joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c75f0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub esp, 0xc4
mov eax, dword [0x588e74]
xor eax, esp
mov dword [esp + 0xc0], eax
push esi
mov esi, dword [esp + 0xcc]
lea eax, [esp + 0x41]
push 0x3f
xorps xmm0, xmm0
mov dword [esp + 0x18], 0
push 0
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
movups xmmword [esp + 0x30], xmm0
mov dword [esp + 0x48], 0
movq qword [esp + 0x40], xmm0
mov byte [esp + 0x4c], 0
call fcn.0052ee50
add esp, 0xc
mov dword [esp + 0x80], 0
test esi, esi
je 0x4c77af
lea eax, [esp + 0x14]
push eax
call fcn.004c9f30
add esp, 4
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [0x58200c]
test eax, eax
jne 0x4c76b1
push 2
call fcn.004d7b88
push eax
push 0x445894
call fcn.004d8ba9
add esp, 0xc
jmp 0x4c76ea
lea eax, [esp + 0x84]
push eax
push 0x20
push dword [esp + 0xc]
call dword [0x582004]
test eax, eax
jne 0x4c76de
push 2
call fcn.004d7b88
push eax
push 0x4458b4
call fcn.004d8ba9
add esp, 0xc
push 0
push dword [esp + 8]
call dword [0x582008]
push 0x20
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004c9f70
add esp, 0xc
mov dword [esp + 4], 0
lea eax, [esp + 4]
mov dword [esp + 8], 0
xorps xmm0, xmm0
movlpd qword [esp + 0xc], xmm0
push eax
call dword [0x582080]
test eax, eax
je 0x4c776f
call dword [0x5820a0]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [esp + 0x8c], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], edx
call fcn.004d6f93
mov eax, dword [esp + 0x10]
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], ecx
push 0x20
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004c9f70
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0xb4]
push eax
call fcn.004c9e40
push 0x20
lea eax, [esp + 0xbc]
push eax
push esi
call fcn.004c77d0
add esp, 0x20
mov dword [esi + 0x24], 1
mov ecx, dword [esp + 0xc4]
pop esi
xor ecx, esp
call fcn.005168d0
add esp, 0xc4
ret
Function at 0x4c8c30
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x30
mov eax, dword [0x588e74]
xor eax, esp
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0x34]
push ebx
push esi
push edi
mov edi, dword [edx + 0x24]
mov ebx, 0
sub edi, 6
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edi
mov eax, ebx
je 0x4c8cbb
mov esi, dword [esp + 0x44]
mov ecx, edi
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x10]
xor esi, esi
nop
cmp ebx, dword [edx + 0x24]
ja 0x4c8e08
cmp esi, edi
jae 0x4c8ca2
nop dword [eax]
cmp eax, 4
jae 0x4c8c9e
mov edi, dword [esp + 0xc]
lea edx, [eax + ebx*4]
mov ecx, dword [esp + esi*4 + 0x18]
inc eax
inc esi
mov dword [edi + edx*4 + 0x38], ecx
mov edi, dword [esp + 0x10]
cmp esi, edi
jb 0x4c8c80
mov edx, dword [esp + 0xc]
cmp eax, 4
lea ecx, [ebx + 1]
cmovne ecx, ebx
mov ebx, ecx
xor ecx, ecx
cmp eax, 4
cmovne ecx, eax
mov eax, ecx
cmp esi, edi
jb 0x4c8c70
cmp ebx, dword [edx + 0x24]
ja 0x4c8e08
mov esi, 0x5874a0
nop dword [eax]
movzx ecx, byte [esp + edi*4 + 0x15]
mov dl, byte [esp + 0x18]
xor dl, byte [ecx + 0x5842a0]
mov byte [esp + 0x18], dl
movzx ecx, byte [esp + edi*4 + 0x16]
movzx ecx, byte [ecx + 0x5842a0]
xor byte [esp + 0x19], cl
movzx ecx, byte [esp + edi*4 + 0x17]
movzx ecx, byte [ecx + 0x5842a0]
xor byte [esp + 0x1a], cl
movzx ecx, byte [esp + edi*4 + 0x14]
movzx ecx, byte [ecx + 0x5842a0]
xor byte [esp + 0x1b], cl
movzx ecx, byte [esi]
inc esi
xor cl, dl
mov dword [esp + 0x14], esi
mov byte [esp + 0x18], cl
mov edx, 1
cmp edi, 8
je 0x4c8d47
cmp edi, edx
jbe 0x4c8d3d
nop
mov ecx, dword [esp + edx*4 + 0x14]
xor dword [esp + edx*4 + 0x18], ecx
inc edx
cmp edx, edi
jb 0x4c8d30
test edi, edi
je 0x4c8dfb
jmp 0x4c8dae
mov ecx, dword [esp + edx*4 + 0x14]
xor dword [esp + edx*4 + 0x18], ecx
inc edx
cmp edx, 4
jb 0x4c8d47
movzx ecx, byte [esp + 0x24]
mov edx, 5
movzx ecx, byte [ecx + 0x5842a0]
xor byte [esp + 0x28], cl
movzx ecx, byte [esp + 0x25]
movzx ecx, byte [ecx + 0x5842a0]
xor byte [esp + 0x29], cl
movzx ecx, byte [esp + 0x26]
movzx ecx, byte [ecx + 0x5842a0]
xor byte [esp + 0x2a], cl
movzx ecx, byte [esp + 0x27]
movzx ecx, byte [ecx + 0x5842a0]
xor byte [esp + 0x2b], cl
nop word [eax + eax]
mov ecx, dword [esp + edx*4 + 0x14]
xor dword [esp + edx*4 + 0x18], ecx
inc edx
cmp edx, 8
jb 0x4c8da0
xor esi, esi
mov ecx, dword [esp + 0xc]
cmp ebx, dword [ecx + 0x24]
ja 0x4c8df7
cmp esi, edi
jae 0x4c8dde
nop dword [eax]
cmp eax, 4
jae 0x4c8dde
mov edi, dword [esp + 0xc]
lea edx, [eax + ebx*4]
mov ecx, dword [esp + esi*4 + 0x18]
inc eax
inc esi
mov dword [edi + edx*4 + 0x38], ecx
mov edi, dword [esp + 0x10]
cmp esi, edi
jb 0x4c8dc0
cmp eax, 4
lea ecx, [ebx + 1]
cmovne ecx, ebx
mov ebx, ecx
xor ecx, ecx
cmp eax, 4
cmovne ecx, eax
mov eax, ecx
cmp esi, edi
jb 0x4c8db0
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
cmp ebx, dword [ecx + 0x24]
jbe 0x4c8cd0
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005168d0
add esp, 0x30
ret
Function at 0x4c8e20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
movups xmm2, xmmword [eax]
mov eax, dword [esp + 8]
movaps xmm1, xmm2
pslldq xmm1, 4
movaps xmm0, xmm1
movups xmmword [eax], xmm2
pxor xmm0, xmm2
pslldq xmm1, 4
movaps xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 1
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movaps xmm1, xmm3
movups xmmword [eax + 0x10], xmm3
pslldq xmm1, 4
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm3
movaps xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 2
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm0
movaps xmm1, xmm2
movups xmmword [eax + 0x20], xmm2
pslldq xmm1, 4
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movaps xmm3, xmm1
pxor xmm3, xmm0
pslldq xmm1, 4
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movaps xmm1, xmm3
movups xmmword [eax + 0x30], xmm3
pslldq xmm1, 4
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm3
movaps xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 8
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm0
movaps xmm1, xmm2
movups xmmword [eax + 0x40], xmm2
pslldq xmm1, 4
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movaps xmm3, xmm1
pxor xmm3, xmm0
pslldq xmm1, 4
aeskeygenassist xmm0, xmm2, 0x10
pxor xmm3, xmm1
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movaps xmm1, xmm3
movups xmmword [eax + 0x50], xmm3
pslldq xmm1, 4
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm3
movaps xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
aeskeygenassist xmm0, xmm3, 0x20
pxor xmm2, xmm1
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm0
movaps xmm1, xmm2
movups xmmword [eax + 0x60], xmm2
pslldq xmm1, 4
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movaps xmm3, xmm1
pxor xmm3, xmm0
pslldq xmm1, 4
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movaps xmm1, xmm3
movups xmmword [eax + 0x70], xmm3
pslldq xmm1, 4
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm3
movaps xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm0
movaps xmm1, xmm2
movups xmmword [eax + 0x80], xmm2
pslldq xmm1, 4
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movaps xmm3, xmm1
pxor xmm3, xmm0
pslldq xmm1, 4
aeskeygenassist xmm0, xmm2, 0x1b
pxor xmm3, xmm1
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movaps xmm2, xmm3
movups xmmword [eax + 0x90], xmm3
pslldq xmm2, 4
movaps xmm0, xmm2
pslldq xmm2, 4
pxor xmm0, xmm3
movaps xmm1, xmm2
pxor xmm1, xmm0
pslldq xmm2, 4
aeskeygenassist xmm0, xmm3, 0x36
pxor xmm1, xmm2
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm0
movups xmmword [eax + 0xa0], xmm1
ret
Function at 0x4c9c70
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x12c
mov eax, dword [0x588e74]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
mov ebx, dword [esp + 0x134]
push ebp
push esi
push edi
movups xmm0, xmmword [ebx + 0x2c]
mov eax, dword [ebx + 0xc]
mov ebp, 0x30
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x14]
movups xmmword [esp + 0x38], xmm0
mov dword [esp + 0x10], eax
movups xmm0, xmmword [ebx + 0x3c]
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0x1c]
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x24], eax
movups xmm0, xmmword [ebx + 0x4c]
mov eax, dword [ebx + 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x24]
movups xmmword [esp + 0x58], xmm0
mov dword [esp + 0x18], eax
movups xmm0, xmmword [ebx + 0x5c]
mov eax, dword [ebx + 0x28]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x70]
mov dword [esp + 0x34], ebx
movups xmmword [esp + 0x68], xmm0
nop dword [eax]
mov edx, dword [eax]
lea eax, [eax + 4]
mov esi, dword [eax - 0x38]
mov edi, edx
mov ecx, edx
rol edi, 0xf
rol ecx, 0xd
xor edi, ecx
shr edx, 0xa
xor edi, edx
mov ecx, esi
mov edx, esi
ror ecx, 7
rol edx, 0xe
xor edx, ecx
shr esi, 3
xor edx, esi
add edi, edx
add edi, dword [eax - 0x3c]
add edi, dword [eax - 0x18]
mov dword [eax + 4], edi
sub ebp, 1
jne 0x4c9d00
mov ebp, dword [esp + 0x2c]
xor edi, edi
mov ebx, dword [esp + 0x24]
mov esi, ebx
mov eax, ebx
rol eax, 7
mov ecx, ebx
ror esi, 0xb
not ecx
and ecx, dword [esp + 0x18]
xor esi, eax
mov eax, ebx
mov edx, ebp
ror eax, 6
xor esi, eax
ror edx, 0xd
mov eax, dword [esp + 0x14]
and eax, ebx
or ecx, eax
mov eax, ebp
rol eax, 0xa
add esi, ecx
add esi, dword [edi + 0x445910]
xor edx, eax
add esi, dword [esp + edi + 0x38]
mov eax, ebp
add esi, dword [esp + 0x28]
add edi, 4
ror eax, 2
xor edx, eax
mov eax, dword [esp + 0x1c]
mov ecx, eax
and eax, ebp
or ecx, ebp
and ecx, dword [esp + 0x10]
or ecx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
add edx, ecx
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], eax
lea ebp, [edx + esi]
mov eax, dword [esp + 0x10]
add ebx, esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
cmp edi, 0x100
jb 0x4c9d44
mov eax, dword [esp + 0x30]
add eax, ebp
mov dword [esp + 0x24], ebx
mov ebx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
add dword [ebx + 0x10], ecx
mov ecx, dword [esp + 0x12c]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 4]
add dword [ebx + 0x14], eax
mov eax, dword [esp + 0x14]
add dword [ebx + 0x18], eax
mov eax, dword [esp + 0x18]
add dword [ebx + 0x1c], eax
mov eax, dword [esp + 8]
add dword [ebx + 0x20], eax
mov eax, dword [esp + 0xc]
add dword [ebx + 0x24], eax
mov eax, dword [esp + 0x1c]
add dword [ebx + 0x28], eax
pop ebx
xor ecx, esp
call fcn.005168d0
add esp, 0x12c
ret
Function at 0x4d21a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x546db5
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x588e74]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov al, byte [ecx]
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
xor edx, edx
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x24], al
xor edi, edi
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
cmp eax, ecx
je 0x4d2228
mov esi, ecx
lea ecx, [ebp - 0x24]
sub esi, eax
push esi
call fcn.00483a00
mov edi, dword [ebp - 0x20]
push esi
mov esi, dword [ebp - 0x28]
push esi
push edi
call fcn.0052e8d0
mov edx, dword [ebp - 0x20]
sub edi, esi
mov esi, dword [ebp - 0x30]
add esp, 0xc
add edi, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 1
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
mov ecx, dword [ecx + 0x10]
mov eax, ecx
not eax
add eax, eax
xor eax, ecx
xor ecx, ecx
mov dword [ebp - 0x14], eax
sub edi, edx
je 0x4d2265
mov eax, ecx
and eax, 3
mov al, byte [ebp + eax - 0x14]
xor byte [edx + ecx], al
inc ecx
cmp ecx, edi
jb 0x4d2254
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x4d22ff
mov eax, dword [ecx]
lea edx, [ebp - 0x24]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
sub ecx, eax
je 0x4d2291
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4d2283
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x4d22dd
mov esi, dword [ebp - 0x18]
sub esi, eax
mov edx, esi
je 0x4d22b2
mov ecx, eax
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, 1
jne 0x4d22a7
mov dword [ebp - 4], 2
cmp esi, 0x1000
jb 0x4d22d3
mov ecx, dword [eax - 4]
add esi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d22fa
mov eax, ecx
push esi
push eax
call fcn.005163b4
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005168d0
mov esp, ebp
pop ebp
ret 4
call fcn.004d2584
call fcn.005178fd
int3
Function at 0x4e9dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x3cc
mov eax, dword [0x588e74]
xor eax, esp
mov dword [esp + 0x3c8], eax
push ebx
mov ebx, dword [esp + 0x3d4]
lea eax, [esp + 4]
push ebp
mov ebp, dword [esp + 0x3e0]
push esi
push edi
mov edi, dword [esp + 0x3e4]
mov esi, ecx
push 0x90
push eax
push 1
mov eax, dword [esi + 0x24]
push ebx
call eax
add esp, 0x10
cmp eax, 0x90
je 0x4e9e18
push ebx
mov ecx, esi
call fcn.004ea710
jmp 0x4e9f19
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x3c]
or ecx, dword [esp + 0x38]
or eax, dword [esp + 0x1c]
jne 0x4e9e34
mov eax, dword [esp + 0x40]
or eax, dword [esp + 0x20]
or ecx, eax
mov dword [esi + 0x54], ecx
cmp dword [ebp], 0
jne 0x4e9e53
movzx eax, byte [esp + 0x10]
shl ax, 8
movzx ecx, ax
movzx eax, byte [esp + 0x11]
or ecx, eax
mov dword [ebp], ecx
mov ax, word [esp + 0x12]
mov ecx, dword [esp + 0x98]
or ecx, dword [esp + 0x78]
mov word [edi + 4], ax
mov eax, dword [esp + 0x14]
mov dword [edi + 8], eax
mov eax, dword [esp + 0x7c]
or eax, dword [esp + 0x5c]
jne 0x4e9e85
mov eax, dword [esp + 0x80]
or eax, dword [esp + 0x60]
or ecx, eax
or dword [esi + 0x54], ecx
cmp dword [edi + 0x40], 0
jne 0x4e9f17
push 0x220
lea eax, [esp + 0xa4]
push eax
mov eax, dword [esi + 0x24]
push 0x37
push ebx
call eax
add esp, 0x10
cmp eax, 0x220
jne 0x4e9ee4
mov cx, word [esp + 0xa4]
mov al, cl
shr al, 3
test al, 1
je 0x4e9ecb
lea eax, [esp + 0x140]
jmp 0x4e9f0e
shr cl, 2
lea eax, [esp + 0x120]
test cl, 1
lea ecx, [esp + 0x1c0]
cmove eax, ecx
jmp 0x4e9f0e
push 0x118
lea eax, [esp + 0x2c4]
push eax
mov eax, dword [esi + 0x24]
push 0xa
push ebx
call eax
add esp, 0x10
cmp eax, 0x118
jne 0x4e9e0b
lea eax, [esp + 0x2d8]
push eax
lea ecx, [edi + 0x2c]
call fcn.004bd600
xor eax, eax
mov ecx, dword [esp + 0x3d8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005168d0
add esp, 0x3cc
ret 0xc
Function at 0x4f3e40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x547580
mov eax, dword fs:[0]
push eax
sub esp, 0x164
mov eax, dword [0x588e74]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x16c], esi
mov ecx, dword [esi + 0x78]
push 0
push dword [esi + 0x24]
mov edi, dword [ecx + 0x2fc]
call fcn.004ec8b0
test eax, eax
je 0x4f4063
mov eax, dword [esi]
mov ecx, esi
shr eax, 1
and al, 1
mov byte [ebp - 0x170], al
lea eax, [ebp - 0x38]
push dword [ebp - 0x170]
push eax
call fcn.004f48c0
or dword [esi], 8
lea ecx, [ebp - 0x34]
mov dword [esi + 0x54], eax
or eax, 1
mov esi, dword [ebp + 8]
push esi
push dword [ebp - 0x38]
push ecx
mov ecx, dword [ebp - 0x16c]
push eax
call fcn.004f4230
push esi
mov esi, dword [ebp - 0x16c]
mov byte [ebp - 0x165], al
push dword [esi + 0x24]
mov ecx, dword [esi + 0x78]
call fcn.004f27d0
test al, al
je 0x4f3f52
mov esi, dword [esi + 0x24]
mov ecx, edi
call fcn.004f4d60
xor ecx, ecx
test esi, esi
jle 0x4f3f01
mov eax, dword [edi + 0x20]
movzx ecx, word [eax + esi*2 - 2]
mov eax, dword [edi + 0x20]
movzx esi, word [eax + esi*2]
cmp ecx, esi
jae 0x4f3f4c
mov edx, ecx
shl edx, 4
sub edx, ecx
shl edx, 2
sub esi, ecx
mov eax, dword [edi + 0x14]
add eax, edx
mov ecx, dword [eax + 0x34]
and ecx, 0x30000000
cmp ecx, 0x20000000
je 0x4f3f44
or ecx, 0x20000000
cmp dword [eax + 4], 3
mov dword [eax + 0x34], ecx
jne 0x4f3f44
mov dword [eax + 4], 1
add edx, 0x3c
sub esi, 1
jne 0x4f3f18
mov esi, dword [ebp - 0x16c]
cmp byte [ebp - 0x165], 0
je 0x4f4063
mov eax, dword [ebp - 0x38]
xorps xmm0, xmm0
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x28]
add esi, 0x58
movlpd qword [ebp - 0x18], xmm0
movups xmm0, xmmword [ebp - 0x34]
push 0x128
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x160]
push 0
push eax
movups xmmword [esi], xmm0
mov byte [ebp - 0x164], 0
call fcn.0052ee50
xor eax, eax
cmp byte [ebp - 0x164], al
setne al
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.004c6f10
lea eax, [ebp - 0x138]
mov dword [ebp - 4], 0
push eax
xor eax, eax
cmp byte [ebp - 0x164], al
setne al
push eax
push 0x10
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.004c7440
lea eax, [ebp - 0x160]
push eax
call fcn.004c7580
push esi
lea eax, [ebp - 0x160]
push esi
push eax
call fcn.004c7020
add esp, 0x38
cmp byte [ebp + 0xc], 0
jne 0x4f4049
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
call fcn.004bac40
push dword [0x445570]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.004bad20
lea ecx, [ebp - 0x24]
call fcn.004bad40
push 0x10
push esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.004bace0
push 0x20
push esi
lea ecx, [ebp - 0x24]
call fcn.004bad00
lea ecx, [ebp - 0x24]
call fcn.004bacc0
lea eax, [ebp - 0x160]
mov dword [ebp - 4], 3
push eax
call fcn.004c71e0
add esp, 4
mov al, 1
jmp 0x4f4065
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005168d0
mov esp, ebp
pop ebp
ret 8
Function at 0x4f8770
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x547925
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x588e74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
lea eax, [ebx + 4]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
call fcn.00516384
mov esi, eax
add esp, 4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], esi
mov edx, dword [eax]
mov dword [esi + 8], edx
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [ebp - 4], 1
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
xor eax, edx
imul eax, eax, 0x1000193
push eax
mov dword [ebp - 0x1c], eax
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004f8700
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4f883e
mov dword [edi], eax
mov byte [edi + 4], 0
push 0xc
push esi
call fcn.005163b4
add esp, 8
jmp 0x4f8961
mov ecx, dword [ebx + 8]
cmp ecx, 0x15555555
je 0x4f8977
movss xmm3, dword [ebx]
lea eax, [ecx + 1]
mov ebx, dword [ebx + 0x1c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4452a0]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x4452a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
seta al
test al, al
je 0x4f890b
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.004e7290
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.00516cb0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x4f88e7
cmp ebx, 0x200
jae 0x4f88e5
shl ebx, 3
cmp ebx, ecx
jae 0x4f88e7
mov ebx, ecx
push ebx
mov ebx, dword [ebp - 0x10]
mov ecx, ebx
call fcn.004f9890
push dword [ebp - 0x1c]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004f8700
mov ecx, dword [ebx + 8]
mov edx, dword [eax]
jmp 0x4f8911
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
lea eax, [ecx + 1]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0xc]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x4f8942
mov dword [ecx + eax*8], esi
jmp 0x4f8954
cmp ebx, edx
jne 0x4f894b
mov dword [ecx + eax*8], esi
jmp 0x4f8958
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4f8958
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x44fa10
call fcn.0051791a
int3
Function at 0x4f9860
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor ecx, ecx
test esi, esi
je 0x4f988a
mov edx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4f9874
pop edi
mov eax, edx
pop esi
ret
mov eax, dword [esp + 8]
pop esi
ret

Function at 0x4f9890
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
mov esi, 1
mov dword [esp + 8], ebx
mov eax, esi
shl eax, cl
mov ecx, dword [esp + 0x14]
cmp ecx, eax
ja 0x4f99d9
lea eax, [ecx - 1]
or eax, esi
bsr ecx, eax
push ebp
mov ebp, dword [ebx + 4]
push edi
push ebp
lea ecx, [ecx + 1]
mov dword [esp + 0x18], ebp
shl esi, cl
lea edi, [ebx + 0xc]
mov ecx, edi
lea eax, [esi + esi]
push eax
call fcn.00488090
mov edx, dword [ebx + 4]
lea eax, [esi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], esi
mov edx, dword [edx]
cmp edx, ebp
je 0x4f99b3
mov ecx, edx
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul esi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor esi, eax
movzx eax, byte [ecx + 0xa]
imul esi, esi, 0x1000193
xor esi, eax
movzx eax, byte [ecx + 0xb]
imul esi, esi, 0x1000193
xor esi, eax
mov eax, dword [edi]
imul esi, esi, 0x1000193
and esi, dword [ebx + 0x18]
mov edi, dword [eax + esi*8]
lea ebp, [eax + esi*8]
cmp edi, dword [esp + 0x14]
jne 0x4f9943
mov dword [ebp], ecx
mov dword [ebp + 4], ecx
jmp 0x4f99a4
mov eax, dword [ebp + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x4f9971
mov ebx, dword [eax]
cmp ebx, ecx
je 0x4f996c
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], ebx
mov eax, dword [ebx + 4]
mov dword [eax], ecx
mov dword [ebx + 4], esi
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov dword [ebp + 4], ecx
jmp 0x4f99a0
mov esi, eax
cmp edi, eax
je 0x4f9985
mov eax, dword [eax + 4]
mov esi, eax
cmp ebx, dword [eax + 8]
je 0x4f99bd
cmp edi, esi
jne 0x4f9977
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov dword [ebp], ecx
mov ebx, dword [esp + 0x10]
lea edi, [ebx + 0xc]
mov ecx, edx
cmp edx, dword [esp + 0x14]
jne 0x4f98f5
pop edi
pop ebp
pop esi
pop ebx
add esp, 8
ret 4
mov edi, dword [ecx + 4]
mov ebx, dword [eax]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], ebx
mov eax, dword [ebx + 4]
mov dword [eax], ecx
mov dword [ebx + 4], esi
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
jmp 0x4f99a0
push 0x44fa2c
call fcn.0051791a
int3

Function at 0x4f9a10
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
cmp eax, ecx
je 0x4f9a2e
nop word [eax + eax]
mov edx, dword [eax]
cmp byte [edx], 0xcc
je 0x4f9a31
add eax, 4
cmp eax, ecx
jne 0x4f9a20
xor al, al
ret
call fcn.0046a780
mov dword [eax], 0xb
mov al, 1
ret