joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d830
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [eax*4 + 0x5d08c8]
push ebx
push ebp
push esi
shl eax, 6
mov esi, ecx
xor ecx, ecx
add eax, 0x5d0848
push edi
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x3c]
lea edi, [esi + 0x50]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0x13
mov dword [esp + 0x24], eax
xor ebp, ebp
mov dword [esp + 0x18], ecx
jmp 0x46d874
mov edx, dword [esp + 0x20]
mov eax, dword [edx]
add eax, dword [esp + 0x1c]
add edx, 4
test ebp, ebp
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x24]
mov eax, dword [edx + eax*4]
mov dword [esp + 0x28], eax
mov ebx, ebp
jle 0x46d8e2
cdq
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edx
jmp 0x46d8a0
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
sub ecx, 4
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
cdq
push ecx
push edx
push eax
call fcn.004b3e20
mov cl, 0x20
call fcn.0051d0b0
mov edx, dword [esi]
lea eax, [edx + eax*2]
mov dword [edi], eax
sub ebx, 1
add edi, 4
add esi, 4
test ebx, ebx
jg 0x46d8a0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
sar eax, 0xc
mov dword [edi], eax
mov eax, esi
mov esi, edi
mov edx, dword [esi]
mov edi, eax
mov eax, edx
sar eax, 0x1f
xor eax, edx
test ebp, ebp
mov dword [esp + 0x14], esi
mov edx, ebp
jle 0x46d91a
mov ecx, dword [esi - 4]
sub esi, 4
mov ebx, ecx
sar ebx, 0x1f
xor ebx, ecx
sub edx, 1
or eax, ebx
test edx, edx
jg 0x46d900
mov ecx, dword [esp + 0x18]
sub edi, ecx
cmp eax, 0x40000000
jl 0x46d94c
sar eax, 1
test ebp, ebp
mov edx, ebp
jle 0x46d941
jmp 0x46d930
sar dword [esi], 1
sar dword [edi], 1
sub edx, 1
add esi, 4
add edi, 4
test edx, edx
jg 0x46d930
sar dword [esi], 1
sub dword [esp + 0x10], 1
sub esi, ecx
sub edi, ecx
add ebp, 1
add ecx, 4
cmp ebp, dword [esp + 0x38]
mov dword [esp + 0x18], ecx
jl 0x46d870
xor ebx, ebx
cmp eax, 0x7fff
jle 0x46d97c
lea esp, [esp]
sar eax, 1
add ebx, 1
cmp eax, 0x7fff
jg 0x46d970
test eax, eax
je 0x46d99c
cmp eax, 0x4000
jge 0x46d99c
jmp 0x46d990
add eax, eax
sub ebx, 1
cmp eax, 0x4000
jl 0x46d990
test ebx, ebx
mov edi, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
jl 0x46d9c9
test edx, edx
mov eax, edx
jle 0x46d9c9
mov ecx, 0x10
sub ecx, ebx
mov ebp, dword [esi]
shl ebp, cl
sub eax, 1
add edi, 4
add esi, 4
test eax, eax
mov dword [edi - 4], ebp
jg 0x46d9b5
mov eax, dword [esp + 0x10]
pop edi
sub eax, ebx
cmp eax, 0xf
pop esi
pop ebp
mov dword [esp + 4], eax
pop ebx
jle 0x46d9f8
test edx, edx
lea ecx, [eax - 0xf]
mov eax, dword [esp + 0x2c]
jle 0x46d9f3
sar dword [eax], cl
sub edx, 1
add eax, 4
test edx, edx
jg 0x46d9e7
mov eax, dword [esp]
sub eax, ecx
add esp, 0x24
ret
Function at 0x475480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [esp + 4]
mov al, byte [ecx]
sub esp, 0x38
test al, al
js 0x47549a
movsx ax, al
movzx ecx, ax
mov dword [esp + 0x3c], ecx
jmp 0x4754f0
mov dl, al
and dl, 0xe0
cmp dl, 0xe0
jne 0x4754d3
mov dl, byte [ecx + 1]
mov cl, byte [ecx + 2]
and dl, 0x3f
movsx ax, al
movsx dx, dl
shl ax, 6
and cl, 0x3f
or dx, ax
movsx ax, cl
shl dx, 6
or dx, ax
movzx ecx, dx
mov dword [esp + 0x3c], ecx
jmp 0x4754f0
and al, 0x3f
movsx dx, al
mov al, byte [ecx + 1]
and al, 0x3f
movsx cx, al
shl dx, 6
or dx, cx
movzx edx, dx
mov dword [esp + 0x3c], edx
mov ax, word [esp + 0x3c]
cmp ax, 0x80
jae 0x47550a
movzx eax, al
movsx ax, byte [eax + 0x58a680]
add esp, 0x38
ret
movzx ecx, ax
add ecx, 0xffffff40
cmp ecx, 0x3c
ja case.0x475523.208
movzx ecx, byte [ecx + 0x475718]
jmp dword [ecx*4 + 0x4756f4]
mov dword [esp + 0x3c], 0x41
mov ax, word [esp + 0x3c]
add esp, 0x38
ret
mov dword [esp + 0x3c], 0x5a
mov ax, word [esp + 0x3c]
add esp, 0x38
ret
mov dword [esp + 0x3c], 0x45
mov ax, word [esp + 0x3c]
add esp, 0x38
ret
mov dword [esp + 0x3c], 0x49
mov ax, word [esp + 0x3c]
add esp, 0x38
ret
mov dword [esp + 0x3c], 0x4f
mov ax, word [esp + 0x3c]
add esp, 0x38
ret
mov dword [esp + 0x3c], 0x55
mov ax, word [esp + 0x3c]
add esp, 0x38
ret
mov dword [esp + 0x3c], 0x4e
mov ax, word [esp + 0x3c]
add esp, 0x38
ret
mov dword [esp + 0x3c], 0x43
mov ax, word [esp + 0x3c]
add esp, 0x38
ret
mov ecx, 0x41
mov word [esp + 0x2a], cx
mov word [esp + 0x30], cx
mov ecx, 2
mov word [esp + 4], cx
mov word [esp + 0xa], cx
mov word [esp + 0x14], 0x3b1
mov word [esp + 0x16], 0x3c9
mov word [esp + 0x18], 0x391
mov word [esp + 0x1a], 0x430
mov word [esp + 0x1c], 0x42f
mov word [esp + 0x1e], 0x410
mov word [esp + 0x20], 0x30a1
mov word [esp + 0x22], 0x30f3
mov word [esp + 0x24], 0x3041
mov word [esp + 0x26], 0xff21
mov word [esp + 0x28], 0xff3a
mov word [esp + 0x2c], 0xff41
mov word [esp + 0x2e], 0xff5a
mov word [esp + 0x32], 0xff10
mov word [esp + 0x34], 0xff19
mov word [esp + 0x36], 0x30
mov word [esp], 0x304b
mov word [esp + 2], 0x3062
mov word [esp + 6], 0x3064
mov word [esp + 8], 0x3069
mov word [esp + 0xc], 0x306f
mov word [esp + 0xe], 0x307d
mov word [esp + 0x10], 3
xor ecx, ecx
lea edx, [esp + 0x16]
cmp word [edx - 2], ax
ja 0x475681
cmp ax, word [edx]
jbe 0x47568e
add ecx, 1
add edx, 6
cmp ecx, 6
jb 0x475676
jmp 0x4756a5
lea ecx, [ecx + ecx*2]
add ecx, ecx
mov dx, word [esp + ecx + 0x18]
sub dx, word [esp + ecx + 0x14]
add ax, dx
mov word [esp + 0x3c], ax
xor ecx, ecx
lea edx, [esp + 2]
jmp 0x4756b0
cmp word [edx - 2], ax
ja 0x4756c2
cmp ax, word [edx]
ja 0x4756c2
cmp word [edx + 2], 0
jne 0x4756d1
add ecx, 1
add edx, 6
cmp ecx, 3
jb 0x4756b0
add esp, 0x38
ret
lea ecx, [ecx + ecx*2]
add ecx, ecx
movzx edx, word [esp + ecx]
movzx ecx, word [esp + ecx + 4]
movzx eax, ax
sub eax, edx
cdq
idiv ecx
sub dword [esp + 0x3c], edx
mov ax, word [esp + 0x3c]
add esp, 0x38
ret
Function at 0x475e80
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
xor edi, edi
test eax, eax
mov esi, eax
jne 0x475e91
pop edi
pop esi
ret
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x475e94
sub eax, edx
lea ecx, [eax*4]
mov eax, 0xaaaaaaab
mul ecx
push ebx
mov ebx, edx
shr ebx, 1
push ebp
add ebx, 4
push ebx
call fcn.004772c0
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x475eca
pop ebp
pop ebx
pop edi
pop esi
ret
push ebx
push 0
push ebp
call fcn.004b3a80
add esp, 0xc
mov ecx, ebp
mov al, byte [esi]
test al, al
je 0x475f48
cmp edi, 3
ja case.default.0x475ee3
jmp dword [edi*4 + 0x475f70]
sar al, 2
and al, 0x3f
mov edi, 1
jmp 0x475f34
and al, 3
shl al, 4
add esi, 1
mov byte [ecx], al
mov dl, byte [esi]
sar dl, 4
and dl, 0xf
or byte [ecx], dl
mov edi, 2
jmp case.default.0x475ee3
and al, 0xf
add al, al
add al, al
mov byte [ecx], al
mov al, byte [esi + 1]
add esi, 1
sar al, 6
and al, 3
or byte [ecx], al
mov edi, 3
jmp case.default.0x475ee3
and al, 0x3f
xor edi, edi
add esi, 1
mov byte [ecx], al
movsx edx, byte [ecx]
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
add ecx, 1
test esi, esi
jne 0x475ed8
sub edi, 1
je 0x475f57
sub edi, 1
je 0x475f61
sub edi, 1
jne 0x475f5a
mov byte [ecx], 0x3d
mov eax, ebp
pop ebp
pop ebx
pop edi
pop esi
ret
mov eax, ebp
pop ebp
pop ebx
pop edi
mov byte [ecx], 0x3d
mov byte [ecx + 1], 0x3d
pop esi
ret

Function at 0x478bb0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x478bbe
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esi]
push eax
push ecx
push edx
call fcn.004b6972
mov ecx, eax
add esp, 0xc
test ecx, ecx
jle 0x478be0
cdq
add dword [esi + 0x10], eax
adc dword [esi + 0x14], edx
mov eax, ecx
pop esi
ret

Function at 0x47a190
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov dword [esp + 4], 0
call fcn.004883e0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.004b74ac
mov esi, eax
mov eax, dword [esp + 0x1c]
push eax
push esi
call fcn.00488400
add esp, 0x20
test eax, eax
je 0x47a1e0
push esi
call fcn.00479d30
add esp, 4
call fcn.004883f0
xor eax, eax
pop esi
pop ecx
ret
call fcn.004883f0
mov ecx, dword [esp + 0x14]
push ecx
push esi
call dword [0x58a1f4]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x48d330
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x24
mov eax, dword [0x5eef00]
xor eax, esp
mov dword [esp + 0x20], eax
xor eax, eax
cmp dword [0x5ee3f4], eax
push edi
mov edi, dword [esp + 0x34]
mov byte [esp + 4], 0x30
mov dword [esp + 5], eax
mov dword [esp + 9], eax
mov dword [esp + 0xd], eax
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov word [esp + 0x21], ax
mov byte [esp + 0x23], al
je 0x48d479
cmp dword [0x607988], eax
je 0x48d479
push esi
push eax
push 0x6e03e0
call fcn.00479fc0
lea eax, [esp + 0x10]
push 0x20
push eax
call fcn.0048da70
mov eax, dword [esp + 0x44]
add esp, 0x10
call fcn.0048cb80
mov esi, dword [esp + 0x30]
push eax
call fcn.0048cb10
push eax
lea ecx, [esp + 0x10]
push ecx
push str._s__s____s:
push pe_nt_image_headers32
push 0x607370
call fcn.004776e0
mov eax, 0x607370
add esp, 0x18
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x48d3e0
sub eax, edx
mov esi, eax
call fcn.004b3c49
add eax, 0x20
push eax
push esi
push 1
push 0x607370
call fcn.004b8899
mov eax, edi
add esp, 0x10
lea ecx, [eax + 1]
jmp 0x48d410
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x48d410
sub eax, ecx
mov esi, eax
call fcn.004b3c49
add eax, 0x20
push eax
push esi
push 1
push edi
call fcn.004b8899
call fcn.004b3c49
add eax, 0x20
push eax
push 0xd
call fcn.004b85fb
call fcn.004b3c49
add eax, 0x20
push eax
push 0xa
call fcn.004b85fb
call fcn.004b3c49
add eax, 0x20
push eax
call fcn.004b859f
add esp, 0x24
cmp dword [0x607988], 0
pop esi
je 0x48d479
push 0
push 0x6e03e0
call fcn.0047a000
add esp, 8
mov ecx, dword [esp + 0x24]
pop edi
xor ecx, esp
call fcn.004b2f95
add esp, 0x24
ret
Function at 0x4c99d0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
lea edi, [edx + 8]
mov dword [esp + 0x10], 4
mov esi, dword [edi - 8]
xor dword [eax], esi
movzx ebx, byte [eax + 3]
mov ebx, dword [edx + ebx*4 + 0x48]
movzx ebp, byte [eax + 2]
add ebx, dword [edx + ebp*4 + 0x448]
movzx ebp, byte [eax + 1]
xor ebx, dword [edx + ebp*4 + 0x848]
mov esi, dword [eax]
and esi, 0xff
add ebx, dword [edx + esi*4 + 0xc48]
add edi, 0x10
xor dword [ecx], ebx
mov esi, dword [ecx]
xor dword [eax], esi
mov esi, dword [eax]
xor dword [ecx], esi
mov esi, dword [ecx]
xor dword [eax], esi
mov ebx, dword [eax]
mov esi, dword [edi - 0x14]
xor esi, ebx
mov dword [eax], esi
movzx ebx, byte [eax + 3]
mov ebx, dword [edx + ebx*4 + 0x48]
movzx ebp, byte [eax + 2]
add ebx, dword [edx + ebp*4 + 0x448]
movzx ebp, byte [eax + 1]
xor ebx, dword [edx + ebp*4 + 0x848]
and esi, 0xff
add ebx, dword [edx + esi*4 + 0xc48]
xor dword [ecx], ebx
mov esi, dword [ecx]
xor dword [eax], esi
mov esi, dword [eax]
xor dword [ecx], esi
mov esi, dword [ecx]
xor dword [eax], esi
mov ebx, dword [eax]
mov esi, dword [edi - 0x10]
xor esi, ebx
mov dword [eax], esi
movzx ebx, byte [eax + 3]
mov ebx, dword [edx + ebx*4 + 0x48]
movzx ebp, byte [eax + 2]
add ebx, dword [edx + ebp*4 + 0x448]
movzx ebp, byte [eax + 1]
xor ebx, dword [edx + ebp*4 + 0x848]
and esi, 0xff
add ebx, dword [edx + esi*4 + 0xc48]
xor dword [ecx], ebx
mov esi, dword [ecx]
xor dword [eax], esi
mov esi, dword [eax]
xor dword [ecx], esi
mov esi, dword [ecx]
xor dword [eax], esi
mov ebx, dword [eax]
mov esi, dword [edi - 0xc]
xor esi, ebx
mov dword [eax], esi
movzx ebx, byte [eax + 3]
movzx ebp, byte [eax + 2]
mov ebx, dword [edx + ebx*4 + 0x48]
add ebx, dword [edx + ebp*4 + 0x448]
movzx ebp, byte [eax + 1]
xor ebx, dword [edx + ebp*4 + 0x848]
and esi, 0xff
add ebx, dword [edx + esi*4 + 0xc48]
xor dword [ecx], ebx
mov esi, dword [ecx]
xor dword [eax], esi
mov esi, dword [eax]
xor dword [ecx], esi
mov esi, dword [ecx]
xor dword [eax], esi
sub dword [esp + 0x10], 1
jne 0x4c99e0
mov esi, dword [edx + 0x40]
xor dword [eax], esi
mov edx, dword [edx + 0x44]
xor dword [ecx], edx
mov edx, dword [ecx]
xor dword [eax], edx
mov edx, dword [eax]
xor dword [ecx], edx
mov ecx, dword [ecx]
xor dword [eax], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4c9b10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [edx]
xor dword [eax], esi
mov esi, dword [eax]
xor dword [edx], esi
mov esi, dword [edx]
xor dword [eax], esi
mov esi, dword [ecx + 0x44]
xor dword [edx], esi
mov esi, dword [ecx + 0x40]
xor dword [eax], esi
push edi
mov esi, 0xf
mov edi, edi
movzx edi, byte [edx + 2]
mov edi, dword [ecx + edi*4 + 0x448]
movzx ebx, byte [edx + 3]
add edi, dword [ecx + ebx*4 + 0x48]
movzx ebx, byte [edx + 1]
xor edi, dword [ecx + ebx*4 + 0x848]
mov ebx, dword [edx]
and ebx, 0xff
add edi, dword [ecx + ebx*4 + 0xc48]
sub esi, 1
xor dword [eax], edi
mov edi, dword [ecx + esi*4 + 4]
xor dword [edx], edi
movzx edi, byte [eax + 2]
movzx ebx, byte [eax + 3]
mov edi, dword [ecx + edi*4 + 0x448]
add edi, dword [ecx + ebx*4 + 0x48]
movzx ebx, byte [eax + 1]
xor edi, dword [ecx + ebx*4 + 0x848]
mov ebx, dword [eax]
and ebx, 0xff
add edi, dword [ecx + ebx*4 + 0xc48]
sub esi, 1
xor dword [edx], edi
mov edi, dword [ecx + esi*4 + 4]
xor dword [eax], edi
test esi, esi
jg 0x4c9b30
pop edi
pop esi
pop ebx
ret

Function at 0x4c9bb0
Capabilities:
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x4c9ce6
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x4c9ce6
push esi
mov ecx, 0x597d98
xor eax, eax
sub ecx, ebp
push edi
mov edi, dword [esp + 0x20]
mov esi, ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0x12
jmp 0x4c9bf0
movzx ecx, byte [eax + ebx]
add eax, 1
cmp eax, edi
jne 0x4c9bfd
xor eax, eax
movzx edx, byte [eax + ebx]
shl ecx, 8
add eax, 1
or edx, ecx
cmp eax, edi
jne 0x4c9c0f
xor eax, eax
movzx ecx, byte [eax + ebx]
shl edx, 8
add eax, 1
or ecx, edx
cmp eax, edi
jne 0x4c9c21
xor eax, eax
movzx edx, byte [eax + ebx]
shl ecx, 8
add eax, 1
or edx, ecx
cmp eax, edi
jne 0x4c9c33
xor eax, eax
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + esi]
xor ecx, edx
mov dword [esi], ecx
add esi, 4
sub dword [esp + 0x18], 1
jne 0x4c9bf0
mov eax, 0x597de0
lea ecx, [ebp + 0x48]
mov esi, 4
mov edx, pe_nt_image_headers32
lea ebx, [ebx]
mov edi, dword [eax]
mov dword [ecx], edi
add eax, 4
add ecx, 4
sub edx, 1
jne 0x4c9c60
sub esi, 1
jne 0x4c9c55
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], esi
lea esp, [esp]
lea ecx, [esp + 0x10]
lea eax, [esp + 0x18]
mov edx, ebp
call fcn.004c99d0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov dword [ebp + esi*4], edx
mov dword [ebp + esi*4 + 4], eax
add esi, 2
cmp esi, 0x12
jb 0x4c9c80
lea esi, [ebp + 0x4c]
mov ebx, 4
nop
mov edi, 0x80
lea ecx, [esp + 0x10]
lea eax, [esp + 0x18]
mov edx, ebp
call fcn.004c99d0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esi - 4], ecx
mov dword [esi], edx
add esi, 8
sub edi, 1
jne 0x4c9cb5
sub ebx, 1
jne 0x4c9cb0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
Function at 0x4ca020
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x4cae00
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
ret

Function at 0x4caee0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x1c]
lea ecx, [eax*8]
add dword [esi], ecx
mov ebx, 0
push edi
adc dword [esi + 4], ebx
mov byte [eax + esi + 0x20], 0x80
mov edi, 1
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
cmp eax, 0x38
jbe 0x4caf3d
mov ecx, 0x40
cmp eax, ecx
jae 0x4caf2e
lea esp, [esp]
mov byte [eax + esi + 0x20], bl
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
cmp eax, ecx
jb 0x4caf20
lea edx, [esi + 0x20]
push esi
call fcn.004ca8d0
add esp, 4
mov dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0x38
jae 0x4caf53
mov edx, dword [esi + 0x1c]
mov byte [esi + edx + 0x20], bl
add dword [esi + 0x1c], edi
cmp dword [esi + 0x1c], 0x38
jb 0x4caf43
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x58], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x59], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x5a], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x5c], cl
movzx ecx, byte [esi]
mov byte [esi + 0x5d], dl
lea edx, [esi + 0x20]
push esi
mov byte [esi + 0x5e], al
mov byte [esi + 0x5f], cl
call fcn.004ca8d0
movzx edx, byte [esi + 0xb]
mov eax, dword [esp + 0x18]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
push 0x60
push ebx
push esi
mov byte [eax + 0x13], cl
call fcn.004b3a80
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x4cbb40
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xf0
mov eax, dword [0x5eef00]
xor eax, esp
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x104]
push ebx
mov ebx, dword [esp + 0xf8]
test ebx, ebx
push ebp
mov ebp, dword [esp + 0x100]
push esi
mov esi, dword [esp + 0x108]
push edi
mov dword [esp + 0x10], eax
jne 0x4cbb84
test ebp, ebp
ja 0x4cbce0
test esi, esi
mov edi, dword [esp + 0x110]
jne 0x4cbb97
test edi, edi
ja 0x4cbce0
test eax, eax
je 0x4cbce0
cmp dword [esp + 0x118], 0x10
jne 0x4cbce0
cmp edi, 0x40
jbe 0x4cbbf0
lea eax, [esp + 0x14]
push eax
call fcn.004ca020
push edi
lea ecx, [esp + 0x1c]
push esi
push ecx
call fcn.004ca720
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x90]
push eax
call fcn.004ca7f0
push 0x30
lea ecx, [esp + 0xa8]
push 0
push ecx
call fcn.004b3a80
add esp, 0x24
jmp 0x4cbc1e
push 0x40
lea edx, [esp + 0x80]
push 0
push edx
call fcn.004b3a80
add esp, 0xc
test esi, esi
je 0x4cbc1e
test edi, edi
jbe 0x4cbc1e
push edi
lea eax, [esp + 0x80]
push esi
push eax
call fcn.004b42c0
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x7c]
xor cl, 0x36
mov byte [esp + eax + 0xbc], cl
add eax, 1
cmp eax, 0x40
jb 0x4cbc20
lea edx, [esp + 0x14]
push edx
call fcn.004ca020
push 0x40
lea eax, [esp + 0xc4]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.004ca720
add esp, 0x10
test ebx, ebx
je 0x4cbc6e
test ebp, ebp
jbe 0x4cbc6e
push ebp
lea edx, [esp + 0x18]
push ebx
push edx
call fcn.004ca720
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x70]
push ecx
call fcn.004ca7f0
add esp, 8
xor eax, eax
mov dl, byte [esp + eax + 0x7c]
xor dl, 0x5c
mov byte [esp + eax + 0xbc], dl
add eax, 1
cmp eax, 0x40
jb 0x4cbc82
lea eax, [esp + 0x14]
push eax
call fcn.004ca020
push 0x40
lea ecx, [esp + 0xc4]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.004ca720
push 0x10
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.004ca720
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x30]
push edx
push eax
call fcn.004ca7f0
add esp, 0x24
xor eax, eax
jmp 0x4cbce3
or eax, 0xffffffff
mov ecx, dword [esp + 0xfc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b2f95
add esp, 0xf0
ret
Function at 0x4cbd00
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xfc
mov eax, dword [0x5eef00]
xor eax, esp
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x110]
push ebx
mov ebx, dword [esp + 0x104]
test ebx, ebx
push ebp
mov ebp, dword [esp + 0x10c]
push esi
mov esi, dword [esp + 0x114]
push edi
mov dword [esp + 0x10], eax
jne 0x4cbd44
test ebp, ebp
ja 0x4cbea6
test esi, esi
mov edi, dword [esp + 0x11c]
jne 0x4cbd57
test edi, edi
ja 0x4cbea6
test eax, eax
je 0x4cbea6
cmp dword [esp + 0x124], 0x14
jne 0x4cbea6
cmp edi, 0x40
jbe 0x4cbdb0
lea eax, [esp + 0x14]
push eax
call fcn.004cae00
push edi
lea ecx, [esp + 0x1c]
push esi
push ecx
call fcn.004cae40
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.004caee0
push 0x2c
lea ecx, [esp + 0xb8]
push 0
push ecx
call fcn.004b3a80
add esp, 0x24
jmp 0x4cbdde
push 0x40
lea edx, [esp + 0x8c]
push 0
push edx
call fcn.004b3a80
add esp, 0xc
test esi, esi
je 0x4cbdde
test edi, edi
jbe 0x4cbdde
push edi
lea eax, [esp + 0x8c]
push esi
push eax
call fcn.004b42c0
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x88]
xor cl, 0x36
mov byte [esp + eax + 0xc8], cl
add eax, 1
cmp eax, 0x40
jb 0x4cbde0
lea edx, [esp + 0x14]
push edx
call fcn.004cae00
push 0x40
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.004cae40
add esp, 0x10
test ebx, ebx
je 0x4cbe31
test ebp, ebp
jbe 0x4cbe31
push ebp
lea edx, [esp + 0x18]
push ebx
push edx
call fcn.004cae40
add esp, 0xc
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.004caee0
add esp, 8
xor eax, eax
mov dl, byte [esp + eax + 0x88]
xor dl, 0x5c
mov byte [esp + eax + 0xc8], dl
add eax, 1
cmp eax, 0x40
jb 0x4cbe45
lea eax, [esp + 0x14]
push eax
call fcn.004cae00
push 0x40
lea ecx, [esp + 0xd0]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.004cae40
push 0x14
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.004cae40
mov edx, dword [esp + 0x2c]
push edx
lea eax, [esp + 0x34]
push eax
call fcn.004caee0
add esp, 0x24
xor eax, eax
jmp 0x4cbea9
or eax, 0xffffffff
mov ecx, dword [esp + 0x108]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b2f95
add esp, 0xfc
ret