joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b730
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [0x655248]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp ebx, eax
je 0x46b780
mov edi, ecx
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x46b789
xor esi, esi
inc esi
lea eax, [ebp - 0x19]
push dword [edi + 0x20]
push esi
push esi
push eax
call fcn.005c3e34
add esp, 0x10
cmp eax, esi
mov esi, 0xffffffff
je 0x46b782
jmp 0x46b811
xor ebx, ebx
mov esi, ebx
jmp 0x46b811
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x19]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x46b80e
mov ebx, eax
cmp eax, 3
je 0x46b7f1
cmp ebx, 1
ja 0x46b80e
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.005c3e34
add esp, 0x10
cmp eax, esi
jne 0x46b80e
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x46b794
jmp 0x46b806
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.005c3e34
add esp, 0x10
cmp eax, ebx
jne 0x46b80e
mov ebx, dword [ebp + 8]
jmp 0x46b782
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005aae21
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x46b860
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x46b884
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.005c3e34
add esp, 0x14
jmp 0x46b8b4
test esi, esi
jle 0x46b8ad
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x46b8af
inc edi
cmp esi, edi
mov eax, ebx
jne 0x46b88d
mov edi, esi
jmp 0x46b8af
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x46b8c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
movzx esi, word [ebp + 8]
mov eax, dword [0x655248]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp si, 0xffff
je 0x46b90f
mov edi, ecx
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x46b927
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.005c3e34
add esp, 0x10
cmp eax, 1
je 0x46b911
xor esi, esi
dec esi
jmp 0x46b911
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005aae21
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x1a]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x46b90a
mov ebx, eax
cmp eax, 3
je 0x46b98f
cmp ebx, 1
ja 0x46b90a
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.005c3e34
add esp, 0x10
cmp eax, esi
jne 0x46b90a
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x46b932
jmp 0x46b9a8
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.005c3e34
add esp, 0x10
cmp eax, ebx
jne 0x46b90a
movzx esi, word [ebp + 8]
jmp 0x46b911

Function at 0x46bb40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x46bb6f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x46bb51
pop esi
pop edi
pop ebp
ret 8

Function at 0x46bc70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x46bca1
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x46bc81
pop esi
pop edi
pop ebp
ret 8
Function at 0x4721a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov esi, esp
mov dword [esi + 0x78], ebp
lea ecx, [esi + 0x80]
mov dword [ecx - 4], esp
xor edx, edx
dec edx
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x47f130
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x18]
mov word [eax + 4], 0
mov dword [eax], 0x7025
lea edi, [esi + 0x50]
mov dword [edi + 0x10], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esi + 0x70]
push ebx
call fcn.0046db90
add esp, 4
push dword [ebp + 0x18]
lea eax, [esi + 0x18]
push eax
push dword [ebx + 4]
push dword [ebx]
push 0x14
push edi
call fcn.00481a13
add esp, 0x18
mov dword [esi + 0x14], eax
add eax, esi
add eax, 0x50
push dword [ebp + 0x10]
mov dword [esi + 0x10], eax
push eax
push edi
call fcn.00470de6
add esp, 0xc
mov dword [esi + 0xc], eax
xor eax, eax
dec eax
mov dword [esi + 0x41], eax
mov dword [esi + 0x3d], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
lea edi, [esi + 8]
mov ecx, dword [ebp + 0x10]
push edi
call fcn.00469158
lea eax, [esi + 0x80]
mov dword [eax + 8], 0
mov ecx, edi
push 0x656798
call fcn.0047adb8
mov ebx, eax
mov ecx, dword [esi + 8]
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x472286
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
mov dword [esi + 0x88], 0xffffffff
lea edx, [esi + 0x20]
mov ecx, ebx
push edx
mov edi, dword [esi + 0x10]
push edi
lea ebx, [esi + 0x50]
push ebx
call eax
mov ecx, dword [esi + 0xc]
mov eax, ecx
sub eax, ebx
cmp ecx, edi
mov ecx, dword [esi + 0x14]
lea ecx, [esi + ecx + 0x20]
lea eax, [esi + eax + 0x20]
cmove eax, ecx
movsx edx, byte [ebp + 0x14]
push edx
push dword [ebp + 0x10]
push ecx
push eax
lea eax, [esi + 0x20]
push eax
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.00401d50
add esp, 0x1c
mov eax, dword [esi + 0x80]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x475984
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0047e944
mov ebx, eax
test esi, esi
je 0x4759bd
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x4759aa
movzx eax, word [eax]
jmp 0x4759b1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x4759bd
test bl, bl
jne 0x4759c3
jmp 0x475a20
xor esi, esi
test bl, bl
jne 0x475a11
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x4759d2
movzx eax, word [eax]
jmp 0x4759d7
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx eax, ax
push eax
push 8
call dword [edx + 0xc]
test al, al
je 0x475a02
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x4759fb
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x475990
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x475990
mov ecx, edi
call fcn.0047e944
mov ebx, eax
test esi, esi
jne 0x475a29
jmp 0x475a1a
mov ecx, edi
call fcn.0047e944
mov ebx, eax
test bl, bl
jne 0x475a48
jmp 0x475a4e
mov ecx, edi
call fcn.0047e944
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x475a36
movzx eax, word [eax]
jmp 0x475a3d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x475a4e
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x476e50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov esi, esp
mov dword [esi + 0x88], ebp
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x90]
mov dword [eax - 4], esp
xor edx, edx
dec edx
mov dword [eax + 8], edx
mov dword [eax + 4], 0x47f2b0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
lea ecx, [esi + 0x20]
mov dword [ecx + 0x60], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx + 0x50], xmm0
movdqa xmmword [ecx + 0x40], xmm0
movdqa xmmword [ecx + 0x30], xmm0
movdqa xmmword [ecx + 0x20], xmm0
movdqa xmmword [ecx + 0x10], xmm0
movdqa xmmword [ecx], xmm0
mov dword [esi + 8], ecx
mov dword [esi + 0x18], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0xc], fcn.00413ad0
mov dword [esi + 0x14], edx
mov dword [eax + 8], 1
lea eax, [esi + 4]
mov dword [eax], edx
push eax
call fcn.00469158
mov dword [esi + 0x98], 2
lea ecx, [esi + 4]
push 0x656798
call fcn.0047adb8
mov dword [esi + 0x10], eax
mov al, byte [ebp + 0x14]
lea ecx, [esi + 0x84]
lea edx, [esi + 3]
mov byte [edx], 0
lea edi, [esi + 0x14]
lea ebx, [esi + 8]
movzx eax, al
push ecx
push edi
push ebx
push dword [esi + 0x10]
push edx
push dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push dword [ecx + 4]
lea ecx, [esi + 4]
push ecx
push eax
push dword [esi + 0x1c]
lea eax, [ebp + 0xc]
push eax
call fcn.004763b0
add esp, 0x2c
test al, al
je 0x476fb0
mov ecx, dword [ebp + 0x20]
cmp byte [ecx + 0xb], 0
js 0x476f4a
xor eax, eax
mov byte [ecx], al
mov byte [ecx + 0xb], al
jmp 0x476f56
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
cmp byte [esi + 3], 0
je 0x476f72
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x2d
call dword [eax + 0x1c]
movsx eax, al
mov ecx, dword [ebp + 0x20]
push eax
call fcn.0047fcf6
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x30
call dword [eax + 0x1c]
mov edx, dword [esi + 8]
mov edi, dword [esi + 0x14]
lea ebx, [edi - 1]
cmp edx, ebx
jae 0x476f9c
lea ecx, [edx + 1]
cmp ebx, ecx
cmova ecx, ebx
cmp byte [edx], al
jne 0x476f9c
inc edx
cmp ecx, edx
jne 0x476f91
mov edx, ecx
mov dword [esi + 0x98], 2
mov ecx, dword [ebp + 0x20]
push edi
push edx
call fcn.0047e980
lea eax, [ebp + 0x10]
lea ecx, [ebp + 0xc]
push eax
call fcn.0042c3b0
mov edi, dword [ebp + 8]
test al, al
je 0x476fc9
mov eax, dword [ebp + 0x1c]
or byte [eax], 2
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
mov ecx, dword [esi + 4]
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x476fe2
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
je 0x477004
mov dword [esi + 0x98], 0
push eax
call dword [esi + 0xc]
mov edi, dword [ebp + 8]
add esp, 4
mov eax, dword [esi + 0x90]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x484300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov edi, ecx
mov eax, dword [0x655248]
xor eax, ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 8], edx
mov dword [esp + 0x1c], edx
movzx ecx, byte [0x656e4c]
xor ecx, 3
xor eax, eax
mov dword [esp + 0x10], ecx
mov ebx, dword [eax*8 + 0x5e2238]
mov dword [esp + 0x14], eax
mov eax, dword [eax*8 + 0x5e2234]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x2b], bl
lea ecx, [ebx + ebx]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.005ae710
add esp, 0xc
mov word [esp + ebx*2 + 0x20], 0
movzx eax, byte [esp + 0x2b]
test al, al
mov ecx, dword [esp + 0x24]
mov edx, eax
mov dword [esp + 0xc], ecx
cmovs edx, ecx
cmp edx, dword [esp + 8]
jbe 0x4843a0
test al, al
js 0x4843e0
mov ecx, dword [esp + 0x10]
jmp 0x4843f6
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
test edx, edx
je 0x48440a
test al, al
lea esi, [esp + 0x20]
cmovs esi, dword [esp + 4]
xor ebx, ebx
nop dword [eax]
movzx ecx, word [edi + ebx*2]
cmp cx, word [esi + ebx*2]
jne 0x484396
add ebx, 1
cmp edx, ebx
jne 0x4843c0
jmp 0x48440a
push dword [esp + 0x20]
call fcn.005aade6
add esp, 4
movzx ecx, byte [0x656e4c]
xor ecx, 3
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, ecx
jb 0x484331
jmp 0x484496
test al, al
js 0x484418
mov ecx, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
jmp 0x48442e
push dword [esp + 4]
call fcn.005aade6
add esp, 4
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, dword [esp + 0xc]
xor ebx, ebx
test ecx, ecx
je 0x48449c
cmp ecx, dword [esp + 8]
je 0x48449c
lea eax, [esp + 0x18]
push 0
push 0x5e22e0
push eax
mov ebx, ecx
call fcn.00492be0
add esp, 0xc
mov ecx, dword [esp + 0x1c]
sub ecx, ebx
jb 0x4844b1
mov edx, ebx
sub eax, ebx
cmp ecx, eax
cmovb eax, ecx
cmp eax, esi
jne 0x484496
test esi, esi
je 0x48449a
add edx, edx
add edx, dword [esp + 0x18]
xor eax, eax
nop word cs:[eax + eax]
nop dword [eax + eax]
movzx ecx, word [edx + eax*2]
cmp cx, word [edi + eax*2]
sete bl
jne 0x48449c
add eax, 1
cmp esi, eax
jne 0x484480
jmp 0x48449c
xor ebx, ebx
jmp 0x48449c
mov bl, 1
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.005aae21
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x4a7fa0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x655248]
xor eax, ebp
mov dword [esp + 0x30], eax
movsd xmm1, qword [0x657c98]
xorpd xmm0, xmm0
ucomisd xmm1, xmm0
jne 0x4a8124
jp 0x4a8124
mov edi, dword [0x64da80]
call edi
push eax
call dword [0x64db3c]
mov dword [esp + 0xc], eax
call edi
push 2
push eax
call dword [0x64dca4]
mov eax, dword [0x657ca8]
mov ecx, dword [0x6593e0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x18]
jg 0x4a8149
mov eax, dword [0x657cb8]
mov ecx, dword [0x6593e0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x18]
jg 0x4a8182
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
lea esi, [esp + 0x28]
push esi
call dword [0x64dc24]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
call dword [0x64da80]
push dword [esp + 0xc]
push eax
call dword [0x64dca4]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push esi
call dword [0x64dc28]
sub edi, dword [0x657cb0]
sbb ebx, dword [0x657cb4]
movd xmm0, ebx
movd xmm1, edi
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x5dcb00]
subpd xmm1, xmmword [0x5dcb10]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
divsd xmm0, qword [esp + 0x20]
xorpd xmm1, xmm1
movsd xmm2, qword [0x5e3778]
ucomisd xmm2, xmm0
ja 0x4a8124
mov eax, dword [esp + 8]
sub eax, dword [0x657ca0]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x657ca4]
movd xmm1, ecx
movd xmm2, eax
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x5dcb00]
subpd xmm2, xmmword [0x5dcb10]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x657c98], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.005aae21
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x657ca8
call fcn.005aae67
add esp, 4
cmp dword [0x657ca8], 0xffffffff
jne 0x4a8012
rdtsc
mov dword [0x657ca0], eax
mov dword [0x657ca4], edx
push 0x657ca8
call fcn.005aaedd
add esp, 4
jmp 0x4a8012
push 0x657cb8
call fcn.005aae67
add esp, 4
cmp dword [0x657cb8], 0xffffffff
jne 0x4a8033
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
lea eax, [esp + 0x28]
push eax
call dword [0x64dc24]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [0x657cb4], ecx
mov dword [0x657cb0], eax
push 0x657cb8
call fcn.005aaedd
add esp, 4
jmp 0x4a8033
Function at 0x4a9600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x655248]
xor eax, ebp
mov dword [esp + 0x18], eax
mov edi, dword [ecx + 0x38]
test edi, edi
jne 0x4a96a3
mov esi, ecx
mov dword [esp + 0x10], 0
mov byte [esp + 0x13], 9
mov dword [esp + 0xc], 0x65647261
mov dword [esp + 8], 0x63736964
mov word [esp + 0x10], 0x64
push 0x40
call fcn.005aadb6
add esp, 4
mov ebx, eax
lea eax, [esp + 8]
mov edi, esp
mov ecx, esi
push eax
push edi
call fcn.004a9510
mov ecx, ebx
push edi
push dword [esi + 0x28]
lea eax, [esp + 0x10]
push eax
call fcn.004a8430
mov edi, dword [esi + 0x38]
mov dword [esi + 0x38], ebx
test edi, edi
je 0x4a968d
mov ecx, edi
call fcn.004a8480
push edi
call fcn.005aade6
add esp, 4
cmp byte [esp + 0x13], 0
jns 0x4a96a0
push dword [esp + 8]
call fcn.005aade6
add esp, 4
mov edi, dword [esi + 0x38]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.005aae21
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ae850
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 0xc]
movzx edx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test dl, dl
mov dword [ebp - 0x10], ecx
lea ecx, [eax + ecx]
mov dword [ebp - 0x20], edx
lea edx, [esi + edx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
jb 0x4ae8bd
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x4ae890
cmp edx, 1
jne 0x4ae8c6
jmp 0x4ae8e2
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x4ae8e2
cmp edx, 2
je 0x4ae8d9
cmp edx, 3
jne 0x4ae8ed
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx + 4]
xor ecx, ecx
test edi, edi
je 0x4aea48
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov ebx, eax
shr ebx, 0xf
xor ebx, eax
mov eax, edi
shr eax, 1
and eax, 0x55555555
mov edx, edi
sub edx, eax
mov eax, edx
and eax, 0x33333333
shr edx, 2
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
ja 0x4ae954
lea edx, [edi - 1]
and edx, ebx
jmp 0x4ae960
mov edx, ebx
cmp ebx, edi
jb 0x4ae960
mov eax, ebx
xor edx, edx
div edi
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x24], edx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4aea48
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
mov ebx, dword [eax]
test ebx, ebx
je 0x4aea48
mov eax, dword [ebp - 0x18]
add eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x10]
cmovns eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x4ae9b6
and eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
jne 0x4aea46
mov ebx, dword [ebx]
test ebx, ebx
je 0x4aea46
mov eax, dword [ebx + 4]
cmp eax, dword [ebp - 0x14]
jne 0x4aea10
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x4ae9cb
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x4ae9ac
lea ecx, [ebx + 8]
mov edx, dword [ecx]
test al, al
cmovs ecx, edx
js 0x4aea28
cmp dword [ebp - 0x10], 0
je 0x4aea42
cmp byte [esi], dl
jne 0x4ae9ac
add eax, 0xffffffff
xor ecx, ecx
nop dword [eax + eax]
cmp eax, ecx
je 0x4aea42
movzx edx, byte [ebx + ecx + 9]
lea edi, [ecx + 1]
cmp dl, byte [esi + ecx + 1]
mov ecx, edi
je 0x4ae9f0
jmp 0x4ae9ac
cmp dword [ebp - 0x28], 1
jbe 0x4ae9a0
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x4ae9a3
xor edx, edx
div ecx
mov eax, edx
jmp 0x4ae9a3
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4aea42
push eax
push esi
push ecx
call fcn.005ad7fd
add esp, 0xc
test eax, eax
jne 0x4ae9ac
mov ecx, ebx
jmp 0x4aea48
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4aee90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x655248]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x4aef9e
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x301
mov dword [esp + 0x54], ecx
mov eax, dword [eax]
mov dword [esp + 0x60], eax
sar eax, 0x1f
mov dword [esp + 0x64], eax
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.004a7890
mov eax, dword [0x5e49b0]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
lea ebx, [esp + 0x50]
mov dword [esp + 0x3c], ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], edi
pxor xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x5d9740]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.004f64f0
sub esp, 0x44
mov al, byte [esp + 0x50]
test al, al
je 0x4aef9e
xor esi, esi
jmp 0x4aef7a
add esi, 1
movzx ecx, al
cmp esi, ecx
jae 0x4aef9e
cmp byte [esp + esi + 0x51], 8
jne 0x4aef70
mov ecx, dword [esp + esi*8 + 0x60]
test ecx, ecx
je 0x4aef70
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
movzx eax, byte [esp + 0x50]
jmp 0x4aef70
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.005aae21
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4aefc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x655248]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x4af0ce
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x701
mov dword [esp + 0x54], ecx
cmp byte [eax + 0xb], 0
jns 0x4af00f
mov eax, dword [eax]
mov dword [esp + 0x60], eax
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.004a7890
mov eax, dword [0x5e49b0]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
lea ebx, [esp + 0x50]
mov dword [esp + 0x3c], ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], edi
pxor xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x5d9740]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.004f64f0
sub esp, 0x44
mov al, byte [esp + 0x50]
test al, al
je 0x4af0ce
xor esi, esi
jmp 0x4af0aa
add esi, 1
movzx ecx, al
cmp esi, ecx
jae 0x4af0ce
cmp byte [esp + esi + 0x51], 8
jne 0x4af0a0
mov ecx, dword [esp + esi*8 + 0x60]
test ecx, ecx
je 0x4af0a0
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
movzx eax, byte [esp + 0x50]
jmp 0x4af0a0
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.005aae21
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret