joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4acee0
Capabilities:
Access the windows event log

Disassembly:
push 0xffffffffffffffff
push 0x572330
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x59b000]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [esp + 0x50]
push 0x445214
push 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov edi, eax
test edi, edi
je 0x4ad044
mov dword [esp + 0x20], edi
mov ebx, 0x10000
mov dword [esp + 0x48], 0
push ebx
call fcn.0054cb68
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov byte [esp + 0x48], 1
test esi, esi
je 0x4ad023
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push ebx
push esi
push 0
push 9
push edi
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
test eax, eax
jne 0x4acfd8
call ebp
cmp eax, 0x7a
jne 0x4acfb3
mov ebx, dword [esp + 0x24]
push ebx
push esi
call fcn.0054cbfa
add esp, 8
test eax, eax
jne 0x4acf74
push esi
call fcn.00549ff4
add esp, 4
xor esi, esi
mov byte [esp + 0x48], 0
test esi, esi
je 0x4acfc5
push esi
call fcn.00549ff4
add esp, 4
push edi
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
xor al, al
jmp 0x4ad046
lea eax, [esp + 0x18]
push eax
push 0x1775
push 0x44521c
push dword [esp + 0x34]
push esi
call fcn.004acdc0
add esp, 0x14
test al, al
je 0x4acf74
mov eax, dword [esp + 0x18]
push dword [eax + 0xc]
lea eax, [esp + 0x30]
push 0x4451bc
push eax
call fcn.0054a8cc
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x38]
add esp, 0xc
push eax
call fcn.004aae20
mov byte [esp + 0x48], 0
test esi, esi
je 0x4ad035
push esi
call fcn.00549ff4
add esp, 4
push edi
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov al, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0054a992
add esp, 0x38
ret
Function at 0x4ad6a0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x572418
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x59b000]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x1c]
mov ecx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
mov edi, dword [esp + 0x4c]
push edx
push dword [0x595088]
mov byte [esp + 0x1f], 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ad753
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x18], esi
mov dword [esp + 0x34], eax
mov eax, dword [edi]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push ebp
lea eax, [esp + 0x2c]
mov dword [edi], 0
push eax
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete bl
test bl, bl
je 0x4ad740
mov eax, dword [esp + 0x20]
mov dword [edi], eax
push esi
mov dword [esp + 0x38], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x4ad757
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0054a992
add esp, 0x24
ret
Function at 0x4ad780
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x572418
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x59b000]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x48]
xor bl, bl
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], 0
jb 0x4ad7d5
mov eax, dword [edi]
jmp 0x4ad7d7
mov eax, edi
mov byte [eax], 0
lea eax, [esp + 0x1c]
push eax
push dword [0x595088]
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ad8b5
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x18], esi
mov dword [esp + 0x34], eax
lea eax, [esp + 0x24]
push eax
push 0
lea eax, [esp + 0x28]
push eax
push 0
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, eax
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x4ad829
cmp eax, 2
jne 0x4ad8a6
test ecx, ecx
jne 0x4ad8a6
mov ecx, dword [edi + 0x10]
mov eax, dword [esp + 0x24]
cmp eax, ecx
ja 0x4ad851
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], eax
jb 0x4ad849
mov ecx, dword [edi]
mov byte [ecx + eax], 0
jmp 0x4ad85d
mov ecx, edi
mov byte [ecx + eax], 0
jmp 0x4ad85d
sub eax, ecx
mov ecx, edi
push 0
push eax
call fcn.004abe60
cmp dword [edi + 0x14], 0x10
jb 0x4ad867
mov eax, dword [edi]
jmp 0x4ad869
mov eax, edi
lea ecx, [esp + 0x24]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
push 0
push ebp
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4ad8a6
cmp dword [edi + 0x14], 0x10
jb 0x4ad88f
mov ecx, dword [edi]
jmp 0x4ad891
mov ecx, edi
mov eax, dword [edi + 0x10]
dec eax
add eax, ecx
mov ecx, edi
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004ac7c0
mov bl, 1
push esi
mov dword [esp + 0x38], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0054a992
add esp, 0x24
ret

Function at 0x4ad940
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x34
push esi
mov esi, dword [esp + 0x3c]
push esi
push 0x4451c0
push 0x4451d0
push reloc.WS2_32.dll_bind
call fcn.004ad780
add esp, 0x10
cmp dword [esi + 0x10], 0
jne 0x4ad98b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], eax
mov ecx, 0x445080
cmp eax, dword [ecx]
je 0x4ad99e
add ecx, 8
cmp ecx, 0x445180
jne 0x4ad975
mov eax, 1
jmp 0x4ad9a1
push 0x13
push 0x445380
mov ecx, esi
call fcn.00465760
pop esi
add esp, 0x34
ret
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
lea ecx, [esp + 0xc]
push 0
lea eax, [esp + 8]
push eax
call fcn.004aa070
push 0x584500
lea eax, [esp + 0x10]
push eax
call fcn.0054a9a1
int3
Function at 0x4aef20
Capabilities:
Clear file content
Get file size
Write file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
mov ebx, dword [esp + 0x18]
lea eax, [esp + 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4aef55
xor al, al
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0054a992
add esp, 0x10
ret
xor edx, edx
push edi
mov edi, dword [esp + 0x20]
cmp edx, 0x7fffffff
jb 0x4aef89
ja 0x4aef6b
cmp edi, 0xffffffff
jbe 0x4aef89
push 0xdf
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0054a992
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
push ebp
push esi
cmp edx, ecx
jl 0x4aefff
mov eax, dword [esp + 0x14]
jg 0x4aef9d
cmp edi, eax
jbe 0x4aefff
push 0
push 0
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4af01b
sub edi, dword [esp + 0x14]
je 0x4aefea
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 0x200
nop
cmp edi, 0x200
mov esi, edi
push 0
cmova esi, eax
lea eax, [esp + 0x14]
push eax
push esi
push 0x5a1848
push ebx
call ebp
cmp dword [esp + 0x10], esi
jne 0x4af01b
mov eax, 0x200
sub edi, esi
jne 0x4aefc0
pop esi
pop ebp
pop edi
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0054a992
add esp, 0x10
ret
push 0
push 0
push edx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4af01b
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4aefea
mov ecx, dword [esp + 0x1c]
xor al, al
pop esi
pop ebp
pop edi
pop ebx
xor ecx, esp
call fcn.0054a992
add esp, 0x10
ret
Function at 0x4af450
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
jne 0x4af491
mov eax, dword [0x5a1a48]
test eax, eax
jne 0x4af47f
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x18]
mov ecx, 1
cmp ecx, eax
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x20
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
cmp eax, 8
jb 0x4af4ed
cmp eax, 0x20
jae 0x4af4b3
pause
inc dword [esi + 0xc]
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0054a992
add esp, 0x28
ret
mov ecx, esi
jne 0x4af4cf
call fcn.004ada80
inc dword [esi + 0xc]
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0054a992
add esp, 0x28
ret
call fcn.004af500
test al, al
je 0x4af4e5
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
test eax, eax
jne 0x4af4ed
push eax
jmp 0x4af4e7
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [esi + 0xc]
mov ecx, dword [esp + 0x28]
pop esi
xor ecx, esp
call fcn.0054a992
add esp, 0x28
ret

Function at 0x4b2b70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57b9db
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov eax, dword [0x59b000]
xor eax, esp
push eax
lea eax, [esp + 0x148]
mov dword fs:[0], eax
mov esi, dword [esp + 0x15c]
lea eax, [esp + 0xc]
push 0x128
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.0054b440
xor eax, eax
cmp byte [esp + 0x14], al
setne al
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004b2d60
mov eax, dword [esp + 0x174]
xorps xmm0, xmm0
movdqu xmmword [esp + 0x148], xmm0
mov dword [esp + 0x148], eax
mov eax, dword [esp + 0x178]
mov dword [esp + 0x14c], eax
mov eax, dword [esi]
mov dword [esp + 0x150], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x154], eax
lea eax, [esp + 0x48]
push eax
xor eax, eax
mov dword [esp + 0x168], 0
cmp byte [esp + 0x20], al
setne al
push eax
push 0x10
push dword [esi + 0xc]
lea eax, [esp + 0x30]
push eax
call fcn.004b38f0
lea eax, [esp + 0x15c]
xorps xmm0, xmm0
push eax
push eax
lea eax, [esp + 0x3c]
push eax
movdqu xmmword [esp + 0x68], xmm0
call fcn.004b33c0
movdqu xmm0, xmmword [esp + 0x168]
mov esi, dword [esp + 0x18c]
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x188], 0xffffffff
movdqu xmmword [esi], xmm0
call fcn.004b33a0
add esp, 0x38
mov eax, esi
mov ecx, dword [esp + 0x148]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.0054a992
add esp, 0x14c
ret
Function at 0x4b2ed0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov ebx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x44]
mov dword [esp + 0xc], esi
test ebp, ebp
je 0x4b3052
test ebx, ebx
je 0x4b3052
mov ecx, dword [esp + 0x40]
cmp ecx, 0x10
jbe 0x4b3052
test esi, esi
je 0x4b3052
push edi
mov edi, ecx
mov eax, 0x10
and edi, 0xf
cmove edi, eax
cmp ecx, 0x20
jbe 0x4b2f53
push dword [esp + 0x10]
cmp edi, eax
mov edx, 0x20
mov esi, ecx
cmove eax, edx
and esi, 0xfffffff0
sub esi, eax
mov eax, dword [ebp + 0x1c]
push esi
push ebx
push ebp
call eax
add ebx, esi
add esp, 0x10
add dword [esp + 0x10], esi
mov esi, dword [esp + 0x10]
push edi
lea eax, [ebx + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0054adf0
lea eax, [esp + 0x30]
push eax
mov eax, dword [ebp + 0x14]
push ebx
push ebp
call eax
add esp, 0x18
xor eax, eax
test edi, edi
je 0x4b2fd4
cmp edi, 0x20
jb 0x4b2fc3
mov ecx, edi
mov edx, edi
and ecx, 0x1f
sub edx, ecx
jmp 0x4b2f90
movdqu xmm0, xmmword [esp + eax + 0x24]
movdqu xmm1, xmmword [esp + eax + 0x14]
pxor xmm1, xmm0
movdqu xmmword [esp + eax + 0x24], xmm1
movdqu xmm0, xmmword [esp + eax + 0x34]
movdqu xmm1, xmmword [esp + eax + 0x24]
pxor xmm1, xmm0
movdqu xmmword [esp + eax + 0x34], xmm1
add eax, 0x20
cmp eax, edx
jb 0x4b2f90
cmp eax, edi
jae 0x4b2fd4
mov cl, byte [esp + eax + 0x14]
xor byte [esp + eax + 0x24], cl
inc eax
cmp eax, edi
jb 0x4b2fc7
push edi
lea eax, [esp + 0x28]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.0054adf0
add esp, 0xc
test edi, edi
je 0x4b303b
mov eax, 0x10
sub eax, edi
push eax
lea eax, [esp + 0x28]
add eax, edi
push eax
lea eax, [esp + 0x1c]
add eax, edi
push eax
call fcn.0054adf0
lea eax, [esp + 0x20]
push eax
push eax
mov eax, dword [ebp + 0x14]
push ebp
call eax
mov eax, dword [ebp + 0x28]
add esp, 0x18
xor eax, dword [esp + 0x14]
mov dword [esi], eax
mov ecx, dword [ebp + 0x2c]
xor ecx, dword [esp + 0x18]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0x30]
xor ecx, dword [esp + 0x1c]
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0x34]
xor ecx, dword [esp + 0x20]
mov dword [esi + 0xc], ecx
mov eax, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0054a992
add esp, 0x28
ret
mov ecx, dword [esp + 0x30]
xor eax, eax
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0054a992
add esp, 0x28
ret
Function at 0x4b3420
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x30]
push ebx
mov ebx, dword [esp + 0x40]
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x44]
push edi
mov edi, esi
mov dword [esp + 0x10], ecx
and edi, 0xf
test ecx, ecx
je 0x4b35a1
cmp esi, 0x10
jbe 0x4b35a1
mov eax, esi
and eax, 0xfffffff0
cmp eax, 0x10
jbe 0x4b3484
mov eax, dword [ecx + 0x18]
and esi, 0xfffffff0
push ebx
sub esi, 0x10
push esi
push ebp
push ecx
call eax
mov ecx, dword [esp + 0x20]
add ebp, esi
add esp, 0x10
add ebx, esi
mov esi, dword [esp + 0x48]
mov eax, dword [ecx + 0x28]
lea edx, [ecx + 0x28]
xor eax, dword [ebp]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 4]
xor eax, dword [edx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
xor eax, dword [edx + 8]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
xor eax, dword [edx + 0xc]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push eax
push eax
mov eax, dword [ecx + 0x10]
push ecx
mov dword [esp + 0x20], edx
call eax
add esp, 0xc
test edi, edi
je 0x4b3578
push edi
lea eax, [ebp + 0x10]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.0054adf0
push edi
lea eax, [esp + 0x28]
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.0054adf0
add esp, 0x18
xor eax, eax
test edi, edi
je 0x4b3544
cmp edi, 0x20
jb 0x4b3533
mov ecx, edi
mov edx, edi
and ecx, 0x1f
sub edx, ecx
nop
movdqu xmm0, xmmword [esp + eax + 0x18]
movdqu xmm1, xmmword [esp + eax + 0x28]
pxor xmm1, xmm0
movdqu xmmword [esp + eax + 0x18], xmm1
movdqu xmm0, xmmword [esp + eax + 0x28]
movdqu xmm1, xmmword [esp + eax + 0x38]
pxor xmm1, xmm0
movdqu xmmword [esp + eax + 0x28], xmm1
add eax, 0x20
cmp eax, edx
jb 0x4b3500
cmp eax, edi
jae 0x4b3544
mov cl, byte [esp + eax + 0x28]
xor byte [esp + eax + 0x18], cl
inc eax
cmp eax, edi
jb 0x4b3537
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edi
push eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [eax + 0x10]
call eax
movdqu xmm0, xmmword [edi]
add esp, 0xc
mov eax, esi
movdqu xmmword [ebx], xmm0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0054a992
add esp, 0x2c
ret
movdqu xmm0, xmmword [ebx - 0x10]
pop edi
mov eax, esi
movdqu xmmword [ebx], xmm0
pop esi
movdqu xmm0, xmmword [esp + 0x10]
pop ebp
movdqu xmmword [ebx - 0x10], xmm0
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0054a992
add esp, 0x2c
ret
mov ecx, dword [esp + 0x38]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0054a992
add esp, 0x2c
ret
Function at 0x4b3ad0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
sub esp, 8
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4b3b30
call fcn.0054cfce
add eax, 0x40
push eax
push 0x4458d0
call fcn.0054d0aa
add esp, 8
mov eax, 0x10300001
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0054a992
add esp, 8
ret
push esi
push dword [esp + 0x18]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4b3b7a
call fcn.0054cfce
add eax, 0x40
push eax
push 0x4458f0
call fcn.0054d0aa
add esp, 8
push 0
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 0x10300001
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0054a992
add esp, 8
ret
push 0
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 8]
xor eax, eax
pop esi
xor ecx, esp
call fcn.0054a992
add esp, 8
ret

Function at 0x4b4180
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x5a1aa8], 0
push ebx
push esi
jne 0x4b4258
xor esi, esi
mov eax, esi
and al, 1
movzx ecx, al
mov eax, esi
neg ecx
sbb ecx, ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
mov dword [esi*4 + 0x5a1ab0], eax
inc esi
cmp esi, 0x100
jb 0x4b4191
mov dword [0x5a1aa8], 1
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x4b4314
mov edx, dword [esp + 0x10]
test edx, edx
je 0x4b4314
mov esi, dword [esp + 0x14]
mov eax, dword [ebx]
test esi, esi
je 0x4b4312
push edi
nop
cmp esi, 0x10
jb 0x4b42f2
mov edi, 4
lea ebx, [ebx]
movzx ecx, byte [edx]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x5a1ab0]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x5a1ab0]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x5a1ab0]
movzx ecx, byte [edx + 3]
add edx, 4
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x5a1ab0]
dec edi
jne 0x4b4290
sub esi, 0x10
jmp 0x4b4309
movzx ecx, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x5a1ab0]
dec esi
test esi, esi
jne 0x4b4280
pop edi
mov dword [ebx], eax
pop esi
pop ebx
ret
Function at 0x4b4320
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x12c
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
mov ebx, dword [esp + 0x134]
push ebp
push esi
push edi
movdqu xmm0, xmmword [ebx + 0x2c]
mov eax, dword [ebx + 0xc]
mov ebp, 0x30
mov dword [esp + 0x34], eax
mov dword [esp + 0x2c], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0x14]
movdqu xmmword [esp + 0x38], xmm0
mov dword [esp + 0x14], eax
movdqu xmm0, xmmword [ebx + 0x3c]
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 0x1c]
movdqu xmmword [esp + 0x48], xmm0
mov dword [esp + 0x1c], eax
movdqu xmm0, xmmword [ebx + 0x4c]
mov eax, dword [ebx + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x24]
movdqu xmmword [esp + 0x58], xmm0
mov dword [esp + 0x18], eax
movdqu xmm0, xmmword [ebx + 0x5c]
mov eax, dword [ebx + 0x28]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x70]
mov dword [esp + 0x30], ebx
movdqu xmmword [esp + 0x68], xmm0
mov edx, dword [eax - 0x34]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov edi, edx
mov ecx, edx
rol edi, 0xe
ror ecx, 7
xor edi, ecx
shr edx, 3
xor edi, edx
mov ecx, esi
mov edx, esi
rol ecx, 0xd
rol edx, 0xf
xor edx, ecx
shr esi, 0xa
xor edx, esi
add edi, edx
add edi, dword [eax - 0x3c]
add edi, dword [eax - 0x18]
mov dword [eax + 4], edi
dec ebp
jne 0x4b43b4
mov ebp, dword [esp + 0x2c]
xor edi, edi
mov ebx, dword [esp + 0x1c]
mov esi, ebx
mov eax, ebx
rol eax, 7
mov ecx, ebx
ror esi, 0xb
not ecx
and ecx, dword [esp + 0x18]
xor esi, eax
mov eax, ebx
mov edx, ebp
ror eax, 6
xor esi, eax
ror edx, 0xd
mov eax, dword [esp + 0x10]
and eax, ebx
or ecx, eax
mov eax, ebp
rol eax, 0xa
add esi, ecx
add esi, dword [edi + 0x445928]
xor edx, eax
add esi, dword [esp + edi + 0x38]
mov eax, ebp
add esi, dword [esp + 0x28]
add edi, 4
ror eax, 2
xor edx, eax
mov eax, dword [esp + 0x20]
mov ecx, eax
and eax, ebp
or ecx, ebp
and ecx, dword [esp + 0x14]
or ecx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
add edx, ecx
mov eax, dword [esp + 0x10]
mov ecx, ebp
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x18], eax
lea ebp, [edx + esi]
mov eax, dword [esp + 0x14]
add ebx, esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ecx
cmp edi, 0x100
jb 0x4b43f7
mov eax, dword [esp + 0x34]
add eax, ebp
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
add dword [ebx + 0x10], ecx
mov ecx, dword [esp + 0x12c]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 8]
add dword [ebx + 0x14], eax
mov eax, dword [esp + 0x18]
add dword [ebx + 0x18], eax
mov eax, dword [esp + 0x10]
add dword [ebx + 0x1c], eax
mov eax, dword [esp + 4]
add dword [ebx + 0x20], eax
mov eax, dword [esp + 0xc]
add dword [ebx + 0x24], eax
mov eax, dword [esp + 0x1c]
add dword [ebx + 0x28], eax
pop ebx
xor ecx, esp
call fcn.0054a992
add esp, 0x12c
ret