joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a44fa
Capabilities:
Inspect section memory permissions

Disassembly:
pop dword [esp - 4]
push 0x51f26b
test dh, 0xa2
xor esi, esi
jb 0x4b0028
call int.004b2484
add esp, 4
test eax, eax
jb 0x4b0030
jle 0x4b3d5a
jg 0x4a452d
wait
invalid
mov bl, byte [ebp + 8]

Function at 0x4a87f5
Capabilities:
Inspect section memory permissions

Disassembly:
lea esp, [esp + 4]
push eax
mov ebx, ebx
push ebp
pop ebp
mov byte [esi + 0xba], cl
mov dl, dl
mov byte [esi + 0xbb], 0
ja 0x4ab233
shl ax, 0x20
jbe 0x4a881e
cpuid
nop
ret
jbe 0x4ab233
fcomp dword [0x1d4430]
call 0x49c7f3
fidiv dword [ebp - 1]
invalid

Function at 0x4a930d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp dword [esi]
sbb al, 7
mov eax, dword [esi + 4]
ja 0x495f8e
shl ah, 0x20
jbe 0x48d645
hlt
jbe 0x495f8e
invalid
mov eax, dword [ebp + eax]
mov ebx, dword [esi + 8]
mov eax, dword [eax]
mov di, di
lea esi, [esi + 0xc]
add dword [ebp + ebx], eax
jno 0x48d0b6
jo 0x495fad
cpuid
push cs
ret
jo 0x48d0b6
lea esp, [esp + 4]
je 0x4b1b21
jne 0x4a931b
or dword [edi - 7], edx
stc
cmp al, 0x45
jne 0x4a9339
je 0x4a9328
xor eax, 0x3e80aa
cmp byte [esi], 0
lea ebp, [ebp]
je 0x4b1b72
jne 0x4a9339
arpl word [ebp + 0xf433c1e], sp
cmp dword [ecx - 0x77ffff91], 0xe90470ff
mov ebp, 0x800f73e6
stosd dword es:[edi], eax
outsd dx, dword [esi]
add byte [eax], al
cmp al, 0x43
jno 0x4b02fa
mov bh, bh
jo 0x4a9349
jmp 0xfbe7a07
jo 0x4b02fa
add eax, 0xe8f0ff83
and al, byte es:[ecx]
add byte [ecx + 0x10c4], al
add byte [esi - 0x7b], ah
ror byte [edi], 0x82
inc ebx
sar dh, cl
dec dword [edi]
test byte [eax], cl
invalid
cmp edx, 0xa
jae 0x4b1bbf
jb 0x4ae39e
sub al, 0x3e
cmp dword [esi + 4], 0
mov eax, dword [esi]
mov dx, dx
mov dword [ebp - 0x10], eax
ja 0x4b1ba1
jbe 0x4ae3b8
in eax, 0x78
cmc
jb 0x4ae3d7
jae 0x4ae3c4
nop
cpuid
ret 0x7d81
cmp dword [ebp - 0x10], 0xffff
ja 0x4b1ba1
jbe 0x4ae3d7
fnstcw word [edx + 0x458b8343]
invalid
mov eax, dword [ebp - 0x10]
mov ebx, dword [ecx]
jmp 0x4b650f
test bp, 0xe486
cmp byte [esi], 0
je 0x4b1b43
jne 0x4b1b34
jno 0x4b1b95
adc eax, 0x820fc031
idiv byte [edx + 0x5e5ffffd]
xor eax, eax
jb 0x48d632
pop edi
pop esi
pop ebx
pop ebp
ret
test di, di
jb 0x48d642
jne 0x4b1b67
je 0x4b1b56
sub al, 0xd6
xor eax, eax
jb 0x48d64b
pop edi
pop esi
pop ebx
pop ebp
ret
mov bx, 2
jmp 0x49f8d4
test di, di
jb 0x495fb3
jne 0x48f6b4
je 0x4b1b85
invalid
cmp dx, dx
xor eax, eax
jb 0x48d0b8
pop edi
jmp 0x49c320
push dword [eax + ebp*4]
mov ebx, dword [ecx]
mov word [edi + ebx*4 + 2], ax
inc dword [ecx]
mov cx, cx
inc edx
mov bx, bx
mov eax, dword [ebp - 4]
stc
test dx, 0x63ca
cmp dword [eax], edx
ja 0x4ae38d
jbe 0x4b1bbf
or bh, bh
test al, dh
shl cx, 0x20
mov eax, dword [ebp - 4]
jmp loc.004bc0b8
mov edi, dword [ebp + 0xc]
add esi, 0x10
mov word [edi + ebx*4], ax
mov eax, dword [esi - 8]
shr eax, 0x10
jno 0x4b1b98
jo 0x4b652c
in eax, 0xfe
jo 0x4b1b98
adc byte [esi - 0x7f], 0xc6
add al, 0
add byte [eax], al
popfd
shl dx, 0x20
jmp dword [esi - 4]
Function at 0x4a9bb9
Capabilities:
Inspect section memory permissions

Disassembly:
add esi, 8
add ebx, eax
jno 0x494230
jo 0x48ccf4
nop
cpuid
ret 0x800f
jo 0x494230
in al, dx
xor al, 0x88
in eax, dx
jne 0x495122
mov di, di
je 0x48ed7e
ficom dword [edi + 0xf]
test byte [esi - 0x27ffff9d], bl
jo 0x48edf1
je 0x495122
add cl, 0
test ecx, 0x80000000
jb 0x48ed6d
jne 0x4a0c76
je 0x49424a
mov si, si
mov ecx, dword [esi]
cmc
add esi, 4
test bx, 0xb696
test ecx, 0x1000
jb 0x48ed7c
je fcn.004997c6
jne 0x494271
mov ecx, dword [esi]
add esi, 8
test ecx, 0x1000
jb 0x496c47
lea ebp, [ebp]
jne 0x4b1e52
je 0x495143
popfd
jmp dword [esi - 4]
xor eax, 0x24448f96
cld
mov cl, cl
mov ebx, dword [ebp + ebx]
lea esi, [esi + 0xc]
jno 0x4a53bd
jo 0x496c60
fisubr dword [esi]
jo 0x4a53bd
and eax, 0x14c481ef
add byte [eax], al
add byte [ebp - 0x143fbb], cl
invalid
in eax, 0xa0
sub eax, 0x75c1880f
add dword [eax], eax
jns 0x4a5ac1
mov bl, 0x40
and dh, cl
jns 0x4bd07c
xor eax, 0x24448f4a
cld
pop dword [esp - 4]
test bl, bl
jb 0x4bd4e7
je 0x491efd
jne 0x4a9bd1
mov bh, 0x9e
adc ebp, dword [esi - 1]
shr ebp, 0x40
push ebx
shr ebp, 0x40
xchg esi, edi
xchg edi, esi
call fcn.004af839
add esp, 4
test eax, eax
jb 0x4bd4ef
jne 0x491f0b
je 0x4a9bf9
nop
cpuid
ret 0x810f
jno 0x49226f
jo 0x4a9c03
pop eax
adc ecx, dword [edi]
and byte [esi - 0x7a], 0xfe
inc dword [0x2ea8025]
jo 0x49226f
add eax, 0x2ea8025
xor cl, dl
jb 0x4b3f6b
inc eax
add ebx, 0
sub ch, 0
cmp eax, 8
mov byte [ebp + eax - 0xfd], cl
xchg bh, ch
xchg ch, bh
jl 0x494a3d
jge 0x4a9c3c
mov bh, 0x4a
adc ah, byte [edi]
jmp fcn.004b3336
lea esi, [esi + 0xc]
and word [ebx], ax
jb 0x4a5ab2
jmp dword [esi]
push edi
pushal
shl di, 0x20
push 0x499eed
ret
mov eax, dword [esi + 4]
jno 0x48cce0
jo 0x4bd08b
insb byte es:[edi], dx
xchg ecx, eax
jge 0x4bd09b
jo 0x48cce0
or byte [edi - 4], 0xfc
inc edi
lodsb al, byte [esi]
js 0x4b481f
invalid
xchg dx, bp
xchg bp, dx
jns 0x4bd0a3
ljmp 0x8902:0x79d58766
mov dword [ebx + 0x7776890f], eax
invalid
jns 0x4b481f
xor al, 0x85
mov ecx, dword [eax]
push ecx
call fcn.004b6571
mov esp, ebp
pop ebp
ret
sahf
push ecx
jbe 0x4affec
invalid
Function at 0x4aa21e
Capabilities:
Contain obfuscated stackstrings
Packed with generic packer

Disassembly:
mov esi, dword [ebp + 8]
xor edi, edi
jb 0x4aff84
xchg ebx, eax
xchg ebx, eax
mov al, byte [esi]
push eax
push edx
pop edx
push ebp
mov bp, bp
mov ebp, esp
lea ebx, [ebx]
push ebx
xor bx, bx
jb 0x4aff6c
jmp 0x4aa234
push esi
jmp 0x4aa237
push edi
ja 0x4a3913
jbe 0x4aa243
pop ds
xchg ebx, eax
jbe 0x4a3913
fnstenv [edi + ecx - 0x1a5907f]
push dword [eax + 4]
or eax, 0xf20b43a
and byte [ebx + 0x5a], 0xfe
inc dword [edx - 0x643ca25d]
adc dl, byte [ebp - 0x77]
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 0xefc16626
inc eax
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [ebp + eax]
jne 0x4b7080
je 0x4aff87
test byte [ebp - 0x69], dh
je 0x4b7080
lea esi, [esi + 0xc]
add dword [ebx], eax
cmp cl, bl
ja 0x4a290f
jbe 0x4b7096
sal byte [edx], 1
aad 0xf
xchg byte [ebx - 0x48], dh
invalid
jbe 0x4a290f
xor al, 0x67
add eax, 0
cmp al, 0x49
jne 0x49466a
je 0x4bac8d
mov ebx, 0xc03113c2
xor eax, eax
jb 0x4b7089
call fcn.00494658
and byte [esi], 0xc1
call 0xc4b12e3
js 0x4a119e
jns 0x4bacae
dec esi
xor al, 0x66
jns 0x4a119e
or byte [0x8b0f098d], 0x26
mov edx, 0x8966fffe
ror byte [ebp - 0x77f0f78a], 0x23
or eax, 0x368dffff
jns 0x4bacd0
lcall 0xff0d, 0x17890f3b
push dword [esi + ebp*4]
jns 0x4ab9ed
xor al, 0xae
cmp cx, cx
cmp dl, 9
jbe 0x4a23f5
ja 0x4bace9
ja 0x4bad45
and ch, byte [eax - 0x18]
and ecx, dword [edx]
push 0x4a23e8
ret
les ecx, [eax]
add byte [eax], al
add byte [eax - 0x7af0a025], cl
push edi
and ch, bh
jmp dword [esi - 0x77]
Function at 0x4adb98
Capabilities:
Inspect section memory permissions

Disassembly:
pop dword [esp - 4]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
pop eax
lea ebx, [ebx]
mov word [ecx + eax*4], 0x378
shl bp, 0x20
mov eax, dword [edx]
mov word [ecx + eax*4 + 2], 1
mov eax, dword [edx]
inc eax
mov dword [edx], eax
mov word [ecx + eax*4], 0x278
js 0x4bc44e
jns 0x4adbd2
nop
cpuid
ret
jns 0x4bc44e
and eax, 0x85e8b60
lea esi, [esi + 0xc]
test word [ebx], ax
jb 0x497b93
jmp dword [esi]
mov eax, dword [edx]
mov word [ecx + eax*4 + 2], 1
call fcn.004ab1cc
fldenv [ecx]

Function at 0x4aee7b
Capabilities:
Authenticate hmac

Disassembly:
pop dword [esp - 4]
ja 0x49f701
jbe 0x4aee8a
adc al, 0xb2
stc
jbe 0x49f701
xor eax, 0x4c4816b
add byte [eax], al
add byte [esi - 0x3f], ah
out dx, eax
inc eax

Function at 0x4b709e
Capabilities:
Inspect section memory permissions
Packed with generic packer

Disassembly:
xor cl, 0x83
mov byte [eax], 0x71
add al, 0xaa
add byte [ecx + 4], dh
stosb byte es:[edi], al
sahf
pop es
cmpsd dword [esi], dword es:[edi]
jno 0x4933fe
fidiv dword [ebp - 0x3dbbb71]
mov ecx, ecx
jmp 0x48fbc9
push eax
shl eax, 0x20
call dword [0x51f0f5]
test eax, eax
jb 0x4b54b4
shr di, 0x40
jne 0x4b9bf1
xchg di, ax
xchg di, ax
je 0x48fbee
loope 0x48fbb3
xor eax, eax
jb 0x4960eb
shr bh, 0x40
mov esp, ebp
js 0x4b9bed
jns 0x48fc05
sbb bh, byte [esi]
jns 0x4b9bed
fmul st(1)
add esp, 4
test ebx, ebx
jb 0x48fbaf
jne 0x4b4386
je 0x4b70b8
movsb byte es:[edi], byte [esi]
and eax, 0xdb88c776
mov bl, bl
mov ecx, dword [ebp - 4]
push ecx
xchg al, ah
xchg ah, al
call fcn.0048e6f0
cmp ebx, ebx
add esp, 4
jmp fcn.004b3035

Function at 0x4b9657
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings

Disassembly:
pop eax
and eax, 0x4468b0c
movzx eax, word [ebp + eax]
add esi, 8
shl eax, cl
add ebx, eax
stc
test ecx, 0x80000000
jb 0x4b704e
jne 0x4a0c76
je 0x4b062a
and dword [ebx], ebp
mov ecx, dword [esi]
jne 0x4a0220
je 0x4b0636
je 0x4a0220
xor dword es:[ebx], eax
pop ds
clc
popfd
push 0x4b9d5b
ret
or al, 0xf6
aad 0x66
xchg ecx, eax
xchg cx, ax
mov ecx, dword [esi]
add esi, 8
test ecx, 0x1000
jb 0x4b5531
jne 0x4b1e52
je 0x4b7073
pop esi
pop ebx
pop ebp
ret
lea edi, [eax*8 - 0xe]
shr di, 0x40
mov ebx, 0xde
pop dword [esp - 4]
lea ecx, [eax*8]
cmp ecx, 0xe
jae 0x4b79e8
jb 0x4b9674
cpuid
nop
ret
push 0xa
mov eax, dword [esi]
push eax
call fcn.004b6571
add esp, 8
pop edi
jno 0x4b79e2
jo 0x4b968f
dec eax
out dx, eax
jo 0x4b79e2
fcom dword [eax]
Function at 0x4be250
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
cmp dword [esp + 0x10c], 0
push ebx
push esi
push edi
push ebp
jne 0x4be274
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
cmp dword [esp + 0x124], 0
jne 0x4be28e
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor eax, eax
mov edx, dword [esp + 0x11c]
mov ax, word [edx]
add eax, 7
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x11c]
sar eax, 3
mov si, ax
lea eax, [esp + 0x18]
movzx ebp, si
push ebp
push edx
push eax
call fcn.004cab40
add esp, 0xc
cmp si, 0xfc
jbe 0x4be2d9
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
mov eax, dword [esp + 0x124]
push eax
call fcn.004c7930
mov esi, dword [esp + 0x124]
add esp, 4
test esi, esi
jne 0x4be387
xor cx, cx
mov eax, dword [esp + 0x124]
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x4be309
xor di, di
xor edx, edx
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
mov edx, dword [esp + 0x11c]
xor eax, eax
mov cl, byte [esi]
mov al, byte [ebx + edx + 2]
xor edx, edx
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x4be325
jmp 0x4be44a
mov edx, dword [esp + 0x11c]
push ebp
lea eax, [esp + 0x1c]
push edx
push eax
add esi, 2
call fcn.004cab40
lea eax, [esp + ebp + 0x24]
add esp, 0xc
push 4
push esi
push eax
call fcn.004cab40
xor cx, cx
mov eax, dword [esp + 0x130]
add esp, 0xc
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x4be3c1
xor di, di
xor edx, edx
add ebp, 4
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
xor edx, edx
xor eax, eax
mov cl, byte [esi]
mov al, byte [esp + ebx + 0x18]
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x4be3e0
lea eax, [esp + 0x18]
push 0
push 0x100
push eax
call fcn.004cab20
add esp, 0xc
mov edx, dword [esp + 0x14]
push 0x100
mov eax, dword [esp + 0x128]
push edx
push eax
call fcn.004c7980
add esp, 0xc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x4be5b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x174
push esi
push edi
mov esi, dword [esp + 0x194]
mov dword [esi], 0
mov ecx, dword [eax]
test ecx, ecx
jne 0x4be5dc
mov ax, 0xcc
pop edi
pop esi
add esp, 0x174
ret
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x184]
push eax
push edx
push ecx
call fcn.004be250
add esp, 0xc
test ax, ax
jne 0x4be728
xor eax, eax
mov al, byte [esp + 0x190]
test eax, eax
je 0x4be624
cmp eax, 1
je 0x4be69e
mov ax, 0xa
pop edi
mov dword [esi], 0
pop esi
add esp, 0x174
ret
mov eax, dword [esp + 0x188]
test eax, eax
je 0x4be645
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004c7980
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.004c7ae0
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 0x18
shr cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x4be65b
xor eax, eax
mov dword [esp + 8], edi
lea ecx, [esp + 0xb]
mov dl, byte [esp + eax + 0x1c]
sub ecx, eax
inc eax
xor byte [ecx], dl
cmp eax, 4
jb 0x4be686
mov eax, dword [esp + 8]
jmp 0x4be70f
mov eax, dword [esp + 0x188]
test eax, eax
je 0x4be6bf
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004c7980
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.004c7ae0
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x4be6d5
xor eax, eax
mov dword [esp + 8], edi
mov cl, byte [esp + eax + 0x1c]
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jb 0x4be6fd
mov eax, dword [esp + 8]
push 0
mov dword [esi], eax
lea eax, [esp + 0x24]
push 0x15c
push eax
call fcn.004cab20
xor ax, ax
add esp, 0xc
pop edi
pop esi
add esp, 0x174
ret
Function at 0x4bef20
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
push ebp
test esi, esi
je 0x4bef87
mov edi, dword [esp + 0x14]
mov cl, byte [edi]
xor ebp, ebp
mov bp, ax
mov dl, cl
shr ax, 4
and ebp, 0xf
and dl, 0xf
xor ebx, ebx
mov bl, dl
and cl, 0xf3
shr cl, 2
inc edi
mov edx, dword [ebx*4 + 0x51f340]
xor ebx, ebx
xor dx, ax
xor eax, eax
xor dx, word [ebp*4 + 0x51f340]
mov al, cl
mov bx, dx
mov eax, dword [eax + 0x51f340]
shr dx, 4
and ebx, 0xf
xor ax, dx
xor ax, word [ebx*4 + 0x51f340]
dec esi
jne 0x4bef33
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4bf4d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
mov eax, 0xffffffff
push esi
xor ecx, ecx
push edi
mov edi, dword [esp + 0x14]
cmp edi, ecx
je 0x4bf506
mov edx, dword [esp + 0x10]
xor ebx, ebx
mov bl, byte [edx + ecx]
inc ecx
xor ebx, eax
shr eax, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x51f400]
xor esi, eax
cmp ecx, edi
mov eax, esi
jb 0x4bf4e6
not eax
pop edi
pop esi
pop ebx
ret

Function at 0x4c15a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov cl, byte [esp + 8]
push ebx
mov edx, dword [esp + 0x10]
push esi
xor si, si
push edi
cmp dword [esp + 0x1c], 0
push ebp
je 0x4c15ca
movzx eax, si
inc si
xor byte [eax + edx], cl
movzx ebx, si
cmp ebx, dword [esp + 0x20]
jb 0x4c15b9
xor ax, ax
mov al, cl
and ax, 0xf
mov word [esp + 0x12], ax
mov di, word [esp + 0x20]
xor cl, cl
dec di
mov esi, edx
cmp word [esp + 0x20], 0
je 0x4c160c
mov bl, byte [esi]
mov ebp, esi
inc esi
mov al, cl
shl al, 7
mov cl, bl
shr bl, 1
and cl, 1
or bl, al
mov byte [ebp], bl
mov bp, di
dec di
test bp, bp
jne 0x4c15eb
test cl, cl
je 0x4c1613
or byte [edx], 0x80
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x4c15d8
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x4c1960
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
sub esp, 8
mov al, byte [esp + 0xc]
push ebx
and ax, 0xf
push esi
mov word [esp + 0xa], ax
push edi
mov eax, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
lea ecx, [eax + ebp - 1]
mov dword [esp + 0x14], ecx
xor bl, bl
mov edi, dword [esp + 0x14]
test bp, bp
lea esi, [ebp - 1]
je 0x4c19b1
mov cl, byte [edi]
mov eax, edi
dec edi
mov dl, bl
mov bl, cl
add cl, cl
shr bl, 7
or cl, dl
mov byte [eax], cl
mov ax, si
dec si
test ax, ax
jne 0x4c1995
test bl, bl
je 0x4c19bc
mov eax, dword [esp + 0x14]
or byte [eax], 1
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x4c1987
xor si, si
test ebp, ebp
je 0x4c19e9
mov dl, byte [esp + 0x1c]
mov eax, dword [esp + 0x20]
movzx ecx, si
inc si
xor byte [ecx + eax], dl
movzx ecx, si
cmp ecx, ebp
jb 0x4c19d2
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4c3ac0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x88
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov esi, dword [esp + 0x98]
push ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
jne 0x4c3af0
mov dword [esp + 0x18], 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x24], eax
je 0x4c3be2
mov eax, dword [esp + 0x10]
xor dword [esi], eax
mov ecx, dword [esp + 0x14]
xor dword [esi + 4], ecx
cmp dword [esp + 0x20], 0
jne 0x4c3bb2
cmp dword [esp + 0x1c], 2
push 0
jbe 0x4c3b93
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.004c3c90
add esp, 0xc
cmp dword [0x51f9d4], 0
jne 0x4c3c7d
mov eax, dword [esp + 0x28]
lea ebx, [esp + 0x30]
mov edi, 0x19
mov dword [esp + 0x30], eax
mov eax, dword [ebx]
mov cl, 0x20
add eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [ebx + 4], eax
add ebx, 4
mov eax, dword [esp + 0x28]
mov edx, dword [ebx - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x34], eax
dec edi
jne 0x4c3b64
jmp 0x4c3bc0
push 0
push esi
call fcn.004c3c90
add esp, 0xc
cmp dword [0x51f9d4], 0
je 0x4c3bc0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
lea eax, [esp + 0x30]
push eax
push esi
call fcn.004c3e40
add esp, 8
mov eax, dword [esi]
add esi, 8
mov dword [esp + 0x10], eax
inc dword [esp + 0x20]
mov ecx, dword [esi - 4]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
cmp eax, dword [esp + 0x24]
jb 0x4c3b17
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x4c3bf8
mov cl, byte [eax + esi]
xor byte [esp + eax + 0x10], cl
inc eax
cmp dword [esp + 0x18], eax
ja 0x4c3bea
cmp dword [esp + 0x1c], 2
jbe 0x4c3c13
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.004c3e40
add esp, 8
jmp 0x4c3c38
cmp dword [esp + 0x1c], 1
jne 0x4c3c27
mov eax, dword [esi]
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x10]
push 0
push 0
push eax
call fcn.004c3c90
add esp, 0xc
cmp dword [esp + 0x1c], 1
jbe 0x4c3c70
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x4c3c57
mov dl, byte [eax + esi - 8]
lea ecx, [eax + esi]
inc eax
mov byte [ecx], dl
cmp dword [esp + 0x18], eax
ja 0x4c3c47
mov eax, dword [esp + 0x10]
mov dword [esi - 8], eax
mov ecx, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi - 4], ecx
pop esi
pop ebx
add esp, 0x88
ret
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
Function at 0x4c3e40
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
push esi
push edi
mov eax, dword [edx]
push ebp
mov esi, dword [esp + 0x14]
add edx, 8
mov ebp, 0xc
add dword [esi + 4], eax
mov ecx, dword [edx - 4]
add dword [esi], ecx
mov ebx, dword [esi]
mov edi, dword [esi + 4]
xor edi, ebx
mov cl, 0x20
shr ebx, 4
mov eax, edi
and bl, 0x1f
add edx, 8
sub cl, bl
shr eax, cl
mov cl, bl
shl edi, cl
or eax, edi
mov cl, 0x20
sub eax, dword [edx - 8]
mov dword [esi + 4], eax
mov edi, dword [esi]
xor edi, eax
shr eax, 7
mov ebx, edi
and al, 0x1f
sub cl, al
shr ebx, cl
mov cl, al
shl edi, cl
or ebx, edi
add ebx, dword [edx - 4]
dec ebp
mov dword [esi], ebx
jne 0x4c3e5e
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c3eb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x90
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov ebx, dword [esp + 0xa0]
push ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jne 0x4c3ee0
mov dword [esp + 0x10], 8
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
cmp dword [esp + 0x14], 1
jbe 0x4c3fd5
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x14]
sub eax, 2
mov dword [esp + 0x2c], eax
je 0x4c3fd5
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x28], 0
jne 0x4c3f95
lea eax, [esp + 0x30]
push 0
push eax
push ebx
call fcn.004c3c90
add esp, 0xc
cmp dword [0x51f9d4], 0
jne 0x4c40d2
mov eax, dword [esp + 0x30]
lea edi, [esp + 0x38]
mov esi, 0x19
mov dword [esp + 0x38], eax
mov eax, dword [edi]
mov cl, 0x20
add eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov dword [edi + 4], eax
add edi, 4
mov eax, dword [esp + 0x30]
mov edx, dword [edi - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x3c], eax
dec esi
jne 0x4c3f66
jmp 0x4c3fa3
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.004c40e0
add esp, 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor dword [ebx], eax
mov edx, dword [esp + 0x20]
xor dword [ebx + 4], ecx
mov eax, dword [esp + 0x24]
add ebx, 8
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
inc dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0x2c]
jb 0x4c3f24
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x10], eax
je 0x4c3ffe
mov eax, dword [esp + 0x10]
lea esi, [ebx + 8]
lea edi, [esp + 0x18]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x14], 1
jne 0x4c4026
push 0
push 0
push ebx
call fcn.004c3c90
add esp, 0xc
cmp dword [0x51f9d4], 0
je 0x4c405c
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
cmp dword [esp + 0x14], 2
jne 0x4c404e
push 0
push 0
push ebx
call fcn.004c3c90
add esp, 0xc
cmp dword [0x51f9d4], 0
je 0x4c405c
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.004c40e0
add esp, 8
cmp dword [esp + 0x14], 1
jbe 0x4c40c5
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
xor dword [esp + 0x18], eax
xor dword [esp + 0x1c], ecx
xor ecx, ecx
cmp dword [esp + 0x10], ecx
je 0x4c408f
mov dl, byte [ecx + ebx + 8]
lea eax, [ecx + ebx]
inc ecx
mov byte [eax], dl
cmp dword [esp + 0x10], ecx
mov dl, byte [esp + ecx + 0x17]
mov byte [eax + 8], dl
ja 0x4c4078
cmp dword [esp + 0x14], 2
jne 0x4c40b7
push 0
push 0
push ebx
call fcn.004c3c90
add esp, 0xc
cmp dword [0x51f9d4], 0
je 0x4c40c5
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.004c40e0
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
xor dword [ebx], eax
xor dword [ebx + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret