joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ab8ff
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ab77e

Function at 0x4aded1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004adb91

Function at 0x4b7b3f
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
shr eax, 0x10
xor eax, dword [ebp + 8]
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop ebp
ret

Function at 0x4b7b67
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push esi
shr edx, 2
xor esi, esi
test edx, edx
je 0x4b7ba2
push edi
mov edi, dword [ebp + 8]
imul eax, dword [edi + esi*4], 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, ecx
rol eax, 0xd
imul ecx, eax, 5
sub ecx, 0x19ab949c
inc esi
cmp esi, edx
jb 0x4b7b7e
pop edi
xor ecx, dword [ebp + 0xc]
push ecx
call fcn.004b7b3f
pop ecx
pop esi
pop ebp
ret

Function at 0x4d03c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jle 0x4d0438
cmp dword [ebp + 0x14], 0
je 0x4d03e6
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041c366
jmp 0x4d0438
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
sub eax, edi
mov dword [ebp + 0x14], eax
movzx esi, byte [eax + edi + 3]
mov ecx, dword [edi]
inc esi
mov edx, ecx
mov eax, ecx
and edx, 0xff00ff
shr eax, 8
imul edx, esi
and eax, 0xffff00ff
imul eax, esi
shr ecx, 8
shr edx, 8
xor edx, eax
mov eax, 0xff00ff
and ecx, eax
and edx, eax
mov eax, dword [ebp + 0x14]
imul ecx, esi
xor edx, ecx
mov dword [edi], edx
lea edi, [edi + 4]
sub ebx, 1
jne 0x4d03f3
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x4d043d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jle 0x4d04b7
cmp dword [ebp + 0x14], 0
je 0x4d045f
push dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041c366
jmp 0x4d04b7
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
sub eax, ebx
push esi
mov dword [ebp + 0x14], eax
movzx eax, byte [eax + ebx + 3]
mov esi, 0x100
mov ecx, dword [ebx]
sub esi, eax
mov edx, ecx
mov eax, ecx
and edx, 0xff00ff
shr eax, 8
imul edx, esi
and eax, 0xffff00ff
imul eax, esi
shr ecx, 8
shr edx, 8
xor edx, eax
mov eax, 0xff00ff
and ecx, eax
and edx, eax
mov eax, dword [ebp + 0x14]
imul ecx, esi
xor edx, ecx
mov dword [ebx], edx
lea ebx, [ebx + 4]
sub edi, 1
jne 0x4d046c
pop esi
pop ebx
pop edi
pop ebp
ret 0x10
Function at 0x4d262c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x64a3a4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.004d268e
push 1
call fcn.00499c38
push eax
call fcn.004a92a5
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x808]
push 0x800
push eax
call fcn.004d26ac
add esp, 0x20
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426902
mov esp, ebp
pop ebp
ret
Function at 0x4ed6df
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push 0x14
push esi
lea eax, [edi + 4]
push eax
call fcn.00491c90
add esp, 0xc
xor edx, edx
push 5
pop ecx
add edx, dword [esi]
lea esi, [esi + 4]
imul edx, edx, 0x401
mov eax, edx
shr eax, 6
xor edx, eax
sub ecx, 1
jne 0x4ed6fd
imul ecx, edx, 9
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
mov dword [edi], eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x4ef760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
mov ecx, dword [edi + 0x84]
mov dword [ebp - 8], ecx
mov ecx, dword [edi + 0x8c]
mov ebx, dword [eax + 0x5c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ebx
call fcn.004c7558
mov esi, dword [ebp + 8]
xor esi, dword [ebp + 0xc]
and esi, 1
mov dword [ebp - 4], eax
shl esi, 8
cmp byte [edi + 0x88], 2
je 0x4ef87e
movd xmm0, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
cvtdq2ps xmm0, xmm0
push eax
push ecx
push ecx
lea ebx, [edi + 0x5c]
addss xmm0, dword [0x5dc1bc]
movss dword [esp + 4], xmm0
movd xmm0, dword [ebp + 8]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x5dc1bc]
movss dword [esp], xmm0
push ebx
call dword [ebp - 8]
movss xmm0, dword [ebp - 0x18]
add esp, 0x10
cmp byte [edi + 0x88], 1
movss xmm1, dword [0x5f8f94]
mulss xmm0, xmm1
cvttss2si eax, xmm0
mov dword [ebp - 8], eax
jne 0x4ef823
movd xmm0, dword [ebp + 0xc]
lea eax, [ebp + 8]
push 0
cvtdq2ps xmm0, xmm0
push eax
push ecx
mov ecx, ebx
movss dword [esp], xmm0
call fcn.004d3dbe
mov edi, dword [ebp + 8]
jmp 0x4ef82f
movss xmm0, dword [ebx]
mulss xmm0, xmm1
cvttss2si edi, xmm0
mov eax, edi
mov ecx, 0x4efb14
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x10
jge 0x4ef847
mov ecx, 0x4efb50
jmp 0x4ef863
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x58], 0
jne 0x4ef857
mov ecx, 0x4ef91d
jmp 0x4ef863
cmp dword [eax + 0x58], 2
mov edx, 0x4efad3
cmove ecx, edx
push dword [ebp + 0x14]
push esi
push dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp - 8]
push edi
push dword [ebp - 0x10]
call ecx
add esp, 0x1c
jmp 0x4ef914
movd xmm0, dword [ebp + 8]
lea ecx, [edi + 0x5c]
movd xmm1, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp - 4]
cvtdq2ps xmm0, xmm0
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov dword [ebp + 0xc], eax
cvtdq2ps xmm1, xmm1
movss dword [ebp + 8], xmm0
movss dword [ebp - 0x10], xmm1
lea eax, [ebp - 0x18]
push eax
push ecx
push ecx
movss dword [esp + 4], xmm1
movss dword [esp], xmm0
push ecx
call dword [ebp - 8]
movss xmm0, dword [ebp - 0x18]
mulss xmm0, dword [0x5f8f94]
cvttss2si eax, xmm0
push eax
call ebx
mov ecx, dword [ebp + 0xc]
add esp, 0x14
movss xmm0, dword [ebp + 8]
addss xmm0, dword [0x5dc1e8]
movss xmm1, dword [ebp - 0x10]
shr eax, 8
add eax, esi
xor esi, 0x100
movss dword [ebp + 8], xmm0
mov ax, word [edi + eax*2]
mov word [ecx], ax
add ecx, 2
sub dword [ebp + 0x14], 1
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp - 0xc]
jne 0x4ef8ad
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4efb89
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
mov ecx, dword [edi + 0x84]
mov dword [ebp - 8], ecx
mov ecx, dword [edi + 0x8c]
mov ebx, dword [eax + 0x5c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ebx
call fcn.004c7576
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
and esi, 1
add esi, esi
mov dword [ebp - 4], eax
and ecx, 1
or esi, ecx
shl esi, 8
cmp byte [edi + 0x88], 2
je 0x4efca7
movd xmm0, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
cvtdq2ps xmm0, xmm0
push eax
push ecx
push ecx
lea ebx, [edi + 0x5c]
addss xmm0, dword [0x5dc1bc]
movss dword [esp + 4], xmm0
movd xmm0, dword [ebp + 8]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x5dc1bc]
movss dword [esp], xmm0
push ebx
call dword [ebp - 8]
movss xmm0, dword [ebp - 0x18]
add esp, 0x10
cmp byte [edi + 0x88], 1
movss xmm1, dword [0x5f8f94]
mulss xmm0, xmm1
cvttss2si eax, xmm0
mov dword [ebp - 8], eax
jne 0x4efc53
movd xmm0, dword [ebp + 0xc]
lea eax, [ebp + 8]
push 0
cvtdq2ps xmm0, xmm0
push eax
push ecx
mov ecx, ebx
movss dword [esp], xmm0
call fcn.004d3dbe
mov ecx, dword [ebp + 8]
jmp 0x4efc5f
movss xmm0, dword [ebx]
mulss xmm0, xmm1
cvttss2si ecx, xmm0
mov eax, 0x4eff1c
test ecx, ecx
jne 0x4efc6f
mov eax, 0x4eff56
jmp 0x4efc8b
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x58], 0
jne 0x4efc7f
mov eax, 0x4efd44
jmp 0x4efc8b
cmp dword [edx + 0x58], 2
mov edi, 0x4efee0
cmove eax, edi
push dword [ebp + 0x14]
mov edi, dword [ebp - 4]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp - 8]
push ecx
push dword [ebp - 0x10]
call eax
add esp, 0x1c
jmp 0x4efd3b
movd xmm0, dword [ebp + 8]
lea ecx, [edi + 0x5c]
movd xmm1, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp - 4]
cvtdq2ps xmm0, xmm0
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov dword [ebp + 0xc], eax
cvtdq2ps xmm1, xmm1
movss dword [ebp + 8], xmm0
movss dword [ebp - 0x10], xmm1
lea eax, [ebp - 0x18]
push eax
push ecx
push ecx
movss dword [esp + 4], xmm1
movss dword [esp], xmm0
push ecx
call dword [ebp - 8]
movss xmm0, dword [ebp - 0x18]
mulss xmm0, dword [0x5f8f94]
cvttss2si eax, xmm0
push eax
call ebx
mov ecx, dword [ebp + 0xc]
add esp, 0x14
movss xmm0, dword [ebp + 8]
addss xmm0, dword [0x5dc1e8]
movss xmm1, dword [ebp - 0x10]
shr eax, 8
add eax, esi
xor esi, 0x100
movss dword [ebp + 8], xmm0
mov eax, dword [edi + eax*4]
mov dword [ecx], eax
add ecx, 4
sub dword [ebp + 0x14], 1
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp - 0xc]
jne 0x4efcd6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4f079a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [edi + 4]
mov eax, dword [edi + 0x84]
mov ecx, dword [edi + 0x8c]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0xc], eax
call fcn.004c7558
mov esi, dword [ebp + 8]
xor esi, dword [ebp + 0xc]
and esi, 1
mov dword [ebp - 4], eax
shl esi, 8
lea eax, [edi + 0x5c]
cmp byte [edi + 0x88], 2
je 0x4f08c0
movd xmm0, dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
cvtdq2ps xmm0, xmm0
push ecx
push ecx
push ecx
addss xmm0, dword [0x5dc1bc]
movss dword [esp + 4], xmm0
movd xmm0, dword [ebp + 8]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x5dc1bc]
movss dword [esp], xmm0
push eax
call dword [ebp - 8]
movss xmm2, dword [edi + 0x68]
lea ecx, [edi + 0x5c]
movss xmm1, dword [ecx]
add esp, 0x10
cmp byte [edi + 0x88], 1
jne 0x4f0869
movd xmm0, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
cvtdq2ps xmm0, xmm0
lea eax, [ebp - 0x18]
push eax
push ecx
movss dword [esp], xmm0
call fcn.004d3dbe
movd xmm1, dword [ebp - 0x18]
movd xmm2, dword [ebp - 0x14]
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm2, xmm2
mulss xmm1, dword [0x5f8f54]
mulss xmm2, dword [0x5f8f54]
cmp dword [ebx + 0x58], 0
mov eax, 0x4f0b3e
jne 0x4f087b
mov eax, 0x4f0976
jmp 0x4f0887
cmp dword [ebx + 0x58], 2
mov ecx, 0x4f0aa7
cmove eax, ecx
push dword [ebp + 0x14]
mov edi, dword [ebp - 4]
movss xmm0, dword [ebp - 0x1c]
push esi
push edi
push dword [ebp + 0x10]
sub esp, 0x10
movss dword [esp + 0xc], xmm2
movss dword [esp + 8], xmm0
movss xmm0, dword [ebp - 0x20]
movss dword [esp + 4], xmm1
movss dword [esp], xmm0
call eax
add esp, 0x20
jmp 0x4f096d
movd xmm0, dword [ebp + 8]
movd xmm1, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp - 4]
cvtdq2ps xmm0, xmm0
mov dword [ebp - 0x14], eax
cvtdq2ps xmm1, xmm1
movss dword [ebp + 8], xmm0
movss dword [ebp - 0x10], xmm1
lea ecx, [ebp - 0x20]
push ecx
push ecx
push ecx
movss dword [esp + 4], xmm1
movss dword [esp], xmm0
push eax
call dword [ebp - 8]
movss xmm0, dword [ebp - 0x1c]
pop ecx
pop ecx
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 0x20]
movss dword [esp], xmm0
call fcn.004dfe63
fstp dword [ebp + 0xc]
movss xmm0, dword [ebp + 0xc]
mulss xmm0, dword [0x5f8f94]
cvttss2si eax, xmm0
push eax
call dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
add esp, 0xc
movss xmm0, dword [ebp + 8]
addss xmm0, dword [0x5dc1e8]
movss xmm1, dword [ebp - 0x10]
shr eax, 8
add eax, esi
xor esi, 0x100
movss dword [ebp + 8], xmm0
mov ax, word [edi + eax*2]
mov word [ecx], ax
add ecx, 2
mov eax, dword [ebp - 0x14]
mov dword [ebp + 0x10], ecx
sub ebx, 1
jne 0x4f08e3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4f3cf9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x84]
mov ecx, dword [ebx + 0x8c]
mov dword [ebp - 8], eax
lea eax, [ebx + 0x5c]
mov dword [ebp - 4], eax
call fcn.004c7558
mov edi, dword [ebp + 8]
mov esi, edi
xor esi, dword [ebp + 0xc]
and esi, 1
mov dword [ebp - 0x10], eax
shl esi, 8
cmp byte [ebx + 0x88], 2
je 0x4f3e61
movd xmm0, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
cvtdq2ps xmm0, xmm0
push eax
push ecx
push ecx
addss xmm0, dword [0x5dc1bc]
movss dword [esp + 4], xmm0
movss dword [ebp - 4], xmm0
movd xmm0, edi
lea edi, [ebx + 0x5c]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x5dc1bc]
movss dword [esp], xmm0
push edi
call dword [ebp - 8]
movss xmm1, dword [ebp - 0x18]
add esp, 0x10
cmp byte [ebx + 0x88], 1
movss xmm2, dword [ebp - 0x14]
movss dword [ebp + 0xc], xmm1
movss dword [ebp + 8], xmm2
jne 0x4f3de8
movss xmm0, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
mov ecx, edi
movss dword [esp], xmm0
call fcn.004d3dbe
movd xmm1, dword [ebp - 0xc]
cvtdq2ps xmm1, xmm1
movss xmm2, dword [ebp + 8]
mulss xmm1, dword [0x5f8f54]
movss dword [ebp - 4], xmm1
movd xmm1, dword [ebp - 8]
cvtdq2ps xmm1, xmm1
mulss xmm1, dword [0x5f8f54]
movss dword [ebp - 8], xmm1
movss xmm1, dword [ebp + 0xc]
jmp 0x4f3dfb
movss xmm0, dword [edi]
movss dword [ebp - 4], xmm0
movss xmm0, dword [edi + 0xc]
movss dword [ebp - 8], xmm0
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x4f3ef7
mov ebx, dword [ebp + 0x10]
push ecx
push ecx
movss dword [esp + 4], xmm1
movss dword [esp], xmm2
call fcn.004f393d
movss xmm1, dword [ebp + 0xc]
add eax, esi
movss xmm0, dword [ebp - 4]
xor esi, 0x100
movss xmm2, dword [ebp + 8]
addss xmm0, xmm1
addss xmm2, dword [ebp - 8]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
movaps xmm1, xmm0
movss dword [ebp + 0xc], xmm0
movss dword [ebp + 8], xmm2
mov ax, word [ecx + eax*2]
mov word [ebx], ax
add ebx, 2
dec edi
test edi, edi
jg 0x4f3e09
jmp 0x4f3ef7
mov eax, dword [ebp + 0x14]
add eax, edi
mov dword [ebp + 0x14], eax
cmp edi, eax
jge 0x4f3ef7
movd xmm0, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp - 4]
cvtdq2ps xmm0, xmm0
mov dword [ebp + 0xc], eax
addss xmm0, dword [0x5dc1bc]
movss dword [ebp + 8], xmm0
lea eax, [ebp - 0x18]
push eax
push ecx
push ecx
movss dword [esp + 4], xmm0
movd xmm0, edi
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x5dc1bc]
movss dword [esp], xmm0
push ebx
call dword [ebp - 8]
movss xmm0, dword [ebp - 0x18]
pop ecx
pop ecx
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 0x14]
movss dword [esp], xmm0
call fcn.004f393d
movss xmm0, dword [ebp + 8]
add eax, esi
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor esi, 0x100
mov ax, word [ecx + eax*2]
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
add ecx, 2
inc edi
mov dword [ebp + 0xc], ecx
cmp edi, dword [ebp + 0x14]
jl 0x4f3e8f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4f3f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, ecx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x84]
lea ebx, [eax + 0x5c]
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 0x8c]
mov dword [ebp - 4], eax
call fcn.004c7576
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
and esi, 1
add esi, esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov ecx, edi
and ecx, 1
or esi, ecx
shl esi, 8
cmp byte [eax + 0x88], 2
je 0x4f4070
movd xmm0, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
cvtdq2ps xmm0, xmm0
push eax
push ecx
push ecx
addss xmm0, dword [0x5dc1bc]
movss dword [esp + 4], xmm0
movss dword [ebp - 0x14], xmm0
movd xmm0, edi
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x5dc1bc]
movss dword [esp], xmm0
push ebx
call dword [ebp - 8]
mov eax, dword [ebp - 4]
add esp, 0x10
movss xmm1, dword [ebp - 0x1c]
movss xmm2, dword [ebp - 0x18]
movss dword [ebp + 0xc], xmm1
cmp byte [eax + 0x88], 1
movss dword [ebp + 8], xmm2
jne 0x4f3ff9
movss xmm0, dword [ebp - 0x14]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
mov ecx, ebx
movss dword [esp], xmm0
call fcn.004d3dbe
movd xmm1, dword [ebp - 0xc]
cvtdq2ps xmm1, xmm1
movss xmm2, dword [ebp + 8]
mulss xmm1, dword [0x5f8f54]
movss dword [ebp - 4], xmm1
movd xmm1, dword [ebp - 8]
cvtdq2ps xmm1, xmm1
mulss xmm1, dword [0x5f8f54]
movss dword [ebp - 8], xmm1
movss xmm1, dword [ebp + 0xc]
jmp 0x4f400c
movss xmm0, dword [ebx]
movss dword [ebp - 4], xmm0
movss xmm0, dword [ebx + 0xc]
movss dword [ebp - 8], xmm0
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x4f4101
mov ebx, dword [ebp + 0x10]
push ecx
push ecx
movss dword [esp + 4], xmm1
movss dword [esp], xmm2
call fcn.004f393d
movss xmm1, dword [ebp + 0xc]
add eax, esi
movss xmm0, dword [ebp - 4]
xor esi, 0x100
movss xmm2, dword [ebp + 8]
addss xmm0, xmm1
addss xmm2, dword [ebp - 8]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
movaps xmm1, xmm0
movss dword [ebp + 0xc], xmm0
movss dword [ebp + 8], xmm2
mov eax, dword [ecx + eax*4]
mov dword [ebx], eax
add ebx, 4
dec edi
test edi, edi
jg 0x4f401a
jmp 0x4f4101
mov eax, dword [ebp + 0x14]
add eax, edi
mov dword [ebp + 0x14], eax
cmp edi, eax
jge 0x4f4101
movd xmm0, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
cvtdq2ps xmm0, xmm0
mov dword [ebp + 0xc], eax
addss xmm0, dword [0x5dc1bc]
movss dword [ebp + 8], xmm0
lea eax, [ebp - 0x1c]
push eax
push ecx
push ecx
movss dword [esp + 4], xmm0
movd xmm0, edi
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x5dc1bc]
movss dword [esp], xmm0
push ebx
call dword [ebp - 8]
movss xmm0, dword [ebp - 0x1c]
pop ecx
pop ecx
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 0x18]
movss dword [esp], xmm0
call fcn.004f393d
movss xmm0, dword [ebp + 8]
add eax, esi
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor esi, 0x100
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
add ecx, 4
inc edi
mov dword [ebp + 0xc], ecx
cmp edi, dword [ebp + 0x14]
jl 0x4f409b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4fbdb4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push dword [ebp + 0x10]
jne 0x4fbded
call fcn.004a23cc
pop ecx
cmp eax, 0xffffffff
jne 0x4fbdcf
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 0x10]
call fcn.004a1dd3
add esp, 0xc
xor ecx, ecx
test eax, eax
cmovne esi, ecx
mov eax, esi
pop esi
pop ebp
ret
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.004a18e8
add esp, 0x10
pop ebp
ret

Function at 0x4fbe79
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push dword [ebp + 8]
call fcn.004ae7b2
mov esi, eax
pop ecx
cmp esi, 0xffffffff
jne 0x4fbe93
xor eax, eax
jmp 0x4fbef3
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4fbe8f
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004fbe57
pop ecx
pop ecx
test al, al
jne 0x4fbe8f
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
je 0x4fbee6
push ebx
push ebx
push ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x4fbee6
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x4fbee8
mov edi, ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x50ad2f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ecx + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov ecx, dword [eax + 0x28]
imul ecx, dword [ebp + 0xc]
movsx esi, word [ebx]
push edi
mov dword [ebp + 0xc], esi
add ecx, dword [eax + 8]
mov eax, dword [ebp + 8]
lea edi, [ecx + eax*4]
test esi, esi
jle 0x50adf6
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x50add7
cmp eax, 0xff
jne 0x50ad7d
push esi
push 0xff000000
push edi
call fcn.004d6d57
add esp, 0xc
jmp 0x50add7
mov ecx, eax
mov dword [ebp - 4], esi
shl ecx, 0x18
mov dword [ebp - 8], ecx
mov ecx, 0x100
sub ecx, eax
mov eax, 0xff00ff
mov dword [ebp + 8], ecx
mov ebx, ecx
dec esi
mov ecx, dword [edi + esi*4]
mov edx, ecx
and edx, eax
mov eax, ecx
imul edx, ebx
shr eax, 8
and eax, 0xffff00ff
shr ecx, 8
imul eax, ebx
shr edx, 8
xor edx, eax
mov eax, 0xff00ff
and ecx, eax
and edx, eax
imul ecx, ebx
xor edx, ecx
add edx, dword [ebp - 8]
mov dword [edi + esi*4], edx
test esi, esi
jg 0x50ad99
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
lea ebx, [ebx + esi*2]
add eax, esi
mov dword [ebp + 0x14], ebx
lea edi, [edi + esi*4]
mov dword [ebp + 0x10], eax
movsx esi, word [ebx]
mov dword [ebp + 0xc], esi
test esi, esi
jg 0x50ad5e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x50b5ff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov dl, byte [ebp + 0x14]
push esi
mov esi, ecx
test dl, dl
je 0x50b6cd
cmp dword [esi + 0x20], 0
je 0x50b6cd
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, dword [esi + 0xc]
mov ebx, 0xff
mov esi, dword [esi + 0x14]
mov ecx, dword [edi + 0x28]
imul ecx, dword [ebp + 0xc]
add ecx, dword [edi + 8]
lea ecx, [ecx + eax*4]
mov dword [ebp + 0x14], ecx
cmp dl, bl
je 0x50b673
mov ecx, esi
movzx edx, dl
mov eax, esi
and ecx, 0xff00ff
inc edx
shr eax, 8
imul ecx, edx
and eax, 0xffff00ff
imul eax, edx
shr esi, 8
shr ecx, 8
xor ecx, eax
mov eax, 0xff00ff
and esi, eax
and ecx, eax
imul esi, edx
xor esi, ecx
mov ecx, dword [ebp + 0x14]
mov eax, esi
shr eax, 0x18
sub ebx, eax
mov eax, dword [edi + 0x28]
mov edi, dword [ebp + 0x10]
sub edi, 1
mov dword [ebp + 0xc], eax
js 0x50b6cb
mov eax, 0xff00ff
mov ecx, dword [ecx]
mov edx, ecx
and edx, eax
mov eax, ecx
imul edx, ebx
shr eax, 8
and eax, 0xffff00ff
shr ecx, 8
imul eax, ebx
shr edx, 8
xor edx, eax
mov eax, 0xff00ff
and ecx, eax
and edx, eax
imul ecx, ebx
xor edx, ecx
mov ecx, dword [ebp + 0x14]
add edx, esi
mov dword [ecx], edx
add ecx, dword [ebp + 0xc]
sub edi, 1
mov dword [ebp + 0x14], ecx
jns 0x50b68d
pop edi
pop ebx
pop esi
pop ebp
ret 0x10