joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bd80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x6dfb96
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc00]
test eax, eax
push esi
push edi
jne 0x44bfab
mov eax, dword [ebx + 0x544]
dec eax
xorps xmm0, xmm0
movss dword [esp + 0x18], xmm0
mov edi, 0x91a408
je 0x44be3a
dec eax
mov al, byte [ebx + 0x524]
je 0x44bde7
test al, 0x40
je 0x44bde0
push 0x8cf670
jmp 0x44be4f
push 0x8cf668
jmp 0x44be4f
test al, 0x40
je 0x44bdf2
push 0x8cfc94
jmp 0x44bdf7
push 0x8cfcb0
call fcn.0050e790
test eax, eax
je 0x44be05
movss xmm0, dword [eax + 4]
mov edx, dword [ebx]
movss dword [esp + 0x14], xmm0
fld dword [esp + 0x14]
fmul dword [0x738ab4]
mov ecx, ebx
fstp dword [esp + 0x14]
call dword [edx + 0x4f8]
fmul dword [esp + 0x14]
fmul dword [ebp + 0xc]
fld dword [0x757e10]
fmul st(1)
fstp dword [esp + 0x18]
fstp st(0)
jmp 0x44be86
test byte [ebx + 0x524], 0x40
je 0x44be4a
push 0x8cfcb8
jmp 0x44be4f
push 0x8cfca4
call fcn.0050e790
test eax, eax
je 0x44be5d
movss xmm0, dword [eax + 4]
mov eax, dword [ebx]
movss dword [esp + 0x14], xmm0
fld dword [esp + 0x14]
fmul dword [0x738ab4]
mov ecx, ebx
fstp dword [esp + 0x14]
call dword [eax + 0x4f8]
fmul dword [esp + 0x14]
fmul dword [ebp + 0xc]
fstp dword [esp + 0x18]
xorps xmm0, xmm0
comiss xmm0, dword [esp + 0x18]
jbe 0x44beba
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x4f4]
fadd dword [esp + 0x18]
fld dword [0x738a54]
fcompi st(1)
fstp st(0)
jbe 0x44beba
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x4f4]
fchs
fstp dword [esp + 0x18]
mov edx, dword [ebx]
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
call dword [edx + 0x4f0]
test byte [ebx + 0x524], 0x40
je 0x44bfab
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x4f4]
fld dword [0x738a6c]
fcompi st(1)
fstp st(0)
jbe 0x44bfab
mov eax, dword [ebx + 0x2510]
test eax, eax
je 0x44bf9f
mov edx, str.GENERIC_LETHAL
lea esi, [esp + 0x14]
call fcn.005112a0
xor esi, esi
lea ecx, [esp + 0x30]
mov dword [esp + 0x1ac], esi
call fcn.00527d10
mov byte [esp + 0x1ac], 1
movss xmm0, dword [ebx + 0x48]
movss xmm1, dword [ebx + 0x44]
movss xmm2, dword [ebx + 0x40]
lea eax, [esp + 0x20]
push eax
sub esp, 8
mov eax, esp
mov dword [esp + 0x28], esp
push str.GENERIC_LETHAL
lea ecx, [esp + 0x40]
movss dword [esp + 0x30], xmm2
movss dword [esp + 0x34], xmm1
movss dword [esp + 0x38], xmm0
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00527eb0
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
push ecx
push edx
lea ecx, [esp + 0x38]
call fcn.00528140
push ebx
call fcn.00528a80
lea ecx, [esp + 0x30]
call fcn.00493b70
mov ecx, dword [esp + 0x1a4]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx]
push 0
mov ecx, ebx
call dword [eax + 0x27c]
mov ecx, dword [esp + 0x1a4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4646c6
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6deb51
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov byte [esp + 0x14], 2
call fcn.00464a60
mov ecx, dword [esp + 0xc]
mov dword [esi], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x46f2a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6e0aa8
mov eax, dword fs:[0]
push eax
mov eax, dword [esp + 0x28]
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x38]
push eax
push ecx
mov ecx, 0x8d68e0
call fcn.004013f0
imul esi, esi, 0x1c
mov ax, word [eax + 0x76]
xor edx, edx
mov dl, al
movzx ax, ah
and edx, 0xff
mov ecx, edx
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi + ecx + 0xc8]
push ebp
push eax
mov eax, dword [0x91a2e8]
mov ecx, dword [eax + edx*8]
add ecx, dword [0x91a2fc]
push ecx
lea edx, [esp + 0x20]
push edx
mov ecx, 0x91a698
call fcn.00510720
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov ecx, 0x8d68e0
call fcn.004013f0
mov esi, eax
test esi, esi
je 0x46f47b
push edi
push ebx
lea edx, [esp + 0x30]
push str._s_SPEED
push edx
call fcn.00626a10
mov edx, dword [eax]
add esp, 0xc
call fcn.0050e6f0
and eax, 0xfffffff
or eax, 0x10000000
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x2c]
call fcn.00626990
lea eax, [esp + 0x28]
push eax
mov edi, 0x91a408
call fcn.0050e790
test eax, eax
je 0x46f393
movss xmm0, dword [eax + 4]
jmp 0x46f396
xorps xmm0, xmm0
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edx, dword [esi]
push eax
mov eax, dword [esp + 0x48]
push ecx
mov ecx, dword [eax]
mov eax, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x48]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
movss dword [esp + 0x48], xmm0
mov eax, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x48]
push ecx
push ebp
push eax
mov ecx, esi
call dword [edx + 0xec]
push ebx
lea ecx, [esp + 0x34]
push str._s_PainDropDist
push ecx
call fcn.00626a10
mov edx, dword [eax]
call fcn.0050e6f0
and eax, 0xfffffff
or eax, 0x10000000
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x3c]
call fcn.00626990
push ebx
lea edx, [esp + 0x40]
push str._s_PainDropScale
push edx
call fcn.00626a10
mov edx, dword [eax]
add esp, 0x18
call fcn.0050e6f0
and eax, 0xfffffff
or eax, 0x10000000
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x30]
call fcn.00626990
lea eax, [esp + 0x34]
push eax
mov edi, 0x91a408
call fcn.0050e790
test eax, eax
je 0x46f44a
movss xmm1, dword [eax + 4]
jmp 0x46f44d
xorps xmm1, xmm1
lea ecx, [esp + 0x2c]
push ecx
mov edi, 0x91a408
call fcn.0050e790
test eax, eax
pop edi
je 0x46f468
movss xmm0, dword [eax + 4]
jmp 0x46f46b
xorps xmm0, xmm0
movss dword [esi + 0xd0], xmm0
movss dword [esi + 0xd4], xmm1
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x28
Function at 0x47fe60
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x6e0eb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0xa
mov ecx, 0x784858
call fcn.0065ead0
mov edx, dword [eax]
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call dword [edx + 0xf0]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
mov ecx, 0x8d68e0
call fcn.004013f0
test eax, eax
mov dword [esp + 0x14], eax
je 0x480089
mov edx, str.THETA_PROJECTILE
mov eax, 0x1505
mov ecx, 0x54
mov edi, edi
inc edx
cmp ecx, 0x61
jl 0x47fede
cmp ecx, 0x7a
jg 0x47fede
sub ecx, 0x20
imul eax, eax, 0x21
xor eax, ecx
movsx ecx, byte [edx]
test ecx, ecx
jne 0x47fed0
and eax, 0xfffffff
or eax, 0x40000000
mov dword [esp + 0x10], eax
mov dword [esp + 0x5c], ecx
lea ecx, [ebx + 0xde0]
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov dword [esp + 0x30], edx
fld dword [esp + 0x30]
mov edx, dword [ecx + 8]
mov dword [esp + 0x34], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0xc]
fsub dword [eax]
mov dword [esp + 0x38], edx
movss xmm0, dword [esp + 0x38]
fld dword [esp + 0x34]
fsub dword [eax + 4]
subss xmm0, dword [eax + 8]
movss dword [esp + 0xc], xmm0
fld dword [esp + 0xc]
fmul dword [esp + 0xc]
movss dword [esp + 0x38], xmm0
fld st(2)
xorps xmm0, xmm0
fmul st(3)
movss dword [esp + 0x2c], xmm0
mov edx, str.THETA_ProjectileSpeed
mov ecx, 0x1505
faddp st(1)
mov eax, 0x54
fsqrt
fxch st(1)
fxch st(1)
fpatan
fchs
fstp dword [esp + 0x24]
fld dword [esp + 0x38]
fpatan
fstp dword [esp + 0x28]
inc edx
cmp eax, 0x61
jl 0x47ff90
cmp eax, 0x7a
jg 0x47ff90
sub eax, 0x20
imul ecx, ecx, 0x21
xor ecx, eax
movsx eax, byte [edx]
test eax, eax
jne 0x47ff82
and ecx, 0xfffffff
or ecx, 0x10000000
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0xc]
push ecx
mov edi, 0x91a408
call fcn.0050e790
test eax, eax
je 0x47ffd9
lea edx, [esp + 0xc]
push edx
call fcn.0050e790
test eax, eax
je 0x47ffd4
movss xmm1, dword [eax + 4]
jmp 0x47ffe1
movaps xmm1, xmm0
jmp 0x47ffe1
movss xmm1, dword [0x738aa4]
lea edi, [esp + 0x24]
lea esi, [esp + 0x40]
movss dword [esp + 0x40], xmm0
movss dword [esp + 0x44], xmm0
movss dword [esp + 0x48], xmm1
call fcn.0042e0f0
movzx eax, word [ebx + 0x76]
mov ecx, dword [esp + 0x10]
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0xc]
push ecx
mov edx, eax
push 0
shr edx, 8
push edx
mov edx, dword [ebp + 0xc]
and eax, 0xff
push eax
lea eax, [esp + 0x50]
push eax
mov eax, dword [ebx]
lea ecx, [esp + 0x38]
push ecx
push edx
mov ecx, ebx
call dword [eax + 0xb8]
push edi
push esi
mov esi, dword [esp + 0x38]
mov edx, eax
call fcn.004af0e0
movss xmm0, dword [ebx + 0x40]
xor ecx, ecx
mov cl, byte [ebx + 0x76]
push 0
push 1
lea edx, [esp + 0x38]
movss dword [esp + 0x38], xmm0
movss xmm0, dword [ebx + 0x44]
movss dword [esp + 0x3c], xmm0
movss xmm0, dword [ebx + 0x48]
and ecx, 0xff
push ecx
push edx
push 1
push 0x940c00
mov edx, str.Theta_Projectile
movss dword [esp + 0x50], xmm0
call fcn.006335d0
mov ecx, dword [esp + 0x54]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x481910
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x6e2bfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x178
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
push ebx
push esi
push edi
jle 0x4819ee
cmp eax, 6
jge 0x4819ee
shl eax, 5
mov edx, dword [eax + ecx + 0x22fc]
lea eax, [eax + ecx + 0x22f8]
mov dword [esp + 0xc], eax
mov eax, dword [eax]
push edx
push eax
mov ecx, 0x8d68e0
call fcn.004013f0
mov ebx, eax
test ebx, ebx
je 0x4819ee
mov esi, dword [ebp + 0xc]
mov ecx, 0x5c
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x18c], 0
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.00528140
mov eax, dword [ebx]
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call dword [eax + 0x30]
mov eax, dword [esp + 0xc]
movss xmm0, dword [0x738a1c]
lea esi, [eax + 0x1c]
movss dword [eax + 0x10], xmm0
call fcn.0047f220
and dword [esp + 0x17c], 0xfffffffc
lea eax, [esp + 0x10]
call fcn.00527df0
mov eax, 1
mov ecx, dword [esp + 0x184]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esp + 0x184]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x488070
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x6e2556
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push edi
mov edx, str.MUTANT_CONT_FAKE
mov eax, 0x1505
mov ecx, 0x4d
inc edx
cmp ecx, 0x61
jl 0x4880af
cmp ecx, 0x7a
jg 0x4880af
sub ecx, 0x20
imul eax, eax, 0x21
xor eax, ecx
movsx ecx, byte [edx]
test ecx, ecx
jne 0x4880a1
and eax, 0xfffffff
or eax, 0x40000000
mov edi, eax
mov dword [esp + 4], edi
mov dword [esp + 0x18c], ecx
lea ecx, [esp + 0x10]
call fcn.00527d10
mov byte [esp + 0x18c], 1
mov eax, dword [ebx + 0xe4]
mov ecx, dword [ebx + 0xe0]
push eax
push ecx
push edi
lea edx, [esp + 0x1c]
push edx
mov eax, 0x93ccc0
call fcn.00527ee0
push 0x93ccb0
lea ecx, [esp + 0x14]
call fcn.00528060
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov edx, eax
or eax, ecx
mov dword [esp + 0x70], edx
mov edx, ecx
mov dword [esp + 0x74], edx
je 0x48812c
mov eax, 1
jmp 0x48812e
xor eax, eax
mov ecx, dword [esp + 0x17c]
shl eax, 4
xor eax, ecx
and eax, 0x10
xor ecx, eax
mov dword [esp + 0x17c], ecx
push esi
lea ecx, [esp + 0x14]
call fcn.00528a80
mov eax, dword [0x7555d0]
test eax, eax
je 0x4881ab
mov eax, dword [0x779958]
test eax, eax
je 0x4881ab
mov eax, dword [ebx + 0x368]
or eax, dword [ebx + 0x36c]
jne 0x4881ab
xor ecx, ecx
mov cl, byte [ebx + 0x76]
lea edx, [ebx + 0x2a0]
lea eax, [esp + 8]
and ecx, 0xff
push ecx
push edx
push 0x93ccb0
push eax
mov ecx, str.BloodBag_000.fxo
call fcn.004c54a0
mov ecx, dword [eax]
mov dword [ebx + 0x368], ecx
mov edx, dword [eax + 4]
add esp, 0x10
mov dword [ebx + 0x36c], edx
and dword [esp + 0x17c], 0xfffffffc
lea eax, [esp + 0x10]
call fcn.00527df0
mov ecx, dword [esp + 0x184]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4afe70
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x6dfa66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x178
push ebx
push esi
push edi
mov edi, ecx
mov edx, str.BBG_TINYPAIN
mov eax, 0x1505
mov ecx, 0x42
inc edx
cmp ecx, 0x61
jl 0x4afeb3
cmp ecx, 0x7a
jg 0x4afeb3
sub ecx, 0x20
imul eax, eax, 0x21
xor eax, ecx
movsx ecx, byte [edx]
test ecx, ecx
jne 0x4afea5
and eax, 0xfffffff
or eax, 0x40000000
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x18c], ecx
lea ecx, [esp + 0x10]
call fcn.00527d10
mov eax, dword [ebp + 0x10]
mov byte [esp + 0x18c], 1
mov ecx, dword [edi + 0xe4]
mov edx, dword [edi + 0xe0]
push ecx
push edx
push esi
lea ecx, [esp + 0x1c]
add eax, 0x10
push ecx
call fcn.00527ee0
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push ebx
push edi
mov ecx, 0x8d68e0
call fcn.004013f0
mov esi, eax
test esi, esi
je 0x4aff70
mov dword [esp + 0x70], edi
or edi, ebx
mov dword [esp + 0x74], ebx
je 0x4aff31
mov eax, 1
jmp 0x4aff33
xor eax, eax
mov ecx, dword [esp + 0x17c]
mov edx, dword [ebp + 0x10]
shl eax, 4
xor eax, ecx
and eax, 0x10
xor ecx, eax
mov dword [esp + 0x17c], ecx
push edx
lea ecx, [esp + 0x14]
call fcn.00528190
push 0x93ccb0
lea ecx, [esp + 0x14]
call fcn.00528060
push esi
lea ecx, [esp + 0x14]
call fcn.00528a80
and dword [esp + 0x17c], 0xfffffffc
lea eax, [esp + 0x10]
call fcn.00527df0
mov ecx, dword [esp + 0x184]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4dd610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x18
mov eax, dword [edi + 0x90]
movss xmm1, dword [0x7389c8]
push ebx
push esi
xor ebx, ebx
or esi, 0xffffffff
cmp eax, ebx
jne 0x4dd720
mov ecx, dword [edi + 0x110]
xor eax, eax
cmp ecx, ebx
jle 0x4dd687
mov edx, ecx
mov ecx, dword [edi + 0x114]
lea ebx, [ebx]
movss xmm0, dword [ecx]
comiss xmm0, dword [edi + 0x108]
jb 0x4dd674
movss xmm2, dword [edi + 0x10c]
comiss xmm2, xmm0
jbe 0x4dd674
comiss xmm0, xmm1
jb 0x4dd674
mov esi, eax
movaps xmm1, xmm0
inc eax
add ecx, 0x28
cmp eax, edx
jl 0x4dd650
cmp esi, 0xffffffff
je 0x4dd687
mov dword [edi + 0x128], esi
mov eax, dword [edi + 0x128]
cmp eax, 0xffffffff
je 0x4dd720
mov ecx, dword [edi + 0x114]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*8 + 8]
mov ecx, dword [eax + 0x18]
sub ecx, ebx
je 0x4dd6c9
dec ecx
jne 0x4dd720
mov eax, dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4dd720
lea edx, [eax + eax*8]
mov eax, dword [0x8cf5f8]
mov ecx, dword [eax + edx*8 + 0x40]
lea eax, [eax + edx*8]
mov eax, dword [eax + 0x44]
jmp 0x4dd6cf
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
mov edx, ecx
or edx, eax
je 0x4dd720
push eax
push ecx
mov ecx, 0x8d68e0
call fcn.004013f0
cmp eax, ebx
je 0x4dd720
movss xmm0, dword [eax + 0x40]
movss dword [esp + 0x10], xmm0
movss xmm0, dword [eax + 0x44]
movss dword [esp + 0x14], xmm0
movss xmm0, dword [eax + 0x48]
movzx eax, byte [eax + 0x76]
and eax, 0xff
push eax
mov eax, dword [edi + 0x9c]
lea ecx, [esp + 0x14]
push ecx
movss dword [esp + 0x20], xmm0
call fcn.00634050
cmp dword [edi + 0x12c], ebx
mov dword [esp + 0xc], ebx
jle 0x4dd7ce
mov edx, dword [edi + 0x130]
movss xmm0, dword [ebx + edx + 4]
comiss xmm0, dword [edi + 0x108]
lea eax, [ebx + edx]
jbe 0x4dd7b4
movss xmm0, dword [edi + 0x10c]
comiss xmm0, dword [eax + 4]
jb 0x4dd7b4
cmp dword [eax], 1
jne 0x4dd7b4
mov ecx, dword [eax + 0x20]
sub ecx, 0
je 0x4dd782
dec ecx
jne 0x4dd7b4
mov eax, dword [eax + 0x14]
cmp eax, 0xffffffff
je 0x4dd7b4
mov ecx, dword [0x8cf5f8]
lea eax, [eax + eax*8]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
jmp 0x4dd788
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
mov edx, ecx
or edx, eax
je 0x4dd7b4
push eax
push ecx
mov ecx, 0x8d68e0
call fcn.004013f0
mov esi, eax
test esi, esi
je 0x4dd7b4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x78]
test eax, eax
jne 0x4dd7b4
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx + 0x3c]
mov eax, dword [esp + 0xc]
mov ecx, dword [edi + 0x12c]
inc eax
add ebx, 0x68
cmp eax, ecx
mov dword [esp + 0xc], eax
jl 0x4dd730
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e53a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x6e2bfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x190
push edi
mov edi, ecx
test byte [edi + 0x200], 1
jne 0x4e550a
lea ecx, [esp + 0x20]
call fcn.00527d10
mov dword [esp + 0x19c], 0
movss xmm0, dword [edi + 0x40]
movss dword [esp + 0x10], xmm0
movss xmm0, dword [edi + 0x44]
movss dword [esp + 0x14], xmm0
movss xmm0, dword [edi + 0x48]
movss dword [esp + 0x18], xmm0
mov edx, str.Generic_1
mov ecx, 0x1505
mov eax, 0x47
inc edx
cmp eax, 0x61
jl 0x4e5423
cmp eax, 0x7a
jg 0x4e5423
sub eax, 0x20
imul ecx, ecx, 0x21
xor ecx, eax
movsx eax, byte [edx]
test eax, eax
jne 0x4e5415
mov eax, dword [edi + 0xc]
mov edx, dword [edi + 8]
push eax
and ecx, 0xfffffff
push edx
or ecx, 0x40000000
push ecx
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x20]
call fcn.00527ee0
mov edx, dword [edi + 0xc]
movss xmm0, dword [edi + 0x40]
mov eax, dword [edi + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
movss dword [esp + 0x18], xmm0
movss xmm0, dword [edi + 0x44]
push eax
lea ecx, [esp + 0x2c]
movss dword [esp + 0x20], xmm0
movss xmm0, dword [edi + 0x48]
push ecx
mov edx, 0x721e1c
movss dword [esp + 0x28], xmm0
call fcn.00528250
mov edx, dword [edi + 0x1f8]
mov eax, dword [edi + 0x208]
inc edx
cmp edx, eax
jl 0x4e54a7
or dword [edi + 0x200], 8
lea eax, [esp + 0x20]
push eax
push edi
call fcn.004e3000
mov edx, dword [edi + 0x1f8]
mov ecx, dword [edi + 0x208]
inc edx
mov eax, edx
cmp eax, ecx
mov dword [edi + 0x1f8], edx
jl 0x4e54d9
dec eax
mov dword [edi + 0x1f8], eax
or dword [edi + 0x200], 1
mov ecx, dword [edi + 0x1f8]
dec ecx
push ecx
call fcn.004e4c40
mov eax, dword [edi + 0x200]
test al, 1
jne 0x4e54f9
and eax, 0xffffffef
mov dword [edi + 0x200], eax
and dword [esp + 0x18c], 0xfffffffc
lea eax, [esp + 0x20]
call fcn.00527df0
mov ecx, dword [esp + 0x194]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4f47a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6df860
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
push 0x888
push 0
push esi
mov dword [esp + 0x3c], 0
call fcn.00626100
push 0x8cf1c0
lea ecx, [esp + 0x10]
push str._s_SecretList.txt
push ecx
mov dword [esi], 0xffffffff
call fcn.00626a10
add esp, 0x18
mov byte [esp + 0x30], 1
mov eax, dword [eax]
lea ecx, [esp + 4]
call fcn.00627240
mov eax, dword [esp]
call fcn.00626990
mov edx, dword [esp + 4]
push edx
push esi
call fcn.004f4940
mov eax, dword [esp + 4]
test eax, eax
je 0x4f4849
lea ecx, [eax - 8]
lea edx, [esp + 8]
cmp ecx, edx
je 0x4f4849
add eax, 0xfffffff8
push eax
call fcn.0062a450
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x501040
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x3c
push esi
push edi
lea eax, [ebx + 8]
push eax
lea ecx, [esp + 0x24]
call fcn.00626ac0
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
mov edi, 0x1505
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
push edx
lea eax, [esp + 0x10]
push 0x70c658
push eax
call fcn.00626a10
mov ecx, dword [eax]
add esp, 0x10
push ecx
lea ecx, [esp + 0x24]
call fcn.00627180
mov eax, dword [esp + 8]
call fcn.00626990
mov al, byte [esi]
test al, al
je 0x5010c0
lea ecx, [ecx]
imul edi, edi, 0x21
movsx edx, al
mov al, byte [esi + 1]
xor edi, edx
inc esi
test al, al
jne 0x5010b0
mov eax, dword [esp + 0x20]
test eax, eax
mov dword [ebx + 0x28], edi
pop edi
pop esi
je 0x5010e4
lea ecx, [eax - 8]
lea edx, [esp + 0x1c]
cmp ecx, edx
je 0x5010e4
add eax, 0xfffffff8
push eax
call fcn.0062a450
add esp, 4
add esp, 0x3c
ret

Function at 0x503f10
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, eax
mov dword [ecx], 0x1505
mov dword [esi], 0
mov dl, byte [edi]
test dl, dl
mov eax, edi
je 0x503f43
mov ebp, dword [ecx]
imul ebp, ebp, 0x21
movsx edx, dl
xor ebp, edx
inc eax
mov dword [ecx], ebp
mov dl, byte [eax]
test dl, dl
jne 0x503f30
sub eax, edi
mov dword [esi], eax
mov esi, dword [ebx + 0x24]
test esi, esi
mov dword [esp + 0x14], esi
je 0x503f6d
mov ecx, dword [ecx]
xor edx, edx
mov eax, ecx
div esi
mov eax, dword [ebx + 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov eax, dword [eax + edx*4]
cmp eax, 0xffffffff
jne 0x503f81
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret 4
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x503fc2
mov esi, dword [ebx]
lea eax, [esi + eax*8]
cmp dword [eax + 4], ecx
jne 0x503fc2
mov eax, dword [eax]
mov ecx, dword [ebx + 0x14]
mov bl, byte [edi]
movsx esi, byte [ecx + eax]
add ecx, eax
movsx eax, bl
sub eax, esi
jne 0x503fc2
mov esi, edi
sub esi, ecx
test bl, bl
je 0x503fbe
mov bl, byte [esi + ecx + 1]
movsx ebp, byte [ecx + 1]
inc ecx
movsx eax, bl
sub eax, ebp
je 0x503fa8
jmp 0x503fc2
test eax, eax
je 0x503fe4
mov eax, dword [esp + 0x14]
inc edx
cmp edx, eax
jne 0x503fcd
xor edx, edx
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + edx*4]
cmp eax, 0xffffffff
jne 0x503f79
pop esi
pop ebp
or eax, eax
pop ebx
add esp, 0xc
ret 4
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edx*4]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x5040e0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
push edi
mov edi, eax
mov esi, ecx
mov eax, dword [esi + 0x14]
push edi
push eax
call fcn.0062a3e0
add esp, 8
test edi, edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
je 0x504110
mov ecx, dword [esp + 0xc]
push edi
push eax
push ecx
call dword [0x80ed88]
add esp, 0xc
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x50412f
mov edx, dword [esi]
push edx
call fcn.00685b4c
add esp, 4
mov dword [esi], 0
mov dword [esi + 8], 0
mov edi, dword [esi + 0x14]
mov ecx, dword [esi + 0x1c]
mov eax, edi
sub eax, edi
cmp eax, ecx
mov dword [esi + 4], 0
jge 0x50418c
push ebp
call fcn.005041a0
mov dword [eax + 4], 0x1505
mov dl, byte [edi]
test dl, dl
mov ecx, edi
je 0x504175
lea esp, [esp]
mov ebp, dword [eax + 4]
imul ebp, ebp, 0x21
movsx edx, dl
xor ebp, edx
inc ecx
mov dword [eax + 4], ebp
mov dl, byte [ecx]
test dl, dl
jne 0x504160
sub edi, dword [esi + 0x14]
mov dword [eax], edi
mov edx, dword [esi + 0x14]
lea edi, [ecx + 1]
mov ecx, dword [esi + 0x1c]
mov eax, edi
sub eax, edx
cmp eax, ecx
jl 0x504145
pop ebp
mov eax, dword [esi + 4]
shl eax, 1
call fcn.00503e80
pop edi
mov eax, 1
pop esi
ret 4