joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5d55
Capabilities:
Check os version
Encode data using xor

Disassembly:
push ebp
mov cx, cx
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, 0xff
jb 0x4dadd1
add eax, 0xffffffd8
cmp eax, 0xc2
lea edi, [edi]
ja 0x4c5dab
jbe 0x4c5d81
nop
cpuid
ret
xor ecx, ecx
jb 0x4e78e8
shr ecx, 0x40
mov cl, byte [eax + 0x4f6654]
jmp dword [ecx*4 + 0x4f664c]
xor eax, eax
jb 0x4e7901
pop ebp
jne 0x4c7a07
mov dx, dx
je 0x4c5dc3
cpuid
ret
je 0x4c7a07
add eax, 0x83df5f4
add byte [eax], al
add byte [esi - 0x3f], ah
out 0x20, al
ret
mov byte [ebp + ebx], al
jmp dword [esi]
and dword [ebx - 0x75], ebx
pop ebp
inc esp
mov byte [0x40eac073], al
mov ebx, dword [ebp + 0x44]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
jne 0x4f31dc
je 0x4e791a
sub dword [ebx], ecx
inc ecx
je 0x4f31dc
fld dword [esi]
imul byte [ebp + ebx]
lea esi, [esi + 0xc]
shr cl, 0x40
jne 0x4d49da
je 0x4e7938
cpuid
ret
je 0x4d49da
fidiv dword [edx + 0x4b]
fimul dword [ebp]
add byte [ecx], ah
xor byte [eax + eax], 0
add byte [eax], al
and dword [eax], eax
add byte [eax + eax + 0x10000000], bh
add byte [eax], al
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ecx + 0x3f004bc2], dl
jo 0x4e79b2
add byte [ebp + eax*4 + 0x4c], dh
add byte [ecx + edi*2 + 0x4e], dh
add byte [eax + 0x74c3a20f], dl
test dword [eax + eax - 0x12], ecx
push edx
dec edi
add dl, bl
xchg ecx, eax
pop esi
pop ebp
ret
test byte [ebx - 0x78ffe2a4], 0xfa
xchg edi, edx
lea esi, [esi + 0xc]
clc
add byte [ebx], al
lea edx, [edx]
jmp dword [esi]
Function at 0x4cbab9
Capabilities:
Check os version

Disassembly:
push ebp
shl edi, 0x20
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
shr dh, 0x40
call fcn.004ebf84
add esp, 4
mov dword [ebp + 8], eax
xor ecx, ecx
Function at 0x4ccffc
Capabilities:
Check os version

Disassembly:
jmp dword [esi]
mov esi, dword [ebp - 0x14]
lea edx, [eax + ecx]
cmp edx, esi
jbe 0x4ccfea
mov ah, ah
ja 0x4c8263
sub bh, byte [ecx - 0xc0014eb]
jmp 0x4c8264
push ebx
call fcn.004de62e
jmp 0x4ccfcf
add esp, 4
mov ax, 0xa
xchg dx, ax
xchg dx, ax
pop edi
pop esi
pop ebx
mov esp, ebp
xchg edi, edx
xchg edx, edi
pop ebp
ret
ja 0x4e98e1
jbe 0x4ccff4
inc esi
test byte [edi], 0x86
out 0xc8, eax
add dword [eax], eax
jbe 0x4e98e1
xor eax, 0x24648d90
add al, 0x8b
inc esi
add al, 0xc0
in al, 0x20
mov ebx, dword [esi + 8]
mov dx, dx
lea esi, [esi + 0xc]
cmp esi, esi
and word [ebp + ebx], ax
jb 0x4cc4a3
shr ebp, 0x40
jmp dword [esi]
iretd
push eax
xchg bh, ah
xchg ah, bh
call fcn.004f2b35
and eax, 0x8568b0b
mov ax, word [ebp + eax]
lea esi, [esi + 0xc]
and word [ebx + edx], ax
jb 0x4d3c20
ja 0x4c7e85
jbe 0x4e990f

Function at 0x4cd76e
Capabilities:
Check os version

Disassembly:
pop dword [esp - 4]
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov edi, edi
mov dl, dl
mov al, byte [eax]
lea esi, [esi + 0xc]
jmp 0x4e678c
stc
jb 0x4e6793
popfd

Function at 0x4d2850
Capabilities:
Check os version
Encode data using base64

Disassembly:
test ecx, 0x4000
jb 0x4db90e
jne 0x4e4398
je 0x4d2429
sub eax, 0x2f810f64
jge 0x4d242e
jno 0x4da15e
add byte [eax + 4], dh
jo 0x4d2435
cpuid
cli
ret
jo 0x4da15e
xor al, 0x54
cdq
imul ecx, dword [ebp], 2
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [esi], dh
ja 0x4d2498
add byte [eax + 0x19], al
dec esi
add byte [edx], bh
stosd dword es:[edi], eax
dec ebp
add byte [ebp + 0x24], bl
dec ebp
add ah, cl
cmc
fld xword [ebp - 0x34]
dec esp
add byte [eax], al
add byte [eax], al
xor al, 0
add byte [eax], al
dec ebx
fimul dword [ebp]
add byte [ecx], ah
xor byte [eax + eax], 0
add byte [eax], al
and dword [eax], eax
add byte [eax + eax + 0x10000000], bh
add byte [eax], al
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add al, cl
pop edx
dec esi
add byte [ebx - 0x26], cl
dec ebp
add byte [eax], al
popal
add byte [eax + 0x34], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc al, byte [eax]
add byte [eax], al
inc edx
add byte [eax], al
xor byte [eax], al
add byte [eax], al
in al, dx
dec ebx
add byte [eax], al
and dword [eax], eax
add byte [eax + eax + 0x12000000], bh
add byte [eax], al
add byte [edx], al
add byte [eax], dh
add byte [eax], al
add byte [esp + ebp*8 + 0x4b], ah
add byte [eax + 0x1004e3b], dl
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add byte [edi + 0x1b], bl
dec edi
add byte [0xcf004b81], ah
mov dword [0xad9004d], eax
lea esp, [esp + 4]
mov di, di
jne 0x4d2411
je 0x4d2863
pop eax
add dl, byte [esi + 0x24]
mov esi, esi
jne 0x4cbd28
je 0x4d286f
mov eax, dword [esi + 4]
js 0x4df686
jns 0x4da16d
ret 0xb093
jns 0x4df686
invalid
Function at 0x4d31be
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Parse pe header

Disassembly:
pop dword [esp - 4]
mov byte [esi + 0xba], cl
mov byte [esi + 0xbb], 0
jne 0x4d569f
je 0x4d31d9
and al, 0xc5
je 0x4d569f
invalid
push eax
shl cl, 0x20
lea eax, [eax]
jmp 0x4d56a7
push esi
mov word [esi + 0xbc], dx
shl cl, 0x20
call fcn.004c5b02
shl eax, 0x20
call fcn.004ed47d
fnstcw word [ecx + 0x5b]
mov esp, ebp
pop ebp
ret
Function at 0x4d3657
Capabilities:
Check os version

Disassembly:
push ebp
ja 0x4df366
jbe 0x4bd842
dec edi
sbb dword [esi], edx
sbb dword [edi], ecx
xchg byte [esi], bl
sbb eax, dword [edx]
add byte [edx + 0x40eac150], al
jbe 0x4df366
adc byte [eax - 0x3f], 0xea
inc eax
jno 0x4bd835
jo 0x4d3662
dec edi
xor edi, ecx
jo 0x4bd835
xor eax, 0xfbe1e8e0
invalid
Function at 0x4d70b0
Capabilities:
Check os version
Encode data using base64

Disassembly:
lea esp, [esp + 4]
mov ebx, dword [esi + 8]
shr ebx, 0x40
mov ecx, dword [esi + 4]
mov ebx, dword [ebp + ebx]
call fcn.004c8620
ficom dword [0xff5ffeb]
test dword [edi], edi
and edi, esi
push dword [ebx + eax - 0x2c]
xchg dword [edi + ecx - 0x1dccb7c], edx
invalid

Function at 0x4dbd97
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xfffffff4
js 0x4c9d5e
jns 0x4d7a7f
xchg ecx, eax
sbb byte [edi], cl
mov ecx, ebx
and bh, bh
inc edi
aam 0x87
rol dword [edi + 0x758b56da], cl
or byte [edx + 0x10], ch
jns 0x4c9d5e
invalid
lea esp, [esp + 4]
ja 0x4d7a70
mov ah, ah
Function at 0x4e502a
Capabilities:
Check os version

Disassembly:
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ebx - 0x26], cl
dec ebp
add byte [eax], al
popal
add byte [eax + 0x34], al
add byte [ecx], ah
add byte [eax], al
xor al, 0
add byte [eax], al
add byte [ecx], dl
add byte [eax], al
add byte [ecx], al
add byte [eax], bh
add byte [eax], al
add byte [edi], bl
xchg edi, eax
dec esp
add byte [ebx], bl
push edx
dec esi
add byte [eax], dh
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ebp + eax*4 + 0x4c], dh
add byte [ecx + 0x3c], ch
dec ebp
add byte [ebx - 0x26], cl
dec ebp
add byte [eax], al
popal
add byte [eax + 0x34], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
xor byte [eax], al
add byte [eax], al
enter 0x4e5a, 0
mov eax, 0x4d99
add byte [eax], al
add byte [eax], cl
add byte [eax], al
xor al, 0x77
dec esp
add byte [edi + 0x3a004e0f], ch
stosd dword es:[edi], eax
dec ebp
add byte [ebx - 0x2dffb1b0], ch
mov edi, dword [edx]
stosd dword es:[edi], eax
dec ebp
add byte [edi - 0x38ffb1f1], ch
push eax
mov dx, word [ebp + 0x10]
jne 0x4bdf9f
je 0x4e50c5
ret 0xa20f
je 0x4bdf9f
xor al, 0x7a
js 0x4be071
jns 0x4e50d9
dec eax
adc edx, dword [eax]
out 0xf, eax
mov dword [edx - 0x7d000271], edx
pop eax
push 0x4ba7a0
ret
jns 0x4be071
sbb byte [eax + 0x68], 0xa0
cmpsd dword [esi], dword es:[edi]
dec ebx
add bl, al
add eax, 0x81e589fd
in al, dx
adc byte [eax], al
add byte [eax], al
shl di, 0x20
lea eax, [ebp - 0x10]
js 0x4c64eb
jns 0x4e5104
nop
cpuid
ret 0x890f
jns 0x4c64eb
fisub dword [edi + 0xcb866]
shr bx, 0x40
pop ebx
mov dx, dx
mov esp, ebp
pop ebp
ret

Function at 0x4e7251
Capabilities:
Check os version

Disassembly:
add esp, 4
xor eax, eax
jb 0x4e2591
sub cl, 0x34
shl al, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x4d70c6
add dl, 0x58
xchg bl, dh
xchg dh, bl
mov byte [ebp + eax - 8], dl
mov dx, dx
inc eax
cmp eax, 8
jl 0x4e7265
jge 0x4e7294
add dword [eax], esi
pop ss
enter 0x73e9, 0xfffffffffffffff8
invalid
jmp fcn.004e6b0c
Function at 0x4e7c47
Capabilities:
Check os version
Encode data using base64

Disassembly:
push 0x4d0d93
ret
pop dword [esp - 4]
mov byte [esi + 0xba], cl
shr ebp, 0x40
mov cl, cl
mov byte [esi + 0xbb], 0
mov word [esi + 0xbc], dx
call fcn.004efb6a
stc
add esp, 0x3c
shr eax, 0x40
js 0x4ddb6f
jns 0x4d3417
xchg esi, eax
into
or dword [edi], 0xffffff89
push edx
cmpsd dword [esi], dword es:[edi]
add byte [eax], al
jns 0x4ddb6f
fcomp st(1)
shl si, 0x20
mov dx, word [ebp + 0x10]
jno 0x4e7c1c
jo 0x4d3431
dec esp
fisttp qword [edi]
and ch, 0x47
add dword [eax], eax
jo 0x4e7c1c
and eax, 0x3b24f782
mov esi, eax
push 0x4f3e18
ret
jne 0x4c775a
shl dl, 0x20
je 0x4e7c14
sal ch, 0x4e
je 0x4c775a
or byte [edx], 0xeb
jmp 0x4e7c1d
push eax
xchg bl, dl
mov edx, edx
xchg dl, bl
mov ax, ax
jne 0x4d5e31
je 0x4e7c32
cli
xchg esi, eax
je 0x4d5e31
fld dword [ecx + 0x6a]
add byte [ebp + 0x6e68d855], cl
or dword [eax + eax - 0x3d], ecx
and eax, 0x24448f7d
cld
push 0x9c40244c
push edx
call fcn.004c4b52
jne 0x4dbc05
je 0x4e7c62
loopne 0x4e7c7d
jae 0x4e7c06
je 0x4dbc05
invalid
or al, 0x85
inc esp
sbb eax, 0xe3820f00
mov cl, 0xfe
dec dword [ebp + 0x3326ff36]
invalid
Function at 0x4eabdd
Capabilities:
Check os version

Disassembly:
shr dh, 0x40
mov ebx, dword [ebp + 0x44]
shr dh, 0x40
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
mov al, byte [ebp + eax]
push edx
pop edx
lea esi, [esi + 0xc]
call fcn.004c68c5
and eax, 0x4568b8a
mov cl, byte [ebp + 0x34]
jne 0x4d516d
shl dh, 0x20
je 0x4c5cca
mov byte [edx - 0x7bf0a725], al
popfd
hlt
je 0x4d516d
add eax, 0x4c9ea1b3
add byte [eax], bl
add byte [eax], al
xor byte [eax], al
add byte [eax], al
push esp
in eax, 0x4d
add byte [ebx + 0x5e], ah
dec ebp
add byte [edx - 0x8990635], al
insb byte es:[edi], dx
sbb eax, 0x30458900
jne 0x4baa2d
je 0x4c5cfd
nop
cpuid
ret
je 0x4baa2d
mov esp, ebp
pop ebp
ret
pop esi
shr cl, 0x40
mov ax, 0x18
fcmovbe st(0), st(6)
ja 0x4d0a03
add dh, ah
or cl, byte [ebp]
cmp ch, byte [ebx + 0x9c8004d]
dec ebp
add byte [eax], al
sbb byte [ebp + 0x4dda4b1d], 0
add byte [ecx], ah
xor byte [eax + eax], 0
add byte [eax], al
and dword [eax], eax
add byte [eax + eax + 0x10000000], bh
add byte [eax], al
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add al, cl
pop edx
dec esi
add byte [edi + 0x20004c38], dl
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add byte [esi + 0x30004df4], dl
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add ah, dl
mov dl, 0x4c
add byte [0x38000000], cl
add byte [eax], al
add ah, cl
dec esp
add byte [ebx], al
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ebp - 0x77], ch
dec ebp
add byte [eax], dh
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add byte [ebp + eax*4 + 0x4c], dh
add byte [edx + ebx + 0x4f], ch
add bl, bh
xor cl, byte [eax + eax + 0x40]
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
dec ebx
fimul dword [ebp]
add byte [ecx], ah
xor byte [eax + eax], 0
add byte [eax], al
and dword [eax], eax
add byte [edx], bl
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
xor byte [eax], al
add byte [eax], al
enter 0x4e5a, 0
xor dl, byte [ebp + ecx*2]
cmp byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
invalid
lea esi, [esi + 8]
mov bx, bx
call fcn.004bd7b7
add eax, 0x8c481a4
add byte [eax], al
add byte [edi + 0x5e], bl
xchg bp, ax
xchg bp, ax
push 0x40
mov ecx, ecx
lea eax, [ebp - 0x40]
mov si, si
push 0
jmp 0x4e591f
push eax
call fcn.004c0faf
xchg cl, al
xchg al, cl
mov esi, dword [ebp + 8]
push 1
mov ah, ah
push esi
call fcn.004dec62
push 8
jmp 0x4e593b
push esi
call fcn.004c6b43
lea ecx, [ebp - 0x40]
jmp 0x4e5946
push ecx
push esi
call fcn.004f0373
shr eax, 0x40
push 0x104
push esi
call fcn.004d643f
call fcn.004e6b2f
mov eax, eax
jne 0x4c5c96
je 0x4e5970
nop
cpuid
ret
je 0x4c5c96
ficom dword [ecx + 0x66]
mov dword [esi + 0xbc], eax
push ebp
mov bl, bl
mov ebp, esp
sub esp, 0x40
mov eax, dword [ebp + 0x14]
or ecx, ecx
test eax, eax
jb 0x4d09b2
je 0x4eac07
push esi
pop esi
jne 0x4eac02
les ebx, [esi]
mov word [eax], 6
mov eax, dword [ebp + 0x10]
jmp 0x4eac0b
push ebx
shl dx, 0x20
jmp 0x4eac12
push esi
cmp eax, 6
push edi
jae 0x4e590e
jb 0x4eac27
nop
cpuid
ret
pop edi
jno 0x4cc058
jo 0x4eac33
sub edi, dword [ebx - 0x7d]
jo 0x4cc058
invalid
Function at 0x4ec38a
Capabilities:
Check os version
Encode data using base64

Disassembly:
push 0x4c73b9
ret
mov dl, byte [ebp + 0xb]
test al, 0xc3
add esp, 0x2c
mov byte [esi + 0xba], bl
test ax, ax
jb 0x4cc524
shr di, 0x40
mov bp, bp
mov byte [esi + 0xbb], dl
lea esi, [esi]
shr bx, 0x40
xchg ebp, edi
xchg edi, ebp
mov ch, ch
push edx
mov dx, 0x7d1d
xchg dh, dh
pop edx
shr si, 0x40
mov word [esi + 0xbc], di
mov cx, cx
jne 0x4bd169
je 0x4d80b9
push cs
sub byte [eax], ch
jmp 0x4b74d0
lea esp, [esp + 4]
shl bl, 0x20
mov eax, dword [ebp - 8]
lea eax, [eax]
jne 0x4d8065
shr edi, 0x40
je 0x4ec3a3
push ebx
out dx, al
je 0x4d8065
and eax, 0x4468b9b
mov cx, cx
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
adc byte [ebp + ebx], al
shr al, 0x40
jmp dword [esi]

Function at 0x4ee0b5
Capabilities:
Check os version
Encode data using base64

Disassembly:
pop ebp
ret
mov eax, 1
adc byte [ecx + 0xf], 0x8e
mov ch, 0x46
pop dword [esp - 4]
shr ax, 0x40
je 0x4dfe7b
jne 0x4ee0c8
add al, 0x16
xchg ecx, edx
xchg ecx, edx
xchg edx, ecx
shl ax, 0x20
inc eax
cmp eax, 0x43
jb 0x4efd19
jae 0x4ee0e2
rcl ch, cl
mov ecx, ebp
xor eax, eax
jb 0x4e66b3
js 0x4d681b
jns 0x4ee0f6
mov byte [0xfa8949b], al
mov dword [edi], ebx
xchg esi, edi
push dword [ecx + edi*4]
jns 0x4d681b
xor al, 0xb9
call int.004c3bba
add esp, 0x10
jno 0x4f067c
jo 0x4ee113
pop edi
add eax, 0x2563800f
add byte [eax], al
jo 0x4f067c
fcomp dword [ecx - 0x24761377]
pop ebp
ret
Function at 0x4f0ec1
Capabilities:
Check os version

Disassembly:
mov dword [ebp + ebx], eax
jmp dword [esi]
lea esi, [esi]
mov al, byte [ebp + 0xb]
xchg ah, dh
xchg dh, ah
mov bh, bh
call fcn.004f57f0
xor eax, 0xef870f8f
xor dword [eax], eax
add byte [esi + 4], dh
fmul dword [edx - 0x79f0bd2a]
jecxz 0x4bec52
add byte [eax], al
lea esp, [esp + 4]
mov byte [esi + 0xbb], 0
shl bl, 0x20
mov word [esi + 0xbc], dx
mov al, al
call fcn.004f2289
push edi
mov di, ax
pop edi
mov ah, ah
js 0x4bebff
shr al, 0x40
jns 0x4f0ef3
cpuid
nop
ret
jns 0x4bebff
mov edx, dword [esi + 4]
mov ebx, dword [esi + 8]
movzx eax, byte [eax + edx]
lea esi, [esi + 0xc]
jne 0x4b7540
je 0x4f0f11
inc ebp
adc al, dl
je 0x4b7540

Function at 0x4f3830
Capabilities:
Get file size

Disassembly:
mov dword [0x8bf688c7], eax
pop esi
or cl, al
jmp 0x4c6612
clc
pop ebp
ret
jne 0x4e3355
je 0x4dcaa8
and al, bh
je 0x4e3355
invalid
push 8
lea ecx, [ebp - 0x10]
push 0x531fe4
push ecx
call fcn.004c57f4
add esp, 0xc
test al, al
jb 0x4c65c8
jne 0x4f0aba
je 0x4e3380
mov dl, byte [ecx - 0x13]
ret 0x86a
push 8
lea edx, [ebp - 8]
push 0
push edx
call fcn.004c0faf
mov eax, dword [esi]
push 0x100
js 0x4ef678
shr edi, 0x40
jns 0x4e33a3
pop esi
xchg eax, edi
dec ecx
jns 0x4ef678
fiadd dword [ebx - 0x77f4ba76]
fcmovnb st(0), st(0)
loope fcn.004e33d3
fidiv dword [edx - 0x3dbbb71]
call fcn.004c4002
lea ecx, [ebp - 0x11c]
push eax
shr ax, 0x40
push ecx
call fcn.004ed6c6
lea edx, [ebp - 0x11c]
push 0
push edx
call fcn.004f0373
lea eax, [ebp - 0x11c]
jmp 0x4f3094
mov dword [edi + 4], eax
shr edx, 7
and edx, 0x1f
jb 0x4e0f7c
xor eax, ebx
jb 0x4bcdeb
sub ecx, edx
shr edi, 0x40
mov ebx, eax
shr ebx, cl
mov ecx, edx
push 0x4bbebf
ret
push 0
mov bl, bl
jmp 0x4f3099
push eax
call fcn.004c6b43
lea ecx, [ebp - 0x11c]
ja 0x4b948a
jbe 0x4f30b2
nop
cpuid
ret 0x860f
jbe 0x4b948a
sbb byte [ebx + 0x8c681], 0
add byte [ecx - 0x2ff6f78b], cl
jb 0x4df2df
shl ah, 0x20
mov edx, dword [esi - 8]
sub eax, edx
mov edx, eax
ja 0x4f041f
xchg al, dh
xchg dh, al
jbe 0x4f30e4
aad 0x80
jne 0x4f30f4
jbe 0x4f041f
xchg byte [0xd8ffffd3], dh
cmp al, 0x66
fdivr dword [esi]
add ebp, 0x1f300000
jb 0x4ef4b1
cmp byte [eax - 0x3d], 0x26
jmp dword [esi]
add esp, 4
cmp word [ebp + 0xa], ax
je 0x4dca9e
jne 0x4f3202
mov dl, 0x55
xor eax, eax
jb 0x4ed6f3
pop esi
mov esp, ebp
ja 0x4dca9a
jbe 0x4f3219
cpuid
ret
jbe 0x4dca9a
xor al, 0xb8
jne 0x4c2416
shr ecx, 0x40
shl edi, 0x20
mov bp, bp
je 0x4f3234
mov ch, 0xcc
je 0x4c2416
invalid
push ebp
mov ebp, esp
js 0x4be006
jns 0x4f383f
mov eax, 0x890fe59b
shl dword [edi + 0x6fdafffc], 0x8b
jns 0x4be006
fisubr dword [edi - 0x75]
push es
jmp 0x4f384a
push eax
call fcn.004deeee
jno 0x4f31ee
jo 0x4f385d
cpuid
test ebx, 0xf98b800f
invalid
jo 0x4f31ee
mov dword [edi - 0x2cd2618], 0xc1168bff
jecxz 0x4f388f

Function at 0x4f648c
Capabilities:
Check os version
Encode data using base64
Encode data using xor

Disassembly:
pop dword [esp - 4]
jne 0x4d6aea
shl ax, 0x20
je 0x4f649f
add edi, dword [ecx + 0x6870fb5]
ja 0x4c01ab
jbe 0x4f64ab
Function at 0x4f6ff0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
cmp dword [esp + 0x10c], 0
push ebx
push esi
push edi
push ebp
jne 0x4f7014
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
cmp dword [esp + 0x124], 0
jne 0x4f702e
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor eax, eax
mov edx, dword [esp + 0x11c]
mov ax, word [edx]
add eax, 7
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x11c]
sar eax, 3
mov si, ax
lea eax, [esp + 0x18]
movzx ebp, si
push ebp
push edx
push eax
call fcn.00506910
add esp, 0xc
cmp si, 0xfc
jbe 0x4f7079
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
mov eax, dword [esp + 0x124]
push eax
call fcn.00503700
mov esi, dword [esp + 0x124]
add esp, 4
test esi, esi
jne 0x4f7127
xor cx, cx
mov eax, dword [esp + 0x124]
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x4f70a9
xor di, di
xor edx, edx
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
mov edx, dword [esp + 0x11c]
xor eax, eax
mov cl, byte [esi]
mov al, byte [ebx + edx + 2]
xor edx, edx
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x4f70c5
jmp 0x4f71ea
mov edx, dword [esp + 0x11c]
push ebp
lea eax, [esp + 0x1c]
push edx
push eax
add esi, 2
call fcn.00506910
lea eax, [esp + ebp + 0x24]
add esp, 0xc
push 4
push esi
push eax
call fcn.00506910
xor cx, cx
mov eax, dword [esp + 0x130]
add esp, 0xc
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x4f7161
xor di, di
xor edx, edx
add ebp, 4
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
xor edx, edx
xor eax, eax
mov cl, byte [esi]
mov al, byte [esp + ebx + 0x18]
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x4f7180
lea eax, [esp + 0x18]
push 0
push 0x100
push eax
call fcn.005068f0
add esp, 0xc
mov edx, dword [esp + 0x14]
push 0x100
mov eax, dword [esp + 0x128]
push edx
push eax
call fcn.00503750
add esp, 0xc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x4f7350
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x174
push esi
push edi
mov esi, dword [esp + 0x194]
mov dword [esi], 0
mov ecx, dword [eax]
test ecx, ecx
jne 0x4f737c
mov ax, 0xcc
pop edi
pop esi
add esp, 0x174
ret
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x184]
push eax
push edx
push ecx
call fcn.004f6ff0
add esp, 0xc
test ax, ax
jne 0x4f74c8
xor eax, eax
mov al, byte [esp + 0x190]
test eax, eax
je 0x4f73c4
cmp eax, 1
je 0x4f743e
mov ax, 0xa
pop edi
mov dword [esi], 0
pop esi
add esp, 0x174
ret
mov eax, dword [esp + 0x188]
test eax, eax
je 0x4f73e5
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00503750
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.005038b0
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 0x18
shr cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x4f73fb
xor eax, eax
mov dword [esp + 8], edi
lea ecx, [esp + 0xb]
mov dl, byte [esp + eax + 0x1c]
sub ecx, eax
inc eax
xor byte [ecx], dl
cmp eax, 4
jb 0x4f7426
mov eax, dword [esp + 8]
jmp 0x4f74af
mov eax, dword [esp + 0x188]
test eax, eax
je 0x4f745f
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00503750
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.005038b0
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x4f7475
xor eax, eax
mov dword [esp + 8], edi
mov cl, byte [esp + eax + 0x1c]
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jb 0x4f749d
mov eax, dword [esp + 8]
push 0
mov dword [esi], eax
lea eax, [esp + 0x24]
push 0x15c
push eax
call fcn.005068f0
xor ax, ax
add esp, 0xc
pop edi
pop esi
add esp, 0x174
ret