joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4de850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
xor edi, edi
push 0x80
lea eax, [ebp - 0x98]
push edi
push eax
mov dword [ebp - 0x9c], edi
call fcn.0065b340
mov esi, dword [ebp + 8]
xor eax, eax
add esp, 0xc
mov dword [ebp - 0xbc], edi
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
cmp esi, edi
je 0x4df3eb
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
jne 0x4de8c6
lea ebx, [ebp - 0xbc]
mov dword [ebp + 0x10], ebx
mov edi, dword [esi + 0x48]
mov dword [esi + 0x7c], 1
mov dword [ebp - 8], edi
cmp dword [ebx + 0x14], eax
je 0x4de8df
mov eax, esi
call fcn.004de7c0
call fcn.004de230
mov eax, dword [esi + 0x74]
xor esi, esi
cmp eax, esi
jne 0x4de8f2
mov dword [ebp - 0x10], esi
jmp 0x4de8f7
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
cmp dword [ebx], esi
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
je 0x4de93c
mov eax, 0x925034
call fcn.0051fd20
mov dword [ebp - 0x9c], eax
cmp eax, esi
je 0x4de950
push 2
push esi
push eax
call fcn.0065c165
mov edx, dword [ebp - 0x9c]
add esp, 0xc
push 0x925054
push edx
call fcn.0065a664
mov eax, dword [ebp - 0x9c]
add esp, 8
jmp 0x4de94c
mov eax, 0x991004
call fcn.0051fd20
mov dword [ebp - 0x9c], eax
cmp eax, esi
jne 0x4de968
push ebx
push str.cannot_open_output_file__s
push 1
push 0xa2b
push str..mupdf_sourcepdfpdf_write.c
push edi
call fcn.004b35a0
mov eax, dword [edi + 0xc]
call fcn.004b3520
test eax, eax
je 0x4def26
mov edi, dword [edi + 0xc]
mov eax, dword [edi]
mov ecx, eax
shl ecx, 4
add ecx, eax
lea edx, [edi + ecx*4 + 8]
push esi
push edx
call fcn.0065e2c0
mov edi, dword [ebp - 8]
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx]
mov ebx, edx
shl ebx, 4
add ebx, edx
add esp, 8
mov dword [ecx + ebx*4 + 4], eax
cmp eax, esi
jne 0x4def26
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x98], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x90], edx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x8c], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x94], edx
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x88], ecx
mov edx, dword [eax + 0x14]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], SysReAllocString
call fcn.004c26c0
mov esi, eax
add esi, 3
je 0x4dea46
cmp esi, 0x3fffffff
jbe 0x4dea1d
push 4
push esi
push str.malloc_of_array___d_x__d_bytes__failed__integer_overflow_
push 1
push 0x53
push str..mupdf_source_fitzmemory.c
push edi
call fcn.004b35a0
lea ebx, [esi*4]
mov eax, edi
call fcn.004d1410
test eax, eax
jne 0x4dea48
push 4
push esi
push str.malloc_of_array___d_x__d_bytes__failed
push 1
push 0x57
push str..mupdf_source_fitzmemory.c
push edi
call fcn.004b35a0
xor eax, eax
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 8]
call fcn.004c26c0
mov esi, eax
add esi, 3
je 0x4dea82
cmp esi, 0x3fffffff
ja 0x4dea06
lea ebx, [esi*4]
mov eax, edi
invalid
invalid
sub edi, edi
Function at 0x4eb0f0
Capabilities:
Hash data with md5
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x8c
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x94]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, edx
mov dword [esp + 0x14], eax
mov eax, dword [edi + 8]
cdq
and edx, 7
lea ebp, [edx + eax]
sar ebp, 3
cmp esi, 0x20
jle 0x4eb133
mov esi, 0x20
push esi
push ecx
lea ecx, [esp + 0x7c]
push ecx
call fcn.0065b3c0
mov edx, 0x20
sub edx, esi
push edx
lea eax, [esp + esi + 0x84]
push 0x7b6f54
push eax
call fcn.0065b3c0
xor ebx, ebx
lea ecx, [esp + 0x8c]
push ecx
lea eax, [ebx + 0x20]
lea ecx, [esp + 0x34]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x34], 0x67452301
mov dword [esp + 0x38], 0xefcdab89
mov dword [esp + 0x3c], 0x98badcfe
mov dword [esp + 0x40], 0x10325476
call fcn.004af110
lea edx, [edi + 0x24]
push edx
lea eax, [ebx + 0x20]
lea ecx, [esp + 0x38]
call fcn.004af110
mov eax, dword [edi + 0xc4]
mov ecx, eax
mov edx, eax
mov byte [esp + 0x94], al
shr eax, 0x18
mov byte [esp + 0x97], al
shr ecx, 8
lea eax, [esp + 0x94]
mov byte [esp + 0x95], cl
shr edx, 0x10
push eax
lea eax, [ebx + 4]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x9a], dl
call fcn.004af110
mov eax, dword [edi]
add esp, 0x24
cmp eax, ebx
je 0x4eb212
cmp byte [eax + 4], 0x72
jne 0x4eb202
push eax
call fcn.004c74c0
add esp, 4
cmp eax, ebx
je 0x4eb212
cmp byte [eax + 4], 0x73
jne 0x4eb212
movzx esi, word [eax + 0x10]
jmp 0x4eb214
xor esi, esi
mov eax, dword [edi]
cmp eax, ebx
je 0x4eb238
cmp byte [eax + 4], 0x72
jne 0x4eb229
push eax
call fcn.004c74c0
add esp, 4
cmp eax, ebx
je 0x4eb238
cmp byte [eax + 4], 0x73
jne 0x4eb238
add eax, 0x12
jmp 0x4eb23d
mov eax, 0x925010
push eax
mov eax, esi
lea ecx, [esp + 0x1c]
call fcn.004af110
add esp, 4
cmp dword [edi + 0x20], 4
jl 0x4eb278
cmp dword [edi + 0xc8], ebx
jne 0x4eb278
lea ecx, [esp + 0x74]
push ecx
mov eax, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x78], 0xffffffff
call fcn.004af110
add esp, 4
lea edx, [esp + 0x74]
push edx
lea esi, [esp + 0x1c]
call fcn.004af1b0
add esp, 4
cmp dword [edi + 0x20], 3
jl 0x4eb2e0
mov edi, 0x32
lea eax, [esp + 0x74]
push eax
mov eax, ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x67452301
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
call fcn.004af110
lea ecx, [esp + 0x78]
push ecx
lea esi, [esp + 0x20]
call fcn.004af1b0
add esp, 8
dec edi
jne 0x4eb294
mov eax, dword [esp + 0x14]
push ebp
lea edx, [esp + 0x78]
push edx
push eax
call fcn.0065b3c0
mov ecx, dword [esp + 0xa0]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0065865c
add esp, 0x8c
ret
Function at 0x4eb310
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x254
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x24c], eax
mov eax, dword [esp + 0x258]
push ebx
push ebp
mov ebp, dword [esp + 0x264]
mov ebx, edx
push esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x26c]
push edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ecx
cmp ebx, 0x7f
jle 0x4eb35c
mov dword [esp + 0x14], 0x7f
mov ebx, dword [esp + 0x14]
push ebx
push eax
lea edx, [esp + 0x1a8]
push edx
call fcn.0065b3c0
mov eax, dword [esp + 0x280]
xor edx, edx
add esp, 0xc
cmp eax, edx
je 0x4eb3a2
mov ecx, dword [ebp + 0x44]
mov dword [esp + ebx + 0x1a0], ecx
mov ecx, dword [ebp + 0x48]
mov dword [esp + ebx + 0x1a4], ecx
lea esi, [ebp + 0x54]
lea edi, [esp + ebx + 0x1a8]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
jmp 0x4eb3b6
mov ecx, dword [ebp + 0x74]
mov dword [esp + ebx + 0x1a0], ecx
mov ecx, dword [ebp + 0x78]
mov dword [esp + ebx + 0x1a4], ecx
neg eax
sbb eax, eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], edx
and eax, 0x30
lea edx, [esp + 0x1a0]
mov esi, 0x5be0cd19
lea eax, [eax + ebx + 8]
push edx
lea edi, [esp + 0x24]
mov dword [esp + 0x24], 0x6a09e667
mov dword [esp + 0x28], 0xbb67ae85
mov dword [esp + 0x2c], 0x3c6ef372
mov dword [esp + 0x30], 0xa54ff53a
mov dword [esp + 0x34], 0x510e527f
mov dword [esp + 0x38], 0x9b05688c
mov dword [esp + 0x3c], 0x1f83d9ab
mov dword [esp + 0x40], esi
call fcn.004afeb0
mov eax, dword [esp + 0x20]
push eax
mov ebx, edi
call fcn.004aff10
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebp + 0x7c]
mov edx, dword [ebp + 0x80]
mov dword [esp + eax + 0x1a8], ecx
xor ecx, ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x1a8]
mov dword [esp + eax + 0x1ac], edx
add eax, 8
push ecx
mov dword [esp + 0x2c], 0x6a09e667
mov dword [esp + 0x30], 0xbb67ae85
mov dword [esp + 0x34], 0x3c6ef372
mov dword [esp + 0x38], 0xa54ff53a
mov dword [esp + 0x3c], 0x510e527f
mov dword [esp + 0x40], 0x9b05688c
mov dword [esp + 0x44], 0x1f83d9ab
mov dword [esp + 0x48], esi
call fcn.004afeb0
lea edx, [esp + 0x1ac]
push edx
call fcn.004aff10
push 0x98
lea eax, [esp + 0x1d4]
push 0
push eax
call fcn.0065b340
mov ecx, dword [ebp + 8]
push ecx
lea edx, [esp + 0x1c0]
lea ecx, [esp + 0xa8]
call fcn.00532a00
add esp, 0x20
test eax, eax
je 0x4eb4f6
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x18]
push edx
push str.AES_key_init_failed__keylen_d_
push 1
push 0x1bf
push str..mupdf_sourcepdfpdf_crypt.c
push eax
call fcn.004b35a0
cmp dword [esp + 0x274], 0
lea ecx, [ebp + 0x84]
jne 0x4eb50c
lea ecx, [ebp + 0xa4]
push ecx
lea ecx, [esp + 0x8c]
push 0
lea eax, [ebp + 0xcc]
push ecx
lea edi, [esp + 0x1cc]
mov edx, 0x20
call fcn.00533690
mov ecx, dword [esp + 0x268]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0065865c
add esp, 0x254
ret
Function at 0x4ec7c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [ecx + 8]
push ebx
mov ebx, edx
cdq
push esi
mov esi, dword [ebp + 0x10]
and edx, 7
push edi
lea edi, [edx + eax]
sar edi, 3
cmp edi, 0x20
jle 0x4ec7f3
mov edi, 0x20
mov eax, dword [ebp + 8]
add ecx, 0xcc
cmp dword [eax], 3
jne 0x4ec820
push edi
push ecx
push esi
call fcn.0065b3c0
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0065865c
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
push ecx
mov eax, edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.004af110
mov eax, dword [ebp + 0xc]
mov ecx, ebx
mov byte [esp + 0x73], al
sar ecx, 8
sar eax, 8
mov byte [esp + 0x70], bl
lea edx, [esp + 0x70]
mov byte [esp + 0x71], cl
mov byte [esp + 0x74], al
sar ebx, 0x10
push edx
mov eax, 5
lea ecx, [esp + 0x18]
mov byte [esp + 0x76], bl
call fcn.004af110
mov eax, dword [ebp + 8]
add esp, 8
cmp dword [eax], 2
jne 0x4ec8ac
push str.sAlT
mov eax, 4
lea ecx, [esp + 0x14]
call fcn.004af110
add esp, 4
push esi
lea esi, [esp + 0x14]
call fcn.004af1b0
lea eax, [edi + 5]
add esp, 4
cmp eax, 0x10
jle 0x4ec8c6
mov eax, 0x10
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0065865c
mov esp, ebp
pop ebp
ret
Function at 0x4fdbb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, dword [ebp]
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
xor ecx, ecx
push edi
mov dword [esp + 0x18], esi
test ebx, ebx
jle 0x4fdbec
mov edx, ebx
lea esp, [esp]
mov edi, dword [esp + 0x1c]
movzx edi, byte [ecx + edi]
add eax, edi
imul eax, eax, 0x401
mov edi, eax
shr edi, 6
inc ecx
xor eax, edi
cmp ecx, edx
jl 0x4fdbd0
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
xor edx, edx
div dword [ebp + 4]
mov edi, edx
mov ecx, edi
imul ecx, ecx, 0x34
add ecx, esi
cmp dword [ecx + 0x30], 0
je 0x4fdc75
mov esi, dword [esp + 0x1c]
mov eax, ebx
cmp eax, 4
jb 0x4fdc34
jmp 0x4fdc20
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x4fdc58
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x4fdc20
test eax, eax
je 0x4fdca6
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x4fdc58
cmp eax, 1
jbe 0x4fdca6
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x4fdc58
cmp eax, 2
jbe 0x4fdca6
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
je 0x4fdca6
lea eax, [edi + 1]
xor edx, edx
div dword [ebp + 4]
mov edi, edx
mov ecx, edi
imul ecx, ecx, 0x34
add ecx, dword [esp + 0x18]
cmp dword [ecx + 0x30], 0
jne 0x4fdc10
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, edi
imul eax, eax, 0x34
push ebx
add esi, eax
push ecx
push esi
call fcn.0065b3c0
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esi + 0x30], edx
inc dword [ebp + 8]
add esp, 0xc
test eax, eax
je 0x4fdc9f
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4fdcc0
mov ecx, dword [esp + 0x18]
mov dword [eax], edi
imul edi, edi, 0x34
mov eax, dword [edi + ecx + 0x30]
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x14]
push str.assert:_overwrite_hash_slot
push 0x88
push str..mupdf_source_fitzhash.c
push eax
call fcn.004b3370
imul edi, edi, 0x34
mov ecx, dword [esp + 0x28]
mov eax, dword [edi + ecx + 0x30]
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4fdea0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [edx + 0x10]
push ebp
mov ebp, dword [edx]
push esi
mov esi, dword [edx + 4]
xor eax, eax
xor ecx, ecx
push edi
mov dword [esp + 0x10], esi
test ebp, ebp
jle 0x4fdedc
lea esp, [esp]
mov edx, dword [esp + 0x18]
movzx edx, byte [ecx + edx]
add eax, edx
imul eax, eax, 0x401
mov edx, eax
shr edx, 6
inc ecx
xor eax, edx
cmp ecx, ebp
jl 0x4fdec0
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
xor edx, edx
div esi
mov edi, edx
mov ecx, edi
imul ecx, ecx, 0x34
add ecx, ebx
cmp dword [ecx + 0x30], 0
je 0x4fdf60
nop
mov esi, dword [esp + 0x18]
mov eax, ebp
cmp eax, 4
jb 0x4fdf24
jmp 0x4fdf10
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x4fdf48
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x4fdf10
test eax, eax
je 0x4fdf68
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x4fdf48
cmp eax, 1
jbe 0x4fdf68
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x4fdf48
cmp eax, 2
jbe 0x4fdf68
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
je 0x4fdf68
lea eax, [edi + 1]
xor edx, edx
div dword [esp + 0x10]
mov edi, edx
mov ecx, edi
imul ecx, ecx, 0x34
add ecx, ebx
cmp dword [ecx + 0x30], 0
jne 0x4fdf00
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
imul edi, edi, 0x34
mov eax, dword [edi + ebx + 0x30]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4fe020
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [edx + 0x10]
push edi
mov edi, eax
mov eax, dword [edx + 4]
mov ecx, edi
imul ecx, ecx, 0x34
lea ebp, [edi + 1]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [ecx + esi + 0x30], 0
cmp ebp, eax
jne 0x4fe051
xor ebp, ebp
mov ebx, ebp
imul ebx, ebx, 0x34
add ebx, esi
cmp dword [ebx + 0x30], 0
jne 0x4fe074
dec dword [edx + 8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x1c]
xor eax, eax
xor ecx, ecx
cmp dword [edx], eax
jle 0x4fe09c
mov edx, dword [edx]
mov edi, edi
movzx esi, byte [ebx + ecx]
add eax, esi
imul eax, eax, 0x401
mov esi, eax
shr esi, 6
inc ecx
xor eax, esi
cmp ecx, edx
jl 0x4fe080
mov esi, dword [esp + 0x10]
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
xor edx, edx
div dword [esp + 0x14]
cmp edx, edi
ja 0x4fe0ba
cmp edi, ebp
jb 0x4fe0ca
cmp ebp, edx
jae 0x4fe0c2
cmp edx, edi
jbe 0x4fe0ca
cmp edi, ebp
jae 0x4fe0e5
cmp ebp, edx
jae 0x4fe0e5
imul edi, edi, 0x34
add edi, esi
mov ecx, 0xd
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x10]
mov dword [ebx + 0x30], 0
mov edi, ebp
inc ebp
cmp ebp, dword [esp + 0x14]
jne 0x4fe0ee
xor ebp, ebp
mov ebx, ebp
imul ebx, ebx, 0x34
add ebx, esi
cmp dword [ebx + 0x30], 0
jne 0x4fe070
mov eax, dword [esp + 0x1c]
dec dword [eax + 8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4fe110
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
push ebp
mov ebp, dword [edx]
push esi
mov esi, dword [edx + 0x10]
push edi
mov edi, dword [edx + 4]
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
test ebp, ebp
jle 0x4fe14a
movzx edx, byte [ecx + ebx]
add eax, edx
imul eax, eax, 0x401
mov edx, eax
shr edx, 6
inc ecx
xor eax, edx
cmp ecx, ebp
jl 0x4fe132
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
xor edx, edx
div edi
mov eax, edx
mov ecx, eax
imul ecx, ecx, 0x34
add esi, ecx
cmp dword [esi + 0x30], 0
je 0x4fe1d0
lea ecx, [ecx]
mov ecx, ebp
mov edi, ebx
cmp ecx, 4
jb 0x4fe194
lea esp, [esp]
mov edx, dword [edi]
cmp edx, dword [esi]
jne 0x4fe1b8
sub ecx, 4
add esi, 4
add edi, 4
cmp ecx, 4
jae 0x4fe180
test ecx, ecx
je 0x4fe1f3
mov dl, byte [esi]
cmp dl, byte [edi]
jne 0x4fe1b8
cmp ecx, 1
jbe 0x4fe1f3
mov dl, byte [esi + 1]
cmp dl, byte [edi + 1]
jne 0x4fe1b8
cmp ecx, 2
jbe 0x4fe1f3
mov cl, byte [esi + 2]
cmp cl, byte [edi + 2]
je 0x4fe1f3
inc eax
cmp eax, dword [esp + 0xc]
jne 0x4fe1c1
xor eax, eax
mov esi, eax
imul esi, esi, 0x34
add esi, dword [esp + 0x10]
cmp dword [esi + 0x30], 0
jne 0x4fe170
mov edx, dword [esp + 0x18]
push str.assert:_remove_non_existent_hash_entry
push 0x127
push str..mupdf_source_fitzhash.c
push edx
call fcn.004b3370
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004fe020
add esp, 4
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x50dfa0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
inc edx
lea esi, [eax + 7]
jmp 0x50dfb0
movzx ecx, byte [edx - 1]
add ecx, eax
imul ecx, ecx, 0x401
mov eax, ecx
shr eax, 6
xor eax, ecx
movzx ecx, byte [edx]
add eax, ecx
imul eax, eax, 0x401
mov ecx, eax
shr ecx, 6
xor ecx, eax
movzx eax, byte [edx + 1]
add ecx, eax
imul ecx, ecx, 0x401
mov eax, ecx
shr eax, 6
xor eax, ecx
movzx ecx, byte [edx + 2]
add eax, ecx
imul eax, eax, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
add edx, 4
dec esi
jne 0x50dfb0
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
pop esi
ret
Function at 0x5283d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push edi
push 0x98
push 0
push esi
mov edi, eax
call fcn.0065b340
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov ebx, 1
mov dword [esi], eax
lea eax, [edi + ecx]
mov ecx, 2
add esp, 0xc
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x60], ecx
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x64], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x34], 0
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ecx
mov dword [esi + 0x78], ecx
mov dword [esi + 0x10], 0x4949
cmp edi, eax
jae 0x528444
mov cl, byte [edi]
inc edi
mov dword [esi + 8], edi
movzx edi, cl
jmp 0x528447
or edi, 0xffffffff
mov ecx, dword [esi + 8]
cmp ecx, eax
jae 0x528459
mov dl, byte [ecx]
inc ecx
mov dword [esi + 8], ecx
movzx ecx, dl
jmp 0x52845c
or ecx, 0xffffffff
shl ecx, 8
or ecx, edi
mov ebp, ecx
mov dword [esi + 0x10], ebp
cmp ebp, 0x4949
je 0x528490
cmp ebp, 0x4d4d
je 0x528490
mov edx, dword [esp + 0x10]
push str.not_a_TIFF_file__wrong_magic_marker
push ebx
push 0x2f0
push str..mupdf_source_fitzload_tiff.c
push edx
call fcn.004b35a0
mov edx, dword [esi + 8]
cmp edx, eax
jae 0x5284a2
mov cl, byte [edx]
inc edx
mov dword [esi + 8], edx
movzx edx, cl
jmp 0x5284a5
or edx, 0xffffffff
mov edi, dword [esi + 8]
cmp edi, eax
jae 0x5284b7
mov al, byte [edi]
inc edi
mov dword [esi + 8], edi
movzx eax, al
jmp 0x5284ba
or eax, 0xffffffff
cmp ebp, 0x4949
jne 0x5284c7
shl eax, 8
jmp 0x5284ca
shl edx, 8
or eax, edx
cmp eax, 0x2a
je 0x5284eb
mov eax, dword [esp + 0x10]
push str.not_a_TIFF_file__wrong_version_marker
push ebx
push 0x2f5
push str..mupdf_source_fitzload_tiff.c
push eax
call fcn.004b35a0
mov eax, esi
call fcn.00527c70
pop edi
pop ebp
mov dword [esi + 0x14], eax
pop ebx
ret
Function at 0x532270
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x804
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
push ebp
xor ecx, ecx
push esi
lea eax, [ecx + 1]
push edi
lea ecx, [ecx]
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
lea esi, [eax + eax]
and edx, 0x1b
mov dword [esp + ecx*4 + 0x410], eax
mov dword [esp + eax*4 + 0x10], ecx
xor edx, esi
xor eax, edx
inc ecx
and eax, 0xff
cmp ecx, 0x100
jl 0x532290
mov eax, 1
mov ecx, 0x9f2a98
lea esp, [esp]
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
mov dword [ecx], eax
add eax, eax
and edx, 0x1b
xor eax, edx
add ecx, 4
and eax, 0xff
cmp ecx, 0x9f2ac0
jl 0x5322d0
mov byte [0x9f2198], 0x63
mov byte [0x9f4323], 0
mov ebx, 1
mov ecx, dword [esp + ebx*4 + 0x10]
add ecx, ecx
add ecx, ecx
lea edx, [esp + 0x80c]
sub edx, ecx
mov eax, dword [edx]
mov ecx, eax
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
and edx, 0xff
xor eax, edx
mov ecx, edx
add edx, edx
sar ecx, 7
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
xor edx, 0x63
and edx, 0xff
xor eax, edx
mov byte [ebx + 0x9f2198], al
mov byte [eax + 0x9f42c0], bl
inc ebx
cmp ebx, 0x100
jl 0x532308
xor ecx, ecx
lea ebx, [ebx]
movzx esi, byte [ecx + 0x9f2198]
mov edx, esi
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea eax, [esi + esi]
xor edx, eax
and edx, 0xff
mov eax, edx
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, edx
mov dword [ecx*4 + 0x9f3ec0], eax
rol eax, 8
mov dword [ecx*4 + 0x9f3ac0], eax
rol eax, 8
mov dword [ecx*4 + 0x9f36c0], eax
rol eax, 8
mov dword [ecx*4 + 0x9f32c0], eax
movzx eax, byte [ecx + 0x9f42c0]
test eax, eax
je 0x532436
mov esi, dword [esp + eax*4 + 0x10]
mov edx, dword [esp + 0x48]
lea eax, [esi + edx]
cdq
mov edi, 0xff
idiv edi
mov eax, dword [esp + 0x34]
add eax, esi
mov ebp, dword [esp + edx*4 + 0x410]
cdq
idiv edi
mov ebx, dword [esp + edx*4 + 0x410]
mov edx, dword [esp + 0x44]
lea eax, [esi + edx]
cdq
idiv edi
mov eax, dword [esp + 0x3c]
add eax, esi
mov esi, 0xff
mov edi, dword [esp + edx*4 + 0x410]
cdq
idiv esi
mov edx, dword [esp + edx*4 + 0x410]
jmp 0x53243e
xor ebp, ebp
xor ebx, ebx
xor edi, edi
xor edx, edx
shl edx, 8
xor edx, edi
shl edx, 8
xor edx, ebx
shl edx, 8
xor edx, ebp
mov dword [ecx*4 + 0x9f2ec0], edx
rol edx, 8
mov dword [ecx*4 + 0x9f2ac0], edx
rol edx, 8
mov dword [ecx*4 + 0x9f2698], edx
rol edx, 8
mov dword [ecx*4 + 0x9f2298], edx
inc ecx
cmp ecx, 0x100
jl 0x532380
mov ecx, dword [esp + 0x810]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0065865c
add esp, 0x804
ret