joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cb8d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
test edi, edi
jne 0x4cb8f9
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x4cba45
mov eax, dword [ebx + 0x310]
mov edx, eax
add edx, edi
shr edx, 3
add edx, edx
add edx, edx
add edx, edx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 0xc]
jae 0x4cb928
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
jmp 0x4cba45
test eax, eax
jbe 0x4cb9ca
mov edx, 8
sub edx, eax
mov dword [ebp - 8], edx
cmp edi, dword [ebp - 8]
jae 0x4cb95a
lea edx, [ebx + eax + 0x308]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.004030c8
add dword [ebx + 0x310], edi
xor edi, edi
jmp 0x4cb9ca
lea edx, [ebx + eax + 0x308]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.004030c8
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
sub edi, dword [ebp - 8]
mov eax, dword [ebx + 0x308]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x30c]
mov dword [ebp - 0x10], eax
mov ecx, esi
mov edx, ebx
lea eax, [ebx + 0x308]
call fcn.004cb8a0
lea eax, [ebx + 0x300]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x304]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x300], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x304], eax
xor eax, eax
mov dword [ebx + 0x310], eax
cmp edi, 8
jb 0x4cba21
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004cb8a0
lea eax, [ebx + 0x300]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x304]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x300], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x304], eax
add dword [ebp - 4], 8
sub edi, 8
cmp edi, 8
jae 0x4cb9cf
test edi, edi
jbe 0x4cba3b
lea edx, [ebx + 0x308]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.004030c8
mov dword [ebx + 0x310], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4cbc40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test edi, edi
jne 0x4cbc61
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x4cbdaa
mov eax, dword [ebx + 0x1210]
mov edx, eax
add edx, edi
shr edx, 3
add edx, edx
add edx, edx
add edx, edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 8]
jae 0x4cbc90
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
xor eax, eax
jmp 0x4cbdaa
test eax, eax
jbe 0x4cbd31
mov edx, 8
sub edx, eax
mov dword [ebp - 4], edx
cmp edi, dword [ebp - 4]
jae 0x4cbcc1
lea edx, [ebx + eax + 0x1208]
mov eax, esi
mov ecx, edi
call fcn.004030c8
add dword [ebx + 0x1210], edi
xor edi, edi
jmp 0x4cbd31
lea edx, [ebx + eax + 0x1208]
mov eax, esi
mov ecx, dword [ebp - 4]
call fcn.004030c8
sub edi, dword [ebp - 4]
lea eax, [ebx + 0x1208]
mov eax, dword [eax]
lea edx, [ebx + 0x1200]
xor eax, dword [edx]
lea edx, [ebp - 0x10]
mov dword [edx], eax
lea eax, [ebx + 0x120c]
mov eax, dword [eax]
lea edx, [ebx + 0x1204]
xor eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.004cbb10
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebx + 0x1200], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x1204], edx
add dword [ebp + 0xc], 8
mov eax, dword [ebp - 4]
add esi, eax
xor eax, eax
mov dword [ebx + 0x1210], eax
cmp edi, 8
jb 0x4cbd87
mov eax, dword [esi]
lea edx, [ebx + 0x1200]
xor eax, dword [edx]
lea edx, [ebp - 0x10]
mov dword [edx], eax
add esi, 4
mov eax, dword [esi]
lea edx, [ebx + 0x1204]
xor eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [edx], eax
add esi, 4
mov ecx, dword [ebp + 0xc]
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.004cbb10
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebx + 0x1200], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x1204], edx
add dword [ebp + 0xc], 8
sub edi, 8
cmp edi, 8
jae 0x4cbd36
test edi, edi
jbe 0x4cbda0
lea edx, [ebx + 0x1208]
mov eax, esi
mov ecx, edi
call fcn.004030c8
mov dword [ebx + 0x1210], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4cbdb4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
test edi, edi
jne 0x4cbdd9
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x4cbf25
mov eax, dword [ebx + 0x1210]
mov edx, eax
add edx, edi
shr edx, 3
add edx, edx
add edx, edx
add edx, edx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 0xc]
jae 0x4cbe08
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
jmp 0x4cbf25
test eax, eax
jbe 0x4cbeaa
mov edx, 8
sub edx, eax
mov dword [ebp - 8], edx
cmp edi, dword [ebp - 8]
jae 0x4cbe3a
lea edx, [ebx + eax + 0x1208]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.004030c8
add dword [ebx + 0x1210], edi
xor edi, edi
jmp 0x4cbeaa
lea edx, [ebx + eax + 0x1208]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.004030c8
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
sub edi, dword [ebp - 8]
mov eax, dword [ebx + 0x1208]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x120c]
mov dword [ebp - 0x10], eax
mov ecx, esi
mov edx, ebx
lea eax, [ebx + 0x1208]
call fcn.004cbb7c
lea eax, [ebx + 0x1200]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x1204]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x1200], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x1204], eax
xor eax, eax
mov dword [ebx + 0x1210], eax
cmp edi, 8
jb 0x4cbf01
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004cbb7c
lea eax, [ebx + 0x1200]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x1204]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x1200], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x1204], eax
add dword [ebp - 4], 8
sub edi, 8
cmp edi, 8
jae 0x4cbeaf
test edi, edi
jbe 0x4cbf1b
lea edx, [ebx + 0x1208]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.004030c8
mov dword [ebx + 0x1210], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d1608
Capabilities:
Encrypt data using camellia

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov edi, ecx
mov esi, dword [eax]
xor esi, dword [edx]
mov eax, dword [eax + 4]
xor eax, dword [edx + 4]
mov edx, eax
shr edx, 0x18
movzx edx, dl
movzx edx, byte [edx + 0x5ac320]
mov byte [esp], dl
mov edx, eax
shr edx, 0x10
movzx edx, dl
movzx edx, byte [edx + 0x5ac420]
mov byte [esp + 1], dl
mov edx, eax
shr edx, 8
movzx edx, dl
movzx edx, byte [edx + 0x5ac520]
mov byte [esp + 2], dl
movzx eax, al
movzx eax, byte [eax + 0x5ac620]
mov byte [esp + 3], al
mov eax, esi
shr eax, 0x18
movzx eax, al
movzx eax, byte [eax + 0x5ac420]
mov edx, esi
shr edx, 0x10
movzx edx, dl
movzx edx, byte [edx + 0x5ac520]
mov ecx, esi
shr ecx, 8
movzx ecx, cl
movzx ecx, byte [ecx + 0x5ac620]
mov ebx, esi
movzx ebx, bl
movzx ebx, byte [ebx + 0x5ac320]
mov byte [esp + 4], bl
movzx ebx, byte [esp]
xor bl, byte [esp + 2]
xor bl, byte [esp + 3]
xor bl, dl
xor bl, cl
xor bl, byte [esp + 4]
mov byte [esp + 5], bl
movzx ebx, byte [esp]
xor bl, byte [esp + 1]
xor bl, byte [esp + 3]
xor bl, al
xor bl, cl
xor bl, byte [esp + 4]
mov byte [esp + 6], bl
movzx ebx, byte [esp]
xor bl, byte [esp + 1]
xor bl, byte [esp + 2]
xor bl, al
xor bl, dl
xor bl, byte [esp + 4]
mov byte [esp + 7], bl
movzx ebx, byte [esp + 1]
xor bl, byte [esp + 2]
xor bl, byte [esp + 3]
xor bl, al
xor bl, dl
xor bl, cl
mov byte [esp + 8], bl
movzx ebx, byte [esp]
xor bl, byte [esp + 1]
xor bl, dl
xor bl, cl
xor bl, byte [esp + 4]
mov byte [esp + 9], bl
movzx ebx, byte [esp + 1]
xor bl, byte [esp + 2]
xor bl, al
xor bl, cl
xor bl, byte [esp + 4]
mov byte [esp + 0xa], bl
movzx ebx, byte [esp + 2]
xor bl, byte [esp + 3]
xor bl, al
xor bl, dl
xor bl, byte [esp + 4]
mov byte [esp + 0xb], bl
movzx ebx, byte [esp]
xor bl, byte [esp + 3]
xor al, bl
xor dl, al
xor cl, dl
mov eax, ecx
movzx eax, al
movzx edx, byte [esp + 0xb]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0xa]
shl edx, 0x10
or eax, edx
movzx edx, byte [esp + 9]
shl edx, 0x18
or eax, edx
mov dword [edi], eax
movzx eax, byte [esp + 8]
movzx edx, byte [esp + 7]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 6]
shl edx, 0x10
or eax, edx
movzx edx, byte [esp + 5]
shl edx, 0x18
or eax, edx
mov dword [edi + 4], eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4d283c
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov esi, edx
mov ebp, eax
mov edi, 0x5ac750
mov ecx, ebp
and cl, 0xff
mov eax, ebp
shr eax, 8
and al, 0xff
mov edx, ebp
shr edx, 0x10
and dl, 0xff
mov ebx, ebp
shr ebx, 0x18
mov byte [esp + 4], bl
cmp dword [esp], 0xc0
jbe 0x4d28bc
movzx ecx, cl
movzx ecx, byte [edi + ecx + 0x100]
mov ebx, esi
add ebx, 0xc
xor cl, byte [ebx]
movzx eax, al
movzx eax, byte [edi + eax]
mov ebx, esi
add ebx, 0xd
xor al, byte [ebx]
movzx edx, dl
movzx edx, byte [edi + edx]
mov ebx, esi
add ebx, 0xe
xor dl, byte [ebx]
movzx ebx, byte [esp + 4]
movzx ebx, byte [edi + ebx + 0x100]
mov ebp, esi
add ebp, 0xf
xor bl, byte [ebp]
mov byte [esp + 4], bl
cmp dword [esp], 0x80
jbe 0x4d290c
movzx ecx, cl
movzx ecx, byte [edi + ecx + 0x100]
mov ebx, esi
add ebx, 8
xor cl, byte [ebx]
movzx eax, al
movzx eax, byte [edi + eax + 0x100]
mov ebx, esi
add ebx, 9
xor al, byte [ebx]
movzx edx, dl
movzx edx, byte [edi + edx]
mov ebx, esi
add ebx, 0xa
xor dl, byte [ebx]
movzx ebx, byte [esp + 4]
movzx ebx, byte [edi + ebx]
mov ebp, esi
add ebp, 0xb
xor bl, byte [ebp]
mov byte [esp + 4], bl
movzx ecx, cl
movzx ecx, byte [edi + ecx]
mov ebx, esi
add ebx, 4
xor cl, byte [ebx]
movzx eax, al
movzx eax, byte [edi + eax + 0x100]
mov ebx, esi
add ebx, 5
xor al, byte [ebx]
movzx edx, dl
movzx edx, byte [edi + edx]
mov ebx, esi
add ebx, 6
xor dl, byte [ebx]
movzx ebx, byte [esp + 4]
movzx ebx, byte [edi + ebx + 0x100]
mov ebp, esi
add ebp, 7
xor bl, byte [ebp]
mov byte [esp + 4], bl
movzx ecx, cl
movzx ecx, byte [edi + ecx]
xor cl, byte [esi]
movzx ecx, cl
movzx ecx, byte [edi + ecx + 0x100]
movzx eax, al
movzx eax, byte [edi + eax]
mov ebx, esi
inc ebx
xor al, byte [ebx]
movzx eax, al
movzx eax, byte [edi + eax]
movzx edx, dl
movzx edx, byte [edi + edx + 0x100]
mov ebx, esi
add ebx, 2
xor dl, byte [ebx]
movzx edx, dl
movzx edx, byte [edi + edx + 0x100]
movzx ebx, byte [esp + 4]
movzx ebx, byte [edi + ebx + 0x100]
add esi, 3
xor bl, byte [esi]
movzx ebx, bl
movzx ebx, byte [edi + ebx]
mov byte [esp + 4], bl
movzx ebx, al
movzx ebx, byte [ebx + 0x5aca70]
xor bl, cl
movzx esi, dl
xor bl, byte [esi + 0x5ac970]
movzx esi, byte [esp + 4]
xor bl, byte [esi + 0x5ac970]
mov byte [esp + 5], bl
movzx ebx, cl
movzx ebx, byte [ebx + 0x5ac970]
movzx esi, al
xor bl, byte [esi + 0x5aca70]
movzx esi, dl
xor bl, byte [esi + 0x5aca70]
xor bl, byte [esp + 4]
mov byte [esp + 6], bl
movzx ebx, cl
movzx ebx, byte [ebx + 0x5aca70]
movzx esi, al
xor bl, byte [esi + 0x5ac970]
xor bl, dl
movzx esi, byte [esp + 4]
xor bl, byte [esi + 0x5aca70]
mov byte [esp + 7], bl
movzx ecx, cl
xor al, byte [ecx + 0x5aca70]
movzx edx, dl
xor al, byte [edx + 0x5aca70]
movzx edx, byte [esp + 4]
xor al, byte [edx + 0x5ac970]
movzx edx, byte [esp + 5]
movzx ecx, byte [esp + 6]
shl ecx, 8
or edx, ecx
movzx ecx, byte [esp + 7]
shl ecx, 0x10
or edx, ecx
movzx eax, al
shl eax, 0x18
or edx, eax
mov eax, edx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d2a68
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov esi, edx
mov ebp, eax
mov edi, 0x5ac750
mov ecx, ebp
and cl, 0xff
mov eax, ebp
shr eax, 8
and al, 0xff
mov edx, ebp
shr edx, 0x10
and dl, 0xff
mov ebx, ebp
shr ebx, 0x18
mov byte [esp + 4], bl
cmp dword [esp], 0xc0
jbe 0x4d2ae8
movzx ecx, cl
movzx ecx, byte [edi + ecx + 0x100]
mov ebx, esi
add ebx, 0xc
xor cl, byte [ebx]
movzx eax, al
movzx eax, byte [edi + eax]
mov ebx, esi
add ebx, 0xd
xor al, byte [ebx]
movzx edx, dl
movzx edx, byte [edi + edx]
mov ebx, esi
add ebx, 0xe
xor dl, byte [ebx]
movzx ebx, byte [esp + 4]
movzx ebx, byte [edi + ebx + 0x100]
mov ebp, esi
add ebp, 0xf
xor bl, byte [ebp]
mov byte [esp + 4], bl
cmp dword [esp], 0x80
jbe 0x4d2b38
movzx ecx, cl
movzx ecx, byte [edi + ecx + 0x100]
mov ebx, esi
add ebx, 8
xor cl, byte [ebx]
movzx eax, al
movzx eax, byte [edi + eax + 0x100]
mov ebx, esi
add ebx, 9
xor al, byte [ebx]
movzx edx, dl
movzx edx, byte [edi + edx]
mov ebx, esi
add ebx, 0xa
xor dl, byte [ebx]
movzx ebx, byte [esp + 4]
movzx ebx, byte [edi + ebx]
mov ebp, esi
add ebp, 0xb
xor bl, byte [ebp]
mov byte [esp + 4], bl
movzx ecx, cl
movzx ecx, byte [edi + ecx]
mov ebx, esi
add ebx, 4
xor cl, byte [ebx]
movzx eax, al
movzx eax, byte [edi + eax + 0x100]
mov ebx, esi
add ebx, 5
xor al, byte [ebx]
movzx edx, dl
movzx edx, byte [edi + edx]
mov ebx, esi
add ebx, 6
xor dl, byte [ebx]
movzx ebx, byte [esp + 4]
movzx ebx, byte [edi + ebx + 0x100]
mov ebp, esi
add ebp, 7
xor bl, byte [ebp]
mov byte [esp + 4], bl
movzx ecx, cl
movzx ecx, byte [edi + ecx]
xor cl, byte [esi]
movzx ecx, cl
movzx ecx, byte [edi + ecx + 0x100]
movzx eax, al
movzx eax, byte [edi + eax]
mov ebx, esi
inc ebx
xor al, byte [ebx]
movzx eax, al
movzx eax, byte [edi + eax]
movzx edx, dl
movzx edx, byte [edi + edx + 0x100]
mov ebx, esi
add ebx, 2
xor dl, byte [ebx]
movzx edx, dl
movzx edx, byte [edi + edx + 0x100]
movzx ebx, byte [esp + 4]
movzx ebx, byte [edi + ebx + 0x100]
add esi, 3
xor bl, byte [esi]
movzx ebx, bl
movzx ebx, byte [edi + ebx]
mov byte [esp + 4], bl
movzx ecx, cl
movzx eax, al
shl eax, 8
or ecx, eax
movzx eax, dl
shl eax, 0x10
or ecx, eax
movzx eax, byte [esp + 4]
shl eax, 0x18
or ecx, eax
mov eax, ecx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d3d70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
mov bp, 0x10
mov esi, dword [esp]
mov eax, dword [esi]
xor dword [ebx], eax
mov edx, dword [ebx]
mov eax, dword [esp]
call fcn.004d3d1c
xor dword [edi], eax
mov eax, dword [ebx]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], eax
add esi, 4
dec bp
jne 0x4d3d83
mov eax, dword [ebx]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x40]
xor dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x44]
xor dword [ebx], eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d3e18
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp + 4], edx
mov dword [esp], eax
mov edi, 4
mov ecx, 0x5acbb8
mov eax, dword [esp]
add eax, 0x48
mov dword [esp + 0x10], eax
mov ebx, pe_nt_image_headers32
mov eax, ecx
mov edx, dword [esp + 0x10]
mov esi, dword [eax]
mov dword [edx], esi
add edx, 4
add eax, 4
dec ebx
jne 0x4d3e45
add dword [esp + 0x10], 0x400
add ecx, 0x400
dec edi
jne 0x4d3e3a
xor ebx, ebx
mov edi, 0x12
mov dword [esp + 0x14], 0x5acb70
mov eax, dword [esp]
mov dword [esp + 0x18], eax
xor ebp, ebp
mov esi, 4
shl ebp, 8
mov eax, dword [esp + 4]
movzx eax, byte [eax + ebx]
or ebp, eax
inc ebx
mov eax, dword [esp + 4]
call fcn.00405f30
cmp ebx, eax
jl 0x4d3e9d
xor ebx, ebx
dec esi
jne 0x4d3e80
mov eax, dword [esp + 0x14]
xor ebp, dword [eax]
mov eax, dword [esp + 0x18]
mov dword [eax], ebp
add dword [esp + 0x18], 4
add dword [esp + 0x14], 4
dec edi
jne 0x4d3e79
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0xc], eax
xor edi, edi
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
mov eax, dword [esp]
call fcn.004d3d70
mov eax, dword [esp]
mov edx, dword [esp + 8]
mov dword [eax + edi*4], edx
mov eax, dword [esp]
mov edx, dword [esp + 0xc]
mov dword [eax + edi*4 + 4], edx
add edi, 2
cmp edi, 0x12
jl 0x4d3ec7
mov edi, 4
mov esi, dword [esp]
xor ebx, ebx
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
mov eax, dword [esp]
call fcn.004d3d70
mov eax, dword [esp + 8]
mov dword [esi + ebx*4 + 0x48], eax
mov eax, dword [esp + 0xc]
mov dword [esi + ebx*4 + 0x4c], eax
add ebx, 2
cmp ebx, 0x100
jl 0x4d3efe
add esi, 0x400
dec edi
jne 0x4d3efc
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d424c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
movzx edx, byte [eax + 1]
movzx ecx, byte [eax]
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x4d42c0
inc ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0
inc edx
movzx esi, dl
movzx ecx, byte [eax + esi + 2]
add byte [ebp - 0xd], cl
movzx ebx, byte [ebp - 0xd]
movzx ebx, byte [eax + ebx + 2]
push ebx
pop ebx
mov byte [eax + esi + 2], bl
movzx ebx, byte [ebp - 0xd]
mov byte [eax + ebx + 2], cl
add cl, byte [eax + esi + 2]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
movzx ebx, byte [ebx + esi]
movzx ecx, cl
xor bl, byte [eax + ecx + 2]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov byte [ecx + esi], bl
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x4d4277
movzx ecx, byte [ebp - 0xd]
mov byte [eax], cl
mov byte [eax + 1], dl
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4d42d4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
movzx edx, byte [eax + 1]
movzx ecx, byte [eax]
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x4d4348
inc ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0
inc edx
movzx esi, dl
movzx ecx, byte [eax + esi + 2]
add byte [ebp - 0xd], cl
movzx ebx, byte [ebp - 0xd]
movzx ebx, byte [eax + ebx + 2]
push ebx
pop ebx
mov byte [eax + esi + 2], bl
movzx ebx, byte [ebp - 0xd]
mov byte [eax + ebx + 2], cl
add cl, byte [eax + esi + 2]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
movzx ebx, byte [ebx + esi]
movzx ecx, cl
xor bl, byte [eax + ecx + 2]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov byte [ecx + esi], bl
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x4d42ff
movzx ecx, byte [ebp - 0xd]
mov byte [eax], cl
mov byte [eax + 1], dl
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4d488c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test edi, edi
jne 0x4d48ad
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x4d49f6
mov eax, dword [ebx + 0x90]
mov edx, eax
add edx, edi
shr edx, 3
add edx, edx
add edx, edx
add edx, edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 8]
jae 0x4d48dc
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
xor eax, eax
jmp 0x4d49f6
test eax, eax
jbe 0x4d497d
mov edx, 8
sub edx, eax
mov dword [ebp - 4], edx
cmp edi, dword [ebp - 4]
jae 0x4d490d
lea edx, [ebx + eax + 0x88]
mov eax, esi
mov ecx, edi
call fcn.004030c8
add dword [ebx + 0x90], edi
xor edi, edi
jmp 0x4d497d
lea edx, [ebx + eax + 0x88]
mov eax, esi
mov ecx, dword [ebp - 4]
call fcn.004030c8
sub edi, dword [ebp - 4]
lea eax, [ebx + 0x88]
mov eax, dword [eax]
lea edx, [ebx + 0x80]
xor eax, dword [edx]
lea edx, [ebp - 0x10]
mov dword [edx], eax
lea eax, [ebx + 0x8c]
mov eax, dword [eax]
lea edx, [ebx + 0x84]
xor eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.004d4518
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebx + 0x80], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x84], edx
add dword [ebp + 0xc], 8
mov eax, dword [ebp - 4]
add esi, eax
xor eax, eax
mov dword [ebx + 0x90], eax
cmp edi, 8
jb 0x4d49d3
mov eax, dword [esi]
lea edx, [ebx + 0x80]
xor eax, dword [edx]
lea edx, [ebp - 0x10]
mov dword [edx], eax
add esi, 4
mov eax, dword [esi]
lea edx, [ebx + 0x84]
xor eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [edx], eax
add esi, 4
mov ecx, dword [ebp + 0xc]
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.004d4518
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebx + 0x80], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x84], edx
add dword [ebp + 0xc], 8
sub edi, 8
cmp edi, 8
jae 0x4d4982
test edi, edi
jbe 0x4d49ec
lea edx, [ebx + 0x88]
mov eax, esi
mov ecx, edi
call fcn.004030c8
mov dword [ebx + 0x90], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d4a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
test edi, edi
jne 0x4d4a25
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x4d4b71
mov eax, dword [ebx + 0x90]
mov edx, eax
add edx, edi
shr edx, 3
add edx, edx
add edx, edx
add edx, edx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 0xc]
jae 0x4d4a54
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
jmp 0x4d4b71
test eax, eax
jbe 0x4d4af6
mov edx, 8
sub edx, eax
mov dword [ebp - 8], edx
cmp edi, dword [ebp - 8]
jae 0x4d4a86
lea edx, [ebx + eax + 0x88]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.004030c8
add dword [ebx + 0x90], edi
xor edi, edi
jmp 0x4d4af6
lea edx, [ebx + eax + 0x88]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.004030c8
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
sub edi, dword [ebp - 8]
mov eax, dword [ebx + 0x88]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x8c]
mov dword [ebp - 0x10], eax
mov ecx, esi
mov edx, ebx
lea eax, [ebx + 0x88]
call fcn.004d46a4
lea eax, [ebx + 0x80]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x84]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x80], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x84], eax
xor eax, eax
mov dword [ebx + 0x90], eax
cmp edi, 8
jb 0x4d4b4d
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004d46a4
lea eax, [ebx + 0x80]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x84]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x80], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x84], eax
add dword [ebp - 4], 8
sub edi, 8
cmp edi, 8
jae 0x4d4afb
test edi, edi
jbe 0x4d4b67
lea edx, [ebx + 0x88]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.004030c8
mov dword [ebx + 0x90], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8