joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447960
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [0x4df19c]
mov esi, ecx
xor ecx, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
cpuid
mov edi, eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 0x38], 0
lea ecx, [esi + 0x28]
push eax
call fcn.0041f2fe
test edi, edi
jle 0x447ab0
mov eax, 1
xor ecx, ecx
cpuid
cmp edi, 7
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x48], edx
jl 0x4479ce
mov eax, 7
xor ecx, ecx
cpuid
shr bl, 5
and bl, 1
mov dword [ebp - 0x4c], ebx
mov ebx, dword [ebp - 0x54]
mov eax, ebx
mov ecx, ebx
mov dword [esi], ebx
and eax, 0xf
shr ecx, 0xc
mov dword [esi + 0x10], eax
mov eax, ebx
mov edx, ecx
and ecx, 3
shr eax, 4
and edx, 0xf0
and eax, 0xf
or edx, eax
mov eax, ebx
shr eax, 8
mov dword [esi + 0xc], edx
and eax, 0xf
mov dword [esi + 8], eax
mov eax, ebx
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x48]
shr ebx, 0x14
shr eax, 0x10
and eax, 0xf
mov dword [esi + 0x14], eax
movzx eax, bl
mov dword [esi + 0x18], eax
mov eax, ecx
shr eax, 0x17
and al, 1
mov byte [esi + 0x1c], al
mov eax, ecx
shr ecx, 0x1a
shr eax, 0x19
and cl, 1
and al, 1
mov byte [esi + 0x1d], al
mov byte [esi + 0x1e], cl
mov ecx, dword [ebp - 0x50]
mov eax, ecx
and al, 1
mov byte [esi + 0x1f], al
mov eax, ecx
shr eax, 9
and al, 1
mov byte [esi + 0x20], al
mov eax, ecx
shr eax, 0x13
and al, 1
mov byte [esi + 0x21], al
mov eax, ecx
shr eax, 0x14
and al, 1
mov byte [esi + 0x22], al
mov eax, ecx
shr eax, 0x17
and al, 1
test ecx, ecx
mov byte [esi + 0x23], al
mov eax, ecx
setns byte [ebp - 0x48]
xor edi, edi
and eax, 0x1c000000
cmp eax, 0x1c000000
mov eax, 0
jne 0x447a93
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov ecx, dword [ebp - 0x50]
mov byte [esi + 0x24], al
shr ecx, 0x19
and cl, 1
test al, al
movzx eax, byte [ebp - 0x4c]
mov byte [esi + 0x26], cl
cmove eax, edi
mov byte [esi + 0x25], al
jmp 0x447ab4
mov byte [ebp - 0x48], 1
mov eax, 0x80000000
xor ecx, ecx
cpuid
cmp eax, 0x80000004
jl 0x447b2c
mov edi, eax
mov eax, 0x80000002
xor ecx, ecx
cpuid
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], edx
mov eax, 0x80000003
xor ecx, ecx
cpuid
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
mov eax, 0x80000004
xor ecx, ecx
cpuid
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov byte [ebp - 0x14], 0
lea ecx, [esi + 0x34]
push eax
call fcn.0041f2fe
cmp edi, 0x80000007
jl 0x447b2c
mov eax, 0x80000007
xor ecx, ecx
cpuid
and dh, 1
mov byte [esi + 0x27], dh
cmp byte [esi + 0x27], 0
setne al
or byte [ebp - 0x48], al
jne 0x447b5d
mov eax, 0x40000000
xor ecx, ecx
cpuid
cmp edx, 0x76482074
jne 0x447b5d
cmp ebx, 0x7263694d
jne 0x447b5d
cmp ecx, 0x666f736f
jne 0x447b5d
mov byte [esi + 0x27], 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004956a1
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x448b20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x4df19c]
mov ebx, ecx
lea esi, [ebp - 0x1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], edx
push edx
push ecx
push esi
call fcn.00428df0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x448b4f
mov esi, dword [ebp - 0x1c]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
mov edi, eax
js 0x448bdd
test edi, edi
je 0x448bf0
cmp dword [ebp + 8], 0
mov dword [ebp - 0x20], ebx
mov bl, 1
je 0x448c54
mov eax, edi
mov ecx, 0xffffffff
add eax, edi
cmovae ecx, eax
push ecx
call fcn.00495693
add esp, 4
mov esi, eax
lea ebx, [ebp - 0x1c]
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push ebx
call fcn.00428df0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x448bab
mov ebx, dword [ebp - 0x1c]
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x448bc5
push dword [ebp - 0x1c]
call fcn.00495666
add esp, 4
cmp word [esi], 0
mov bl, 1
je 0x448bf4
xor eax, eax
nop
cmp word [esi + eax*2 + 2], 0
lea eax, [eax + 1]
jne 0x448bd0
jmp 0x448bf6
push dword [ebp - 0x1c]
call fcn.00495666
add esp, 4
test edi, edi
jne 0x448b6a
xor ebx, ebx
jmp 0x448c54
xor eax, eax
lea ecx, [ebp - 0x1c]
push eax
push esi
push ecx
call fcn.00429200
add esp, 0xc
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
js 0x448c16
mov byte [ecx], 0
mov byte [ecx + 0xb], 0
jmp 0x448c3c
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
cmp byte [ecx + 0xb], 0
jns 0x448c3c
push dword [ecx]
call fcn.00495666
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [ecx + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [ecx + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ecx], xmm0
push esi
call fcn.0049569c
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004956a1
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x448d50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov edx, dword [0x4df19c]
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x10]
xor edx, ebp
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 0
push edx
push esi
push edi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x448db8
mov eax, dword [ebp - 0x10]
mov esi, 0x3f4
add eax, 0xfffffffd
cmp eax, 1
ja 0x448db8
cmp dword [ebp - 0x14], 4
jne 0x448db8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
xor esi, esi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004956a1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret 8
Function at 0x448dd0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.00495a30
mov edx, dword [0x4df19c]
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x810]
lea esi, [ebp - 0x1014]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x1018]
mov dword [ebp - 0x1014], 1
mov dword [ebp - 0x1018], 0x800
push edx
push ebx
push esi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x448e7b
mov eax, dword [ebp - 0x1014]
mov edi, dword [ebp + 0xc]
cmp eax, 2
je 0x448e45
mov esi, 0x3f4
cmp eax, 1
jne 0x448e7b
mov ecx, edi
push ebx
jmp 0x448e74
lea eax, [ebp - 0x1010]
push 0x400
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
dec eax
mov esi, 0xea
cmp eax, 0x3ff
ja 0x448e7b
mov ecx, edi
lea eax, [ebp - 0x1010]
push eax
call fcn.0041fcae
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004956a1
mov eax, esi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x448ec0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
js 0x448ecd
jmp 0x4706d0
xor eax, eax
ret
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x18]
xor ecx, ecx
test edx, edx
je 0x4707af
mov eax, dword [esp + 0x1c]
test eax, eax
jle 0x4707af
mov edi, eax
mov esi, eax
and edi, 3
shr esi, 2
je 0x470735
mov ecx, eax
mov ebx, edx
and ecx, 0xfffffffc
mov dword [esp], ecx
nop word cs:[eax + eax]
nop
movzx ebp, word [ebx]
add ebp, eax
movzx eax, word [ebx + 2]
add ebx, 4
mov ecx, ebp
shl ecx, 0x10
xor ecx, ebp
shl eax, 0xb
xor ecx, eax
mov eax, ecx
shr eax, 0xb
add eax, ecx
dec esi
jg 0x470710
add edx, dword [esp]
cmp edi, 1
je 0x47075e
cmp edi, 2
je 0x470770
cmp edi, 3
jne 0x470783
movzx ecx, word [edx]
add eax, ecx
movsx ecx, byte [edx + 2]
shl ecx, 0x12
xor ecx, eax
shl eax, 0x10
xor ecx, eax
mov eax, ecx
shr eax, 0xb
jmp 0x470781
movsx ecx, byte [edx]
add eax, ecx
mov ecx, eax
shl ecx, 0xa
xor ecx, eax
mov eax, ecx
shr eax, 1
jmp 0x470781
movzx ecx, word [edx]
add eax, ecx
mov ecx, eax
shl ecx, 0xb
xor ecx, eax
mov eax, ecx
shr eax, 0x11
add eax, ecx
lea ecx, [eax*8]
xor ecx, eax
mov eax, ecx
shr eax, 5
add eax, ecx
mov ecx, eax
shl ecx, 4
xor ecx, eax
mov eax, ecx
shr eax, 0x11
add eax, ecx
mov edx, eax
shl edx, 0x19
xor edx, eax
mov ecx, edx
shr ecx, 6
add ecx, edx
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44991d
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x24]
mov dword [esp + 4], edx
mov dword [esp], ecx
cmp edx, esi
mov eax, esi
cmovb eax, edx
test eax, eax
je 0x44997a
mov dword [esp + 8], eax
xor eax, eax
xor ebp, ebp
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + ebp*4]
mov ecx, dword [esp]
mov ecx, dword [ecx + ebp*4]
mov ebx, ecx
mov edx, ecx
sub ebx, edi
xor edx, edi
xor ebx, ecx
or ebx, edx
xor ebx, ecx
mov ecx, edx
dec edx
sar ebx, 0x1f
xor ecx, 0x80000000
or ebx, 1
test edx, ecx
cmovns eax, ebx
inc ebp
cmp ebp, dword [esp + 8]
jb 0x449942
jmp 0x44997c
xor eax, eax
mov ecx, dword [esp + 4]
mov edi, dword [esp + 0x20]
mov edx, dword [esp]
mov ebx, ecx
sub ebx, esi
jae 0x4499ac
sub esi, ecx
lea edx, [edi + ecx*4]
xor ecx, ecx
or ecx, dword [edx]
add edx, 4
dec esi
jne 0x449994
mov edx, ecx
dec ecx
not edx
and ecx, edx
sar ecx, 0x1f
not ecx
or eax, ecx
jmp 0x4499d4
cmp esi, ecx
jae 0x4499d4
lea edx, [edx + esi*4]
xor ecx, ecx
or ecx, dword [edx]
add edx, 4
dec ebx
jne 0x4499b5
mov edx, ecx
dec ecx
not edx
and ecx, edx
sar ecx, 0x1f
mov edx, ecx
and ecx, eax
not edx
and edx, 1
or edx, ecx
mov eax, edx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x449ac8
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, dword [eax + 4]
mov esi, dword [ecx + 4]
mov ebx, eax
sub ebx, esi
jge 0x449af1
mov ebp, dword [ecx]
xor edx, edx
mov edi, eax
or edx, dword [ebp + edi*4]
inc edi
cmp edi, esi
jl 0x449ae8
cmp esi, eax
jge 0x449b0b
mov edi, dword [esp + 0x14]
lea ebp, [esi*4]
add ebp, dword [edi]
or edx, dword [ebp]
add ebp, 4
dec ebx
jne 0x449b02
cmp eax, esi
cmovle esi, eax
test esi, esi
jle 0x449b2b
mov eax, dword [esp + 0x14]
mov ebx, dword [ecx]
xor ebp, ebp
mov edi, dword [eax]
mov eax, dword [ebx + ebp*4]
xor eax, dword [edi + ebp*4]
inc ebp
or edx, eax
cmp ebp, esi
jl 0x449b1e
mov ecx, dword [ecx + 0xc]
mov eax, dword [esp + 0x14]
xor ecx, dword [eax + 0xc]
xor eax, eax
or ecx, edx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x44d7db
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x24]
xor edx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], 2
mov ecx, 0
mov esi, dword [eax]
jl 0x44d7fa
mov ecx, dword [eax + 4]
xor eax, eax
xor ebp, ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x40
mov dword [esp], 0
mov dword [esp + 4], esi
inc eax
mov ebx, eax
and ebx, 1
mov edi, dword [esp + 8]
mov esi, 0
neg ebx
sbb esi, esi
and ebx, dword [esp + 4]
and edi, esi
mov ecx, edi
and edi, ebp
xor ecx, ebp
mov ebp, ebx
and ebx, eax
xor ebp, eax
shrd ebp, ecx, 1
shr ecx, 1
add ebx, ebp
adc edi, ecx
shrd dword [esp], edx, 1
and esi, 0x80000000
shr edx, 1
mov eax, ebx
or edx, esi
dec dword [esp + 0xc]
mov ebp, edi
jne 0x44d818
mov eax, dword [esp]
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44eb4f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x190
mov eax, dword [0x4df19c]
xor eax, ebp
cmp dword [ebp + 0xc], 0
mov dword [esp + 0x188], eax
je 0x44ed11
call fcn.004796ac
test eax, eax
je 0x44eb94
xorps xmm0, xmm0
movaps xmmword [esp + 0x170], xmm0
movaps xmmword [esp + 0x160], xmm0
jmp 0x44eba6
lea eax, [esp + 0x160]
push 0x20
push eax
call fcn.004796cc
add esp, 8
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ecx, 0xffffffe0
movups xmm0, xmmword [eax + ecx + 0x20]
movups xmm1, xmmword [esp + ecx + 0x180]
xorps xmm1, xmm0
movups xmmword [esp + ecx + 0x180], xmm1
add ecx, 0x10
jne 0x44ebb1
push 1
call fcn.00478347
add esp, 4
test eax, eax
je 0x44ec3e
mov ecx, eax
add ecx, 0x118
cmp dword [eax + 0x118], 0x1000
mov dword [esp + 8], ecx
jb 0x44ecae
mov ebx, 0x30
lea ecx, [esp + 0x40]
push ebx
push ecx
mov esi, eax
call fcn.004796cc
add esp, 8
mov ecx, esi
lea edx, [esp + 0x40]
push ebx
call fcn.00454613
add esp, 4
test eax, eax
je 0x44ed27
xor eax, eax
mov dword [esi + 0x110], 1
mov dword [esi + 0x114], eax
mov dword [esi + 0x118], eax
jmp 0x44ecac
push 0x120
call fcn.0045d829
add esp, 4
test eax, eax
je 0x44ec65
push 0x4548f0
push eax
push 1
mov esi, eax
call fcn.004783c6
add esp, 0xc
test eax, eax
jne 0x44ec69
lea esi, [esp + 0x40]
xor ebx, ebx
lea eax, [esp + 0x10]
mov dword [esi + 0x11c], ebx
push 0x30
push eax
call fcn.004796cc
add esp, 8
push ebx
push ebx
lea eax, [esp + 0x18]
push eax
push esi
call fcn.0045454e
add esp, 0x10
test eax, eax
je 0x44ed27
lea eax, [esi + 0x118]
mov dword [esi + 0x118], 0
mov dword [esp + 8], eax
mov eax, esi
mov edx, dword [ebp + 0xc]
mov ecx, 0x20
mov dword [esp + 0xc], eax
mov esi, 0x10000
cmp edx, esi
mov esi, 0x10000
cmovb esi, edx
push ecx
lea ecx, [esp + 0x164]
push ecx
push esi
push edi
push eax
mov ebx, edi
mov edi, edx
call fcn.004546da
add esp, 0x14
test eax, eax
je 0x44ed27
mov eax, dword [esp + 8]
add ebx, esi
xor ecx, ecx
inc dword [eax]
sub edi, esi
mov eax, dword [esp + 0xc]
mov edx, edi
mov edi, ebx
jne 0x44ecba
lea ecx, [esp + 0x40]
cmp eax, ecx
jne 0x44ed11
push 0x118
push ecx
call fcn.0045d87c
add esp, 8
mov ecx, dword [esp + 0x188]
xor ecx, ebp
call fcn.004956a1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004a885c
Function at 0x45454e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [0x4df19c]
mov edi, dword [ebp + 0x14]
xor esi, esi
xor eax, ebp
cmp edi, 0x30
mov dword [ebp - 0x10], eax
ja 0x4545ff
lea esi, [ebp - 0x40]
push 0x30
push dword [ebp + 0xc]
push esi
call fcn.00498e50
add esp, 0xc
test edi, edi
je 0x454595
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov dl, byte [eax + ecx]
xor byte [ebp + ecx - 0x40], dl
inc ecx
cmp edi, ecx
jne 0x454589
mov edi, dword [ebp + 8]
mov eax, 0xffffffd0
movups xmm0, xmmword [eax + 0x4c90f5]
movups xmm1, xmmword [ebp + eax - 0x10]
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x10], xmm1
add eax, 0x10
jne 0x45459d
lea eax, [edi + 0xf4]
xor ebx, ebx
push 0x20
push esi
push eax
push ebx
push edi
call fcn.0044f5ab
add esp, 0x14
mov dword [edi + 0xf8], eax
xor esi, esi
movsd xmm0, qword [ebp - 0x20]
movsd xmm1, qword [ebp - 0x18]
inc esi
movsd qword [edi + 0xfc], xmm0
movsd qword [edi + 0x104], xmm1
mov dword [edi + 0x114], ebx
mov dword [edi + 0x110], 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004956a1
mov eax, esi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x454613
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [0x4df19c]
xor ebx, ebx
xor eax, ebp
cmp dword [ebp + 8], 0x30
mov dword [ebp - 0x10], eax
ja 0x4546c6
lea eax, [ecx + 0xf4]
mov esi, ecx
lea ebx, [ecx + 0xfc]
xor edi, edi
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], eax
push dword [esi + 0x108]
call fcn.004a1a99
add esp, 4
inc eax
push eax
call fcn.004a1a99
add esp, 4
mov dword [esi + 0x108], eax
lea eax, [ebp + edi - 0x40]
push esi
push eax
push ebx
call dword [esi + 0xf4]
add esp, 0xc
add edi, 0x10
cmp edi, 0x30
jb 0x454648
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 0x48]
test edi, edi
je 0x454696
xor eax, eax
mov cl, byte [edx + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp edi, eax
jne 0x45468a
lea edi, [ebp - 0x40]
push 0x20
push edi
push dword [ebp - 0x44]
push 0
push esi
call fcn.0044f5ab
add esp, 0x14
mov dword [esi + 0xf8], eax
movsd xmm0, qword [edi + 0x20]
movsd xmm1, qword [edi + 0x28]
movsd qword [ebx], xmm0
movsd qword [ebx + 8], xmm1
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004956a1
mov eax, ebx
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45d329
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
xor edi, edi
mov dword [ebp - 0x1c], ecx
push 0x60
push edi
push dword [ebp + 0xc]
call fcn.00499950
add esp, 0xc
test ebx, ebx
je 0x45d3a3
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], ebx
lea ecx, [eax + 0x20]
lea eax, [eax + 0x40]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
mov ebx, edi
mov ecx, dword [ebp + 0xc]
xor ebx, dword [ebp - 0x1c]
mov edx, ebx
push ecx
push esi
call fcn.0045d2cb
add esp, 8
mov ecx, dword [ebp - 0x14]
lea eax, [esi + 0x20]
mov edx, ebx
push ecx
push eax
call fcn.0045d2cb
add esp, 8
mov ecx, dword [ebp - 0x10]
mov edx, ebx
mov ebx, dword [ebp - 0x18]
lea eax, [esi + 0x40]
push ecx
push eax
call fcn.0045d2cb
add esp, 8
inc edi
add esi, 0x60
cmp ebx, edi
jne 0x45d360
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x45d8fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x45d925
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
xor edi, edi
xor eax, eax
mov bl, byte [edx + edi]
xor bl, byte [esi + edi]
inc edi
movzx ebx, bl
or eax, ebx
cmp ecx, edi
jne 0x45d913
jmp 0x45d927
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x46a0c0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 0xc]
movzx ebx, byte [edi + 0xb]
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ebp - 0x10], edx
test bl, bl
lea esi, [edi + ebx]
lea edx, [eax + edx]
mov dword [ebp - 0x20], ebx
cmovs edi, eax
cmovs esi, edx
sub esi, edi
mov dword [ebp - 0x1c], edi
cmp esi, 4
jb 0x46a1ad
mov dword [ebp - 0x18], ecx
mov edx, edi
mov eax, esi
lea ecx, [esi - 4]
nop word cs:[eax + eax]
nop dword [eax + eax]
imul edi, dword [edx], 0x5bd1e995
imul eax, eax, 0x5bd1e995
add esi, 0xfffffffc
add edx, 4
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
xor eax, edi
cmp esi, 3
ja 0x46a110
mov edx, dword [ebp - 0x1c]
mov esi, ecx
and ecx, 0xfffffffc
sub esi, ecx
lea edx, [edx + ecx + 4]
mov ecx, dword [ebp - 0x18]
cmp esi, 1
je 0x46a168
cmp esi, 2
je 0x46a15f
cmp esi, 3
jne 0x46a173
movzx esi, byte [edx + 2]
shl esi, 0x10
xor eax, esi
movzx esi, byte [edx + 1]
shl esi, 8
xor eax, esi
movzx edx, byte [edx]
xor edx, eax
imul eax, edx, 0x5bd1e995
mov ebx, dword [ecx + 4]
mov esi, dword [ebp - 0x1c]
test ebx, ebx
je 0x46a295
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
lea eax, [ebx - 1]
test eax, ebx
mov dword [ebp - 0x18], eax
je 0x46a1b8
cmp edi, ebx
mov edx, edi
jb 0x46a1bc
mov eax, edi
xor edx, edx
div ebx
jmp 0x46a1bc
mov eax, esi
mov edx, edi
cmp esi, 1
jne 0x46a14c
jmp 0x46a168
mov edx, edi
and edx, eax
mov eax, dword [ecx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x46a295
mov dword [ebp - 0x24], ebx
mov ebx, dword [eax]
mov ecx, 0
test ebx, ebx
je 0x46a297
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
test cl, cl
cmovns eax, ecx
mov dword [ebp - 0x10], eax
nop dword [eax]
mov eax, dword [ebx + 4]
cmp edi, eax
jne 0x46a250
movzx eax, byte [ebx + 0x13]
test al, al
mov ecx, eax
jns 0x46a204
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x46a26f
lea ecx, [ebx + 8]
test al, al
mov edx, dword [ecx]
cmovs ecx, edx
js 0x46a27b
cmp dword [ebp - 0x10], 0
je 0x46a291
cmp byte [esi], dl
jne 0x46a26f
dec eax
xor ecx, ecx
nop word cs:[eax + eax]
nop dword [eax]
cmp eax, ecx
je 0x46a291
movzx edx, byte [ebx + ecx + 9]
cmp dl, byte [esi + ecx + 1]
lea ecx, [ecx + 1]
je 0x46a230
jmp 0x46a26f
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
test edx, ecx
je 0x46a266
cmp eax, ecx
jb 0x46a268
xor edx, edx
div ecx
mov eax, edx
jmp 0x46a268
and eax, edx
mov ecx, dword [ebp - 0x14]
cmp eax, ecx
jne 0x46a295
mov ebx, dword [ebx]
test ebx, ebx
jne 0x46a1f0
jmp 0x46a295
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x46a291
push eax
push esi
push ecx
call fcn.00497e9d
add esp, 0xc
test eax, eax
jne 0x46a26f
mov ecx, ebx
jmp 0x46a297
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x46e250
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [ecx]
mov edx, dword [ecx + 4]
sub edx, ebp
je 0x46e2c6
sar edx, 2
xor esi, esi
mov ebx, edx
nop word cs:[eax + eax]
nop
mov edi, dword [ebp + esi*4]
inc esi
mov eax, edi
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x4cd794]
mov eax, edi
shr eax, 8
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x4cd794]
mov eax, edi
shr edi, 0x18
shr eax, 0x10
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x4cd794]
movzx eax, bl
shr ebx, 8
xor edi, eax
xor ebx, dword [edi*4 + 0x4cd794]
cmp esi, edx
jb 0x46e270
jmp 0x46e2c8
xor ebx, ebx
cmp ebx, dword [ecx + 0xc]
sete al
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x46e2e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [ecx]
mov edx, dword [ecx + 4]
sub edx, ebp
je 0x46e356
sar edx, 2
xor esi, esi
mov ebx, edx
nop word cs:[eax + eax]
nop
mov edi, dword [ebp + esi*4]
inc esi
mov eax, edi
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x4cd794]
mov eax, edi
shr eax, 8
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x4cd794]
mov eax, edi
shr edi, 0x18
shr eax, 0x10
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x4cd794]
movzx eax, bl
shr ebx, 8
xor edi, eax
xor ebx, dword [edi*4 + 0x4cd794]
cmp esi, edx
jb 0x46e300
jmp 0x46e358
xor ebx, ebx
mov dword [ecx + 0xc], ebx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4782a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov ecx, dword [0x4df19c]
mov eax, dword [ebp + 0xc]
xor ecx, ebp
cmp eax, 3
mov dword [ebp - 0xc], ecx
jne 0x478334
push 0x478380
push 0x4e3f70
call fcn.004781f8
add esp, 8
cmp dword [0x4e3f74], 0
jne 0x478334
push dword [0x4e3f78]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x478334
mov esi, eax
mov edi, 0x4e3f7c
push edi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [0x4e3f88]
movsd xmm0, qword [0x4e3f80]
mov dword [ebp - 0x10], eax
movsd qword [ebp - 0x18], xmm0
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov edi, 0xfffffff4
mov eax, dword [ebp + edi - 0xc]
test eax, eax
je 0x478326
push dword [esi + edi + 0xc]
call eax
add esp, 4
add edi, 4
jne 0x478315
push esi
call fcn.0045d84c
add esp, 4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004956a1
add esp, 0x10
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x4783c6
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0xc]
push 0x478380
push 0x4e3f70
call fcn.004781f8
add esp, 8
cmp dword [0x4e3f74], 0
je 0x4783f5
push ebx
call dword [ebp + 0x10]
add esp, 4
xor edi, edi
jmp 0x478429
call fcn.0047839e
mov esi, eax
test eax, eax
je 0x478430
mov edi, dword [ebp + 8]
mov ebx, 0x4e3f7c
push ebx
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [edi*4 + 0x4e3f80], eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [esi + edi*4], eax
xor edi, edi
inc edi
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xc
call fcn.0045d829
add esp, 4
test eax, eax
je 0x4783ea
xor edi, edi
mov esi, eax
mov dword [eax + 4], edi
mov dword [eax], edi
mov dword [eax + 8], edi
push eax
push dword [0x4e3f78]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x478400
push esi
call fcn.0045d84c
add esp, 4
push ebx
call dword [ebp + 0x10]
add esp, 4
jmp 0x478429