joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4045e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40460b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00404f00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x40462d
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x40462f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x4046ce
jg 0x40464c
test esi, esi
je 0x4046ce
test ecx, ecx
jl 0x404699
jg 0x404656
test eax, eax
je 0x404699
cmp ebx, ecx
jg 0x40466a
jl 0x404660
cmp esi, eax
jae 0x40466a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.0040acc0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x4046a0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x4046ce
jg 0x4046aa
test esi, esi
je 0x4046ce
cmp dword [edi + 0x4c], 0
je 0x4046ce
mov ecx, edi
call fcn.00405690
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.0040eff6
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404b20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x437068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x404b50
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004096fc
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x404b8c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x404b8c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004096fc
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x404c58
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x404bb4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x404be7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0040e0f7
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004096fc
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
cmp edx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x404c6e
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00402170
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004096fc
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x404c48
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040ea1c
add esp, 0x10
cmp edi, eax
jne 0x404c58
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x404b77
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004096fc
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x404c58
cmp eax, 1
jle 0x404c2b
cmp eax, 3
jne 0x404c58
jmp 0x404c00
Function at 0x405750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x437068]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x4057e7
cmp byte [esi + 0x3d], 0
je 0x4057e7
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4057a0
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx]
cmp edx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x4057f9
lea edi, [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x28], edi
sub eax, 0
je 0x4057b2
sub eax, 1
je 0x4057b6
sub eax, 2
je 0x4057e7
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004096fc
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4057d0
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040ea1c
add esp, 0x10
cmp edi, eax
jne 0x4057a0
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004096fc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004096fc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
mov edi, dword [ebp - 0x28]
jmp 0x405791

Function at 0x405bd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425380
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x437068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00409712
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00408690
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x416ee6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416d65
Function at 0x406330
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x406344
push dword [esi]
call fcn.00409e20
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, dword [esi]
dec eax
and ecx, eax
mov eax, dword [esi + 4]
lea ebx, [eax + ecx*4]
mov eax, dword [ebx]
mov ecx, ebx
test eax, eax
je 0x40638d
nop dword [eax]
cmp edx, dword [eax + 4]
je 0x40638d
mov ecx, eax
mov eax, dword [eax]
test eax, eax
jne 0x406380
mov eax, dword [ecx]
test eax, eax
jne 0x40643a
push edi
push 0x14
call fcn.00401230
mov ecx, dword [ebx]
mov edi, eax
add esp, 4
lea eax, [edi + 4]
mov dword [edi], ecx
test eax, eax
je 0x4063b6
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
lea eax, [edi + 8]
test eax, eax
je 0x4063df
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [ebx], edi
inc dword [esi + 8]
mov eax, dword [esi + 8]
mov ecx, dword [esi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4f38e0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm1, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x4f38e0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi + 0xc]
jbe 0x406430
lea eax, [ecx + ecx]
mov ecx, esi
push eax
call fcn.00409e20
lea eax, [edi + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 4
pop esi
add eax, 8
pop ebx
pop ebp
ret 4
Function at 0x409a70
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 4]
test esi, esi
jne 0x409a94
mov eax, dword [ebp + 8]
mov ecx, dword [edi]
shl ecx, 2
pop edi
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [edi]
mov edx, dword [eax]
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
lea eax, [ebx - 1]
and ecx, eax
mov eax, dword [esi + ecx*4]
lea edi, [esi + ecx*4]
mov ecx, edi
test eax, eax
je 0x409add
nop
cmp edx, dword [eax + 4]
je 0x409add
mov ecx, eax
mov eax, dword [eax]
test eax, eax
jne 0x409ad0
mov ecx, dword [ecx]
test ecx, ecx
jne 0x409ae6
lea edi, [esi + ebx*4]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
lea ecx, [esi + ebx*4]
pop ebx
mov dword [eax + 4], edi
pop edi
mov dword [eax + 8], ecx
pop esi
pop ebp
ret 8

Function at 0x409e20
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [esi + 8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4f38e0]
cvtpd2ps xmm0, xmm0
movss dword [ebp - 8], xmm0
divss xmm0, dword [esi + 0xc]
call fcn.004bda70
mov edx, eax
movss xmm1, dword [ebp - 8]
mov ecx, edx
shr ecx, 0x1f
movd xmm0, edx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [ecx*8 + 0x4f38e0]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [esi + 0xc]
comiss xmm1, xmm0
jbe 0x409e83
inc edx
cmp edx, dword [ebp + 8]
mov ebx, 8
cmovb edx, dword [ebp + 8]
mov dword [ebp + 8], ebx
cmp edx, ebx
jbe 0x409e9f
add ebx, ebx
cmp ebx, edx
jb 0x409e96
mov dword [ebp + 8], ebx
cmp ebx, dword [esi]
jne 0x409ead
cmp dword [esi + 4], 0
jne 0x409f50
push edi
lea edi, [ebx*4]
push edi
call fcn.00401230
add esp, 4
mov edx, eax
mov dword [ebp - 8], edx
test ebx, ebx
je 0x409ed2
shr edi, 2
xor eax, eax
mov ecx, edi
mov edi, edx
rep stosd dword es:[edi], eax
cmp dword [esi + 4], 0
je 0x409f3c
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi], edi
jbe 0x409f3c
mov eax, dword [esi + 4]
mov esi, dword [eax + edi*4]
test esi, esi
je 0x409f31
lea eax, [ebx - 1]
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edi, eax
mov ecx, dword [esi + 4]
shr ecx, 0x10
xor ecx, dword [esi + 4]
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
mov ecx, dword [esi]
imul eax, eax, 0xc2b2ae35
mov edx, eax
shr edx, 0x10
xor edx, eax
and edx, edi
mov eax, dword [ebx + edx*4]
mov dword [esi], eax
mov dword [ebx + edx*4], esi
mov esi, ecx
test ecx, ecx
jne 0x409ef6
mov ebx, dword [ebp + 8]
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 0x10]
inc edi
mov dword [ebp - 4], edi
cmp edi, dword [esi]
jb 0x409ee1
push dword [esi + 4]
call fcn.00401240
mov eax, dword [ebp - 8]
add esp, 4
mov dword [esi], ebx
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x464110
Capabilities:
Access peb ldr_data
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da077
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x6360e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x38], esi
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], eax
lea ebx, [esi + 4]
mov dword [esi], 0x6044f0
mov dword [ebp - 4], 0
mov dword [ebx], 0
mov dword [esi + 8], 0x6044e4
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 8
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x34], 0x3f800000
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 3
push eax
call fcn.0045d8a0
add esp, 4
mov eax, dword [eax]
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor ecx, eax
lea eax, [ebp - 0x2d]
push eax
mov dword [esi + 0x38], ecx
lea ecx, [ebp - 0x2c]
push 0x60450c
call fcn.004015e0
cmp byte [ebp + 0x10], 0
mov byte [ebp - 4], 4
je 0x464214
push 0x604518
lea ecx, [ebp - 0x2c]
call fcn.00402290
push dword [ebp - 0x34]
lea eax, [ebp - 0x2d]
mov byte [ebp - 0x2d], 1
push eax
push edi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00461e60
add esp, 0x14
cmp ebx, eax
je 0x464259
mov ecx, dword [eax]
mov dword [eax], 0
mov edi, dword [ebx]
mov dword [ebx], ecx
test edi, edi
je 0x464259
mov ecx, edi
call fcn.004a3120
push 0xac
push edi
call fcn.004bd789
add esp, 8
mov edi, dword [ebp - 0x34]
test edi, edi
je 0x464275
mov ecx, edi
call fcn.004a3120
push 0xac
push edi
call fcn.004bd789
add esp, 8
mov ecx, esi
call fcn.00467d00
test dword [ebp - 0x24], 0x80000000
mov byte [ebp - 4], 5
jne 0x464294
push dword [ebp - 0x2c]
call fcn.00401240
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bd797
mov esp, ebp
pop ebp
ret 0xc
Function at 0x465c40
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x465c54
push dword [esi]
call fcn.0046b650
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, dword [esi]
dec eax
and ecx, eax
mov eax, dword [esi + 4]
lea ebx, [eax + ecx*4]
mov eax, dword [ebx]
mov ecx, ebx
test eax, eax
je 0x465c9d
nop dword [eax]
cmp edx, dword [eax + 4]
je 0x465c9d
mov ecx, eax
mov eax, dword [eax]
test eax, eax
jne 0x465c90
mov eax, dword [ecx]
test eax, eax
jne 0x465d35
push edi
push 0x10
call fcn.00401230
mov ecx, dword [ebx]
mov edi, eax
add esp, 4
lea eax, [edi + 4]
mov dword [edi], ecx
test eax, eax
je 0x465cc6
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
lea eax, [edi + 8]
test eax, eax
je 0x465cda
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [ebx], edi
inc dword [esi + 8]
mov eax, dword [esi + 8]
mov ecx, dword [esi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4f38e0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm1, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x4f38e0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi + 0xc]
jbe 0x465d2b
lea eax, [ecx + ecx]
mov ecx, esi
push eax
call fcn.0046b650
lea eax, [edi + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 4
pop esi
add eax, 8
pop ebx
pop ebp
ret 4

Function at 0x46a450
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dbc66
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x6360e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebx + 4]
test esi, esi
je 0x46a51c
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor ecx, eax
mov eax, dword [ebx]
dec eax
and eax, ecx
lea esi, [esi + eax*4]
mov eax, dword [esi]
test eax, eax
je 0x46a4c3
cmp edx, dword [eax + 4]
je 0x46a4c3
mov esi, eax
mov eax, dword [eax]
test eax, eax
jne 0x46a4b6
mov edi, dword [esi]
test edi, edi
je 0x46a51c
mov eax, dword [edi]
mov dword [ebp + 8], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x46a4eb
or eax, 0xffffffff
lock xadd dword [ecx + 8], eax
jne 0x46a4eb
mov eax, dword [ecx]
call dword [eax + 0xc]
push edi
mov dword [ebp - 4], 0xffffffff
call fcn.00401240
mov eax, dword [ebp + 8]
add esp, 4
mov dword [esi], eax
mov eax, 1
dec dword [ebx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46a540
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 4]
test esi, esi
jne 0x46a564
mov eax, dword [ebp + 8]
mov ecx, dword [edi]
shl ecx, 2
pop edi
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [edi]
mov edx, dword [eax]
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
lea eax, [ebx - 1]
and ecx, eax
mov eax, dword [esi + ecx*4]
lea edi, [esi + ecx*4]
mov ecx, edi
test eax, eax
je 0x46a5ad
nop
cmp edx, dword [eax + 4]
je 0x46a5ad
mov ecx, eax
mov eax, dword [eax]
test eax, eax
jne 0x46a5a0
mov ecx, dword [ecx]
test ecx, ecx
jne 0x46a5b6
lea edi, [esi + ebx*4]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
lea ecx, [esi + ebx*4]
pop ebx
mov dword [eax + 4], edi
pop edi
mov dword [eax + 8], ecx
pop esi
pop ebp
ret 8

Function at 0x46b650
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [esi + 8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4f38e0]
cvtpd2ps xmm0, xmm0
movss dword [ebp - 8], xmm0
divss xmm0, dword [esi + 0xc]
call fcn.004bda70
mov edx, eax
movss xmm1, dword [ebp - 8]
mov ecx, edx
shr ecx, 0x1f
movd xmm0, edx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [ecx*8 + 0x4f38e0]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [esi + 0xc]
comiss xmm1, xmm0
jbe 0x46b6b3
inc edx
cmp edx, dword [ebp + 8]
mov ebx, 8
cmovb edx, dword [ebp + 8]
mov dword [ebp + 8], ebx
cmp edx, ebx
jbe 0x46b6cf
add ebx, ebx
cmp ebx, edx
jb 0x46b6c6
mov dword [ebp + 8], ebx
cmp ebx, dword [esi]
jne 0x46b6dd
cmp dword [esi + 4], 0
jne 0x46b780
push edi
lea edi, [ebx*4]
push edi
call fcn.00401230
add esp, 4
mov edx, eax
mov dword [ebp - 8], edx
test ebx, ebx
je 0x46b702
shr edi, 2
xor eax, eax
mov ecx, edi
mov edi, edx
rep stosd dword es:[edi], eax
cmp dword [esi + 4], 0
je 0x46b76c
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi], edi
jbe 0x46b76c
mov eax, dword [esi + 4]
mov esi, dword [eax + edi*4]
test esi, esi
je 0x46b761
lea eax, [ebx - 1]
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edi, eax
mov ecx, dword [esi + 4]
shr ecx, 0x10
xor ecx, dword [esi + 4]
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
mov ecx, dword [esi]
imul eax, eax, 0xc2b2ae35
mov edx, eax
shr edx, 0x10
xor edx, eax
and edx, edi
mov eax, dword [ebx + edx*4]
mov dword [esi], eax
mov dword [ebx + edx*4], esi
mov esi, ecx
test ecx, ecx
jne 0x46b726
mov ebx, dword [ebp + 8]
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 0x10]
inc edi
mov dword [ebp - 4], edi
cmp edi, dword [esi]
jb 0x46b711
push dword [esi + 4]
call fcn.00401240
mov eax, dword [ebp - 8]
add esp, 4
mov dword [esi], ebx
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b8070
Capabilities:
Check for vm using instruction vpcext

Disassembly:
fldcw word [edx - 0x164b2a97]
push ds
in al, dx
aam 0xeb
fcmovu st(0), st(2)
mov dh, 0x6a
je 0x4b80e6
stosd dword es:[edi], eax
aad 0x66
xor eax, 0xbd060c9b
pop esi
scasd eax, dword es:[edi]
shr ecx, cl
fidiv dword [edx + edi*4 + 0x76]
mov dword [0xcfafbbb5], eax
outsb dx, byte [esi]
rcr byte [ebx], cl
mov cs, word [edi - 0x6cfc0672]
test eax, 0x88952a74
inc esi
inc ebx
add dword [eax - 0x540b8d10], 0x8d56eaad
push esi
xlatb
popal
mov ch, 0xdb
mov ebx, 0xab76ec31
fldenv [eax - 0x2f9ccb2d]
fstp xword [edx]
popfd
fisub word [eax + 0x34]
sbb dword [edx], edi
invalid
sbb dword [edx], edi
cmp esi, ecx
inc esp
rcr edx, cl
lodsb al, byte [esi]
xor eax, 0xfe9e87d9
invalid

Function at 0x4bdc60
Capabilities:
Encode data using xor

Disassembly:
or al, 0xe7
test dword [edi], esi
sbb esp, dword [0xd5adc4db]
cwde
lodsd eax, dword [esi]
aad 0x98
aaa
out 0xf7, al
xor eax, 0x87dde6a7
wait
push esp
fistp qword [ebx + 0x6ccfab32]
push 0x12a6baac
xor dh, cl
sti
push edx
push 0xffffffffffffff93
std
xor ah, ah
cmpsd dword [esi], dword es:[edi]
or byte [0x4fb30af3], 0xdd
pop ecx
pop esi
jo 0x4bdc68
mov ebp, 0xf9cef5a3
sbb cl, ah
adc ebp, dword [edx + 0x664c4126]
int1
scasd eax, dword es:[edi]
test eax, 0xa439bb79
pop edi
mov ecx, 0x9c5125eb
add ebx, esi
lahf
xor bl, byte gs:[ecx]
xchg edi, eax
dec byte [edx - 0x63]
aaa
pushfd
lea esp, [edi]
sbb dword [ecx - 0x78], 2
sahf
insd dword es:[edi], dx
sub edx, dword [esi + 4]
add byte [edi + 0x66f200d8], bh
fbstp tbyte [edi + 0x1c045c49]
sal dword fs:[ebx - 0x27], 1
cmp bh, ah
das
pop esi
sal byte fs:[esi - 0x5f551828], 0x1f
loop 0x4bdc9a
pop edx
rol byte [ebx + 0x39], 0x30
add edi, ebp
cmp ebx, dword [edi + 0x16]
push ss
bound eax, qword [ecx + 0x2248fc4f]
popal
inc ebx
fadd dword [eax + 0x37]
clc
xlatb
and dword [ebp - 0x1fc38], ebp
les esi, [ecx + 0x31]
rcl byte [edi - 2], 0x4f
adc eax, 0xa97abf59
js 0x4bdcef
cmp eax, esi
xchg ebx, eax
movsd dword es:[edi], dword [esi]
and eax, 0x4278067e
pop ecx
test byte [edx - 0x665d7b82], dh
out dx, eax
and bh, bh
sbb al, 0x43
inc ebp
add eax, ebp
xchg edi, eax
leave
inc esp
mov cl, 0xe
fadd st(5)
cmp byte [ecx + 0x1f], 0xdc
cmpsd dword [esi], dword es:[edi]
out dx, al
aad 0xe1
retf
Function at 0x405170
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x4091d0]
cmp ax, 0xcb
je 0x40527c
cmp ax, 0xcc
je 0x40527c
lea esi, [esi]
mov edx, dword [0x40e0e0]
test edx, edx
je 0x4051a5
mov eax, dword [0x40df90]
call edx
mov ebx, eax
jmp 0x4051aa
mov ebx, 0x40df94
cmp word [0x40df80], 0
jle 0x4051d0
mov eax, 0x40df60
call fcn.004053e0
mov eax, ebx
call fcn.00404d30
mov eax, ebx
call fcn.00404da0
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x4051f2
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x4051ed
mov edx, edi
mov eax, ebx
call fcn.004041a0
jmp 0x4051f0
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x4051d8
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x40df80], 0
jle 0x40527c
mov edx, 0x40dea0
mov eax, ebx
call fcn.004042e0
mov edi, eax
test edi, edi
je 0x40524c
mov eax, dword [0x40df34]
mov dword [edi + 0xc], eax
cmp dword [0x40df34], 0
je 0x405240
mov eax, dword [0x40df34]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x40df34], eax
nop
sub word [0x40df80], 1
cmp word [0x40df80], 0
sete bl
mov eax, 0x40df60
call fcn.004053f0
test bl, bl
je 0x40527c
mov eax, 0x40df60
call fcn.004053d0
lea esi, [esi]
pop edi
pop esi
pop ebx
ret