joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478270
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
push edi
jmp 0x47828d
mov esi, dword [ebp + 8]
cmp word [esi], 0x5a4d
je 0x47829f
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push esi
nop
call 0x75114679
cmp dword [eax], 0x4550
je 0x4782b6
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x28]
push ebx
mov dword [ebp + 8], ecx
xor ecx, ecx
mov cx, word [eax + 6]
xor ebx, ebx
lea edi, [ebp - 0x403]
lea edx, [ecx + ecx*4]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov byte [ebp - 0x404], bl
add eax, ecx
mov ecx, 0xff
lea edx, [eax + edx*8 + 0x18]
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
lea ecx, [ebp - 0x404]
push eax
mov eax, dword [esi + 0x2c]
push 0x400
xor eax, 0x78
push ecx
push eax
push edx
call fcn.00478140
add esp, 0x14
or edx, 0xffffffff
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x800]
mov dword [ebp - 0x804], ebx
rep stosd dword es:[edi], eax
mov edi, dword [0x59f958]
lea esi, [ebp - 0x804]
test al, 1
je 0x478342
mov ebx, eax
lea ecx, [edi + 0x123456]
shr ebx, 1
xor ecx, ebx
jmp 0x478346
mov ecx, eax
shr ecx, 1
mov dword [esi], ecx
inc eax
add esi, 4
cmp eax, 0x100
jb 0x478330
xor eax, eax
pop ebx
xor ecx, ecx
mov esi, edx
mov cl, byte [ebp + eax - 0x400]
and esi, 0xff
xor ecx, esi
shr edx, 8
mov ecx, dword [ebp + ecx*4 - 0x804]
xor edx, ecx
inc eax
cmp eax, 0x10
jb 0x478356
mov eax, dword [ebp - 0x404]
not edx
cmp edx, eax
je 0x47838f
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov ecx, 5
lea esi, [ebp - 0x404]
rep movsd dword es:[edi], dword [esi]
mov dword [edx], eax
jmp 0x4783b7
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47a3c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
xor ebp, ebp
push esi
cmp ebx, 1
push edi
jl 0x47a3db
cmp ebx, 8
jg 0x47a3db
mov eax, 1
jmp 0x47a3dd
xor eax, eax
mov esi, dword [esp + 0x14]
push 0x59fd28
push eax
push esi
call fcn.00478c40
mov eax, dword [esi + 0x6af70]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af78], ebp
jne 0x47a414
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
mov ecx, 0x7fff
xor eax, eax
lea edi, [esi + 0x4af70]
mov dword [esi + 0x6af6c], ebp
rep stosd dword es:[edi], eax
mov ax, word [ebx*8 + 0x560492]
xor ecx, ecx
mov dword [esi + 0x6af98], eax
mov cx, word [ebx*8 + 0x560490]
xor edx, edx
mov dword [esi + 0x6af9c], ecx
mov dx, word [ebx*8 + 0x560494]
xor eax, eax
mov dword [esi + 0x6afa0], edx
mov ax, word [ebx*8 + 0x560496]
cmp ebx, 2
mov dword [esi + 0x6af94], eax
jg 0x47a475
mov eax, dword [esp + 0x1c]
or byte [eax], 4
jmp 0x47a481
cmp ebx, 8
jl 0x47a481
mov eax, dword [esp + 0x1c]
or byte [eax], 2
lea edi, [esi + 0x1af70]
push 0x10000
push edi
push esi
mov dword [esi + 0x6af84], ebp
mov dword [esi + 0x6af74], ebp
call dword [esi + 0xc]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af90], eax
je 0x47a4fa
cmp eax, 0xffffffff
je 0x47a4fa
cmp eax, 0x106
mov dword [esi + 0x6af8c], ebp
jae 0x47a4c5
push esi
call fcn.0047a710
add esp, 4
mov dword [esi + 0x6af7c], ebp
xor eax, eax
mov edx, dword [esi + 0x6af7c]
xor ecx, ecx
mov cl, byte [edi + eax]
and edx, 0x3ff
and ecx, 0x7fff
shl edx, 5
xor ecx, edx
inc eax
cmp eax, 2
mov dword [esi + 0x6af7c], ecx
jb 0x47a4cd
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x47a860
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebp, ebp
xor edi, edi
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
test eax, eax
je 0x47aaa4
push ebx
cmp eax, 3
jb 0x47a8db
mov ecx, dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af7c]
xor eax, eax
and edx, 0x3ff
mov al, byte [ecx + esi + 0x1af72]
and eax, 0x7fff
shl edx, 5
xor eax, edx
and ecx, 0x7fff
mov dword [esi + 0x6af7c], eax
mov ebp, dword [esi + eax*4 + 0x4af70]
mov dword [esi + ecx*4 + 0x2af70], ebp
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
test ebp, ebp
je 0x47a91d
mov edx, dword [esi + 0x6af84]
sub edx, ebp
cmp edx, 0x7efa
ja 0x47a91d
mov eax, dword [esi + 0x6af90]
mov ecx, dword [esi + 0x6afa0]
cmp ecx, eax
jbe 0x47a905
mov dword [esi + 0x6afa0], eax
push ebp
push esi
call fcn.0047a510
mov edi, eax
mov eax, dword [esi + 0x6af90]
add esp, 8
cmp edi, eax
jbe 0x47a91d
mov edi, eax
cmp edi, 3
jb 0x47aa16
mov ecx, dword [esi + 0x6af84]
mov ebx, dword [esi + 0x6af88]
lea eax, [edi - 3]
sub ecx, ebx
push eax
push ecx
push esi
call fcn.00479c10
mov edx, dword [esi + 0x6af90]
mov ecx, dword [esi + 0x6af98]
add esp, 0xc
sub edx, edi
mov ebx, eax
cmp edi, ecx
mov dword [esi + 0x6af90], edx
mov eax, edx
ja 0x47a9c4
cmp eax, 3
jb 0x47a9c4
dec edi
mov ebp, dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af7c]
inc ebp
xor eax, eax
mov ecx, ebp
mov dword [esi + 0x6af84], ebp
and edx, 0x3ff
mov al, byte [esi + ecx + 0x1af72]
and ecx, 0x7fff
and eax, 0x7fff
shl edx, 5
xor eax, edx
dec edi
mov dword [esi + 0x6af7c], eax
mov ebp, dword [esi + eax*4 + 0x4af70]
mov dword [esi + ecx*4 + 0x2af70], ebp
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
jne 0x47a964
jmp 0x47aa40
mov edx, dword [esi + 0x6af84]
xor eax, eax
add edx, edi
push 0x59fd84
mov dword [esi + 0x6af84], edx
push 1
mov al, byte [edx + esi + 0x1af70]
lea ecx, [edx + esi]
xor edx, edx
mov dword [esi + 0x6af7c], eax
mov dl, byte [ecx + 0x1af71]
and eax, 0x3ff
and edx, 0x7fff
push esi
shl eax, 5
xor edx, eax
xor edi, edi
mov dword [esi + 0x6af7c], edx
call fcn.00478c40
add esp, 0xc
jmp 0x47aa46
mov eax, dword [esi + 0x6af84]
xor ecx, ecx
mov cl, byte [eax + esi + 0x1af70]
push ecx
push 0
push esi
call fcn.00479c10
mov ecx, dword [esi + 0x6af90]
add esp, 0xc
dec ecx
mov ebx, eax
mov dword [esi + 0x6af90], ecx
inc dword [esi + 0x6af84]
test ebx, ebx
je 0x47aa80
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x47aa5d
lea ecx, [eax + esi + 0x1af70]
jmp 0x47aa5f
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.004799d0
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x47aa95
push esi
call fcn.0047a710
add esp, 4
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x47a884
pop ebx
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x47aab7
lea ecx, [eax + esi + 0x1af70]
jmp 0x47aab9
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.004799d0
add esp, 0x10
pop edi
pop esi
pop ebp
ret
Function at 0x47b790
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x47b79b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x47b89e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x5604e0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5604e0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5604e0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5604e0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5604e0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5604e0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5604e0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5604e0]
xor eax, edx
inc ecx
dec edi
jne 0x47b7b6
pop edi
test esi, esi
je 0x47b8c0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5604e0]
xor eax, edx
inc ecx
dec esi
jne 0x47b8a2
pop esi
pop ebx
not eax
ret

Function at 0x47b8d0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [ecx]
and esi, 0xff
mov eax, edx
and eax, 0xff
xor eax, esi
shr edx, 8
mov eax, dword [eax*4 + 0x5604e0]
xor eax, edx
mov edx, dword [ecx + 4]
mov dword [ecx], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 4], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x5604e0]
xor eax, edx
mov dword [ecx + 8], eax
ret
Function at 0x47bb00
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x44
lea eax, [esp + 0x10]
push esi
mov esi, dword [esp + 0x4c]
push eax
push esi
nop
call 0x75bd53ae
test eax, eax
jne 0x47bb22
mov eax, 0x200
pop esi
add esp, 0x44
ret
mov eax, dword [esp + 0x14]
push ebp
mov edx, eax
xor ebp, ebp
and edx, 1
je 0x47bb35
mov ebp, 1
test al, 2
je 0x47bb3c
or ebp, 2
test al, 4
je 0x47bb43
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x47bb4d
or ebp, 0x10
test al, 0x20
je 0x47bb54
or ebp, 0x20
test ecx, ecx
je 0x47bb60
or ebp, 0x40000000
jmp 0x47bb66
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x47bb76
or ebp, 0x800000
push ebx
push edi
push 0
push esi
nop
call 0x75bd196e
cmp eax, 0x28
mov dword [esp + 0x14], eax
jbe 0x47bc25
mov edi, dword [0x5111c0]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [0x511128]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x60]
push 2
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 4
push ecx
push esi
call ebx
cmp word [esp + 0x58], 0x54ad
jne 0x47bc25
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea edx, [eax + 0x34]
cmp ecx, edx
jbe 0x47bc25
push 0
push 0
push eax
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x24]
push 4
push ecx
push esi
call ebx
mov eax, dword [esp + 0x1c]
cmp eax, 0x5a4d
je 0x47bc1f
cmp eax, 0x454e
je 0x47bc1f
cmp eax, 0x454c
je 0x47bc1f
cmp eax, 0x4550
jne 0x47bc25
or ebp, 0x400000
mov eax, dword [esp + 0x5c]
pop edi
test eax, eax
pop ebx
je 0x47bc31
mov dword [eax], ebp
mov eax, dword [esp + 0x58]
pop ebp
test eax, eax
je 0x47bc40
mov edx, dword [esp + 8]
mov dword [eax], edx
mov esi, dword [esp + 0x58]
test esi, esi
je 0x47bc89
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.0047ba60
mov dword [esi], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x34]
push edx
push eax
call fcn.0047ba60
mov ecx, dword [esp + 0x2c]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov edx, dword [esp + 0x28]
push ecx
push edx
call fcn.0047ba60
mov dword [esi + 0x10], eax
add esp, 0x18
mov dword [esi + 0x14], edx
mov esi, dword [esp + 0x5c]
test esi, esi
je 0x47bcc8
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x50]
lea ecx, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
call fcn.0047ba90
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
and ecx, 0xffff
and edx, 0xffff
shl ecx, 0x10
add esp, 0x10
or ecx, edx
mov dword [esi], ecx
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x47eea0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x47eeab
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x47efae
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x5604e0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5604e0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5604e0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5604e0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5604e0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5604e0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5604e0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5604e0]
xor eax, edx
inc ecx
dec edi
jne 0x47eec6
pop edi
test esi, esi
je 0x47efd0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5604e0]
xor eax, edx
inc ecx
dec esi
jne 0x47efb2
pop esi
pop ebx
not eax
ret

Function at 0x47efe0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [ecx]
and esi, 0xff
mov eax, edx
and eax, 0xff
xor eax, esi
shr edx, 8
mov eax, dword [eax*4 + 0x5604e0]
xor eax, edx
mov edx, dword [ecx + 4]
mov dword [ecx], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 4], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x5604e0]
xor eax, edx
mov dword [ecx + 8], eax
ret
Function at 0x4806f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
cmp edi, ebx
jne 0x48070c
pop edi
pop esi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x18], ebx
jne 0x48071d
pop edi
pop esi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x7c], ebx
je 0x48072b
push edi
call fcn.00480b10
add esp, 4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push edi
call fcn.004804f0
add esp, 0x10
test eax, eax
je 0x480753
pop edi
pop esi
mov eax, 0xffffff99
pop ebx
add esp, 8
ret
push 0x84
call fcn.00416312
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x480772
pop edi
pop esi
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
push 0x4000
call fcn.00416312
mov dword [esi], eax
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x44], ecx
mov edx, dword [esp + 0x10]
add esp, 4
cmp eax, ebx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
jne 0x4807ab
push esi
call fcn.00416306
add esp, 4
mov eax, 0xffffff98
pop edi
pop esi
pop ebx
add esp, 8
ret
mov dword [esi + 0x40], ebx
mov edx, dword [edi + 0x34]
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp edx, ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
sete al
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
cmp eax, ebx
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
jne 0x4807f9
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
push eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.0047f270
add esp, 4
test eax, eax
jne 0x4807f9
mov dword [esi + 0x40], 1
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x58], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x5c], edx
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov ecx, dword [edi + 0x30]
shr ecx, 3
test cl, 1
je 0x480826
mov edx, dword [edi + 0x38]
shr edx, 8
mov byte [esi + 0x80], dl
jmp 0x480832
mov eax, dword [edi + 0x3c]
shr eax, 0x18
mov byte [esi + 0x80], al
mov cl, byte [esi + 0x6c]
push ebp
mov ebp, dword [esp + 0x20]
lea ebx, [esi + 0x70]
neg cl
sbb ecx, ecx
mov dword [ebx], 0x12345678
and ecx, 0xc
mov dword [esi + 0x74], 0x23456789
test ebp, ebp
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x78], 0x34567890
je 0x480873
mov al, byte [ebp]
test al, al
je 0x480873
push eax
push ebx
call fcn.0047efe0
add esp, 8
inc ebp
jne 0x48085f
mov edx, dword [edi + 0x78]
mov eax, dword [esp + 0x14]
mov dword [esi + 8], 0
pop ebp
lea ecx, [edx + eax + 0x1e]
xor eax, eax
mov dword [esi + 0x3c], ecx
mov dword [edi + 0x7c], esi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4888f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x50093f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.004161fe
mov ebp, dword [esp + 0x2c]
mov ebx, dword [0x511298]
push 0
push 0
push 0xffffffffffffffff
push ebp
push 0
push 0x3b6
mov dword [esp + 0x38], 1
call ebx
mov edi, eax
lea eax, [edi + edi + 2]
push eax
call fcn.00416312
add esp, 4
mov esi, eax
push edi
push esi
push 0xffffffffffffffff
push ebp
push 0
push 0x3b6
call ebx
mov ebx, dword [0x511290]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0x3a8
call ebx
mov ebp, eax
lea ecx, [ebp + 1]
push ecx
call fcn.00416312
add esp, 4
mov edi, eax
push 0
push 0
push ebp
push edi
push 0xffffffffffffffff
push esi
push 0
push 0x3a8
call ebx
push edi
lea ecx, [esp + 0x14]
call fcn.00416366
push esi
call fcn.00416306
push edi
call fcn.00416306
mov esi, dword [esp + 0x30]
add esp, 8
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.0041644a
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.004161d4
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x489700
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x500ad1
push eax
mov eax, 0x1090
mov dword fs:[0], esp
call fcn.00416b90
push ebx
push esi
xor esi, esi
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], esi
call fcn.004161fe
mov eax, dword [esp + 0x10b0]
lea ecx, [esp + 0xc]
push eax
mov ebx, 1
push 0x59b4ec
push ecx
mov dword [esp + 0x10b0], ebx
call fcn.004161f2
add esp, 0xc
push 0x80000002
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5a852c
call fcn.00416450
push ecx
lea edx, [esp + 0x1c]
mov edi, esp
mov dword [esp + 0x2c], esp
push ecx
mov byte [esp + 0x10b8], 2
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.0041644a
push edi
call fcn.00489360
add esp, 8
lea ecx, [esp + 0x34]
mov byte [esp + 0x10b4], bl
call fcn.00454870
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
mov byte [esp + 0x10a8], 3
call fcn.00454be0
lea ecx, [esp + 0x14]
mov byte [esp + 0x10a4], 4
push ecx
lea ecx, [esp + 0x14]
call fcn.0041644a
lea ecx, [esp + 0x14]
mov byte [esp + 0x10a4], 6
call fcn.004161d4
mov edx, dword [esp + 0x10]
push 0x5a852c
push edx
nop
call 0x750783c0
add esp, 8
test eax, eax
jne 0x489814
mov esi, dword [esp + 0x10ac]
push 0x5a852c
mov ecx, esi
call fcn.00416450
mov dword [esp + 0x18], ebx
jmp 0x489866
mov eax, dword [0x5ec59c]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
lea ecx, [esp + 0x1c]
mov eax, dword [eax - 8]
push ecx
push eax
push esi
mov ecx, 0x5ec59c
call fcn.00416318
push eax
lea ecx, [esp + 0x50]
call fcn.00461c00
push esi
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.0041644a
mov esi, dword [esp + 0x10b4]
lea ecx, [esp + 0x4c]
push esi
call fcn.00462f20
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x10a4], 3
call fcn.004161d4
lea ecx, [esp + 0x24]
mov byte [esp + 0x10a4], bl
call fcn.004549f0
lea ecx, [esp + 0xc]
mov byte [esp + 0x10a4], 0
call fcn.004161d4
mov ecx, dword [esp + 0x109c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x109c
ret

Function at 0x494110
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x58], eax
ret
Function at 0x49eeb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x501921
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
nop
call 0x749f1559
mov eax, dword [0x511cc4]
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push ecx
push ebx
push edx
lea ecx, [esp + 0x30]
nop
call 0x74a35552
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.0049fd40
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], edx
je 0x49ef5b
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x49ef52
cmp al, 0xff
je 0x49ef52
dec al
mov byte [ecx], al
jmp 0x49ef5b
push ecx
call fcn.00416306
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x49ef8c
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x49ef83
cmp al, 0xff
je 0x49ef83
dec al
mov byte [ecx], al
jmp 0x49ef8c
push ecx
call fcn.00416306
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4