joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b63e5
Capabilities:
Check os version
Encode data using base64

Disassembly:
call fcn.004bc285
push ebp
mov cx, cx
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, 0xff
jb 0x4cb461
add eax, 0xffffffd8
cmp eax, 0xc2
lea edi, [edi]
ja 0x4b643b
jbe 0x4b6411
nop
cpuid
ret
xor ecx, ecx
jb 0x4d7f78
shr ecx, 0x40
mov cl, byte [eax + 0x4e6ce4]
jmp dword [ecx*4 + 0x4e6cdc]
xor eax, eax
jb 0x4d7f91
pop ebp
jne 0x4b8097
mov dx, dx
je 0x4b6453
cpuid
ret
je 0x4b8097
add eax, 0x83df5f4
add byte [eax], al
add byte [esi - 0x3f], ah
out 0x20, al
mov cx, cx
jl 0x4c8e84
jge 0x4b6474
nop
cpuid
ret
jmp fcn.004b8058
ret
mov byte [ebp + ebx], al
jmp dword [esi]
and dword [ebx - 0x75], ebx
pop ebp
inc esp
mov byte [0x40eac073], al
mov ebx, dword [ebp + 0x44]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
jne 0x4e386c
je 0x4d7faa
sub dword [ebx], ecx
inc ecx
je 0x4e386c
fld dword [esi]
imul byte [ebp + ebx]
lea esi, [esi + 0xc]
shr cl, 0x40
jne 0x4c506a
je 0x4d7fc8
cpuid
ret
je 0x4c506a
fidiv dword [edx - 0x25]
loopne 0x4d801f
add byte [eax], al
popal
add byte [eax + 0x34], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
xor byte [eax], al
add byte [eax], al
and ecx, ecx
dec edx
add bh, cl
jbe 0x4d8041
add byte [esp + ecx*4], al
dec ebx
add byte [eax + eax*4], al
dec ebp
add byte [eax + 0x4c3a20f], dl
mov word [ebx], cs
jle 0x4d8063
dec esi
add dl, bl
xchg ecx, eax
pop esi
pop ebp
ret
in al, 0x58
jo 0x4a8871
Function at 0x4c0fe2
Capabilities:
Check os version
Encode data using base64

Disassembly:
jmp 0x4aea46
push esi
mov byte [esi + 0xba], bl
mov dl, dl
push 0x4def93
ret
pop dword [esp - 4]
call fcn.004bf49d
shl di, 0x20
shr dx, 0x40
shr edx, 0x40
jne 0x4ce89c
je 0x4c1002
daa
arpl si, si
mov cl, 0xf
test byte [eax + ebx*8 + 0x73350000], dl
mov ebx, dword [esi + 8]
je 0x4ce89c
xor eax, 0x85e8b73
mov ax, word [ebp + eax]
mov ebx, dword [ebp + ebx]
lea esi, [esi + 0xc]
xor word [ebx], ax
jb 0x4c5150
jmp dword [esi]
pop ebp
shl cx, 0x20
mov edx, edx
mov al, byte [ebp + 0xb]
js 0x4aea45
jns 0x4ce8ab
push ds
ret
jns 0x4aea45
xor al, 0x50
pop ebp
ret
Function at 0x4c384e
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Get number of processors
Parse pe header

Disassembly:
pop dword [esp - 4]
mov byte [esi + 0xba], cl
mov byte [esi + 0xbb], 0
jne 0x4c5d2f
je 0x4c3869
and al, 0xc5
je 0x4c5d2f
invalid
push eax
shl cl, 0x20
lea eax, [eax]
jmp 0x4c5d37
push esi
mov word [esi + 0xbc], dx
shl cl, 0x20
call fcn.004b6192
shl eax, 0x20
call fcn.004ddb0d
fnstcw word [ecx + 0x5b]
mov esp, ebp
pop ebp
ret
Function at 0x4c3ce7
Capabilities:
Check os version
Encode data using base64
Get number of processors

Disassembly:
push ebp
ja 0x4cf9f6
jbe 0x4aded2
dec edi
sbb dword [esi], edx
sbb dword [edi], ecx
xchg byte [esi], bl
sbb eax, dword [edx]
add byte [edx + 0x40eac150], al
jbe 0x4cf9f6
adc byte [eax - 0x3f], 0xea
inc eax
jno 0x4adec5
jo 0x4c3cf2
dec edi
xor edi, ecx
jo 0x4adec5
xor eax, 0xfbe1e8e0
invalid
push ebx
jmp 0x4c4ee5
push esi
add byte [ecx + 0x40c4], al
add al, ch
pop edx
invalid
mov ebp, esp
push ecx
js 0x4c4ee3
jns 0x4cfa03
mov dh, 0xe6
jns 0x4c4ee3
add eax, 0x4c722988
add byte [ecx], al
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add dh, al
jge 0x4cfa65
add byte [ecx + 0x6f], al
dec ebp
add dl, cl
mov cl, 0x4c
add byte [ebx], ch
cli
dec esp
add byte [edi], cl
mov byte [0xa033ffc3], al
dec esp
add byte [eax], al
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
movsd dword es:[edi], dword [esi]
mov cl, 0x4c
add byte [edx - 6], al
dec esp
add byte [edx], dl
pop ebp
jp 0x4cf9e8
mov cl, 0x4c
add byte [ebx], ch
outsb dx, byte [esi]
dec ebp
add dl, bl
xchg dword [ebx - 0x6c], edi
dec edx
add byte [eax], dh
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [esp + ecx*4], al
dec ebx
add byte [ecx - 0x18], bh
dec esp
add bh, ch
and dword [esi], ecx
inc ebp
jle 0x4cfab3
add byte [edi - 0x56], bl
dec esp
add bh, al
xor ecx, ebp
xor cl, byte [edx - 0x37260001]
shl edx, 0x20

Function at 0x4c518f
Capabilities:
Check os version
Encode data using base64

Disassembly:
pop dword [esp - 4]
jmp 0x4b0cb3

Function at 0x4c7740
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 4]
mov ebx, dword [esi + 8]
shr ebx, 0x40
mov ecx, dword [esi + 4]
mov ebx, dword [ebp + ebx]
call fcn.004b8cb0
ficom dword [0xff5ffeb]
test dword [edi], edi
and edi, esi
push dword [ebx + eax - 0x2c]
xchg dword [edi + ecx - 0x1dccb7c], edx
invalid
Function at 0x4d4c87
Capabilities:
Packed with generic packer

Disassembly:
or edx, eax
jb 0x4c6e32
lea esp, [esp + 4]
mov dx, di
shr al, 0x40
shr dx, 0xe
lea eax, [edi*4]
jmp 0x4ac77a
Function at 0x4dca1a
Capabilities:
Check os version

Disassembly:
push 0x4b7a49
ret
mov dl, byte [ebp + 0xb]
test al, 0xc3
add esp, 0x2c
mov byte [esi + 0xba], bl
test ax, ax
jb 0x4bcbb4
shr di, 0x40
mov bp, bp
mov byte [esi + 0xbb], dl
lea esi, [esi]
shr bx, 0x40
xchg ebp, edi
xchg edi, ebp
mov ch, ch
push edx
mov dx, 0x7d1d
xchg dh, dh
pop edx
shr si, 0x40
mov word [esi + 0xbc], di
mov cx, cx
jne 0x4ad7f9
je 0x4c8749
push cs
sub byte [eax], ch
jmp 0x4a7b60
lea esp, [esp + 4]
shl bl, 0x20
mov eax, dword [ebp - 8]
lea eax, [eax]
jne 0x4c86f5
shr edi, 0x40
je 0x4dca33
push ebx
out dx, al
je 0x4c86f5
and eax, 0x4468b9b
mov cx, cx
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
adc byte [ebp + ebx], al
shr al, 0x40
jmp dword [esi]
Function at 0x4e3ec0
Capabilities:
Get file size

Disassembly:
pop ebp
ret
jne 0x4d39e5
je 0x4cd138
and al, bh
je 0x4d39e5
invalid
push 8
lea ecx, [ebp - 0x10]
push 0x5fee04
push ecx
call fcn.004b5e84
add esp, 0xc
test al, al
jb 0x4b6c58
jne 0x4e114a
je 0x4d3a10
mov dl, byte [ecx - 0x13]
ret 0x86a
push 8
lea edx, [ebp - 8]
push 0
push edx
call fcn.004b163f
mov eax, dword [esi]
push 0x100
js 0x4dfd08
shr edi, 0x40
jns 0x4d3a33
pop esi
xchg eax, edi
dec ecx
jns 0x4dfd08
fiadd dword [ebx - 0x77f4ba76]
fcmovnb st(0), st(0)
loope fcn.004d3a63
fidiv dword [edx - 0x3dbbb71]
call fcn.004b4692
lea ecx, [ebp - 0x11c]
push eax
shr ax, 0x40
push ecx
call fcn.004ddd56
lea edx, [ebp - 0x11c]
push 0
push edx
call fcn.004e0a03
lea eax, [ebp - 0x11c]
jmp 0x4e3724
mov dword [edi + 4], eax
push 0
mov bl, bl
jmp 0x4e3729
push eax
call fcn.004b71d3
lea ecx, [ebp - 0x11c]
ja 0x4a9b1a
jbe 0x4e3742
nop
cpuid
ret 0x860f
jbe 0x4a9b1a
sbb byte [ebx + 0x8c681], 0
add byte [ecx - 0x2ff6f78b], cl
jb 0x4cf96f
shl ah, 0x20
mov edx, dword [esi - 8]
sub eax, edx
mov edx, eax
ja 0x4e0aaf
xchg al, dh
xchg dh, al
jbe 0x4e3774
aad 0x80
jne 0x4e3784
jbe 0x4e0aaf
xchg byte [0xd8ffffd3], dh
cmp al, 0x66
fdivr dword [esi]
add ebp, 0x1f300000
jb 0x4dfb41
cmp byte [eax - 0x3d], 0x26
jmp dword [esi]
add esp, 4
cmp word [ebp + 0xa], ax
je 0x4cd12e
jne 0x4e3892
mov dl, 0x55
xor eax, eax
jb 0x4ddd83
pop esi
mov esp, ebp
ja 0x4cd12a
jbe 0x4e38a9
cpuid
ret
jbe 0x4cd12a
xor al, 0xb8
jne 0x4b2aa6
shr ecx, 0x40
shl edi, 0x20
mov bp, bp
je 0x4e38c4
mov ch, 0xcc
je 0x4b2aa6
invalid
push ebp
mov ebp, esp
js 0x4ae696
jns 0x4e3ecf
mov eax, 0x890fe59b
shl dword [edi + 0x6fdafffc], 0x8b
jns 0x4ae696
fisubr dword [edi - 0x75]
push es
jmp 0x4e3eda
push eax
call fcn.004cf57e
jno 0x4e387e
jo 0x4e3eed
cpuid
test ebx, 0xf98b800f
invalid
jo 0x4e387e
mov dword [edi - 0x2cd2618], 0xc1168bff
jecxz 0x4e3f1f

Function at 0x4e6b1c
Capabilities:
Check os version
Encode data using base64
Encode data using xor
Get number of processors

Disassembly:
pop dword [esp - 4]
jne 0x4c717a
shl ax, 0x20
je 0x4e6b2f
ja 0x4b083b
jbe 0x4e6b3b
jbe 0x4b083b
Function at 0x4e7680
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
cmp dword [esp + 0x10c], 0
push ebx
push esi
push edi
push ebp
jne 0x4e76a4
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
cmp dword [esp + 0x124], 0
jne 0x4e76be
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor eax, eax
mov edx, dword [esp + 0x11c]
mov ax, word [edx]
add eax, 7
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x11c]
sar eax, 3
mov si, ax
lea eax, [esp + 0x18]
movzx ebp, si
push ebp
push edx
push eax
call fcn.004f6fb0
add esp, 0xc
cmp si, 0xfc
jbe 0x4e7709
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
mov eax, dword [esp + 0x124]
push eax
call fcn.004f3da0
mov esi, dword [esp + 0x124]
add esp, 4
test esi, esi
jne 0x4e77b7
xor cx, cx
mov eax, dword [esp + 0x124]
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x4e7739
xor di, di
xor edx, edx
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
mov edx, dword [esp + 0x11c]
xor eax, eax
mov cl, byte [esi]
mov al, byte [ebx + edx + 2]
xor edx, edx
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x4e7755
jmp 0x4e787a
mov edx, dword [esp + 0x11c]
push ebp
lea eax, [esp + 0x1c]
push edx
push eax
add esi, 2
call fcn.004f6fb0
lea eax, [esp + ebp + 0x24]
add esp, 0xc
push 4
push esi
push eax
call fcn.004f6fb0
xor cx, cx
mov eax, dword [esp + 0x130]
add esp, 0xc
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x4e77f1
xor di, di
xor edx, edx
add ebp, 4
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
xor edx, edx
xor eax, eax
mov cl, byte [esi]
mov al, byte [esp + ebx + 0x18]
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x4e7810
lea eax, [esp + 0x18]
push 0
push 0x100
push eax
call fcn.004f6f90
add esp, 0xc
mov edx, dword [esp + 0x14]
push 0x100
mov eax, dword [esp + 0x128]
push edx
push eax
call fcn.004f3df0
add esp, 0xc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x4e79e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x174
push esi
push edi
mov esi, dword [esp + 0x194]
mov dword [esi], 0
mov ecx, dword [eax]
test ecx, ecx
jne 0x4e7a0c
mov ax, 0xcc
pop edi
pop esi
add esp, 0x174
ret
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x184]
push eax
push edx
push ecx
call fcn.004e7680
add esp, 0xc
test ax, ax
jne 0x4e7b58
xor eax, eax
mov al, byte [esp + 0x190]
test eax, eax
je 0x4e7a54
cmp eax, 1
je 0x4e7ace
mov ax, 0xa
pop edi
mov dword [esi], 0
pop esi
add esp, 0x174
ret
mov eax, dword [esp + 0x188]
test eax, eax
je 0x4e7a75
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004f3df0
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.004f3f50
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 0x18
shr cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x4e7a8b
xor eax, eax
mov dword [esp + 8], edi
lea ecx, [esp + 0xb]
mov dl, byte [esp + eax + 0x1c]
sub ecx, eax
inc eax
xor byte [ecx], dl
cmp eax, 4
jb 0x4e7ab6
mov eax, dword [esp + 8]
jmp 0x4e7b3f
mov eax, dword [esp + 0x188]
test eax, eax
je 0x4e7aef
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004f3df0
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.004f3f50
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x4e7b05
xor eax, eax
mov dword [esp + 8], edi
mov cl, byte [esp + eax + 0x1c]
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jb 0x4e7b2d
mov eax, dword [esp + 8]
push 0
mov dword [esi], eax
lea eax, [esp + 0x24]
push 0x15c
push eax
call fcn.004f6f90
xor ax, ax
add esp, 0xc
pop edi
pop esi
add esp, 0x174
ret
Function at 0x4e8350
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
push ebp
test esi, esi
je 0x4e83b7
mov edi, dword [esp + 0x14]
mov cl, byte [edi]
xor ebp, ebp
mov bp, ax
mov dl, cl
shr ax, 4
and ebp, 0xf
and dl, 0xf
xor ebx, ebx
mov bl, dl
and cl, 0xf3
shr cl, 2
inc edi
mov edx, dword [ebx*4 + 0x5ffa10]
xor ebx, ebx
xor dx, ax
xor eax, eax
xor dx, word [ebp*4 + 0x5ffa10]
mov al, cl
mov bx, dx
mov eax, dword [eax + 0x5ffa10]
shr dx, 4
and ebx, 0xf
xor ax, dx
xor ax, word [ebx*4 + 0x5ffa10]
dec esi
jne 0x4e8363
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4e83c0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
mov dword [eax], 0
cmp dword [esp + 0x1c], 1
push esi
push edi
push ebp
jae 0x4e83e2
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
xor edi, edi
mov ebp, dword [esp + 0x28]
cmp ebp, edi
je 0x4e84e0
lea eax, [edi*4]
mov ecx, 3
sub edx, edx
xor ebx, ebx
div ecx
mov edx, dword [esp + 0x1c]
lea esi, [edx + eax]
mov eax, dword [esp + 0x24]
add eax, edi
inc esi
inc esi
mov dword [esp + 0x10], eax
mov al, byte [eax]
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x14], al
mov dl, byte [ecx + 1]
and al, 3
xor ecx, ecx
mov bl, al
mov al, dl
shl ebx, 4
and dl, 0xf
shr al, 4
mov cl, al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], 0
or ebx, ecx
mov cl, byte [eax + 2]
xor eax, eax
and ebx, 0x3f
mov al, dl
mov dl, cl
shl eax, 2
and cl, 0x3f
shr dl, 6
mov byte [esp + 0x10], dl
xor edx, edx
or eax, dword [esp + 0x10]
mov dl, cl
mov dword [esp + 0x10], 0
mov cl, byte [esp + 0x14]
shr cl, 2
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 2], cl
mov cl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 1], cl
cmp ebp, 3
mov ecx, ebp
jb 0x4e8499
mov ecx, 3
cmp ecx, 1
jne 0x4e84a7
mov byte [esi], 0x3d
mov byte [esi + 1], 0x3d
jmp 0x4e84c9
and eax, 0x3f
inc esi
cmp ecx, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 1], al
jne 0x4e84be
mov byte [esi], 0x3d
jmp 0x4e84c9
and edx, 0x3f
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
sub ebp, 3
mov eax, dword [esp + 0x20]
add edi, 3
add dword [eax], 4
cmp edi, dword [esp + 0x28]
jb 0x4e83f0
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x4e8b20
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
push esi
xor ebx, ebx
mov esi, dword [esp + 0xc]
mov ecx, 4
mov al, byte [esi + 2]
mov bl, byte [eax + str._.C]
mov eax, dword [esp + 0x10]
cmp eax, ecx
jle 0x4e8b58
mov edx, ebx
inc ecx
and edx, 0xff
inc ebx
mov dl, byte [edx + str._.C]
xor byte [esi + ecx - 1], dl
cmp ecx, eax
jl 0x4e8b40
pop esi
pop ebx
ret
Function at 0x4e8df0
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [esp + 8]
push ebx
and ax, 0x8000
push esi
mov dx, word [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ax, 1
sbb eax, eax
add dx, dx
inc eax
or ax, dx
mov word [esp + 0x10], ax
xor byte [esp + 0x11], al
mov ax, word [esp + 0x10]
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
mov esi, 0x55
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
mov eax, 0x58
mov dl, byte [esp + 0x10]
mov bl, byte [esp + 0x10]
and dl, 0x80
add bl, bl
shr dl, 7
add ecx, 2
or dl, bl
mov byte [esp + 0x10], dl
mov dl, byte [esp + 0x11]
and dl, 1
mov bl, byte [esp + 0x11]
shl dl, 7
shr bl, 1
or dl, bl
mov byte [esp + 0x11], dl
mov bl, byte [esp + 0x10]
xor byte [esp + 0x11], bl
mov dx, word [esp + 0x10]
not dx
mov word [esp + 0x10], dx
xor word [ecx - 2], dx
add word [esp + 0x10], si
dec eax
jne 0x4e8e73
pop esi
pop ebx
ret

Function at 0x4eaab0
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
sub esp, 8
mov al, byte [esp + 0xc]
push ebx
and ax, 0xf
push esi
mov word [esp + 0xa], ax
push edi
mov eax, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
lea ecx, [eax + ebp - 1]
mov dword [esp + 0x14], ecx
xor bl, bl
mov edi, dword [esp + 0x14]
test bp, bp
lea esi, [ebp - 1]
je 0x4eab01
mov dl, byte [edi]
mov eax, edi
dec edi
mov cl, bl
mov bl, dl
add dl, dl
shr bl, 7
or dl, cl
mov byte [eax], dl
mov ax, si
dec si
test ax, ax
jne 0x4eaae5
test bl, bl
je 0x4eab0c
mov eax, dword [esp + 0x14]
or byte [eax], 1
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x4eaad7
xor si, si
test ebp, ebp
je 0x4eab39
mov dl, byte [esp + 0x1c]
mov eax, dword [esp + 0x20]
movzx ecx, si
inc si
xor byte [ecx + eax], dl
movzx ecx, si
cmp ecx, ebp
jb 0x4eab22
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x4eb2d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov cl, byte [esp + 8]
push ebx
mov edx, dword [esp + 0x10]
push esi
xor si, si
push edi
cmp dword [esp + 0x1c], 0
push ebp
je 0x4eb2fa
movzx eax, si
inc si
xor byte [eax + edx], cl
movzx ebx, si
cmp ebx, dword [esp + 0x20]
jb 0x4eb2e9
xor ax, ax
mov al, cl
and ax, 0xf
mov word [esp + 0x12], ax
mov di, word [esp + 0x20]
xor cl, cl
dec di
mov esi, edx
cmp word [esp + 0x20], 0
je 0x4eb33c
mov al, byte [esi]
mov ebp, esi
inc esi
mov bl, cl
shl bl, 7
mov cl, al
shr al, 1
and cl, 1
or bl, al
mov byte [ebp], bl
mov bp, di
dec di
test bp, bp
jne 0x4eb31b
test cl, cl
je 0x4eb343
or byte [edx], 0x80
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x4eb308
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x4ef0b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x88
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov esi, dword [esp + 0x98]
push ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
jne 0x4ef0e0
mov dword [esp + 0x18], 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x24], eax
je 0x4ef1d2
mov eax, dword [esp + 0x10]
xor dword [esi], eax
mov ecx, dword [esp + 0x14]
xor dword [esi + 4], ecx
cmp dword [esp + 0x20], 0
jne 0x4ef1a2
cmp dword [esp + 0x1c], 2
push 0
jbe 0x4ef183
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.004ef280
add esp, 0xc
cmp dword [0x5ffed8], 0
jne 0x4ef26d
mov eax, dword [esp + 0x28]
lea ebx, [esp + 0x30]
mov edi, 0x19
mov dword [esp + 0x30], eax
mov eax, dword [ebx]
mov cl, 0x20
add eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [ebx + 4], eax
add ebx, 4
mov eax, dword [esp + 0x28]
mov edx, dword [ebx - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x34], eax
dec edi
jne 0x4ef154
jmp 0x4ef1b0
push 0
push esi
call fcn.004ef280
add esp, 0xc
cmp dword [0x5ffed8], 0
je 0x4ef1b0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
lea eax, [esp + 0x30]
push eax
push esi
call fcn.004ef5a0
add esp, 8
mov eax, dword [esi]
add esi, 8
mov dword [esp + 0x10], eax
inc dword [esp + 0x20]
mov ecx, dword [esi - 4]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
cmp eax, dword [esp + 0x24]
jb 0x4ef107
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x4ef1e8
mov cl, byte [esi + eax]
xor byte [esp + eax + 0x10], cl
inc eax
cmp eax, dword [esp + 0x18]
jb 0x4ef1da
cmp dword [esp + 0x1c], 2
jbe 0x4ef203
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.004ef5a0
add esp, 8
jmp 0x4ef228
cmp dword [esp + 0x1c], 1
jne 0x4ef217
mov eax, dword [esi]
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x10]
push 0
push 0
push eax
call fcn.004ef280
add esp, 0xc
cmp dword [esp + 0x1c], 1
jbe 0x4ef260
xor ecx, ecx
cmp dword [esp + 0x18], ecx
je 0x4ef247
mov dl, byte [esi + ecx - 8]
lea eax, [esi + ecx]
inc ecx
mov byte [eax], dl
cmp ecx, dword [esp + 0x18]
jb 0x4ef237
mov eax, dword [esp + 0x10]
mov dword [esi - 8], eax
mov ecx, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi - 4], ecx
pop esi
pop ebx
add esp, 0x88
ret
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
Function at 0x4ef5a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
push ebp
mov eax, dword [esi]
add esi, 8
mov ebp, 0xc
add dword [edx + 4], eax
mov ecx, dword [esi - 4]
add dword [edx], ecx
mov ebx, dword [edx]
mov edi, dword [edx + 4]
xor edi, ebx
mov cl, 0x20
shr ebx, 4
mov eax, edi
and bl, 0x1f
add esi, 8
sub cl, bl
shr eax, cl
mov cl, bl
shl edi, cl
or eax, edi
mov cl, 0x20
sub eax, dword [esi - 8]
mov dword [edx + 4], eax
mov edi, dword [edx]
xor edi, eax
shr eax, 7
mov ebx, edi
and al, 0x1f
sub cl, al
shr ebx, cl
mov cl, al
shl edi, cl
or ebx, edi
add ebx, dword [esi - 4]
dec ebp
mov dword [edx], ebx
jne 0x4ef5be
pop ebp
pop edi
pop esi
pop ebx
ret