joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3e9d
Capabilities:
Packed with generic packer

Disassembly:
dec eax
cwde
mov bl, bl
jne 0x4bdcc5
je 0x48fcf4
nop
cpuid
ret 0x840f
je 0x4bdcc5
lea ebp, [edi + 0x440049]
add byte [eax], al
aaa
xor cl, byte [eax + eax + 0x20]
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
in al, 0xf2
dec ecx
add byte [edi + 0x30], dh
and byte [edx + 0x49], dl
add byte [edi + 0x3c0000ef], dh
add byte [eax], al
add byte [edi + 0x34004939], al
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
pushal
clc
dec ecx
add byte [eax], al
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add bl, ch
or cl, byte [ecx]
xor byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
je 0x48fd48
dec edx
add bl, bh
sti
out dx, eax
dec ebx
add byte [esi + 0x38004b71], dl
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add ah, cl
loop 0x48fda4
add byte [eax], al
add byte [eax], al
cmp al, 0
add byte [eax], al
hlt
dec eax
add byte [edi], cl
mov byte [0xc72dc3c4], al
dec edx
add byte [ecx - 0x38ffb50f], dh
and dword [esi - 0x18], edx
pop esi
int3
xor eax, 0x4b574bcb
add byte [eax], al
inc ecx
add byte [eax + 0x40], al
add byte [ecx], al
add byte [eax], al
add al, 0
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
pop ds
adc al, 0x4a
add bl, dl
add dword [eax + eax - 0x30], ecx
add al, 0x4a
add byte [ebp + 0x34000000], al
add byte [eax], al
add byte [edx + eax + 0x4a], dh
add byte [ebx + 0x4b004b85], bl
push edi
dec ebx
add byte [eax], al
inc edx
add byte [eax], al
xor al, 0
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [ecx], ah
cmp byte [eax], 0
add byte [eax], al
add byte [ecx], ah
add byte [eax], al
inc dword [eax]
add byte [eax], al
imul ecx, dword fs:[ecx], 0x49e2cc
inc eax
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
lea ebp, [edi + 0x440049]
add byte [eax], al
in al, 0xf2
dec ecx
add byte [edi], dl
ja 0x49340b
call fcn.004b34c1
add byte [eax], al
xor byte [eax], al
add byte [eax], al
hlt
shl ax, 0x20
mov bp, bp
push ebp
mov ebp, esp
push ebx
push esi
push 0x553165
xor esi, esi
jb 0x4bf55d
call fcn.0049d5eb
add bl, 0x55
sub bl, 0x55
add esp, 4
test eax, eax
jb 0x48fce4
jle 0x4c4b89
jg 0x4b3eda
jl 0x4b3f45
mov bl, byte [ebp + 8]
add byte [eax], al
lea esi, [esi]
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
test dword [ebp + ebx], eax
jb 0x4933f5
jmp dword [esi]
and cl, 0x3c
Function at 0x4bc2f7
Capabilities:
Packed with generic packer

Disassembly:
or edx, eax
jb 0x4ae4a2
lea esp, [esp + 4]
mov dx, di
shr al, 0x40
shr dx, 0xe
lea eax, [edi*4]
jmp 0x493dea
Function at 0x4c0518
Capabilities:
Packed with generic packer

Disassembly:
xor eax, 0x4568b00
mov ebx, dword [esi + 8]
shr dx, 0x40
mov eax, dword [eax + edx]
lea esi, [esi + 0xc]
xor dword [ebp + ebx], eax
jb 0x4a85a7
ja 0x4c7ad1
jbe 0x4a3935
rcl byte [edx - 0x6979f00d]
inc ecx
add al, byte [eax]
jbe 0x4c7ad1
xor al, 0x61
mov dword [0x6f810f43], eax
sbb al, 2
add byte [eax + 4], dh
retf
pop dword [esp - 4]
lea ecx, [ebp - 4]
shr bp, 0x40
push 0
and ebx, 0xffff
jb 0x4a390e
push ecx
push pe_nt_image_headers32
xchg al, dh
xchg dh, al
call fcn.004ce243
xchg esi, eax
jno 0x4c058e
add byte [eax], dh
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
inc ebx
dec ebx
add bh, bh
inc dword [eax]
add byte [eax], dh
add byte [eax], al
add byte [edx + eax + 0x4a], dh
add byte [ebp - 0x2bffb6a8], bh
das
dec edx
add byte [edi], cl
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
inc ebx
dec ebx
add bh, bh
inc dword [eax]
add byte [eax + eax], dh
add byte [eax], al
je 0x4c057c
dec edx
add bl, cl
pop eax
dec ecx
add byte [eax + 0x1004bb8], dl
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ebp + 6], ch
retf
dec ebx
add byte [eax], dh
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
je 0x4c059c
dec edx
add bl, dl
pop eax
dec ecx
rcr dword [eax + 0x49], cl
add byte [0xc004b62], al
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ebx + 0x57], cl
dec ebx
add byte [eax], al
inc ecx
add byte [eax + 0x30], al
add byte [ecx], al
add byte [eax], al
xlatb
xor eax, dword [eax]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
inc ecx
add byte [eax], al
dec eax
add byte [eax], al
add byte [edi], bl
adc al, 0x4a
add byte [ebx + 0x65], al
dec ebx
add bh, bh
inc dword [eax]
add byte [eax], cl
add byte [eax], al
je 0x4c05e0
dec edx
add byte [ebx], ch
test byte [eax], 0xf6
sub esi, esi
dec eax
add dh, dh
push ecx
dec ecx
add byte [edi], al
add byte [eax], al
cmp dword [eax], eax
add byte [eax], al
jge 0x4c063c
add byte [eax + eax], dh
add byte [eax], al
xor al, 0
add byte [eax], al
sbb ecx, edi
dec ebx
add byte [eax], cl
add byte [eax], al
xor al, 0
add byte [eax], al
je 0x4c060c
dec edx
add byte [edx], dh
test byte [eax], 0x8d
scasd eax, dword es:[edi]
dec ecx
add byte [eax], cl
add byte [eax], al
rol byte [edx + ecx*2], 1
xor dh, dh
dec eax
add byte [ebp + 0x480049af], cl
add byte [eax], al
add al, dl
add al, 0x4a
add byte [edi + 0x66], dh
add byte [eax], al
xor al, 0
add byte [eax], al
je 0x4c0628
dec edx
add byte [edx - 0xa], cl
dec eax
add byte [ebx - 0x43], al
dec ecx
add byte [edi], bl
mov eax, 0xc72d004c
dec edx
add byte [eax + 6], al
dec edx
test byte [eax], 0x43
mov ebp, 0xb81f0049
dec esp
add byte [0x40004ac7], ch
push es
dec esp
add bh, dl
xlatb
shl byte [edx], 1
wait
sub eax, 0x1f004ac7
mov eax, 0xded9004c
jmp dword [esi]
Function at 0x4c1ce0
Capabilities:
Encode data using base64

Disassembly:
push ebp
sub cl, byte [edi]
sub dword [edx + 0x24], 0x4700003
invalid
mov edx, dword [esi + 4]
call fcn.004cbf0e
clc
lodsb al, byte [esi]
call fcn.004aedb0
add eax, 0x24648dec
lea esp, [esp + 4]
cmc
sub word [ebp + ebx], ax
jmp dword [esi]
mov cx, cx
lea eax, [ebp - 8]
push 8
lea ecx, [ebp - 0x1c]
shr cx, 0x40
jne 0x4c8785
je 0x4be827
cpuid
and ebx, eax
je 0x4c8785
add eax, 0x24448f00
cld
jmp 0x4be834
push esi
call fcn.004a521f
add esp, 0x30
test ax, ax
jb 0x49be28
jne 0x4acf0f
je 0x4be855
mov ch, 0x58
mov al, byte [0xff6ffeb]
sub dword [ecx], 0x70fffe7d
add al, byte [ecx]
adc ecx, dword [edi]
sbb byte [edi], 0x7d
invalid
jmp 0x4be856
push esi
jno 0x4a6587
jo 0x4be862
add dword [ebx], edx
jo 0x4a6587
and eax, 0x38558b69
div ebx
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x38], edx
jmp dword [esi]
pop dword [esp - 4]
je 0x4c8688
jne 0x4c1cef
pop ebx
out 0x6e, al
xor eax, eax
jb 0x4b79a9
pop esi
mov esp, ebp
jne 0x4c8681
je 0x4c1d04
sahf
dec dword [edi]
test byte [edi + 0x69], dh
add byte [eax], al
je 0x4c8681
invalid
pop ebp
ret
shr bh, 0x40
mov al, byte [ebp - 0x62]
cmp al, 1
jne 0x4c86dd
je 0x4c869a
cwde
dec esp
mov cl, byte [ebp - 0x60]
xor eax, eax
jb 0x4b79b2
sub cl, 0x34
shl eax, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x4ba28a
add dl, 0x58
mov bp, bp
mov byte [ebp + eax - 8], dl
lea ecx, [ecx]
inc eax
cmp eax, 8
jl 0x4c86ab
jge 0x4c86d6
in eax, dx
mov ch, 0xe9
xor dword [ecx - 1], esp
push dword [0x89023cb3]
imul al
or cl, byte [edx]
add bh, al
dec esp
xchg ecx, edx
xchg edx, ecx
mov eax, edx
shr bl, 0x40
shr eax, 0x1f
add edx, eax
shr ah, 0x40
mov eax, ecx
shr eax, 0x40
mov edi, edx
shl bl, 0x20
cdq
and edx, 3
jb 0x4b1e2c
jmp 0x4be80c
cmp al, 2
mov esi, esi
call 0x4cd0f0
invalid
add eax, edx
sar ebx, 2
jne 0x4a1747
je 0x4c8721
shr bl, 0x70
clc
je 0x4a1747
invalid
jmp 0x4c8786
push eax
jmp 0x4c8789
push ecx
call fcn.0049d4f4
add esp, 0xc
test al, al
jb 0x4a0347
jne 0x4c87ba
je 0x4c87a8
inc edi
invalid
xor eax, eax
jb 0x4a0360
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov esp, ebp
js 0x4a362c
jns 0x4c87ce
adc al, 0xda
in eax, dx
and ecx, dword [edi]
mov dword [eax - 0x52], ebx
std
invalid
jns 0x4a362c
fnstenv [edx - 0x48]
push ss
dec ebx
add byte [eax], al
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add bl, ch
or cl, byte [ecx]
xor byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
je 0x4c87f2
dec edx
add byte [0xfa004a74], ah
and eax, 0xfa004a74
jle 0x4c8842
add byte [eax + eax], bh
add byte [eax], al
cmp al, 0
add byte [eax], al
hlt
cmp eax, 0x229b26ff
shr edx, 0x40
lea ebx, [ebx]
mov eax, dword [ebp + 0x44]
js 0x4a3910
jns 0x4c885b
cpuid
nop
ret
jns 0x4a3910
xor eax, 0x40edc1eb
mov edx, dword [ebp + 8]
shl dh, 0x20
jmp 0x4c886d
push edx
call fcn.004b632e
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi]
push eax
push ecx
call fcn.004aec95
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c8bc1
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp + ebx], eax
jmp dword [esi]
lea esi, [esi]
mov al, byte [ebp + 0xb]
xchg ah, dh
xchg dh, ah
mov bh, bh
call fcn.004cd4f0
xor eax, 0xef870f8f
xor dword [eax], eax
add byte [esi + 4], dh
fmul dword [edx - 0x79f0bd2a]
jecxz 0x496952
add byte [eax], al
lea esp, [esp + 4]
mov byte [esi + 0xbb], 0
shl bl, 0x20
mov word [esi + 0xbc], dx
mov al, al
call fcn.004c9f89
push edi
mov di, ax
pop edi
mov ah, ah
js 0x4968ff
shr al, 0x40
jns 0x4c8bf3
cpuid
nop
ret
jns 0x4968ff
mov edx, dword [esi + 4]
mov ebx, dword [esi + 8]
movzx eax, byte [eax + edx]
lea esi, [esi + 0xc]
jne 0x48f240
je 0x4c8c11
inc ebp
adc al, dl
je 0x48f240
fisubr dword [ecx - 0x71]
inc esp
and al, 0xfc
je 0x4c8c5d
jne 0x4c8c28
iretd
cmp ax, 0x100
je 0x4c8c5d
jne 0x4c8c37
stc
invalid
cmp ax, 0x12c
xchg edx, ebx
xchg ebx, edx
je 0x4c8c5d
push esi
pop esi
jne 0x4c8c4d
mov edi, 0x662af420
cmp eax, 0x850f0028
cmp ax, 0x28
jne 0x4a0bc4
insd dword es:[edi], dx
jg 0x4c8c53
push dword [esp + eax + 0x7e]
add dword [ebp + 0x5b], edx
je 0x4c8c5d
jle 0x4c8c5c
push ebp
pop ebx
mov ecx, dword [edi]
push ecx
call fcn.004b96f0
ja 0x4a2b36
jbe 0x4c8c72
cpuid
nop
ret
jbe 0x4a2b36
xor al, 0x89
jmp dword [esi]

Function at 0x4ce18c
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
and eax, 0x24448f97
cld
jmp 0x49dfbf
pop dword [esp - 4]
jne 0x4ae7ea
shl ax, 0x20
je 0x4ce19f
ja 0x497eab
jbe 0x4ce1ab
jae 0x4ce1bd
leave
pop ebx
jbe 0x497eab
mov eax, dword [esi + 4]
mov eax, dword [ebp + eax]
add esi, 8
shr dx, 0x40
shr ax, 0x40
shl eax, cl
add edx, 0xdfcce240
sub edx, 0xdfcce240
add edi, eax
test ecx, 0x80000000
jb 0x4bae96
add byte [esi - 0x3f], ah
ljmp 0xd340
shl cl, 0x20
jne 0x4b6076
je 0x4ce1f1
movsb byte es:[edi], byte [esi]
sahf
and eax, 0x40e9c0ed
shr cl, 0x40
mov ecx, dword [esi]
add esi, 4
test ecx, 0x1000
jb 0x4cba8c
jne 0x4aab5d
je 0x4ce213
or ch, al
sbb cl, byte [edi]
test byte [ecx + ecx*8 - 3], al
invalid
je 0x4aab5d
invalid
Function at 0x4cecf0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
cmp dword [esp + 0x10c], 0
push ebx
push esi
push edi
push ebp
jne 0x4ced14
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
cmp dword [esp + 0x124], 0
jne 0x4ced2e
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor eax, eax
mov edx, dword [esp + 0x11c]
mov ax, word [edx]
add eax, 7
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x11c]
sar eax, 3
mov si, ax
lea eax, [esp + 0x18]
movzx ebp, si
push ebp
push edx
push eax
call fcn.004de640
add esp, 0xc
cmp si, 0xfc
jbe 0x4ced79
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
mov eax, dword [esp + 0x124]
push eax
call fcn.004db430
mov esi, dword [esp + 0x124]
add esp, 4
test esi, esi
jne 0x4cee27
xor cx, cx
mov eax, dword [esp + 0x124]
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x4ceda9
xor di, di
xor edx, edx
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
mov edx, dword [esp + 0x11c]
xor eax, eax
mov cl, byte [esi]
mov al, byte [ebx + edx + 2]
xor edx, edx
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x4cedc5
jmp 0x4ceeea
mov edx, dword [esp + 0x11c]
push ebp
lea eax, [esp + 0x1c]
push edx
push eax
add esi, 2
call fcn.004de640
lea eax, [esp + ebp + 0x24]
add esp, 0xc
push 4
push esi
push eax
call fcn.004de640
xor cx, cx
mov eax, dword [esp + 0x130]
add esp, 0xc
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x4cee61
xor di, di
xor edx, edx
add ebp, 4
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
xor edx, edx
xor eax, eax
mov cl, byte [esi]
mov al, byte [esp + ebx + 0x18]
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x4cee80
lea eax, [esp + 0x18]
push 0
push pe_nt_image_headers32
push eax
call fcn.004de620
add esp, 0xc
mov edx, dword [esp + 0x14]
push pe_nt_image_headers32
mov eax, dword [esp + 0x128]
push edx
push eax
call fcn.004db480
add esp, 0xc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x4cf050
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x174
push esi
push edi
mov esi, dword [esp + 0x194]
mov dword [esi], 0
mov ecx, dword [eax]
test ecx, ecx
jne 0x4cf07c
mov ax, 0xcc
pop edi
pop esi
add esp, 0x174
ret
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x184]
push eax
push edx
push ecx
call fcn.004cecf0
add esp, 0xc
test ax, ax
jne 0x4cf1c8
xor eax, eax
mov al, byte [esp + 0x190]
test eax, eax
je 0x4cf0c4
cmp eax, 1
je 0x4cf13e
mov ax, 0xa
pop edi
mov dword [esi], 0
pop esi
add esp, 0x174
ret
mov eax, dword [esp + 0x188]
test eax, eax
je 0x4cf0e5
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004db480
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.004db5e0
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 0x18
shr cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x4cf0fb
xor eax, eax
mov dword [esp + 8], edi
lea ecx, [esp + 0xb]
mov dl, byte [esp + eax + 0x1c]
sub ecx, eax
inc eax
xor byte [ecx], dl
cmp eax, 4
jb 0x4cf126
mov eax, dword [esp + 8]
jmp 0x4cf1af
mov eax, dword [esp + 0x188]
test eax, eax
je 0x4cf15f
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004db480
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.004db5e0
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x4cf175
xor eax, eax
mov dword [esp + 8], edi
mov cl, byte [esp + eax + 0x1c]
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jb 0x4cf19d
mov eax, dword [esp + 8]
push 0
mov dword [esi], eax
lea eax, [esp + 0x24]
push 0x15c
push eax
call fcn.004de620
xor ax, ax
add esp, 0xc
pop edi
pop esi
add esp, 0x174
ret
Function at 0x4cf9c0
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
push ebp
test esi, esi
je 0x4cfa27
mov edi, dword [esp + 0x14]
mov cl, byte [edi]
xor ebp, ebp
mov bp, ax
mov dl, cl
shr ax, 4
and ebp, 0xf
and dl, 0xf
xor ebx, ebx
mov bl, dl
and cl, 0xf3
shr cl, 2
inc edi
mov edx, dword [ebx*4 + 0x553490]
xor ebx, ebx
xor dx, ax
xor eax, eax
xor dx, word [ebp*4 + 0x553490]
mov al, cl
mov bx, dx
mov eax, dword [eax + 0x553490]
shr dx, 4
and ebx, 0xf
xor ax, dx
xor ax, word [ebx*4 + 0x553490]
dec esi
jne 0x4cf9d3
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4cfa30
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
mov dword [eax], 0
cmp dword [esp + 0x1c], 1
push esi
push edi
push ebp
jae 0x4cfa52
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
xor edi, edi
mov ebp, dword [esp + 0x28]
cmp ebp, edi
je 0x4cfb50
lea eax, [edi*4]
mov ecx, 3
sub edx, edx
xor ebx, ebx
div ecx
mov edx, dword [esp + 0x1c]
lea esi, [edx + eax]
mov eax, dword [esp + 0x24]
add eax, edi
inc esi
inc esi
mov dword [esp + 0x10], eax
mov al, byte [eax]
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x14], al
mov dl, byte [ecx + 1]
and al, 3
xor ecx, ecx
mov bl, al
mov al, dl
shl ebx, 4
and dl, 0xf
shr al, 4
mov cl, al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], 0
or ebx, ecx
mov cl, byte [eax + 2]
xor eax, eax
and ebx, 0x3f
mov al, dl
mov dl, cl
shl eax, 2
and cl, 0x3f
shr dl, 6
mov byte [esp + 0x10], dl
xor edx, edx
or eax, dword [esp + 0x10]
mov dl, cl
mov dword [esp + 0x10], 0
mov cl, byte [esp + 0x14]
shr cl, 2
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 2], cl
mov cl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 1], cl
cmp ebp, 3
mov ecx, ebp
jb 0x4cfb09
mov ecx, 3
cmp ecx, 1
jne 0x4cfb17
mov byte [esi], 0x3d
mov byte [esi + 1], 0x3d
jmp 0x4cfb39
and eax, 0x3f
inc esi
cmp ecx, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 1], al
jne 0x4cfb2e
mov byte [esi], 0x3d
jmp 0x4cfb39
and edx, 0x3f
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
sub ebp, 3
mov eax, dword [esp + 0x20]
add edi, 3
add dword [eax], 4
cmp edi, dword [esp + 0x28]
jb 0x4cfa60
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x4d01b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
push esi
xor ebx, ebx
mov esi, dword [esp + 0xc]
mov ecx, 4
mov al, byte [esi + 2]
mov bl, byte [eax + str._.C]
mov eax, dword [esp + 0x10]
cmp eax, ecx
jle 0x4d01e8
mov edx, ebx
inc ecx
and edx, 0xff
inc ebx
mov dl, byte [edx + str._.C]
xor byte [esi + ecx - 1], dl
cmp ecx, eax
jl 0x4d01d0
pop esi
pop ebx
ret
Function at 0x4d0480
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [esp + 8]
push ebx
and ax, 0x8000
push esi
mov dx, word [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ax, 1
sbb eax, eax
add dx, dx
inc eax
or ax, dx
mov word [esp + 0x10], ax
xor byte [esp + 0x11], al
mov ax, word [esp + 0x10]
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
mov esi, 0x55
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
mov eax, 0x58
mov dl, byte [esp + 0x10]
mov bl, byte [esp + 0x10]
and dl, 0x80
add bl, bl
shr dl, 7
add ecx, 2
or dl, bl
mov byte [esp + 0x10], dl
mov dl, byte [esp + 0x11]
and dl, 1
mov bl, byte [esp + 0x11]
shl dl, 7
shr bl, 1
or dl, bl
mov byte [esp + 0x11], dl
mov bl, byte [esp + 0x10]
xor byte [esp + 0x11], bl
mov dx, word [esp + 0x10]
not dx
mov word [esp + 0x10], dx
xor word [ecx - 2], dx
add word [esp + 0x10], si
dec eax
jne 0x4d0503
pop esi
pop ebx
ret

Function at 0x4d2140
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
sub esp, 8
mov al, byte [esp + 0xc]
push ebx
and ax, 0xf
push esi
mov word [esp + 0xa], ax
push edi
mov eax, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
lea ecx, [eax + ebp - 1]
mov dword [esp + 0x14], ecx
xor bl, bl
mov edi, dword [esp + 0x14]
test bp, bp
lea esi, [ebp - 1]
je 0x4d2191
mov dl, byte [edi]
mov eax, edi
dec edi
mov cl, bl
mov bl, dl
add dl, dl
shr bl, 7
or dl, cl
mov byte [eax], dl
mov ax, si
dec si
test ax, ax
jne 0x4d2175
test bl, bl
je 0x4d219c
mov eax, dword [esp + 0x14]
or byte [eax], 1
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x4d2167
xor si, si
test ebp, ebp
je 0x4d21c9
mov dl, byte [esp + 0x1c]
mov eax, dword [esp + 0x20]
movzx ecx, si
inc si
xor byte [ecx + eax], dl
movzx ecx, si
cmp ecx, ebp
jb 0x4d21b2
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x4d2962
Capabilities:
Encode data using xor

Disassembly:
add al, 0x8a
dec esp
and al, 8
push ebx
mov edx, dword [esp + 0x10]
push esi
xor si, si
push edi
cmp dword [esp + 0x1c], 0
push ebp
je 0x4d298a
movzx eax, si
inc si
xor byte [eax + edx], cl
movzx ebx, si
cmp ebx, dword [esp + 0x20]
jb 0x4d2979
xor ax, ax
mov al, cl
and ax, 0xf
mov word [esp + 0x12], ax
mov di, word [esp + 0x20]
xor cl, cl
dec di
mov esi, edx
cmp word [esp + 0x20], 0
je 0x4d29cc
mov al, byte [esi]
mov ebp, esi
inc esi
mov bl, cl
shl bl, 7
mov cl, al
shr al, 1
and cl, 1
or bl, al
mov byte [ebp], bl
mov bp, di
dec di
test bp, bp
jne 0x4d29ab
test cl, cl
je 0x4d29d3
or byte [edx], 0x80
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x4d2998
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x4d6740
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x88
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov esi, dword [esp + 0x98]
push ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
jne 0x4d6770
mov dword [esp + 0x18], 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x24], eax
je 0x4d6862
mov eax, dword [esp + 0x10]
xor dword [esi], eax
mov ecx, dword [esp + 0x14]
xor dword [esi + 4], ecx
cmp dword [esp + 0x20], 0
jne 0x4d6832
cmp dword [esp + 0x1c], 2
push 0
jbe 0x4d6813
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.004d6910
add esp, 0xc
cmp dword [0x553958], 0
jne 0x4d68fd
mov eax, dword [esp + 0x28]
lea ebx, [esp + 0x30]
mov edi, 0x19
mov dword [esp + 0x30], eax
mov eax, dword [ebx]
mov cl, 0x20
add eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [ebx + 4], eax
add ebx, 4
mov eax, dword [esp + 0x28]
mov edx, dword [ebx - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x34], eax
dec edi
jne 0x4d67e4
jmp 0x4d6840
push 0
push esi
call fcn.004d6910
add esp, 0xc
cmp dword [0x553958], 0
je 0x4d6840
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
lea eax, [esp + 0x30]
push eax
push esi
call fcn.004d6c30
add esp, 8
mov eax, dword [esi]
add esi, 8
mov dword [esp + 0x10], eax
inc dword [esp + 0x20]
mov ecx, dword [esi - 4]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
cmp eax, dword [esp + 0x24]
jb 0x4d6797
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x4d6878
mov cl, byte [esi + eax]
xor byte [esp + eax + 0x10], cl
inc eax
cmp eax, dword [esp + 0x18]
jb 0x4d686a
cmp dword [esp + 0x1c], 2
jbe 0x4d6893
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.004d6c30
add esp, 8
jmp 0x4d68b8
cmp dword [esp + 0x1c], 1
jne 0x4d68a7
mov eax, dword [esi]
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x10]
push 0
push 0
push eax
call fcn.004d6910
add esp, 0xc
cmp dword [esp + 0x1c], 1
jbe 0x4d68f0
xor ecx, ecx
cmp dword [esp + 0x18], ecx
je 0x4d68d7
mov dl, byte [esi + ecx - 8]
lea eax, [esi + ecx]
inc ecx
mov byte [eax], dl
cmp ecx, dword [esp + 0x18]
jb 0x4d68c7
mov eax, dword [esp + 0x10]
mov dword [esi - 8], eax
mov ecx, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi - 4], ecx
pop esi
pop ebx
add esp, 0x88
ret
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret