx
shr ebx, 0x18
add ecx, dword [esi + ebx*4]
mov ebx, edx
shr ebx, 8
movzx ebx, bl
xor ecx, dword [esi + ebx*4 + 0x800]
movzx ebx, dl
add ecx, dword [esi + ebx*4 + 0xc00]
xor ecx, dword [edi + 4]
xor eax, ecx
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
mov ecx, dword [esi + ecx*4 + 0x400]
mov ebx, eax
shr ebx, 0x18
add ecx, dword [esi + ebx*4]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor ecx, dword [esi + ebx*4 + 0x800]
movzx ebx, al
add ecx, dword [esi + ebx*4 + 0xc00]
xor edx, ecx
dec dword [esp + 0x18]
jne 0x48f9b7
mov ebp, dword [ebp + 0x24]
xor edx, dword [ebp + 4]
xor eax, dword [ebp]
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
bswap eax
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
mov eax, dword [esp + 0x10]
bswap eax
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
pop ebx
pop ecx
ret 8
Function at 0x48fa60
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, ecx
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
push esi
push edi
call edx
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
xor eax, eax
mov ecx, 2
mov dword [esp + 0x10], eax
add eax, dword [ebp + 0x24]
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [ecx - 2]
div esi
lea eax, [ecx - 1]
movzx ebx, byte [edx + edi]
xor edx, edx
div esi
shl ebx, 8
movzx eax, byte [edx + edi]
or ebx, eax
xor edx, edx
mov eax, ecx
div esi
shl ebx, 8
lea eax, [ecx + 1]
add ecx, 4
movzx edx, byte [edx + edi]
or ebx, edx
xor edx, edx
div esi
shl ebx, 8
movzx eax, byte [edx + edi]
or ebx, eax
mov eax, dword [esp + 0x1c]
xor dword [eax], ebx
mov eax, dword [esp + 0x10]
add eax, 4
mov dword [esp + 0x10], eax
cmp eax, 0x48
jne 0x48fa82
mov edx, dword [ebp + 0x24]
mov esi, dword [ebp + 0x14]
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ecx
mov edi, edi
mov edi, dword [ebp + 0x24]
mov dword [esp + 0x1c], 8
jmp 0x48fb00
xor eax, dword [edi]
add edi, 8
mov edx, eax
shr edx, 0x10
movzx edx, dl
mov edx, dword [esi + edx*4 + 0x400]
mov ebx, eax
shr ebx, 0x18
add edx, dword [esi + ebx*4]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [esi + ebx*4 + 0x800]
movzx ebx, al
add edx, dword [esi + ebx*4 + 0xc00]
xor edx, dword [edi - 4]
xor ecx, edx
mov edx, ecx
shr edx, 0x10
movzx edx, dl
mov edx, dword [esi + edx*4 + 0x400]
mov ebx, ecx
shr ebx, 0x18
add edx, dword [esi + ebx*4]
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
xor edx, dword [esi + ebx*4 + 0x800]
movzx ebx, cl
add edx, dword [esi + ebx*4 + 0xc00]
xor eax, edx
dec dword [esp + 0x1c]
jne 0x48fb00
mov edx, dword [ebp + 0x24]
mov edi, ecx
mov ecx, dword [edx + 0x40]
xor ecx, eax
mov eax, dword [edx + 0x44]
mov edx, dword [esp + 0x18]
xor eax, edi
mov edi, dword [esp + 0x10]
mov dword [edi + edx*4], eax
mov dword [edi + edx*4 + 4], ecx
add edx, 2
mov dword [esp + 0x18], edx
cmp edx, 0x12
jne 0x48faf0
mov esi, dword [ebp + 0x14]
mov dword [esp + 0x18], 0
jmp 0x48fbb0
mov edi, dword [ebp + 0x24]
mov dword [esp + 0x1c], 8
jmp 0x48fbc0
xor eax, dword [edi]
add edi, 8
mov edx, eax
shr edx, 0x10
movzx edx, dl
mov edx, dword [esi + edx*4 + 0x400]
mov ebx, eax
shr ebx, 0x18
add edx, dword [esi + ebx*4]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [esi + ebx*4 + 0x800]
movzx ebx, al
add edx, dword [esi + ebx*4 + 0xc00]
xor edx, dword [edi - 4]
xor ecx, edx
mov edx, ecx
shr edx, 0x10
movzx edx, dl
mov edx, dword [esi + edx*4 + 0x400]
mov ebx, ecx
shr ebx, 0x18
add edx, dword [esi + ebx*4]
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
xor edx, dword [esi + ebx*4 + 0x800]
movzx ebx, cl
add edx, dword [esi + ebx*4 + 0xc00]
xor eax, edx
dec dword [esp + 0x1c]
jne 0x48fbc0
mov edx, dword [ebp + 0x24]
mov edi, ecx
mov ecx, dword [edx + 0x40]
xor ecx, eax
mov eax, dword [edx + 0x44]
mov edx, dword [esp + 0x18]
xor eax, edi
mov dword [esi + edx*4], eax
mov dword [esi + edx*4 + 4], ecx
add edx, 2
mov dword [esp + 0x18], edx
cmp edx, 0x400
jne 0x48fbb0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x48fc70
Capabilities:
Encrypt data using blowfish

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
cmp eax, 0x12
jb 0x48fc80
mov eax, 0x12
mov ecx, dword [esi + 0x24]
add eax, eax
add eax, eax
push eax
push 0x4f7fd8
push ecx
call fcn.00459280
mov eax, dword [esi + 0x18]
add esp, 0xc
cmp eax, 0x400
jb 0x48fca5
mov eax, 0x400
lea edx, [eax*4]
mov eax, dword [esi + 0x14]
push edx
push 0x4f8020
push eax
call fcn.00459280
add esp, 0xc
pop esi
ret
Function at 0x493c80
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x18]
add esi, 8
mov dword [esp + 0x10], 8
lea esp, [esp]
mov edx, dword [ebp]
mov ecx, dword [esi - 4]
xor ecx, edx
mov eax, edx
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov edx, ecx
shr edx, 0x18
mov edx, dword [edx*4 + 0x4fb740]
xor edx, dword [ebx*4 + 0x4fbf40]
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4fc740]
ror eax, 4
xor eax, dword [esi - 8]
movzx ecx, cl
mov ebx, eax
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4fb340]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4fbb40]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4fc340]
movzx eax, al
xor edx, dword [ecx*4 + 0x4fcf40]
add esi, 0x10
xor edx, dword [eax*4 + 0x4fcb40]
xor dword [edi], edx
mov eax, dword [esi - 0xc]
xor eax, dword [edi]
mov ecx, dword [edi]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x4fb740]
xor edx, dword [ebx*4 + 0x4fbf40]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4fc740]
ror ecx, 4
xor ecx, dword [esi - 0x10]
movzx eax, al
mov ebx, ecx
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4fb340]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4fbb40]
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4fc340]
movzx ecx, cl
xor edx, dword [eax*4 + 0x4fcf40]
xor edx, dword [ecx*4 + 0x4fcb40]
xor dword [ebp], edx
dec dword [esp + 0x10]
jne 0x493ca0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x493db0
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x18]
add esi, 0x7c
mov dword [esp + 0x10], 8
lea esp, [esp]
mov edx, dword [ebp]
mov ecx, dword [esi]
xor ecx, edx
mov eax, edx
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov edx, ecx
shr edx, 0x18
mov edx, dword [edx*4 + 0x4fb740]
xor edx, dword [ebx*4 + 0x4fbf40]
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4fc740]
ror eax, 4
xor eax, dword [esi - 4]
movzx ecx, cl
mov ebx, eax
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4fb340]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4fbb40]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4fc340]
movzx eax, al
xor edx, dword [ecx*4 + 0x4fcf40]
sub esi, 0x10
xor edx, dword [eax*4 + 0x4fcb40]
xor dword [edi], edx
mov eax, dword [esi + 8]
xor eax, dword [edi]
mov ecx, dword [edi]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x4fb740]
xor edx, dword [ebx*4 + 0x4fbf40]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4fc740]
ror ecx, 4
xor ecx, dword [esi + 4]
movzx eax, al
mov ebx, ecx
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4fb340]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4fbb40]
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4fc340]
movzx ecx, cl
xor edx, dword [eax*4 + 0x4fcf40]
xor edx, dword [ecx*4 + 0x4fcb40]
xor dword [ebp], edx
dec dword [esp + 0x10]
jne 0x493dd0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x494820
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
cmp esi, 8
jb 0x494883
push edi
mov edi, esi
shr edi, 3
jmp 0x494840
movzx edx, byte [ecx]
xor byte [eax], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx + 2]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 3]
xor byte [eax + 3], dl
movzx edx, byte [ecx + 4]
xor byte [eax + 4], dl
movzx edx, byte [ecx + 5]
xor byte [eax + 5], dl
movzx edx, byte [ecx + 6]
xor byte [eax + 6], dl
movzx edx, byte [ecx + 7]
xor byte [eax + 7], dl
add eax, 8
add ecx, 8
sub esi, 8
dec edi
jne 0x494840
pop edi
test esi, esi
je 0x494899
sub ecx, eax
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x494890
pop esi
ret
Function at 0x4948a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
jb 0x49491d
push ebp
mov ebp, edi
shr ebp, 3
lea ecx, [ecx]
movzx edx, byte [ecx]
xor dl, byte [eax]
add ecx, 8
mov byte [esi], dl
movzx edx, byte [ecx - 7]
xor dl, byte [eax + 1]
add eax, 8
mov byte [esi + 1], dl
movzx edx, byte [ecx - 6]
xor dl, byte [eax - 6]
add esi, 8
mov byte [esi - 6], dl
movzx edx, byte [ecx - 5]
xor dl, byte [eax - 5]
sub edi, 8
mov byte [esi - 5], dl
movzx edx, byte [ecx - 4]
xor dl, byte [eax - 4]
mov byte [esi - 4], dl
movzx edx, byte [ecx - 3]
xor dl, byte [eax - 3]
mov byte [esi - 3], dl
movzx edx, byte [ecx - 2]
xor dl, byte [eax - 2]
mov byte [esi - 2], dl
movzx edx, byte [ecx - 1]
xor dl, byte [eax - 1]
dec ebp
mov byte [esi - 1], dl
jne 0x4948c0
pop ebp
test edi, edi
je 0x494932
sub ecx, eax
sub esi, eax
mov dl, byte [ecx + eax]
xor dl, byte [eax]
inc eax
dec edi
mov byte [esi + eax - 1], dl
jne 0x494925
pop edi
pop esi
ret
Function at 0x495b50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
call fcn.00495aa0
mov ecx, dword [esp + 0x24]
mov edx, 0x10
xor eax, eax
sub ecx, 0x4f42b8
sub edx, 0x4f42b8
lea esp, [esp]
mov di, word [ecx + eax + 0x4f42b8]
mov ebx, dword [esp + 0x10]
rol di, 8
mov word [eax + ebx], di
mov edi, dword [esp + 0x10]
mov bx, word [eax + edi]
xor bx, word [eax + 0x4f42b8]
lea ebp, [edx + eax + 0x4f42b8]
add eax, 2
mov word [edi + ebp], bx
cmp eax, 0x10
jne 0x495b80
xor ecx, ecx
mov eax, 1
mov dword [esp + 0x24], 8
mov edi, dword [esp + 0x10]
lea edx, [eax - 1]
and edx, 7
mov dx, word [edi + edx*2]
mov edi, dword [esi + 0x14]
rol dx, 2
mov word [ecx + edi], dx
mov ebx, dword [esp + 0x10]
lea edx, [eax + 1]
mov edi, edx
and edi, 7
movzx edi, word [ebx + edi*2 + 0x10]
mov ebx, dword [esi + 0x14]
rol di, 1
mov word [ecx + ebx + 2], di
mov ebx, dword [esp + 0x10]
mov edi, eax
and edi, 7
movzx edi, word [ebx + edi*2]
mov ebx, dword [esi + 0x14]
rol di, 5
mov word [ecx + ebx + 4], di
mov ebp, dword [esp + 0x10]
mov ebx, dword [esi + 0x14]
lea edi, [eax + 3]
and edi, 7
movzx edi, word [ebp + edi*2 + 0x10]
mov word [ecx + ebx + 6], di
mov ebx, dword [esp + 0x10]
lea edi, [eax - 4]
and edi, 7
movzx edi, word [ebx + edi*2]
mov ebx, dword [esi + 0x14]
rol di, 8
mov word [ecx + ebx + 8], di
mov ebp, dword [esp + 0x10]
mov ebx, dword [esi + 0x14]
lea edi, [eax + 2]
and edi, 7
movzx edi, word [ebp + edi*2 + 0x10]
mov word [ecx + ebx + 0xa], di
mov ebx, dword [esp + 0x10]
lea edi, [eax - 3]
and edi, 7
movzx edi, word [ebx + edi*2]
mov ebx, dword [esi + 0x14]
ror di, 3
mov word [ecx + ebx + 0xc], di
mov ebx, dword [esp + 0x10]
mov edi, dword [esi + 0x14]
add eax, 0xfffffffe
and eax, 7
mov ax, word [ebx + eax*2 + 0x10]
mov word [ecx + edi + 0xe], ax
add ecx, 0x10
dec dword [esp + 0x24]
mov eax, edx
jne 0x495bc5
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
add eax, eax
push eax
mov eax, dword [esp + 0x14]
push eax
call edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x495d30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
mov ebx, 2
lea esp, [esp]
movzx edx, byte [edi]
mov edx, dword [edx*4 + 0x4ff340]
xor dword [esi], edx
mov edx, dword [edi]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x4ff740]
add edx, dword [esi]
mov dword [esi], edx
movzx edx, byte [edi + 2]
mov edx, dword [edx*4 + 0x4ff340]
add dword [ecx], edx
movzx edx, byte [edi + 3]
mov edx, dword [edx*4 + 0x4ff740]
xor dword [eax], edx
mov ebp, dword [edi]
rol ebp, 8
add ebp, dword [eax]
mov dword [edi], ebp
movzx edx, byte [esi]
mov edx, dword [edx*4 + 0x4ff340]
xor dword [ecx], edx
mov edx, dword [esi]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x4ff740]
add edx, dword [ecx]
mov dword [ecx], edx
movzx edx, byte [esi + 2]
mov edx, dword [edx*4 + 0x4ff340]
add dword [eax], edx
movzx edx, byte [esi + 3]
mov edx, dword [edx*4 + 0x4ff740]
xor dword [edi], edx
mov edx, dword [esi]
rol edx, 8
add edx, dword [ecx]
mov dword [esi], edx
movzx edx, byte [ecx]
mov edx, dword [edx*4 + 0x4ff340]
xor dword [eax], edx
mov edx, dword [ecx]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x4ff740]
add edx, dword [eax]
mov dword [eax], edx
movzx edx, byte [ecx + 2]
mov edx, dword [edx*4 + 0x4ff340]
add dword [edi], edx
movzx edx, byte [ecx + 3]
mov edx, dword [edx*4 + 0x4ff740]
xor dword [esi], edx
mov edx, dword [ecx]
rol edx, 8
mov dword [ecx], edx
movzx edx, byte [eax]
mov edx, dword [edx*4 + 0x4ff340]
xor dword [edi], edx
mov edx, dword [eax]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x4ff740]
add edx, dword [edi]
mov dword [edi], edx
movzx edx, byte [eax + 2]
mov edx, dword [edx*4 + 0x4ff340]
add dword [esi], edx
movzx edx, byte [eax + 3]
mov edx, dword [edx*4 + 0x4ff740]
xor dword [ecx], edx
mov edx, dword [eax]
rol edx, 8
dec ebx
mov dword [eax], edx
jne 0x495d50
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x495e60
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
mov ebx, 2
lea esp, [esp]
movzx edx, byte [esi]
mov edx, dword [edx*4 + 0x4ff740]
xor dword [edi], edx
movzx edx, byte [esi + 3]
mov edx, dword [edx*4 + 0x4ff340]
sub dword [ecx], edx
movzx edx, byte [esi + 2]
mov edx, dword [edx*4 + 0x4ff740]
sub dword [eax], edx
mov edx, dword [esi]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x4ff340]
xor edx, dword [eax]
mov dword [eax], edx
mov edx, dword [esi]
ror edx, 8
mov dword [esi], edx
movzx edx, byte [edi]
mov edx, dword [edx*4 + 0x4ff740]
xor dword [ecx], edx
movzx edx, byte [edi + 3]
mov edx, dword [edx*4 + 0x4ff340]
sub dword [eax], edx
movzx edx, byte [edi + 2]
mov edx, dword [edx*4 + 0x4ff740]
sub dword [esi], edx
mov edx, dword [edi]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x4ff340]
xor edx, dword [esi]
mov dword [esi], edx
mov edx, dword [edi]
ror edx, 8
mov dword [edi], edx
sub dword [ecx], edx
movzx edx, byte [ecx]
mov edx, dword [edx*4 + 0x4ff740]
xor dword [eax], edx
movzx edx, byte [ecx + 3]
mov edx, dword [edx*4 + 0x4ff340]
sub dword [esi], edx
movzx edx, byte [ecx + 2]
mov edx, dword [edx*4 + 0x4ff740]
sub dword [edi], edx
mov edx, dword [ecx]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x4ff340]
xor edx, dword [edi]
mov dword [edi], edx
mov edx, dword [ecx]
ror edx, 8
mov dword [ecx], edx
mov edx, dword [esi]
sub dword [eax], edx
movzx edx, byte [eax]
mov edx, dword [edx*4 + 0x4ff740]
xor dword [esi], edx
movzx edx, byte [eax + 3]
mov edx, dword [edx*4 + 0x4ff340]
sub dword [edi], edx
movzx edx, byte [eax + 2]
mov edx, dword [edx*4 + 0x4ff740]
sub dword [ecx], edx
mov edx, dword [eax]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x4ff340]
xor edx, dword [ecx]
mov dword [ecx], edx
mov edx, dword [eax]
ror edx, 8
dec ebx
mov dword [eax], edx
jne 0x495e80
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4970f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
mov eax, dword [esi]
push edi
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
bswap eax
mov edx, dword [esi + 4]
mov ebx, eax
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
bswap eax
mov ebp, eax
mov eax, dword [esi + 8]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
bswap eax
mov edx, eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
bswap eax
mov ecx, dword [ecx + 0x14]
mov esi, dword [ecx + 4]
mov dword [esp + 0x14], esi
mov esi, dword [ecx + 0xc]
mov dword [esp + 0x18], esi
mov esi, dword [ecx + 8]
mov dword [esp + 0x10], ecx
mov ecx, dword [ecx]
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ecx
mov edi, edi
mov ecx, dword [esp + 0x28]
movzx ecx, byte [ecx + 0x4f42c8]
xor ebx, ecx
mov esi, edx
xor esi, ebx
mov ecx, esi
ror ecx, 8
mov edi, esi
rol edi, 8
xor ecx, edi
xor esi, ecx
mov ecx, dword [esp + 0x14]
xor ecx, esi
xor ebp, ecx
mov ecx, dword [esp + 0x18]
xor ecx, esi
xor eax, ecx
mov esi, eax
xor esi, ebp
mov ecx, esi
ror ecx, 8
mov edi, esi
rol edi, 8
xor ecx, edi
mov edi, dword [esp + 0x1c]
xor esi, ecx
xor edi, esi
xor edi, edx
rol edi, 5
mov ecx, eax
rol ecx, 2
mov edx, ecx
mov eax, ebp
not edx
rol eax, 1
mov ebp, edi
not ebp
and edx, ebp
mov ebp, ecx
xor eax, edx
mov ecx, edi
and ecx, eax
xor ecx, dword [esp + 0x20]
mov edx, ebp
xor ecx, esi
xor ecx, ebx
xor edx, ecx
xor edx, edi
xor edx, eax
mov esi, ecx
mov edi, edx
not esi
not edi
and esi, edi
xor eax, esi
mov ebx, edx
and ebx, eax
xor ebx, ebp
ror eax, 1
ror edx, 5
ror ecx, 2
mov ebp, eax
mov eax, ecx
mov ecx, dword [esp + 0x28]
inc ecx
mov dword [esp + 0x28], ecx
cmp ecx, 0x10
jne 0x497160
xor ebx, 0xd4
mov ecx, edx
xor ecx, ebx
mov esi, ecx
ror esi, 8
mov edi, ecx
rol edi, 8
xor esi, edi
xor ecx, esi
mov esi, dword [esp + 0x10]
mov edi, dword [esi + 4]
mov esi, dword [esi + 0xc]
xor esi, ecx
xor eax, esi
xor edi, ecx
xor ebp, edi
mov ecx, eax
xor ecx, ebp
mov esi, ecx
ror esi, 8
mov edi, ecx
rol edi, 8
xor esi, edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
xor ecx, esi
mov esi, dword [eax + 8]
mov eax, dword [eax]
xor esi, ecx
xor esi, edx
xor eax, ecx
xor eax, ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
bswap eax
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
mov eax, dword [esp + 0x20]
bswap eax
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x1c]
bswap eax
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x18]
bswap eax
pop edi
pop esi
pop ebp
mov dword [ecx + 0xc], eax
pop ebx
add esp, 0x14
ret 8
Function at 0x4972a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
mov eax, dword [esi]
push edi
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
bswap eax
mov edx, dword [esi + 4]
mov ebp, eax
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
bswap eax
mov ebx, eax
mov eax, dword [esi + 8]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
bswap eax
mov edx, eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
bswap eax
mov ecx, dword [ecx + 0x24]
mov esi, dword [ecx + 4]
mov dword [esp + 0x14], esi
mov esi, dword [ecx + 0xc]
mov dword [esp + 0x18], esi
mov esi, dword [ecx + 8]
mov dword [esp + 0x10], ecx
mov ecx, dword [ecx]
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ecx
mov edi, edi
mov esi, edx
xor esi, ebp
mov ecx, esi
ror ecx, 8
mov edi, esi
rol edi, 8
xor ecx, edi
xor esi, ecx
mov ecx, dword [esp + 0x14]
xor ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 0x18]
xor ecx, esi
xor eax, ecx
mov esi, eax
xor esi, ebx
mov ecx, esi
ror ecx, 8
mov edi, esi
rol edi, 8
xor ecx, edi
mov edi, dword [esp + 0x1c]
xor esi, ecx
xor edi, esi
xor edi, edx
rol edi, 5
mov ecx, eax
rol ecx, 2
mov edx, ecx
mov eax, ebx
not edx
mov ebx, edi
rol eax, 1
not ebx
and edx, ebx
xor eax, edx
mov ebx, ecx
mov ecx, dword [esp + 0x28]
movzx ecx, byte [ecx + 0x4f42c8]
mov edx, edi
and edx, eax
xor ecx, edx
xor ecx, dword [esp + 0x20]
mov edx, ebx
xor ecx, esi
xor ecx, ebp
xor edx, ecx
xor edx, edi
xor edx, eax
mov esi, ecx
mov edi, edx
not esi
not edi
and esi, edi
xor eax, esi
mov ebp, edx
and ebp, eax
xor ebp, ebx
ror eax, 1
ror edx, 5
ror ecx, 2
dec dword [esp + 0x28]
mov ebx, eax
mov eax, ecx
jne 0x497310
mov ecx, edx
xor ecx, ebp
mov esi, ecx
ror esi, 8
mov edi, ecx
rol edi, 8
xor esi, edi
xor ecx, esi
mov esi, dword [esp + 0x10]
mov edi, dword [esi + 4]
mov esi, dword [esi + 0xc]
xor esi, ecx
xor eax, esi
xor edi, ecx
xor ebx, edi
mov ecx, eax
xor ecx, ebx
mov esi, ecx
ror esi, 8
mov edi, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
rol edi, 8
xor esi, edi
xor ecx, esi
mov esi, dword [eax + 8]
mov eax, dword [eax]
xor eax, ecx
xor esi, ecx
xor esi, edx
xor eax, ebp
xor eax, 0x80
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
bswap eax
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
mov eax, dword [esp + 0x20]
bswap eax
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x1c]
bswap eax
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x18]
bswap eax
pop edi
pop esi
pop ebp
mov dword [ecx + 0xc], eax
pop ebx
add esp, 0x14
ret 8