joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498841
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp al, 0xa
ja 0x498df1
mov eax, dword [esp + 0x58]
xor ecx, ecx
mov edi, dword [esp + 0x10]
jl 0x498757
adc byte [ebx], ch
jl 0x49875b
cmp byte [ecx + 0x331c2444], cl
ror byte [ecx - 0x74ebdbb4], 0x4c
and al, 0x38
invalid
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], eax
cmp dl, 0x87
jne 0x49875d
cmp byte [ecx + 3], 0x91
je 0x498db5
cmp dl, 0x81
mov edx, dword [esp + 0x6c]
jae 0x498786
test edx, edx
jg 0x498db5
mov eax, dword [esp + 0x50]
test eax, eax
js 0x49877b
cmp eax, 1
jle 0x49878a
mov eax, 1
mov dword [esp + 0x50], eax
jmp 0x49878a
mov eax, dword [esp + 0x50]
test edx, edx
jne 0x49884a
push dword [esp + 0x58]
cmp eax, 1
mov eax, dword [esp + 0x14]
push esi
push dword [esp + 0x54]
mov byte [eax], dl
jg 0x4987fe
push 1
push ecx
call fcn.00496450
mov ebx, dword [esp + 0x4c]
push edi
push ebx
lea esi, [ebx + 1]
push esi
call fcn.004aba70
mov edx, dword [esp + 0x30]
add esp, 0x20
mov ecx, dword [esp + 0x50]
push 4
push ecx
call fcn.00496450
mov ebx, dword [esp + 0x4c]
push edi
push ebx
lea eax, [ebx + 4]
push eax
call fcn.004aba70
add byte [edx - 0x72c7dbbc], cl
dec ebx
add al, byte [ebx + 0x4302444]
sub al, 0x6e
mov byte [ebx], al
add esp, 0x20
mov byte [ebx + 1], 0x83
lea eax, [ecx + 2]
mov word [ecx], 0
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x38], eax
inc esp
and al, 0x38
dec ecx
jmp 0x4989d8
cmp edx, 1
jle 0x4989ce
mov ebx, dword [ebp + 0x34]
test ebx, ebx
je 0x4988cc
lea ecx, [edx - 1]
mov dword [esp + 0x90], ecx
fild dword [esp + 0x90]
imul ecx, dword [esp + 0xac]
fstp qword [esp + 0x90]
fld qword [esp + 0x90]
test byte [eax + edx*4], ah
add byte [eax], al
add bl, bl
test byte [esp + ebp*4], ah
add byte [eax], al
add ch, bl
pushfd
and al, 0x90
add byte [eax], al
add ah, bl
mov word [eax + edx*4], fs
add byte [eax], al
add ah, bl
sbb eax, 0x552270
and dl, byte [ebp]
fnstsw ax
test ah, 0x41
je fcn.0049af5f
mov eax, dword [esp + 0xa4]
mov edx, dword [ebx]
sub eax, edx
cmp eax, ecx
jl fcn.0049af5f
lea eax, [edx + ecx]
mov edx, dword [esp + 0x6c]
mov dword [ebx], eax
jmp 0x4989ca
cmp dword [esp + 0xc0], 0
je 0x4988ed
cmp dword [esp + 0x5c], 0
jge 0x4988ed
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x44]
and al, 0x44
mov dword [esp + 0x5c], eax
mov dword [esp + 0x48], 1
mov ebx, dword [esi + 0x20]
sub ebx, dword [esi + 0x10]
push edi
push ecx
push dword [esp + 0x18]
call fcn.004aba70
mov edx, dword [ebp + 0x30]
add esp, 0xc
mov esi, dword [esi + 0x10]
mov ecx, esi
sub ecx, ebx
add ecx, dword [esp + 0x1c]
mov eax, dword [edx + 0x3c]
mov edi, dword [edx + 0x20]
add eax, 0xffffff9c
add eax, ecx
cmp edi, eax
jbe 0x498959
push edx
call fcn.00493870
mov ecx, dword [ebp + 0x14]
add esp, 4
mov dword [ecx], eax
test eax, eax
invalid
invalid
Function at 0x498b6e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [ebp + 0x30]
mov ebx, dword [esi + 0x20]
sub ebx, dword [esi + 0x10]
mov byte [edx], cl
inc edx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x10], edx
test eax, eax
je 0x498ad1
lea ecx, [edx + 1]
mov byte [edx], 0x83
mov edx, dword [esp + 0x14]
mov eax, ecx
sub eax, edx
mov dword [esp + 0x14], ecx
neg edx
sbb edx, edx
shl byte [ebx], cl
ror byte [ebx + 0x15188c2], 1
sar eax, 8
lea edx, [ecx + 2]
mov byte [ecx], al
mov dword [esp + 0x10], edx
push edi
push dword [esp + 0x3c]
push edx
call fcn.004aba70
mov edx, dword [ebp + 0x30]
add esp, 0xc
mov esi, dword [esi + 0x10]
mov ecx, esi
sub ecx, ebx
add ecx, dword [esp + 0x1c]
mov eax, dword [edx + 0x3c]
mov edi, dword [edx + 0x20]
add eax, 0xffffff9c
add eax, ecx
cmp edi, eax
jbe 0x498b33
lea esp, [esp]
push edx
call fcn.00493870
mov ecx, dword [ebp + 0x14]
add esp, 4
mov dword [ecx], eax
test eax, eax
jne 0x4976cb
mov edx, dword [ebp + 0x30]
mov esi, dword [edx + 0x10]
mov ecx, esi
mov eax, dword [edx + 0x3c]
sub ecx, ebx
add ecx, dword [esp + 0x1c]
add eax, 0xffffff9c
mov edi, dword [edx + 0x20]
add eax, ecx
cmp edi, eax
ja 0x498b00
mov edx, dword [esp + 0x1c]
lea eax, [ebx + esi]
add edx, esi
cmp edx, eax
jae 0x498ba4
mov ebx, dword [esp + 0x48]
mov esi, ebx
neg esi
sbb esi, esi
and esi, 3
inc esi
neg ebx
sbb bl, bl
and bl, 3
inc bl
jmp 0x498b60
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
mov eax, dword [esp + 0x30]
and al, 0x30
add ecx, esi
add ecx, eax
sar ecx, 8
or byte [eax + 0x30c8d0f], cl
mov eax, dword [ebp + 0x30]
add cl, byte [edx + 1]
add edx, 2
mov eax, dword [eax + 0x20]
mov byte [eax + 1], cl
mov eax, dword [ebp + 0x30]
add dword [eax + 0x20], 2
mov edi, dword [eax + 0x20]
mov eax, dword [eax + 0x10]
add eax, dword [esp + 0x60]
cmp edx, eax
jb 0x498b60
mov ebx, dword [esp + 0x60]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x30]
and al, 0x30
add edx, edi
mov ecx, dword [esp + 0x18]
sub eax, 1
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x48], eax
jns 0x498a90
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
test esi, esi
Function at 0x498bae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [ebp + 0x30]
mov ebx, dword [esi + 0x20]
sub ebx, dword [esi + 0x10]
mov byte [edx], cl
inc edx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x10], edx
test eax, eax
je 0x498ad1
lea ecx, [edx + 1]
mov byte [edx], 0x83
mov edx, dword [esp + 0x14]
mov eax, ecx
sub eax, edx
mov dword [esp + 0x14], ecx
neg edx
sbb edx, edx
shl byte [ebx], cl
ror byte [ebx + 0x15188c2], 1
sar eax, 8
lea edx, [ecx + 2]
mov byte [ecx], al
mov dword [esp + 0x10], edx
push edi
push dword [esp + 0x3c]
push edx
call fcn.004aba70
mov edx, dword [ebp + 0x30]
add esp, 0xc
mov esi, dword [esi + 0x10]
mov ecx, esi
sub ecx, ebx
add ecx, dword [esp + 0x1c]
mov eax, dword [edx + 0x3c]
mov edi, dword [edx + 0x20]
add eax, 0xffffff9c
add eax, ecx
cmp edi, eax
jbe 0x498b33
lea esp, [esp]
push edx
call fcn.00493870
mov ecx, dword [ebp + 0x14]
add esp, 4
mov dword [ecx], eax
test eax, eax
jne 0x4976cb
mov edx, dword [ebp + 0x30]
mov esi, dword [edx + 0x10]
mov ecx, esi
mov eax, dword [edx + 0x3c]
sub ecx, ebx
add ecx, dword [esp + 0x1c]
add eax, 0xffffff9c
mov edi, dword [edx + 0x20]
add eax, ecx
cmp edi, eax
ja 0x498b00
mov edx, dword [esp + 0x1c]
lea eax, [ebx + esi]
add edx, esi
cmp edx, eax
jae 0x498ba4
mov ebx, dword [esp + 0x48]
mov esi, ebx
neg esi
sbb esi, esi
and esi, 3
inc esi
neg ebx
sbb bl, bl
and bl, 3
inc bl
jmp 0x498b60
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
mov eax, dword [esp + 0x30]
and al, 0x30
add ecx, esi
add ecx, eax
sar ecx, 8
or byte [eax + 0x30c8d0f], cl
mov eax, dword [ebp + 0x30]
add cl, byte [edx + 1]
add edx, 2
mov eax, dword [eax + 0x20]
mov byte [eax + 1], cl
mov eax, dword [ebp + 0x30]
add dword [eax + 0x20], 2
mov edi, dword [eax + 0x20]
mov eax, dword [eax + 0x10]
add eax, dword [esp + 0x60]
cmp edx, eax
jb 0x498b60
mov ebx, dword [esp + 0x60]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x30]
and al, 0x30
add edx, edi
mov ecx, dword [esp + 0x18]
sub eax, 1
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x48], eax
jns 0x498a90
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
test esi, esi
Function at 0x498f09
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov eax, dword [esp + 0x9c]
or dword [edi + 0x68], eax
inc ebx
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
invalid
inc esp
and al, 0x38
invalid
dec ecx
mov al, byte [ecx]
and al, 0xc0
cmp al, 0x80
jne 0x498f4c
mov al, byte [ecx - 1]
dec ecx
and al, 0xc0
cmp al, 0x80
je 0x498f12
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax - 1]
mov dword [esp + 0x1c], ecx
cmp dl, 0x1e
ja 0x498f76
cmp dword [esp + 0x6c], 1
jle 0x498f76
mov eax, dword [esi + 0x68]
or eax, dword [esp + 0xb4]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x5c], eax
mov esi, dword [esp + 0x10]
cmp dl, 0x10
je 0x498f96
cmp dl, 0xf
je 0x498f96
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
jmp 0x498fa6
movzx eax, byte [edi + 1]
mov dword [esp + 0x14], eax
movzx eax, byte [edi + 2]
mov dword [esp + 0x34], eax
cmp dword [esp + 0x50], 0
mov edx, esi
mov dword [esp + 0x10], edi
je 0x498db5
mov eax, dword [esp + 0x30]
add dword [esp + 0x18], eax
mov esi, dword [esp + 0x6c]
test esi, esi
jne 0x499056
mov eax, dword [eax]
add byte [eax], al
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x18]
cmp edx, 0xffffffff
jne 0x499028
add al, 0x21
mov byte [edi], al
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0x4c], 0
je 0x4991c1
test ecx, 0x10000000
je 0x4991c1
and ecx, 7
lea eax, [esp + 0x118]
push ecx
push eax
push edx
mov dword [esp + 0x28], ecx
call fcn.004aba70
mov ecx, dword [esp + 0x1c]
add esp, 0xc
add ecx, dword [esp + 0x1c]
jmp 0x4991c8
mov ebx, dword [esp + 0x14]
cmp edx, 1
jne 0x49903e
add al, 0x25
lea edx, [edi + 1]
mov byte [edi], al
mov dword [esp + 0x10], edx
jmp 0x498feb
add al, 0x27
mov byte [edi], al
mov eax, edx
mov byte [edi + 2], dl
lea edx, [edi + 3]
push edi
add eax, ecx
clc
or byte [eax + 0x54890147], cl
and al, 0x10
jmp 0x498feb
cmp esi, 1
jne 0x49909f
mov eax, dword [esp + 0x50]
cmp eax, 0xffffffff
jne 0x49906f
mov eax, dword [esp + 0x18]
add al, 0x23
jmp 0x498fde
mov dword [esp + 0x10], edx
invalid

Function at 0x499509
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ecx
add dword [esi - 0x18], edx
pop edi
and eax, 0x4c8b0001
and al, 0x3c

Function at 0x499865
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x499869
test ecx, ecx
jle 0x49a0da
or byte [eax], al
invalid
mov esi, dword [ebp + 0x30]
cmp ecx, dword [esi + 0x44]
jg 0x49a0da
mov edx, dword [esp + 0x10]
mov eax, ecx
shr eax, 8
mov byte [edx + 4], al
mov byte [edx + 5], cl
cmp ecx, dword [esi + 0x4c]
jle fcn.00499894
mov dword [esi + 0x4c], ecx
Function at 0x499905
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esp + 0xc]
mov edx, dword [esp + 0x70]
mov ecx, dword [eax + 0x30]
cmp esi, ecx
jge 0x4999ae
add byte [eax], al
mov eax, dword [esp + 0x70]
mov ebx, 1
movzx edx, byte [edx]
shl edx, 8
mov dword [esp + 0x9c], esi
pushfd
add byte [eax], al
add byte [esi + 0xf], al
mov dh, 0x40
add dword [ebx], ecx
ror byte [ebx - 0x6b76cfbb], 1
and al, 0x90
add byte [eax], al
add byte [ebx], bh
push eax
dec esp
cmp dword [esp + 0x48], 0
jne 0x49a0da
mov eax, dword [esp + 0x1c]
cmp byte [eax], 0x52
jne 0x499a22
xor ecx, ecx
cmp edi, 6
jne 0x49a0da
push edi

Function at 0x499a34
Capabilities:
Resolve function by parsing pe exports

Disassembly:
out 6, eax
add byte [ebx - 0x3f7af33c], al
invalid
or al, 0x85
invalid

Function at 0x49a380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, ebx
movzx ecx, byte [edx + 1]
inc esi
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
add edx, ecx
cmp byte [edx], 0x78
jne 0x49a382

Function at 0x49a522
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp cl, 0x7b
jne 0x49b1ee
aad 0xc
add byte [eax], al
mov dword [esp + 0xc], eax
mov ebx, eax
mov cl, byte [eax]
mov dword [esp + 0x30], 0
inc esp
and al, 0x30
add byte [eax], al
add byte [eax], al
cmp cl, 0x3c
jne 0x49a535
mov edx, 0x3e
jmp 0x49a544
xor edx, edx
mov eax, dword [ebp + 0x10]
mov dword [esi], 0x45

Function at 0x49c27a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xb8], eax
mov eax, edx
shr eax, 0xc
or al, 0x83
loopne 0x49c25c
mov dword [esp + 0xc4], eax
lea eax, [ebp + 0x100]
mov dword [esp + 0x94], eax
lea eax, [ebp + 0x340]
mov ebp, dword [esp + 0x264]
add al, byte [eax]
invalid
mov dword [esp + 0x98], eax
mov eax, ebp
and eax, 0x1800000
je 0x49c2fa
cmp eax, 0x800000
je 0x49c2ed
cmp eax, 0x1000000
jne 0x49c37a
mov dword [esp + 0xc0], 0
test ebp, 0x700000
je 0x49c2b3
mov ecx, ebp
and ecx, 0x700000
cmp ecx, 0x300000
add byte [edi], cl
invalid
movsd dword es:[edi], dword [esi]
add byte [eax], al
invalid
je 0x49c34d
test ecx, ecx
je 0x49c330
cmp ecx, 0x100000
je 0x49c313
cmp ecx, 0x200000
jne 0x49c37a
mov dword [esp + 0x70], 0
jmp 0x49c336
mov dword [esp + 0xc0], 1
jmp 0x49c2a9
test ecx, 0x1800000
je 0x49c29e
mov eax, ecx
shr eax, 0x17
call 0x22a4621
mov dword [esp + 0xc0], eax
jmp 0x49c2a9
xor ecx, ecx
mov eax, 0xd
mov dword [esp + 0x70], ecx
mov ecx, 1
mov dword [esp + 0x74], ecx
mov byte [esp + 0x8c], al
jmp fcn.0049c39a
xor ecx, ecx
mov dword [esp + 0x70], ecx
mov eax, 0xa
mov ecx, 1
mov dword [esp + 0x74], ecx
mov byte [esp + 0x8c], al
jmp fcn.0049c39a
mov ecx, 2
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], ecx
mov word [esp + 0x8c], 0xa0d
jmp fcn.0049c39a
cmp ecx, 0x400000
je 0x49c391
cmp ecx, 0x500000
je 0x49c38a
pop edi
pop esi
pop ebp
mov eax, 0xffffffe9
pop ebx
add esp, 0x23c
ret
mov ecx, 2
jmp 0x49c396
mov ecx, 1
mov dword [esp + 0x70], ecx
Function at 0x49c5f5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [esp + 0x4c], 0
mov edi, ebp
je 0x49c6c3
cmp dword [esp + 0x34], 0
mov edi, esi
je 0x49c63f
cmp esi, ebx
jae 0x49c6c3
mov eax, dword [esp + 0x70]
test eax, eax
je 0x49c5f0
cmp edi, ebx
jae 0x49c5e4
push dword [esp + 0x1c]
lea ecx, [esp + 0x78]
push ecx
push ebx
push eax
push edi
call fcn.00508290
mov ebx, dword [esp + 0xe4]
add esp, 0x14
test eax, eax
je 0x49c5e4
mov eax, 1
jmp 0x49c5e6
xor eax, eax
test eax, eax
jne 0x49c6bc
jmp 0x49c620
mov ecx, dword [esp + 0x74]
mov eax, ebx
ret
sub eax, ecx
cmp edi, eax
ja 0x49c620
mov al, byte [edi]
cmp al, byte [esp + 0x8c]
jne 0x49c620
cmp ecx, 1
je 0x49c6bc
mov al, byte [edi + 1]
cmp al, byte [esp + 0x8d]
je 0x49c6bc
inc edi
cmp edi, ebp
jae 0x49c632
mov al, byte [edi]
and al, 0xc0
cmp al, 0x80
jne 0x49c632
inc edi
cmp edi, ebp
jb 0x49c625
cmp edi, ebx
jb 0x49c5b2
jmp 0x49c6bc
cmp esi, ebx
jae 0x49c6c3
mov esi, dword [esp + 0x74]
mov ebp, dword [esp + 0x1c]
nop
mov eax, dword [esp + 0x70]
test eax, eax
je 0x49c68b
cmp edi, ebx
jae 0x49c683
push ebp
lea ecx, [esp + 0x78]
push ecx
push ebx
push eax
push edi
call fcn.00508290
mov ebx, dword [esp + 0xe4]
add esp, 0x14
mov esi, dword [esp + 0x74]
test eax, eax
je 0x49c683
mov eax, 1
jmp 0x49c685
xor eax, eax
test eax, eax
jne 0x49c6b4
jmp 0x49c6af
mov eax, ebx
sub eax, esi
cmp edi, eax
ja 0x49c6af
mov al, byte [edi]
cmp al, byte [esp + 0x8c]
jne 0x49c6af
invalid
cmp esi, 1
je 0x49c6b4
mov al, byte [edi + 1]
cmp al, byte [esp + 0x8d]
je 0x49c6b4
inc edi
cmp edi, ebx
jb 0x49c650
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x250]
mov eax, dword [edx + 8]
or eax, dword [esp + 0x264]
mov ebx, dword [esp + 0x18]
test eax, 0x4000000
jne 0x49c8b0
mov edx, dword [esp + 0x250]
mov dword [esp + 0x104], 0
jmp 0x49c590
Function at 0x49c84c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test ebx, ebx
je 0x49c722
cmp esi, edi
jae 0x49c8b0
mov cl, byte [esp + 0x12]
mov dl, byte [esp + 0x10]
cmp dword [esp + 0x40], 0
je 0x49c87b
mov eax, dword [esp + 0x260]
mov ecx, dword [esp + 0xcc]
add eax, ecx
cmp esi, eax
jbe 0x49c8b0
cmp esi, edi
jae 0x49c85b
cmp dword [esp + 0x34], 0
je 0x49c7e8
mov eax, dword [esp + 0x70]
test eax, eax
je 0x49c78f
cmp esi, ecx
mov edx, dword [esp + 0x74]
lea eax, [ecx + edx]
cmp esi, eax
jb 0x49c7c9
mov ecx, esi
sub ecx, edx
mov al, byte [ecx]
cmp al, byte [esp + 0x8c]
jne 0x49c7c2
cmp edx, 1
je 0x49c85b
mov al, byte [ecx + 1]
cmp al, byte [esp + 0x8d]
test byte [ecx*4 + 0xf000000], ah
invalid
cdq
add byte [eax], al
invalid
mov ecx, dword [esp + 0xcc]
inc esi
cmp esi, edi
jae 0x49c85b
add byte [eax], al
mov al, byte [esi]
and al, 0xc0
cmp al, 0x80
jne 0x49c758
inc esi
cmp esi, edi
div dword [edx - 0x11]
jmp 0x49c85b
mov ebp, dword [esp + 0x1c]
lea esp, [esp]
mov eax, dword [esp + 0x70]
test eax, eax
je 0x49c820
invalid
cmp esi, ecx
jbe 0x49c818
push ebp
lea edx, [esp + 0x78]
push edx
push ecx
push eax
push esi
call fcn.00508420
add esp, 0x14
test eax, eax
je 0x49c818
mov eax, 1
jmp fcn.0049c81a
xor eax, eax
mov edx, dword [esp + 0x74]
lea eax, [ecx + edx]
cmp esi, eax
jb 0x49c852
mov ecx, esi
sub ecx, edx
mov al, byte [ecx]
cmp al, byte [esp + 0x8c]
jne 0x49c84b
cmp edx, 1
je 0x49c857
mov al, byte [ecx + 1]
cmp al, byte [esp + 0x8d]
je 0x49c857
mov ecx, dword [esp + 0xcc]
inc esi
cmp esi, edi
jb 0x49c7f0
mov ebp, dword [esp + 0x14]
cmp byte [esi - 1], 0xd
jne 0x49c8b0
mov eax, dword [esp + 0x70]
cmp eax, 1
je 0x49c86f
cmp eax, 2
jne 0x49c8b0
inc ecx
cmp esi, edi
jae 0x49c8b0
cmp byte [esi], 0xa
jne 0x49c8b0
inc esi
jmp 0x49c8b0
mov ebx, dword [esp + 0x44]
test ebx, ebx
je 0x49c8ac
cmp esi, edi
jae 0x49c8ac
jmp 0x49c890
movzx edx, byte [esi]
mov eax, 1
mov ecx, edx
shr edx, 3
and ecx, 7
shl eax, cl
test byte [edx + ebx], al
jne 0x49c8ac
inc esi
cmp esi, edi
jb 0x49c890
mov ebx, dword [esp + 0x18]
Function at 0x49d213
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add byte [eax], al
add byte [ecx + 0xac9d], cl
add byte [ebx - 0x7afb82], cl
jne 0x49d21d
push 0x134
call dword [0xc5d940]
mov edi, eax
add esp, 4
add al, 0x85
dec dword [edi]
invalid
invalid
aad 0
invalid
mov dword [edi + 4], ebx
mov dword [esi + 4], edi
mov dword [esi + 0x130], 0x37

Function at 0x49d2ad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add dword [eax], eax
add bh, bh
adc eax, 0xc5d940
mov edx, eax
add esp, 4
test edx, edx
je 0x4aa7d3
mov dword [edx + 4], ebx
mov dword [esi + 4], edx
mov dword [esi + 0x130], 0x33
xor eax, dword [eax]
add byte [eax], al

Function at 0x49d4f2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esp
jmp 0x49dcf3
mov dword [esi + 0x5c], ebx
mov eax, dword [esi + 0xc]
sub eax, dword [ebp + 0x70]
mov dword [esi + 0x78], eax
mov eax, dword [ebp + 0x90]
mov dword [esi + 0xa0], eax
jmp 0x4a7ecb
cmp dword [esi + 0x9c], 0x88
jb 0x4a7ee1
mov dword [ebp + 0x98], 2
mov edx, dword [esi + 4]
test edx, edx
jne 0x4a7f0a
push 0x134
call dword [0xc5d940]
mov edx, eax
add esp, 4
test edx, edx
je 0x4aa7d3
mov dword [edx + 4], 0
mov dword [esi + 4], edx
mov dword [esi + 0x130], 0x30
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov ecx, dword [esi + 0xc]
jmp 0x4a7413

Function at 0x49d61d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc dword [ebx - 0x78f0ef08]
add dword fs:[eax], eax
invalid

Function at 0x49d6d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx edx, byte [eax + 1]
dec edi
movzx eax, byte [eax]
shl eax, 8
or edx, eax
mov eax, dword [ebp + 0xa4]
mov ecx, dword [eax + 4]
xor eax, eax
cmp edx, ecx
sete al
mov dword [esi + 0x58], eax
je 0x49d65e
mov eax, dword [ebp + 0x24]
add eax, ebx
mov ebx, eax
test edi, edi
jg 0x49d6b0
jmp 0x49d65e

Function at 0x49d7c6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc esi
or byte [ecx + 0x468b0841], cl
mov eax, dword [esi + 0xc]
jmp 0x4a72e0
mov eax, dword [esi + 0xc]
movzx ecx, byte [eax + 1]
movzx eax, byte [eax + 2]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x94], ecx
lea eax, [ecx + ecx]
mov dword [esi + 0x98], eax
mov eax, dword [ebp + 0x90]
Function at 0x49f1ab
Capabilities:
Encrypt data using rc4 prga

Disassembly:
or byte [ebx + 0x245489c2], cl
and byte [ebx - 0x7bf036], cl
add byte [eax], al
add byte [ecx - 0x7edfdbac], cl
cli
rol byte [eax], 0
add byte [edi], cl
sub bh, 0
add byte [eax], al
test dl, 0x20
jne 0x49f1b1
movzx eax, byte [edi]
and edx, 0x1f
and eax, 0x3f
shl edx, 6
or edx, eax
lea eax, [edi + 1]
add ecx, ebp
invalid
add byte [eax], al
invalid
test dl, 0x10
jne 0x49f1d8
movzx eax, byte [edi]
and edx, 0xf
and eax, 0x3f
shl edx, 6
or edx, eax
movzx eax, byte [edi + 1]
and eax, 0x3f
shl edx, 6
or edx, eax
lea eax, [edi + 2]
jmp 0x49f278
test dl, 8
jne 0x49f208
movzx eax, byte [edi]
and edx, 7
and eax, 0x3f
shl edx, 6
or edx, eax
movzx eax, byte [edi + 1]
and eax, 0x3f
loopne 0x49f231
shl edx, 6
or edx, eax
movzx eax, byte [edi + 2]
and eax, 0x3f
shl edx, 6
or edx, eax
lea eax, [edi + 3]
jmp 0x49f278
movzx ecx, byte [edi]
movzx eax, byte [edi + 1]
and ecx, 0x3f
and eax, 0x3f
test dl, 4
jne 0x49f244
and edx, 3
shl edx, 6
or edx, ecx
shl edx, 6
or edx, eax
movzx eax, byte [edi + 2]
and eax, 0x3f
shl edx, 6
or edx, eax
movzx eax, byte [edi + 3]
and eax, 0x3f
shl edx, 6
and edx, 1
shl edx, 6
or edx, ecx
shl edx, 6
or edx, eax
movzx eax, byte [edi + 2]
mov dh, 0x47
add al, byte [ebx - 0x1d3ec020]
push es
or edx, eax
movzx eax, byte [edi + 3]
and eax, 0x3f
shl edx, 6
or edx, eax
movzx eax, byte [edi + 4]
and eax, 0x3f
shl edx, 6
or edx, eax
lea eax, [edi + 5]

Function at 0x49f700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ror byte [ebp + 0x63eb0347], 1
test dl, 4
jne fcn.0049f735
and edx, 3
shl edx, 6
or edx, ecx
shl edx, 6
push es
or edx, eax
movzx eax, byte [edi + 2]
and eax, 0x3f
shl edx, 6
or edx, eax
movzx eax, byte [edi + 3]
and eax, 0x3f
shl edx, 6
or edx, eax
lea eax, [edi + 4]
jmp 0x49f769

Function at 0x4a0c1e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc eax
mov dword [esi + 0xc], eax
movzx ebx, byte [eax]
mov dword [esi + 0x80], ebx
cmp ebx, 0xc0
jb 0x4a0d4c
invalid
test bl, 0x20
jne 0x4a0c5f
mov eax, dword [esi + 0xc]
and ebx, 0x1f
shl ebx, 6
movzx eax, byte [eax + 1]
and eax, 0x3f
or eax, ebx
mov dword [esi + 0x80], eax
inc dword [esi + 0x88]
jmp 0x4a0d4c
test bl, 0x10
jne 0x4a0c94
mov eax, dword [esi + 0xc]
and ebx, 0xf
shl ebx, 6
movzx ecx, byte [eax + 1]
movzx eax, byte [eax + 2]
and ecx, 0x3f
or ecx, ebx
and eax, 0x3f
shl ecx, 6
or ecx, eax
mov dword [esi + 0x80], ecx
add dword [esi + 0x88], 2
jmp 0x4a0d4c
mov ecx, dword [esi + 0xc]
movzx edx, byte [ecx + 1]
movzx eax, byte [ecx + 2]
and edx, 0x3f
and eax, 0x3f
test bl, 8
jne 0x4a0cd5
and ebx, 7
test bl, 4
jne 0x4a0d0e
and ebx, 3
shl ebx, 6
or edx, ebx
shl edx, 6
or edx, eax
movzx eax, byte [ecx + 3]
shl edx, 6
and eax, 0x3f
or edx, eax
movzx eax, byte [ecx + 4]
shl edx, 6
and eax, 0x3f
or edx, eax
mov dword [esi + 0x80], edx
add dword [esi + 0x88], 4
and ebx, 1