joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c638d
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp], ecx
push ebx
mov ebx, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x38]
test al, 7
je 0x4c63c0
push 0xffffffffffffffce
pop eax
jmp 0x4c648b
push ebp
push esi
test eax, eax
je 0x4c6487
push 8
pop esi
cmp edx, 1
jne 0x4c641d
mov ebp, edi
sub ebp, ecx
sub ebx, ecx
mov edx, esi
mov al, byte [ebx + ecx]
xor al, byte [ecx]
mov byte [ecx + ebp], al
inc ecx
sub edx, 1
jne 0x4c63da
mov ecx, dword [esp + 0x18]
mov edx, edi
push edi
call fcn.004c6131
pop ecx
test eax, eax
jne 0x4c6489
push esi
push edi
push dword [esp + 0x18]
call fcn.0051c650
mov ecx, dword [esp + 0x1c]
add esp, 0xc
add edi, esi
add ebx, esi
add ebp, esi
sub dword [esp + 0x34], esi
jne 0x4c63d8
jmp 0x4c6487
mov ebp, dword [esp + 0x34]
mov eax, ecx
sub eax, edi
sub edi, ebx
mov dword [esp + 0x14], eax
push esi
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.0051c650
mov ecx, dword [esp + 0x24]
lea eax, [edi + ebx]
push eax
mov edx, ebx
mov dword [esp + 0x2c], eax
call fcn.004c6131
add esp, 0x10
test eax, eax
jne 0x4c6489
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
mov al, byte [ecx + edx]
xor byte [edx], al
inc edx
sub esi, 1
jne 0x4c645d
push 8
pop esi
push esi
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x18]
call fcn.0051c650
sub dword [esp + 0x20], esi
add esp, 0xc
add ebx, esi
sub ebp, esi
jne 0x4c642b
xor eax, eax
pop esi
pop ebp
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x20
ret
Function at 0x4c6912
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp], ecx
push ebx
mov ebx, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x38]
test al, 7
je 0x4c6945
push 0xffffffffffffffce
pop eax
jmp 0x4c6a10
push ebp
push esi
test eax, eax
je 0x4c6a0c
push 8
pop esi
cmp edx, 1
jne 0x4c69a2
mov ebp, edi
sub ebp, ecx
sub ebx, ecx
mov edx, esi
mov al, byte [ebx + ecx]
xor al, byte [ecx]
mov byte [ecx + ebp], al
inc ecx
sub edx, 1
jne 0x4c695f
mov ecx, dword [esp + 0x18]
mov edx, edi
push edi
call fcn.004c649c
pop ecx
test eax, eax
jne 0x4c6a0e
push esi
push edi
push dword [esp + 0x18]
call fcn.0051c650
mov ecx, dword [esp + 0x1c]
add esp, 0xc
add edi, esi
add ebx, esi
add ebp, esi
sub dword [esp + 0x34], esi
jne 0x4c695d
jmp 0x4c6a0c
mov ebp, dword [esp + 0x34]
mov eax, ecx
sub eax, edi
sub edi, ebx
mov dword [esp + 0x14], eax
push esi
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.0051c650
mov ecx, dword [esp + 0x24]
lea eax, [edi + ebx]
push eax
mov edx, ebx
mov dword [esp + 0x2c], eax
call fcn.004c649c
add esp, 0x10
test eax, eax
jne 0x4c6a0e
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
mov al, byte [ecx + edx]
xor byte [edx], al
inc edx
sub esi, 1
jne 0x4c69e2
push 8
pop esi
push esi
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x18]
call fcn.0051c650
sub dword [esp + 0x20], esi
add esp, 0xc
add ebx, esi
sub ebp, esi
jne 0x4c69b0
xor eax, eax
pop esi
pop ebp
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x20
ret

Function at 0x4c7499
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
test ecx, ecx
je 0x4c7592
mov eax, dword [ecx]
test eax, eax
je 0x4c7592
mov eax, dword [eax + 4]
sub eax, 1
je 0x4c758a
sub eax, 1
je 0x4c7582
sub eax, 1
je 0x4c7536
sub eax, 1
je 0x4c74f4
sub eax, 1
je 0x4c74ef
sub eax, 1
je 0x4c74e5
sub eax, 1
jne 0x4c7592
mov ecx, dword [ecx + 4]
jmp fcn.004de4cb
xor edx, edx
mov ecx, dword [ecx + 4]
jmp fcn.004cd303
xor edx, edx
inc edx
jmp 0x4c74e7
mov eax, dword [ecx + 4]
xor ecx, ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
mov dword [eax + 0x68], ecx
jmp 0x4c757a
mov eax, dword [ecx + 4]
xor ecx, ecx
mov dword [eax + 8], 0xc1059ed8
mov dword [eax + 0xc], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0xf70e5939
mov dword [eax + 0x18], 0xffc00b31
mov dword [eax + 0x1c], 0x68581511
mov dword [eax + 0x20], 0x64f98fa7
mov dword [eax + 0x24], 0xbefa4fa4
mov dword [eax + 0x68], 1
mov dword [eax + 4], ecx
mov dword [eax], ecx
xor eax, eax
ret
mov ecx, dword [ecx + 4]
jmp fcn.004de4cb
mov ecx, dword [ecx + 4]
jmp fcn.004c4f3a
mov eax, 0xffffaf00
ret
Function at 0x4c7707
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x50
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
push edi
test esi, esi
je 0x4c7807
mov ecx, dword [esi]
test ecx, ecx
je 0x4c7807
cmp dword [esi + 8], 0
je 0x4c7807
movzx eax, byte [ecx + 9]
mov ebp, dword [esp + 0x64]
cmp ebp, eax
jbe 0x4c7786
mov ecx, esi
call fcn.004c7499
mov edi, eax
test edi, edi
jne 0x4c77f0
push ebp
mov edx, ebx
mov ecx, esi
call fcn.004c7598
mov edi, eax
pop ecx
test edi, edi
jne 0x4c77f0
lea edx, [esp + 0x18]
mov ecx, esi
call fcn.004c75ff
mov edi, eax
test edi, edi
jne 0x4c77f0
mov ecx, dword [esi]
lea ebx, [esp + 0x18]
movzx ebp, byte [ecx + 8]
movzx eax, byte [ecx + 9]
mov edx, dword [esi + 8]
push eax
push 0x36
push edx
mov dword [esp + 0x20], edx
lea edi, [eax + edx]
call fcn.0051c010
mov eax, dword [esi]
add esp, 0xc
movzx eax, byte [eax + 9]
push eax
push 0x5c
push edi
call fcn.0051c010
add esp, 0xc
test ebp, ebp
je 0x4c77ce
mov ecx, dword [esp + 0x14]
sub ecx, ebx
sub edi, ebx
mov al, byte [ebx]
xor byte [ecx + ebx], al
mov al, byte [ebx]
xor byte [ebx + edi], al
inc ebx
sub ebp, 1
jne 0x4c77be
mov ecx, esi
call fcn.004c7499
mov edi, eax
test edi, edi
jne 0x4c77f0
mov eax, dword [esi]
mov ecx, esi
mov edx, dword [esp + 0x14]
movzx eax, byte [eax + 9]
push eax
call fcn.004c7598
pop ecx
mov edi, eax
push 0x40
lea eax, [esp + 0x1c]
push 0
push eax
mov eax, dword [fcn.0051c010]
call eax
add esp, 0xc
mov eax, edi
jmp 0x4c780c
mov eax, 0xffffaf00
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x50
ret

Function at 0x4c7901
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov byte [ebp - 1], 0
push edi
mov edi, ecx
test esi, esi
je 0x4c7929
sub edi, edx
mov al, byte [edi + edx]
mov cl, byte [edx]
xor cl, al
or cl, byte [ebp - 1]
inc edx
mov byte [ebp - 1], cl
sub esi, 1
jne 0x4c7916
movzx eax, byte [ebp - 1]
pop edi
pop esi
leave
ret
Function at 0x4c7e85
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push esi
push edi
mov esi, edx
mov edi, ecx
mov edx, dword [edi + 4]
mov dword [esp + 0x10], edx
cmp edx, dword [esi + 4]
je 0x4c7ea2
push 0xfffffffffffffffc
pop eax
jmp 0x4c7f60
mov ecx, dword [edi]
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esi]
sar ebp, 1
sar ecx, 1
and ebp, 1
and ecx, 1
xor ebp, ecx
mov dword [esp + 0x20], ecx
mov eax, ebp
and eax, ecx
mov dword [esp + 0x14], eax
mov dword [ebx], eax
test edx, edx
je 0x4c7f5c
mov eax, dword [esi + 8]
dec edx
mov ebx, dword [edi + 8]
xor esi, esi
inc esi
sub esi, ecx
sub ebx, eax
lea edx, [eax + edx*4]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], ebx
mov ebx, dword [edx + ebx]
xor esi, esi
mov edi, dword [edx]
inc esi
mov ecx, dword [esp + 0x10]
xor edi, ebx
mov edx, edi
mov eax, edi
and eax, ebx
not edx
sub esi, ebp
mov ecx, dword [ecx]
sub ecx, ebx
and ecx, edx
or ecx, eax
mov eax, dword [esp + 0x10]
shr ecx, 0x1f
or ebp, ecx
and esi, ecx
and esi, dword [esp + 0x20]
sub ebx, dword [eax]
mov ecx, dword [esp + 0x18]
and ebx, edx
mov edx, eax
xor eax, eax
inc eax
sub eax, ebp
and eax, dword [esp + 0x1c]
and edi, dword [edx]
sub edx, 4
or ebx, edi
mov dword [esp + 0x10], edx
shr ebx, 0x1f
and eax, ebx
or ebp, ebx
mov ebx, dword [esp + 0x24]
or eax, esi
or eax, dword [esp + 0x14]
dec ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
test ecx, ecx
jne 0x4c7eeb
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
pop ebp
xor eax, eax
pop ebx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x4c7f66
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x1c]
xor eax, eax
push ebp
push esi
mov esi, edx
mov dword [esp + 0xc], eax
push edi
mov edi, ecx
mov dword [esp + 0x1c], esi
mov ch, al
lea eax, [esi - 0xb]
cmp ebx, eax
movzx ebp, byte [edi + 1]
cmova ebx, eax
movzx eax, byte [edi]
push 2
pop edx
xor ebp, edx
or ebp, eax
cmp esi, edx
jbe 0x4c7fc1
mov cl, byte [edi + edx]
neg cl
or cl, byte [edi + edx]
not cl
shr cl, 7
or ch, cl
mov al, ch
neg al
or al, ch
not al
movzx eax, al
shr eax, 7
add dword [esp + 0x10], eax
inc edx
cmp edx, esi
jb 0x4c7f9b
mov eax, dword [esp + 0x10]
movzx ecx, ch
add eax, 0xfffffff8
neg ecx
shr eax, 0x1f
shr ecx, 0x1f
dec ecx
and ecx, 1
or ecx, eax
or ebp, ecx
mov edx, ebp
mov dword [esp + 0x14], ebp
neg edx
mov ebp, esi
sub ebp, dword [esp + 0x10]
shr edx, 0x1f
sub ebp, 3
neg edx
mov ecx, edx
mov eax, edx
not ecx
and eax, ebx
and ebp, ecx
and edx, 0x4100
or ebp, eax
mov eax, ebx
sub eax, ebp
mov dword [esp + 0x18], ebp
shr eax, 0x1f
mov ebp, eax
or eax, dword [esp + 0x14]
neg ebp
neg eax
shr ebp, 0x1f
mov dword [esp + 0x10], ebp
neg dword [esp + 0x10]
and dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
and ecx, 0x4400
shr eax, 0x1f
or ecx, edx
neg eax
neg ecx
push 0xb
mov dword [esp + 0x14], ecx
pop ecx
cmp esi, ecx
jbe 0x4c804f
not al
and byte [edi + ecx], al
inc ecx
cmp ecx, esi
jb 0x4c8047
neg ebp
sub edi, ebx
add edi, dword [esp + 0x1c]
mov esi, ebp
not esi
and ebp, ebx
and esi, dword [esp + 0x18]
mov eax, ebx
or esi, ebp
mov edx, ebx
sub eax, esi
mov ecx, edi
push eax
call fcn.004c79f7
cmp dword [esp + 0x2c], 0
pop ecx
je 0x4c8087
push ebx
push edi
push dword [esp + 0x2c]
call fcn.0051c650
add esp, 0xc
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4cd303
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
sub esp, 0x34
push ebx
xor eax, eax
mov dword [esp + 0x30], edx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
push ebp
push esi
push edi
test edx, edx
jne 0x4cd38f
mov eax, 0x137e2179
mov dword [esp + 0x34], 0x9b05688c
mov esi, 0x5be0cd19
mov dword [esp + 0x2c], 0xade682d1
mov edi, 0xfb41bd6b
mov dword [esp + 0x30], 0x510e527f
mov ebx, 0x1f83d9ab
mov dword [esp + 0x28], 0xa54ff53a
mov ebp, 0x2b3e6c1f
mov dword [esp + 0x20], 0xfe94f82b
mov dword [esp + 0x24], 0x3c6ef372
mov edx, 0x5f1d36f1
mov dword [esp + 0x18], 0x84caa73b
mov dword [esp + 0x1c], 0xbb67ae85
mov dword [esp + 0x10], 0xf3bcc908
mov dword [esp + 0x14], 0x6a09e667
jmp 0x4cd3fd
mov eax, 0xbefa4fa4
mov dword [esp + 0x34], 0x8eb44a87
mov esi, 0x47b5481d
mov dword [esp + 0x2c], 0xffc00b31
mov edi, 0x64f98fa7
mov dword [esp + 0x30], 0x67332667
mov ebx, 0xdb0c2e0d
mov dword [esp + 0x28], 0x152fecd8
mov ebp, 0x68581511
mov dword [esp + 0x20], 0x3070dd17
mov edx, 0xf70e5939
mov dword [esp + 0x24], 0x9159015a
mov dword [esp + 0x18], 0x367cd507
mov dword [esp + 0x1c], 0x629a292a
mov dword [esp + 0x10], 0xc1059ed8
mov dword [esp + 0x14], 0xcbbb9d5d
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 0x18], eax
mov eax, dword [esp + 0x1c]
mov dword [ecx + 0x1c], eax
mov eax, dword [esp + 0x20]
mov dword [ecx + 0x20], eax
mov eax, dword [esp + 0x24]
mov dword [ecx + 0x24], eax
mov eax, dword [esp + 0x38]
mov dword [ecx + 0x28], edx
mov edx, dword [esp + 0x28]
mov dword [ecx + 0x2c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + 0x30], edx
mov edx, dword [esp + 0x30]
mov dword [ecx + 0x34], edx
mov edx, dword [esp + 0x3c]
mov dword [ecx + 0x38], ebp
mov ebp, dword [esp + 0x34]
mov dword [ecx + 0x3c], ebp
mov dword [ecx + 0x40], edi
mov dword [ecx + 0x44], ebx
mov dword [ecx + 0x48], eax
xor eax, eax
pop edi
mov dword [ecx + 0x4c], esi
pop esi
pop ebp
mov dword [ecx + 0xd0], edx
pop ebx
add esp, 0x34
ret
Function at 0x4d219f
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, edx
xor ebx, ebx
mov ebp, ecx
mov dword [esp + 0x1c], ebx
lea eax, [edi + 1]
push eax
push ebx
push ebp
call fcn.0051c010
add esp, 0xc
mov esi, ebx
test edi, edi
je 0x4d221a
movzx eax, byte [esp + 0x28]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], ebx
test eax, eax
je 0x4d2215
mov al, byte [esi + ebp]
mov byte [esp + 0x13], al
mov eax, esi
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x2c]
mov edx, eax
call fcn.004ce9b4
mov ecx, ebx
shl al, cl
mov cl, byte [esp + 0x13]
or cl, al
mov eax, dword [esp + 0x14]
inc ebx
mov byte [esp + 0x13], cl
add eax, edi
mov byte [esi + ebp], cl
mov dword [esp + 0x14], eax
cmp ebx, dword [esp + 0x18]
jb 0x4d21e2
mov eax, dword [esp + 0x18]
xor ebx, ebx
inc esi
cmp esi, edi
jb 0x4d21cd
xor esi, esi
inc esi
cmp edi, esi
jb 0x4d225c
xor eax, eax
mov bl, byte [esi + ebp]
mov bh, 1
movzx ecx, byte [esi + ebp - 1]
mov dh, bl
and bl, byte [esp + 0x1c]
xor dh, al
mov al, dh
and al, 1
sub bh, al
movzx eax, bh
imul ecx, eax
shl bh, 7
or byte [esi + ebp - 1], bh
mov al, cl
xor cl, dh
and al, dh
mov byte [esi + ebp], cl
or al, bl
inc esi
mov dword [esp + 0x1c], eax
cmp esi, edi
jbe 0x4d2223
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4d84f4
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, 0x56bf80
mov eax, esi
test edi, edi
je 0x4d8530
cmp dword [0x56bf80], 0
je 0x4d8530
mov ecx, dword [edi + 4]
cmp dword [eax + 4], ecx
jne 0x4d8526
push ecx
push dword [edi + 8]
push dword [eax]
call fcn.0051cbd0
add esp, 0xc
test eax, eax
je 0x4d8535
add esi, 0x18
mov eax, esi
cmp dword [esi], 0
jne 0x4d850c
xor eax, eax
pop edi
pop esi
ret
mov eax, esi
jmp 0x4d8532

Function at 0x4d8539
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x56c0f0
mov ebx, edx
mov eax, esi
test edi, edi
je 0x4d8578
cmp dword [0x56c0f0], 0
je 0x4d8578
mov ecx, dword [edi + 4]
cmp dword [eax + 4], ecx
jne 0x4d856e
push ecx
push dword [edi + 8]
push dword [eax]
call fcn.0051cbd0
add esp, 0xc
test eax, eax
je 0x4d857f
add esi, 0x14
mov eax, esi
cmp dword [esi], 0
jne 0x4d8554
push 0xffffffffffffffd2
pop eax
pop edi
pop esi
pop ebx
ret
test esi, esi
je 0x4d8578
mov eax, dword [esi + 0x10]
mov dword [ebx], eax
xor eax, eax
jmp 0x4d857b
Function at 0x4d87e0
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
sub esp, 0x80c
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
push ebp
xor ebx, ebx
mov ebp, 0x100
inc ebx
push esi
push edi
mov dword [esp + 0x10], ebx
mov edx, ebx
xor esi, esi
mov al, dl
mov dword [esp + esi*4 + 0x418], edx
add al, al
mov dword [esp + edx*4 + 0x18], esi
movzx ecx, al
movzx eax, dl
and dl, 0x80
xor ecx, eax
movzx eax, dl
neg eax
sbb eax, eax
and eax, 0x1b
xor ecx, eax
inc esi
mov edx, ecx
cmp esi, ebp
jl 0x4d8808
mov edx, ebx
mov esi, 0x894490
mov eax, edx
mov dword [esi], edx
and al, 0x80
movzx ecx, al
neg ecx
sbb ecx, ecx
add dl, dl
and ecx, 0x1b
movzx edx, dl
add esi, 4
xor edx, ecx
cmp esi, 0x8944b8
jl 0x4d883c
mov byte [0x893e90], 0x63
mov byte [0x8943f3], 0
mov ecx, dword [esp + ebx*4 + 0x18]
lea eax, [esp + 0x814]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx ecx, cl
xor ebx, ecx
mov al, cl
add al, al
shr ecx, 7
movzx edx, al
or edx, ecx
xor ebx, edx
mov al, dl
add al, al
mov dword [esp + 0x14], ebx
movzx ebx, al
shr edx, 7
or ebx, edx
mov al, bl
add al, al
movzx ecx, al
mov eax, ebx
shr eax, 7
or ecx, eax
mov eax, dword [esp + 0x14]
xor ecx, 0x63
xor ecx, ebx
mov ebx, dword [esp + 0x10]
xor eax, ecx
mov byte [ebx + 0x893e90], al
mov byte [eax + 0x894390], bl
inc ebx
mov dword [esp + 0x10], ebx
cmp ebx, ebp
jl 0x4d886c
xor edi, edi
mov ebx, 0xff
mov cl, byte [edi + 0x893e90]
movzx esi, cl
mov eax, esi
movzx ebp, byte [edi + 0x894390]
and al, 0x80
movzx edx, al
neg edx
sbb edx, edx
add cl, cl
movzx eax, cl
and edx, 0x1b
xor edx, eax
mov eax, edx
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, edx
mov ecx, eax
mov dword [edi*4 + 0x8958c0], eax
shl eax, 8
shr ecx, 0x18
or ecx, eax
mov eax, ecx
mov dword [edi*4 + 0x8954c0], ecx
shr eax, 0x18
shl ecx, 8
or eax, ecx
mov dword [edi*4 + 0x8948c0], eax
ror eax, 0x18
mov dword [edi*4 + 0x8944c0], eax
test ebp, ebp
je 0x4d89a2
mov eax, dword [esp + ebp*4 + 0x18]
add eax, dword [esp + 0x44]
cdq
idiv ebx
mov eax, dword [esp + ebp*4 + 0x18]
add eax, dword [esp + 0x4c]
mov esi, dword [esp + edx*4 + 0x418]
cdq
idiv ebx
mov eax, dword [esp + ebp*4 + 0x18]
add eax, dword [esp + 0x3c]
mov ecx, dword [esp + edx*4 + 0x418]
cdq
idiv ebx
mov eax, dword [esp + ebp*4 + 0x18]
mov ebp, 0xff
add eax, dword [esp + 0x50]
mov ebx, dword [esp + edx*4 + 0x418]
cdq
idiv ebp
mov eax, dword [esp + edx*4 + 0x418]
jmp 0x4d89aa
xor esi, esi
xor ecx, ecx
xor ebx, ebx
xor eax, eax
shl esi, 8
xor esi, ecx
shl esi, 8
xor esi, ebx
mov ebx, 0xff
shl esi, 8
xor esi, eax
mov ecx, esi
mov dword [edi*4 + 0x8950c0], esi
shr ecx, 0x18
shl esi, 8
or ecx, esi
mov eax, ecx
mov dword [edi*4 + 0x894cc0], ecx
shr eax, 0x18
shl ecx, 8
or eax, ecx
mov dword [edi*4 + 0x895cc0], eax
ror eax, 0x18
mov dword [edi*4 + 0x893f90], eax
inc edi
cmp edi, 0x100
jl 0x4d88e4
mov ecx, dword [esp + 0x818]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x80c
ret
Function at 0x4d8cb2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
mov ebx, ecx
mov esi, edx
push edi
lea ecx, [esp + 0x10]
call fcn.004d8a17
push dword [ebp + 8]
lea edi, [ebx + 8]
mov edx, esi
lea ecx, [esp + 0x14]
mov dword [ebx + 4], edi
call fcn.004d8a3f
mov dword [esp + 0x10], eax
pop ecx
test eax, eax
jne 0x4d8dac
mov edx, dword [esp + 0x10]
mov dword [ebx], edx
shl edx, 4
add edx, dword [esp + 0x14]
push 4
pop ecx
mov eax, dword [edx]
add edx, ecx
mov dword [edi], eax
add edi, ecx
mov eax, dword [edx]
add edx, ecx
mov dword [edi], eax
add edi, ecx
mov eax, dword [edx]
add edx, ecx
mov dword [edi], eax
add edi, ecx
mov eax, dword [edx]
sub edx, 0x1c
mov dword [edi], eax
add edi, ecx
mov esi, dword [ebx]
dec esi
jmp 0x4d8d8e
mov ebx, ecx
movzx eax, byte [edx + 3]
push 4
movzx ecx, byte [eax + 0x893e90]
movzx eax, byte [edx + 2]
mov ecx, dword [ecx*4 + 0x893f90]
movzx eax, byte [eax + 0x893e90]
xor ecx, dword [eax*4 + 0x895cc0]
movzx eax, byte [edx + 1]
movzx eax, byte [eax + 0x893e90]
xor ecx, dword [eax*4 + 0x894cc0]
movzx eax, byte [edx]
movzx eax, byte [eax + 0x893e90]
xor ecx, dword [eax*4 + 0x8950c0]
mov dword [edi], ecx
pop ecx
add edi, ecx
add edx, ecx
sub ebx, 1
jne 0x4d8d35
dec esi
sub edx, 0x20
test esi, esi
jg 0x4d8d33
mov eax, dword [edx]
mov dword [edi], eax
add edi, ecx
add edx, ecx
mov eax, dword [edx]
mov dword [edi], eax
mov eax, dword [edx + ecx]
mov dword [edi + ecx], eax
mov eax, dword [edx + ecx + 4]
mov dword [edi + ecx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004d8a28
mov ecx, dword [esp + 0x12c]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051b034
mov esp, ebp
pop ebp
ret
Function at 0x4d9b3c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], edx
mov dword [esp + 8], ecx
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0xc], ebp
push esi
mov esi, dword [esp + 0x48]
push edi
test al, 0xf
je 0x4d9b76
push 0xffffffffffffffde
pop eax
jmp 0x4d9c2c
test eax, eax
je 0x4d9c2a
push 0x10
pop edi
test edx, edx
jne 0x4d9bd6
sub ebp, esi
push edi
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.0051c650
mov ecx, dword [esp + 0x24]
xor edx, edx
push esi
push ebx
call fcn.004d9b1a
add esp, 0x14
test eax, eax
jne 0x4d9c2c
mov ecx, edi
mov al, byte [esi + ebp]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x4d9bad
push edi
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x1c]
call fcn.0051c650
add esp, 0xc
add ebx, edi
sub ebp, edi
sub dword [esp + 0x40], edi
jne 0x4d9b87
jmp 0x4d9c2a
mov ecx, esi
sub ecx, ebp
sub ebx, ebp
mov dword [esp + 0x1c], ecx
mov edx, ebp
mov ebp, edi
mov al, byte [edx + ebx]
xor al, byte [edx]
mov byte [ecx + edx], al
inc edx
sub ebp, 1
jne 0x4d9be4
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push esi
push esi
call fcn.004d9b1a
pop ecx
pop ecx
test eax, eax
jne 0x4d9c2c
push edi
push esi
push ebp
call fcn.0051c650
mov ecx, dword [esp + 0x28]
add esp, 0xc
add ecx, edi
add ebx, edi
add esi, edi
mov dword [esp + 0x1c], ecx
sub dword [esp + 0x40], edi
jne 0x4d9be0
xor eax, eax
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x2c
ret
Function at 0x4db353
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x58
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x5c]
push ebx
push ebp
mov ebp, dword [esp + 0x6c]
mov ebx, edx
push esi
push edi
push 0x40
mov dword [esp + 0x1c], eax
xor esi, esi
lea eax, [esp + 0x24]
mov dword [esp + 0x18], ecx
push esi
push eax
call fcn.0051c010
add esp, 0xc
lea eax, [esp + 0x10]
push 4
push esi
push eax
call fcn.0051c010
mov eax, dword [ebp]
add esp, 0xc
test eax, eax
jne 0x4db3a4
xor al, al
jmp 0x4db3a7
mov al, byte [eax + 8]
movzx eax, al
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x4db427
cmp ebx, eax
mov edi, ebx
mov ecx, ebp
cmovae edi, eax
call fcn.004c7499
mov esi, eax
test esi, esi
jne 0x4db427
push dword [esp + 0x70]
mov edx, dword [esp + 0x1c]
mov ecx, ebp
call fcn.004c7598
mov esi, eax
pop ecx
test esi, esi
jne 0x4db427
push 4
lea edx, [esp + 0x14]
mov ecx, ebp
call fcn.004c7598
mov esi, eax
pop ecx
test esi, esi
jne 0x4db427
lea edx, [esp + 0x20]
mov ecx, ebp
call fcn.004c75ff
mov esi, eax
test esi, esi
jne 0x4db427
xor ecx, ecx
test edi, edi
je 0x4db41b
mov edx, dword [esp + 0x14]
mov al, byte [esp + ecx + 0x20]
xor byte [edx], al
inc edx
inc ecx
cmp ecx, edi
jb 0x4db40b
mov dword [esp + 0x14], edx
inc byte [esp + 0x13]
mov eax, dword [esp + 0x1c]
sub ebx, edi
jne 0x4db3b2
push 0x40
lea eax, [esp + 0x24]
push 0
push eax
mov eax, dword [fcn.0051c010]
call eax
mov ecx, dword [esp + 0x70]
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x58
ret