joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aac90
Capabilities:
Check if file exists
Create thread
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi + 4], 1
jne 0x4aaca7
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xc]
mov ecx, 0x102
push ebx
push esi
push 0x208
mov esi, dword [eax + 0x450]
add esi, 6
lea eax, [esi + 2]
cmp eax, 0x104
cmova esi, ecx
mov ebx, esi
call fcn.004d9a7e
mov ecx, dword [edi + 0xc]
add esp, 4
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], 0
mov ecx, dword [ecx + 0x4cc]
push eax
push 0xba8443de
call fcn.00471b30
mov edx, dword [edi + 0x1c]
test eax, eax
jne 0x4aad52
mov esi, edx
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4aad00
sub esi, ecx
sar esi, 1
jne 0x4aadab
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx + 0x450]
add eax, eax
push eax
push dword [ecx + 0x444]
push edx
call fcn.004d6950
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + 0x450]
mov eax, ebx
sub eax, ecx
add eax, eax
push eax
mov eax, dword [edi + 0x1c]
push str.unity_
lea eax, [eax + ecx*2]
push eax
call fcn.004d6950
mov esi, ebx
jmp 0x4aada8
xor eax, eax
mov word [edx], ax
mov ecx, dword [edi + 0xc]
push dword [edi + 0x1c]
push 0xba8443de
mov ecx, dword [ecx + 0x4cc]
call fcn.00471bb0
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx + 0x450]
add eax, eax
push eax
push dword [ecx + 0x444]
push dword [edi + 0x1c]
call fcn.004d6950
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + 0x450]
mov eax, esi
sub eax, ecx
add eax, eax
push eax
mov eax, dword [edi + 0x1c]
push str.unity_
lea eax, [eax + ecx*2]
push eax
call fcn.004d6950
add esp, 0x18
mov eax, dword [edi + 0x1c]
cmp word [eax + esi*2 - 2], 0x5c
jne 0x4aadbe
xor ecx, ecx
mov word [eax + esi*2], cx
jmp 0x4aadd1
mov ecx, 0x5c
mov word [eax + esi*2], cx
xor ecx, ecx
mov eax, dword [edi + 0x1c]
mov word [eax + esi*2 + 2], cx
mov ecx, dword [edi + 0x1c]
call fcn.004958d0
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [edi + 0x20], ecx
push dword [edi + 0x1c]
mov ecx, dword [edi + 0xc]
call fcn.0049a1e0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x24], eax
lea eax, [ebp - 4]
push eax
push 0
push edi
push 0x4aa5b0
push 0
push 0
mov dword [edi + 0x18], 1
call fcn.004d9be5
add esp, 0x18
mov dword [edi + 8], eax
mov dword [edi + 4], 1
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4ae3f0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test ebx, ebx
je 0x4ae4ad
test esi, esi
je 0x4ae4ad
cmp dword [esi], 0x7d5
jne 0x4ae4ad
lea eax, [esi + 0x30]
push eax
push ebx
call fcn.004abe70
test eax, eax
jne 0x4ae4ad
mov eax, dword [edi + 0x90]
mov ecx, dword [edi + 8]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x74]
push eax
push dword [edi + 0x9c]
lea eax, [edi + 0x10]
push eax
push ebx
call fcn.004a73f0
test eax, eax
jne 0x4ae4ad
push eax
push dword [ebp - 0x74]
mov ecx, edi
push dword [edi + 0x9c]
call fcn.004ace30
test eax, eax
jne 0x4ae4ad
lea eax, [ebp - 0x74]
push eax
push ecx
push dword [edi + 0x9c]
call fcn.004abca0
test eax, eax
jne 0x4ae4ad
push 0x2c6
lea eax, [ebp - 0x78]
push eax
call fcn.004bd020
mov ebx, dword [ebp - 0x78]
push 0x28
push dword [ebp - 0x74]
push 0x2c6
push ebx
call fcn.004bba30
test eax, eax
je 0x4ae4c5
push ebx
call fcn.004bd080
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 4]
movzx ecx, word [esi + 0x58]
mov edi, dword [eax + 0x480]
mov eax, dword [esi + 0x5c]
add eax, 0x34
add ecx, eax
lea eax, [esi + 0x30]
test eax, eax
je 0x4ae531
lea edx, [ebp - 0x70]
mov dword [ebp - 0x58], 0
push edx
push ecx
push eax
mov ecx, edi
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x70], 0x67452301
mov dword [ebp - 0x6c], 0xefcdab89
mov dword [ebp - 0x68], 0x98badcfe
mov dword [ebp - 0x64], 0x10325476
mov dword [ebp - 0x60], 0xc3d2e1f0
mov dword [ebp - 0x10], 0
call fcn.004b22d0
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
call fcn.004b2720
push 0x28
lea eax, [esi + 8]
push eax
push ecx
lea eax, [ebp - 0x70]
push eax
push ebx
call fcn.004bbeb0
push ebx
mov esi, eax
call fcn.004bd080
mov ecx, dword [ebp - 4]
neg esi
pop edi
sbb esi, esi
xor ecx, ebp
and esi, 2
mov eax, esi
pop esi
pop ebx
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ae570
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
je 0x4ae6f3
cmp dword [edi], 0x7d5
jne 0x4ae6f3
mov eax, dword [esi + 0x90]
lea ebx, [edi + 0x30]
mov ecx, dword [esi + 8]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x84]
push eax
push dword [esi + 0x9c]
lea eax, [esi + 0x10]
push eax
push ebx
call fcn.004a73f0
test eax, eax
jne 0x4ae6f3
push eax
push dword [ebp - 0x84]
mov ecx, esi
push dword [esi + 0x9c]
call fcn.004ace30
test eax, eax
jne 0x4ae6f3
lea eax, [ebp - 0x84]
push eax
push ecx
push dword [esi + 0x9c]
call fcn.004abca0
test eax, eax
jne 0x4ae6f3
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x84]
mov ecx, dword [eax + 0x4ec]
call fcn.00479620
test eax, eax
jne 0x4ae6f3
mov eax, dword [esi + 4]
movzx ecx, word [edi + 0x58]
mov esi, dword [eax + 0x480]
mov eax, dword [edi + 0x5c]
add eax, 0x34
add eax, ecx
test ebx, ebx
je 0x4ae690
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x68], 0
push ecx
push eax
push ebx
mov ecx, esi
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x80], 0x67452301
mov dword [ebp - 0x7c], 0xefcdab89
mov dword [ebp - 0x78], 0x98badcfe
mov dword [ebp - 0x74], 0x10325476
mov dword [ebp - 0x70], 0xc3d2e1f0
mov dword [ebp - 0x20], 0
call fcn.004b22d0
lea eax, [ebp - 0x80]
mov ecx, esi
push eax
call fcn.004b2720
push 0x2c6
lea eax, [ebp - 0x84]
push eax
call fcn.004bd020
mov esi, dword [ebp - 0x84]
lea eax, [ebp - 0x18]
push 0x14
push eax
push 0x2c6
push esi
call fcn.004bbdb0
lea eax, [ebp - 0x84]
mov dword [ebp - 0x84], 0x28
push eax
lea eax, [edi + 8]
push eax
push ecx
lea eax, [ebp - 0x80]
push eax
push esi
call fcn.004bc800
push esi
call fcn.004bd0e0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3878
mov esp, ebp
pop ebp
ret 4
Function at 0x4ae980
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x84]
push eax
push 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x60], 0
push eax
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x84], 0x6a09e667
mov dword [ebp - 0x80], 0xbb67ae85
mov dword [ebp - 0x7c], 0x3c6ef372
mov dword [ebp - 0x78], 0xa54ff53a
mov dword [ebp - 0x74], 0x510e527f
mov dword [ebp - 0x70], 0x9b05688c
mov dword [ebp - 0x6c], 0x1f83d9ab
mov dword [ebp - 0x68], 0x5be0cd19
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 3
mov dword [ebp - 0xc], 1
call fcn.004b2370
mov edx, dword [ebp - 0x64]
mov ecx, edx
shr ecx, 0x1d
lea eax, [edx*8]
and edx, 0x3f
bswap eax
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x60]
shl eax, 3
or ecx, eax
lea eax, [ebp - 0x84]
bswap ecx
push eax
mov dword [ebp - 0x88], ecx
mov eax, 0x38
mov ecx, 0x78
sub eax, edx
sub ecx, edx
cmp edx, 0x38
cmovae eax, ecx
push eax
push 0x50ace0
call fcn.004b2370
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x88]
push eax
call fcn.004b2370
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x8c]
push eax
call fcn.004b2370
push 0x40
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.004d6ed0
mov eax, dword [ebp - 0x84]
add esp, 0xc
mov dword [esi], eax
mov eax, dword [ebp - 0x80]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x7c]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x78]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x74]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x70]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x6c]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x68]
mov dword [esi + 0x1c], eax
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d3878
mov esp, ebp
pop ebp
ret 8
Function at 0x4aeae0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x88], 0x6a09e667
mov dword [ebp - 0x84], 0xbb67ae85
mov dword [ebp - 0x80], 0x3c6ef372
mov dword [ebp - 0x7c], 0xa54ff53a
mov dword [ebp - 0x78], 0x510e527f
mov dword [ebp - 0x74], 0x9b05688c
mov dword [ebp - 0x70], 0x1f83d9ab
mov dword [ebp - 0x6c], 0x5be0cd19
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 3
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov edi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x14]
test ebx, ebx
jne 0x4aec1c
push 0xc
push eax
mov dword [ebp - 0x10], ebx
call fcn.004b2370
test esi, esi
je 0x4aeba5
lea eax, [ebp - 0x88]
push eax
lea eax, [esi + esi]
push eax
push dword [ebp - 0x8c]
call fcn.004b2370
mov edx, dword [ebp - 0x68]
mov ecx, edx
shr ecx, 0x1d
lea eax, [edx*8]
and edx, 0x3f
bswap eax
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x64]
shl eax, 3
or ecx, eax
lea eax, [ebp - 0x88]
bswap ecx
push eax
mov dword [ebp - 0x8c], ecx
mov eax, 0x38
mov ecx, 0x78
sub eax, edx
sub ecx, edx
cmp edx, 0x38
cmovae eax, ecx
push eax
push 0x50ace0
call fcn.004b2370
lea eax, [ebp - 0x88]
push eax
push 4
lea eax, [ebp - 0x8c]
push eax
call fcn.004b2370
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x90]
jmp 0x4aeccd
push 0x10
push eax
mov dword [ebp - 0x10], 2
mov dword [ebp - 8], ebx
call fcn.004b2370
test esi, esi
je 0x4aec48
lea eax, [ebp - 0x88]
push eax
lea eax, [esi + esi]
push eax
push dword [ebp - 0x8c]
call fcn.004b2370
lea eax, [ebp - 0x88]
push eax
push ebx
push dword [ebp - 0x90]
call fcn.004b2370
mov edx, dword [ebp - 0x68]
mov ecx, edx
shr ecx, 0x1d
lea eax, [edx*8]
and edx, 0x3f
bswap eax
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x64]
shl eax, 3
or ecx, eax
lea eax, [ebp - 0x88]
bswap ecx
push eax
mov dword [ebp - 0x90], ecx
mov eax, 0x38
mov ecx, 0x78
sub eax, edx
sub ecx, edx
cmp edx, 0x38
cmovae eax, ecx
push eax
push 0x50ace0
call fcn.004b2370
lea eax, [ebp - 0x88]
push eax
push 4
lea eax, [ebp - 0x90]
push eax
call fcn.004b2370
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x8c]
push 4
push eax
call fcn.004b2370
push 0x40
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.004d6ed0
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [edi], eax
xor ecx, ebp
mov eax, dword [ebp - 0x84]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x80]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x78]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x74]
mov dword [edi + 0x14], eax
mov eax, dword [ebp - 0x70]
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 0x6c]
mov dword [edi + 0x1c], eax
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4aed30
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x78]
push edi
mov edi, dword [ebp + 0x10]
push eax
push 8
lea eax, [ebp - 0x80]
mov dword [ebp - 0x54], 0
push eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x78], 0x6a09e667
mov dword [ebp - 0x74], 0xbb67ae85
mov dword [ebp - 0x70], 0x3c6ef372
mov dword [ebp - 0x6c], 0xa54ff53a
mov dword [ebp - 0x68], 0x510e527f
mov dword [ebp - 0x64], 0x9b05688c
mov dword [ebp - 0x60], 0x1f83d9ab
mov dword [ebp - 0x5c], 0x5be0cd19
mov dword [ebp - 8], 0
mov dword [ebp - 0x80], 3
mov dword [ebp - 0x7c], 0
call fcn.004b2370
lea eax, [ebp - 0x78]
push eax
push 4
lea eax, [ebp + 0xc]
push eax
call fcn.004b2370
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4aedd8
lea ecx, [ebp - 0x78]
add eax, eax
push ecx
push eax
push edi
call fcn.004b2370
mov edx, dword [ebp - 0x58]
mov ecx, edx
shr ecx, 0x1d
lea eax, [edx*8]
and edx, 0x3f
bswap eax
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x54]
shl eax, 3
or ecx, eax
lea eax, [ebp - 0x78]
bswap ecx
push eax
mov dword [ebp - 0x84], ecx
mov eax, 0x38
mov ecx, 0x78
sub eax, edx
sub ecx, edx
cmp edx, 0x38
cmovae eax, ecx
push eax
push 0x50ace0
call fcn.004b2370
lea eax, [ebp - 0x78]
push eax
push 4
lea eax, [ebp - 0x84]
push eax
call fcn.004b2370
lea eax, [ebp - 0x78]
push eax
push 4
lea eax, [ebp - 0x7c]
push eax
call fcn.004b2370
push 0x40
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.004d6ed0
mov eax, dword [ebp - 0x78]
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [esi], eax
xor ecx, ebp
mov eax, dword [ebp - 0x74]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x70]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x6c]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x68]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x64]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x60]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x5c]
mov dword [esi + 0x1c], eax
xor eax, eax
pop edi
pop esi
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b01f0
Capabilities:
Encode data using xor

Disassembly:
movaps xmm4, xmmword [0x513d80]
mov eax, ecx
movups xmm2, xmmword [ecx + 0x2a00]
mov edx, 0x134
movups xmm3, xmmword [ecx + 0x2a10]
nop dword [eax]
movups xmm1, xmmword [eax]
movaps xmm0, xmm3
psrldq xmm2, 1
lea eax, [eax + 0x10]
pslld xmm0, 6
xorps xmm2, xmm1
pslldq xmm1, 7
xorps xmm2, xmm0
movups xmm0, xmmword [eax + 0x16d0]
psrld xmm0, 0x13
xorps xmm1, xmm2
movaps xmm2, xmm3
andps xmm0, xmm4
xorps xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
movaps xmm3, xmm1
sub edx, 1
jne 0x4b0210
lea eax, [ecx + 0x1340]
mov ecx, 0x16e
nop dword [eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x10]
psrldq xmm2, 1
pslld xmm1, 6
xorps xmm2, xmm0
pslldq xmm0, 7
xorps xmm1, xmm2
movaps xmm2, xmm3
xorps xmm1, xmm0
movups xmm0, xmmword [eax - 0x1350]
psrld xmm0, 0x13
andps xmm0, xmm4
xorps xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
movaps xmm3, xmm1
sub ecx, 1
jne 0x4b0260
ret

Function at 0x4b02a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0x10]
mov edx, dword [ecx + 0xc]
mov eax, dword [ecx + 8]
and eax, dword [ebx + 0x1c]
and edx, dword [ebx + 0x20]
xor edx, eax
mov eax, dword [ecx + 4]
and eax, dword [ebx + 0x18]
xor edx, eax
mov eax, dword [ebx + 0x14]
and eax, dword [ecx]
mov ecx, 0x10
xor edx, eax
nop dword [eax]
mov eax, edx
sar eax, cl
xor edx, eax
shr ecx, 1
jne 0x4b02d0
test dl, 1
jne 0x4b0323
push esi
xor edx, edx
push edi
nop dword [eax]
nop word [eax + eax]
lea edi, [edx*4]
mov eax, 1
mov esi, dword [edi + ebx + 0x14]
xor ecx, ecx
test eax, esi
jne 0x4b031b
inc ecx
add eax, eax
cmp ecx, 0x20
jl 0x4b0302
inc edx
cmp edx, 4
jl 0x4b02f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 0x10]
xor dword [edi + ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b03c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov esi, 1
mov edx, dword [edi + 0x10]
mov dword [edx], eax
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + esi*4 - 4]
lea edx, [eax + esi*4]
shr ecx, 0x1e
xor ecx, dword [edx - 4]
imul eax, ecx, 0x6c078965
add eax, esi
inc esi
mov dword [edx], eax
cmp esi, 0xa88
jl 0x4b03d4
mov ecx, dword [edi + 0x10]
mov dword [edi + 8], 0xa88
mov edx, dword [ecx + 0xc]
mov eax, dword [ecx + 8]
and eax, dword [edi + 0x1c]
and edx, dword [edi + 0x20]
xor edx, eax
mov eax, dword [ecx + 4]
and eax, dword [edi + 0x18]
xor edx, eax
mov eax, dword [edi + 0x14]
and eax, dword [ecx]
mov ecx, 0x10
xor edx, eax
mov eax, edx
sar eax, cl
xor edx, eax
shr ecx, 1
jne 0x4b0423
test dl, 1
jne 0x4b0474
xor edx, edx
push ebx
nop word [eax + eax]
mov esi, dword [edi + edx*4 + 0x14]
lea ebx, [edx*4]
mov eax, 1
xor ecx, ecx
test eax, esi
jne 0x4b046d
inc ecx
add eax, eax
cmp ecx, 0x20
jl 0x4b0452
inc edx
cmp edx, 4
jl 0x4b0440
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
mov ecx, dword [edi + 0x10]
xor dword [ecx + ebx], eax
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x4b06b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
jne 0x4b06cf
lea eax, [edi + 1]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
mov eax, edx
mov ecx, dword [esi + 8]
and edx, 3
movss xmm5, dword [0x513b88]
shr eax, 2
mov dword [esp + 0xc], eax
mov dword [ebp + 0xc], edx
test eax, eax
je 0x4b07e7
movaps xmm4, xmmword [0x513d80]
nop dword [eax + eax]
cmp ecx, 0xa88
jb 0x4b07c8
movss xmm0, dword [esi + 4]
comiss xmm0, xmm5
mov ecx, dword [esi + 0xc]
jb 0x4b07c1
movups xmm2, xmmword [ecx + 0x2a00]
mov eax, ecx
movups xmm3, xmmword [ecx + 0x2a10]
mov edx, 0x134
movups xmm1, xmmword [eax]
movaps xmm0, xmm3
psrldq xmm2, 1
lea eax, [eax + 0x10]
pslld xmm0, 6
xorps xmm2, xmm1
pslldq xmm1, 7
xorps xmm2, xmm0
movups xmm0, xmmword [eax + 0x16d0]
psrld xmm0, 0x13
xorps xmm1, xmm2
movaps xmm2, xmm3
andps xmm0, xmm4
xorps xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
movaps xmm3, xmm1
sub edx, 1
jne 0x4b0732
lea eax, [ecx + 0x1340]
mov ecx, 0x16e
nop
movups xmm0, xmmword [eax]
lea eax, [eax + 0x10]
psrldq xmm2, 1
pslld xmm1, 6
xorps xmm2, xmm0
pslldq xmm0, 7
xorps xmm1, xmm2
movaps xmm2, xmm3
xorps xmm1, xmm0
movups xmm0, xmmword [eax - 0x1350]
psrld xmm0, 0x13
andps xmm0, xmm4
xorps xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
movaps xmm3, xmm1
sub ecx, 1
jne 0x4b0780
jmp 0x4b07c6
call fcn.004aff40
xor ecx, ecx
mov eax, dword [esi + 0x10]
mov eax, dword [eax + ecx*4]
inc ecx
mov dword [edi], eax
add edi, 4
sub dword [esp + 0xc], 1
jne 0x4b0700
lea edx, [esi + 8]
lea eax, [esi + 8]
jmp 0x4b07ec
lea eax, [esi + 8]
mov edx, eax
cmp dword [ebp + 0xc], 0
mov dword [eax], ecx
je 0x4b083f
cmp ecx, 0xa88
jb 0x4b081a
movss xmm0, dword [esi + 4]
comiss xmm0, xmm5
mov ecx, dword [esi + 0xc]
jb 0x4b0810
call fcn.004b01f0
jmp 0x4b0815
call fcn.004aff40
xor ecx, ecx
lea edx, [esi + 8]
lea eax, [ecx + 1]
mov dword [edx], eax
mov eax, dword [esi + 0x10]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4b083f
push eax
lea eax, [esp + 0x10]
push eax
push edi
call fcn.004d6950
add esp, 0xc
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4b1100
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov eax, ecx
push esi
xor esi, esi
mov dword [ebp - 0x1c], eax
add eax, 0x800
mov dword [ebp - 0x18], esi
push edi
mov dword [ebp - 0x10], eax
nop dword [eax + eax]
mov edx, esi
mov dword [ebp - 0x14], 8
mov ecx, esi
mov ebx, esi
mov eax, esi
shl esi, 0x18
mov dword [ebp - 0xc], esi
mov edi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
nop dword [eax]
test al, 1
je 0x4b114d
shr eax, 1
xor eax, 0xedb88320
jmp 0x4b114f
shr eax, 1
mov dword [ebp - 0xc], eax
test bl, 1
je 0x4b1161
shr ebx, 1
xor ebx, 0xb163422d
jmp 0x4b1163
shr ebx, 1
test cl, 1
je 0x4b1172
shr ecx, 1
xor ecx, 0xa872fb4b
jmp 0x4b1174
shr ecx, 1
test dl, 1
je 0x4b1183
shr edx, 1
xor edx, 0x83bff91c
jmp 0x4b1185
shr edx, 1
mov eax, dword [ebp - 4]
test eax, eax
jns 0x4b1195
add eax, eax
xor eax, 0x73cd167
jmp 0x4b1197
add eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
jns 0x4b11aa
add eax, eax
xor eax, 0xd185497
jmp 0x4b11ac
add eax, eax
mov dword [ebp - 8], eax
test edi, edi
jns 0x4b11bd
add edi, edi
xor edi, 0x2d08ad
jmp 0x4b11bf
add edi, edi
test esi, esi
jns 0x4b11cd
add esi, esi
xor esi, 0x9f8a7cdf
jmp 0x4b11cf
add esi, esi
sub dword [ebp - 0x14], 1
mov eax, dword [ebp - 0xc]
jne 0x4b1140
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
mov dword [edi - 0x800], eax
mov eax, edi
mov dword [eax - 0x400], ebx
mov ebx, edi
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov dword [ebx + 0x400], edx
mov dword [ebx + 0x800], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0xc00], eax
mov dword [ebx + 0x1000], edi
mov dword [ebx + 0x1400], esi
add ebx, 4
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], esi
cmp esi, 0x100
jb 0x4b1120
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b1240
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4b1253
mov eax, 1
pop ebp
ret 4
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], 0
xor eax, eax
pop ebp
ret 4

Function at 0x4b1290
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4b12a3
mov eax, 1
pop ebp
ret 4
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x70], 0
xor eax, eax
pop ebp
ret 4
Function at 0x4b2070
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4b21ee
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4b21ee
push esi
mov esi, dword [eax]
mov eax, dword [ebp + 0xc]
movzx ecx, si
shr esi, 0x10
mov dword [ebp - 8], esi
test eax, eax
je 0x4b21da
push ebx
mov edx, 0x15b0
cmp eax, edx
cmovb edx, eax
sub eax, edx
mov dword [ebp + 0xc], eax
cmp edx, 0x10
jb 0x4b2153
mov ebx, edx
shr ebx, 4
movzx eax, byte [edi]
sub edx, 0x10
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 8]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 9]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xa]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xb]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xc]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xd]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xe]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xf]
add esi, ecx
add edi, 0x10
add ecx, eax
add esi, ecx
sub ebx, 1
jne 0x4b20c2
mov dword [ebp - 8], esi
xor ebx, ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
cmp edx, 2
jb 0x4b2194
mov esi, dword [ebp + 8]
lea ebx, [edx - 2]
shr ebx, 1
inc ebx
nop dword [eax]
movzx eax, byte [edi]
sub edx, 2
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add edi, 2
add ecx, eax
add dword [ebp - 4], ecx
sub ebx, 1
jne 0x4b2170
mov dword [ebp + 8], esi
mov esi, dword [ebp - 8]
mov ebx, dword [ebp + 8]
test edx, edx
je 0x4b21a0
movzx eax, byte [edi]
add ecx, eax
add esi, ecx
inc edi
mov eax, dword [ebp - 4]
add eax, ebx
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
add esi, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], esi
test eax, eax
jne 0x4b20a5
pop ebx
mov eax, dword [ebp + 0x10]
shl esi, 0x10
or esi, ecx
mov dword [eax], esi
xor eax, eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 0xc