joyce8/EMBER2024-capa huggingface dataset:
Function at 0x534540
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x78eef7
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x851070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.00516f90
mov dword [ebp - 4], 0
mov dword [edi + 0xbc], 0x7de710
mov byte [ebp - 4], 1
lea ecx, [edi + 0xf8]
mov dword [edi], 0x7de628
mov dword [edi + 4], 0x7de60c
mov dword [edi + 0xbc], 0x7de614
mov dword [edi + 0xc0], 0
mov dword [edi + 0xc4], 1
mov dword [edi + 0xc8], 0xffffffff
mov dword [edi + 0xcc], 0xffffffff
mov dword [edi + 0xd0], 0x6d6d6d
mov dword [edi + 0xd4], 0
mov dword [edi + 0xd8], 0
mov dword [edi + 0xdc], 0
mov dword [edi + 0xe4], 1
mov word [edi + 0xe8], 0x100
mov byte [edi + 0xea], 0
mov dword [edi + 0xec], 0
mov dword [edi + 0xf4], 0x1000100
call fcn.005054f0
mov byte [ebp - 4], 2
push 0x38
mov word [edi + 0x168], 0
mov byte [edi + 0x175], 0
call fcn.00735c39
mov esi, eax
add esp, 4
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00405dd0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x18]
call fcn.00405dd0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [edi + 0x178], esi
mov byte [esi + 0x30], 0
mov eax, dword [edi + 0x178]
movlpd qword [ebp - 0x1c], xmm0
push 0x68
mov dword [eax + 0x34], 0
mov eax, dword [ebp - 0x1c]
mov dword [edi + 0x16c], eax
mov eax, dword [ebp - 0x18]
mov dword [edi + 0x170], eax
mov dword [edi + 0xfc], 0xff9933
mov dword [edi + 0x10c], 0xffffff
mov dword [edi + 0x14], 0xffffff
mov dword [edi + 0x24], 0
mov ecx, dword [edi + 0x58]
or dword [ecx + 0x18], 2
call fcn.00735c39
mov edi, eax
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 5
push 0x68
push 0
push edi
call fcn.00738a30
add esp, 0x10
mov dword [edi], 0
mov dword [edi + 4], 0
lea ecx, [edi + 0xc]
mov dword [edi + 8], 0
call fcn.00405dd0
mov byte [ebp - 4], 6
lea ecx, [edi + 0x24]
call fcn.00405dd0
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x4c], eax
lea esi, [edi + 0x60]
mov dword [edi + 0x50], 0
push 0
mov byte [edi + 0x5c], 0
mov dword [ebp - 0x18], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0054fc80
mov dword [esi], eax
mov byte [ebp - 4], 0xa
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov eax, dword [ebp - 0x1c]
mov dword [edi + 0x54], eax
mov eax, dword [ebp - 0x18]
mov dword [edi + 0x58], eax
movups xmmword [edi + 0x3c], xmm0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xf0], edi
mov dword [eax + 0xc], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x56f940
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7954cb
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x851070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0x18
call fcn.00735c39
mov ebx, dword [0x7aa17c]
add esp, 4
mov dword [esi], eax
push eax
call ebx
mov dword [ebp - 4], 0
lea edi, [esi + 8]
push 0x18
mov byte [esi + 4], 0
mov dword [ebp - 0x14], edi
call fcn.00735c39
add esp, 4
mov dword [edi], eax
push eax
call ebx
mov byte [ebp - 4], 1
lea ecx, [edi + 8]
call fcn.00405dd0
mov byte [ebp - 4], 2
lea esi, [edi + 0x40]
mov dword [edi + 0x20], 3
mov dword [edi + 0x24], 0x3c
mov dword [edi + 0x28], 0xc8
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0x40e00000
mov dword [edi + 0x38], 0x15180
mov byte [edi + 0x3c], 0
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005092c0
mov dword [esi], eax
mov byte [ebp - 4], 5
lea esi, [edi + 0x48]
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00577da0
mov dword [esi], eax
mov byte [ebp - 4], 8
mov byte [edi + 0x50], 0
mov dword [edi + 4], 0
mov byte [ebp - 4], 9
mov edi, dword [ebp - 0x10]
add edi, 0x5c
push 0x18
mov dword [ebp - 0x18], edi
call fcn.00735c39
add esp, 4
mov dword [edi], eax
push eax
call ebx
mov byte [ebp - 4], 0xa
lea ebx, [edi + 4]
mov dword [ebp - 0x14], ebx
lea ecx, [ebx + 8]
mov dword [ebx], 0
mov byte [ebx + 4], 0
call fcn.00405dd0
mov byte [ebp - 4], 0xc
lea esi, [edi + 0x24]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
push 0
push 0
call fcn.004da270
mov dword [esi], eax
mov byte [ebp - 4], 0xf
mov dword [edi + 0x2c], 0
mov byte [ebp - 4], 0x10
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x30]
push 0x7b8b4c
call fcn.00405d80
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x30]
push 0
push 0
push eax
mov ecx, ebx
call fcn.0049bda0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x30]
call fcn.00405d30
mov byte [ebp - 4], 0x13
mov ebx, dword [ebp - 0x10]
lea edi, [ebx + 0x9c]
mov dword [ebp - 0x18], edi
mov dword [edi], 0x7e19a4
mov byte [ebp - 4], 0x14
lea ecx, [edi + 0x10]
mov dword [edi], 0x7e1998
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.00450680
mov byte [ebp - 4], 0x15
lea esi, [edi + 0xf0]
push 0
mov dword [edi + 0xe8], 0
mov dword [edi + 0xec], 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00503110
mov dword [esi], eax
mov byte [ebp - 4], 0x18
lea esi, [edi + 0xf8]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00573ed0
mov dword [esi], eax
mov byte [ebp - 4], 0x1b
mov byte [edi + 0x100], 0
mov dword [edi + 0x104], 0
mov dword [edi + 0x108], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x57f420
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x797b46
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x851070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x18
mov dword [edi], 0xbb8
mov dword [edi + 4], 0x3e80
mov dword [edi + 8], 0xafc8
mov dword [edi + 0xc], 0x3e8
mov word [edi + 0x10], 0
call fcn.00735c39
mov dword [edi + 0x14], eax
add esp, 4
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0x14]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov eax, dword [edi + 0x14]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x30]
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
push 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004da270
mov dword [esi], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x581500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
mov edi, ecx
call fcn.005814a0
test eax, eax
je 0x581513
mov eax, 0xfffffffe
pop edi
ret
push esi
mov esi, dword [edi + 0x1c]
mov dword [edi + 0x14], 0
mov dword [edi + 8], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x2c], 2
mov eax, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x14], 0
test eax, eax
jns 0x58154c
neg eax
mov dword [esi + 0x18], eax
cmp eax, 2
jne 0x581556
lea ecx, [eax + 0x37]
jmp 0x581565
test eax, eax
mov ecx, 0x71
mov edx, 0x2a
cmovne ecx, edx
mov dword [esi + 4], ecx
cmp eax, 2
jne 0x581571
xor eax, eax
jmp 0x58157f
push 0
xor edx, edx
xor ecx, ecx
call fcn.005836a0
add esp, 4
mov dword [edi + 0x30], eax
mov ecx, esi
lea eax, [esi + 0x94]
mov dword [esi + 0x28], 0
mov dword [esi + 0xb18], eax
lea eax, [esi + 0x988]
mov dword [esi + 0xb24], eax
lea eax, [esi + 0xa7c]
mov dword [esi + 0xb30], eax
xor eax, eax
mov dword [esi + 0xb20], 0x7be4b4
mov dword [esi + 0xb2c], 0x7c1394
mov dword [esi + 0xb38], 0x7c146c
mov word [esi + 0x16b8], ax
mov dword [esi + 0x16bc], eax
call fcn.00584430
mov esi, dword [edi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.00738a30
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x7bed7a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x7bed78]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x7bed7c]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x7bed7e]
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
pop edi
ret
Function at 0x584180
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x58418b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.005841a0
Function at 0x5b66c0
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov ebp, edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.00588730
mov esi, eax
add esp, 8
test esi, esi
jne 0x5b66e8
lea eax, [esi + 7]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp byte [0x851a6c], 0
mov edi, dword [esp + 0x14]
je 0x5b6730
mov eax, dword [0x851b5c]
test eax, eax
je 0x5b670c
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x5b6730
lea eax, [esi + 4]
mov dword [esi + 8], ebp
push eax
push 0
push esi
push 0x58b5b0
push 0
push 0
mov dword [esi + 0xc], edi
call fcn.0074bab6
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x5b673d
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x5b6755
call dword [0x7aa3f4]
push edi
mov dword [esi + 4], eax
call ebp
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebp
pop ebx
ret
Function at 0x5c7c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebx, ecx
mov ebp, edx
mov ecx, dword [esp + 0x14]
push esi
push edi
mov dword [esp + 0x10], ebx
xor esi, esi
cmp dword [ebx + 0x14], esi
jle 0x5c7ceb
nop
mov edi, esi
xor edi, 1
cmp esi, 2
cmovge edi, esi
test ecx, ecx
je 0x5c7ca3
mov edx, edi
mov eax, ecx
mov ecx, dword [ebx + 0x10]
add edx, edx
mov ebx, dword [ecx + edx*8]
sub ebx, dword [esp + 0x1c]
nop
movzx edx, byte [eax]
movzx ecx, byte [ebx + eax]
cmp edx, ecx
jne 0x5c7cc8
test edx, edx
jne 0x5c7cda
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 0x10]
add edi, edi
push 0
mov edx, ebp
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
call fcn.0058d370
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x5c7d4a
jmp 0x5c7ce1
movzx ecx, byte [ecx + 0x7c4050]
movzx edx, byte [edx + 0x7c4050]
sub edx, ecx
jne 0x5c7cdd
inc eax
jmp 0x5c7c90
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
inc esi
cmp esi, dword [ebx + 0x14]
jl 0x5c7c70
mov edx, 0x7e32d8
sub edx, ebp
movzx ecx, byte [ebp]
movzx eax, byte [edx + ebp]
cmp ecx, eax
jne 0x5c7d16
test ecx, ecx
jne 0x5c7d28
mov eax, dword [ebx + 0x10]
mov ecx, dword [esp + 0x1c]
mov eax, dword [eax + 0x10]
test ecx, ecx
jne 0x5c7d2b
neg eax
sbb eax, eax
jmp 0x5c7d3a
movzx eax, byte [eax + 0x7c4050]
movzx ecx, byte [ecx + 0x7c4050]
sub ecx, eax
jne 0x5c7d48
inc ebp
jmp 0x5c7cf2
test eax, eax
je 0x5c7d48
mov edx, eax
call fcn.0058beb0
mov ecx, dword [esp + 0x1c]
test eax, eax
jne 0x5c7d48
mov ebp, 0x7e454c
jmp 0x5c7c63
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x5c8090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov eax, ecx
mov dword [esp + 4], edx
push ebx
push edi
xor ebx, ebx
mov dword [esp + 0x10], eax
xor edi, edi
cmp dword [eax + 0x14], ebx
jle 0x5c812a
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov eax, dword [eax + 0x10]
mov esi, edi
xor esi, 1
cmp edi, 2
cmovge esi, edi
shl esi, 4
add esi, eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x5c80e9
mov esi, dword [esi]
mov eax, ebp
sub esi, ebp
movzx edx, byte [eax]
movzx ecx, byte [esi + eax]
cmp edx, ecx
jne 0x5c8115
test edx, edx
jne 0x5c8127
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea ecx, [eax + 0x18]
push 0
call fcn.0058d370
add esp, 4
mov ebx, dword [eax + 8]
test ebx, ebx
jne 0x5c810b
mov eax, dword [esp + 0x18]
inc edi
cmp edi, dword [eax + 0x14]
jl 0x5c80b2
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 0x10
ret
movzx ecx, byte [ecx + 0x7c4050]
movzx edx, byte [edx + 0x7c4050]
sub edx, ecx
jne 0x5c8101
inc eax
jmp 0x5c80d6
pop edi
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x615500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xbc
mov eax, dword [0x851070]
xor eax, esp
mov dword [esp + 0xb8], eax
mov eax, dword [esp + 0xc4]
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0xcc]
lea eax, [edx + 0xf]
mov ebx, dword [esi + eax*4]
lea eax, [esi + eax*4]
push edi
xor edi, edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], 0x7e7f70
mov dword [esp + 0x28], 0x7e7f00
mov dword [esp + 0x2c], 0x7e7f44
mov dword [esp + 0x30], 0x7e8250
mov dword [esp + 0x34], 0x7e8270
mov dword [esp + 0x38], 0x7e8218
mov dword [esp + 0x3c], 0x7e8234
mov dword [esp + 0x40], 0x7e830c
mov dword [esp + 0x44], 0x7e8328
mov dword [esp + 0x48], 0x7e828c
mov dword [esp + 0x4c], 0x7e82c8
mov dword [esp + 0x50], 0x7e809c
mov dword [esp + 0x54], 0x7e80d0
mov dword [esp + 0x58], 0x7e7fe0
mov dword [esp + 0x5c], 0x7e8068
mov dword [esp + 0x60], 0x7e81a8
mov dword [esp + 0x64], 0x7e81ec
mov dword [esp + 0x68], 0x7e8140
mov dword [esp + 0x6c], 0x7e817c
mov dword [esp + 0x70], 0x7e8618
mov dword [esp + 0x74], 0x7e8644
mov dword [esp + 0x78], 0x7e85bc
mov dword [esp + 0x7c], 0x7e85ec
mov dword [esp + 0x80], 0x7e8730
mov dword [esp + 0x84], 0x7ba3e4
mov dword [esp + 0x88], 0x7ba3e4
mov dword [esp + 0x8c], 0x7e8758
mov dword [esp + 0x90], 0x7e8670
mov dword [esp + 0x94], 0x7e86b0
mov dword [esp + 0x98], 0x7e8418
mov dword [esp + 0x9c], 0x7e8480
mov dword [esp + 0xa0], 0x7e836c
mov dword [esp + 0xa4], 0x7e83a8
mov dword [esp + 0xa8], 0x7e8528
mov dword [esp + 0xac], 0x7e8578
mov dword [esp + 0xb0], 0x7e84b8
mov dword [esp + 0xb4], 0x7e84f4
mov dword [esp + 0xb8], 0x7e8868
mov dword [esp + 0xbc], 0x7e88d8
mov dword [esp + 0xc0], 0x7e881c
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ebx
test ebx, ebx
jne 0x61574c
mov eax, dword [esp + edx*4 + 0x24]
cmp edx, 0x12
jne 0x6156de
push dword [esi + 0xe4]
push dword [esi + 0x14]
push dword [esi + 0x10]
push eax
call fcn.0058b200
add esp, 0x10
jmp 0x61570a
cmp edx, 7
jne 0x6156fb
push dword [esi + 0xe0]
push eax
call fcn.0058b200
mov ebp, eax
add esp, 8
mov eax, 0x81
jmp 0x615711
push dword [esi + 0x14]
push dword [esi + 0x10]
push eax
call fcn.0058b200
add esp, 0xc
mov ebp, eax
mov eax, 0x85
test ebp, ebp
jne 0x61571a
lea edi, [ebp + 7]
jmp 0x615748
push 0
lea ecx, [esp + 0x1c]
mov edx, ebp
push ecx
mov ecx, dword [esi + 0xc]
push 0
push eax
push 0xffffffffffffffff
call fcn.005deca0
add esp, 0x14
mov edi, eax
push ebp
call fcn.00588960
mov eax, dword [esp + 0x24]
add esp, 4
mov ebx, dword [esp + 0x18]
mov dword [eax], ebx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x61578e
test ebx, ebx
je 0x61575e
movsx ebp, word [ebx + 0x10]
jmp 0x615760
xor ebp, ebp
xor eax, eax
test edi, edi
jne 0x61578e
cmp eax, ebp
jge 0x615786
push dword [edx + eax*4]
lea esi, [eax + 1]
push esi
push ebx
call fcn.005ade00
mov edx, dword [esp + 0x28]
mov edi, eax
add esp, 0xc
mov eax, esi
test edi, edi
je 0x615766
mov eax, dword [esp + 0x14]
mov dword [eax], ebx
jmp 0x615790
mov dword [ecx], ebx
mov ecx, dword [esp + 0xc8]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00735c28
add esp, 0xbc
ret
Function at 0x61c020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
push edi
push 0x38
xorps xmm0, xmm0
lea eax, [esp + 0x4c]
mov ebp, edx
movlpd qword [esp + 0x2c], xmm0
mov ebx, ecx
mov dword [esp + 0x20], ebp
push 0
movups xmmword [esp + 0x40], xmm0
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x50], 0x13
call fcn.00738a30
add esp, 0xc
lea eax, [esp + 0x48]
mov edx, ebp
mov ecx, ebx
push eax
push 1
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [esp + 0xa0]
call fcn.0060ca40
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x61c1fe
push dword [esp + 0x3c]
lea eax, [esp + 0x3c]
mov ecx, ebx
push dword [esp + 0x3c]
lea edx, [esp + 0x50]
mov dword [esp + 0x5c], eax
call fcn.00617c70
mov esi, eax
add esp, 8
test esi, esi
jne 0x61c1fe
lea edx, [esp + 0x48]
mov ecx, ebx
call fcn.00617d30
mov esi, eax
cmp esi, 0x64
jne 0x61c1fe
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebp
mov edi, dword [esp + 0x78]
lea edx, [esp + 0x20]
mov ebp, dword [esp + 0x7c]
xorps xmm0, xmm0
mov ecx, edi
movlpd qword [esp + 0x20], xmm0
add ebp, edi
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x28], xmm0
call fcn.006090b0
lea esi, [edi + eax]
cmp esi, ebp
jae 0x61c1de
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movlpd qword [esp + 0x20], xmm0
call fcn.006090b0
add esi, eax
cmp esi, ebp
jae 0x61c1da
mov ecx, dword [esp + 0x20]
mov eax, ecx
mov edx, dword [esp + 0x24]
or eax, edx
je 0x61c186
cmp ecx, 1
jne 0x61c146
test edx, edx
je 0x61c186
mov eax, dword [esp + 0x28]
add ecx, 0xfffffffe
adc edx, 0xffffffff
add eax, ecx
mov ecx, dword [esp + 0x70]
adc dword [esp + 0x2c], edx
mov edx, dword [esp + 0x74]
push eax
push dword [esp + 0x34]
mov dword [esp + 0x30], eax
push edi
push ebx
push dword [esp + 0x98]
push dword [esp + 0x30]
call fcn.0061bf70
xor dword [esp + 0x2c], eax
add esp, 0x18
xor dword [esp + 0x10], edx
jmp 0x61c1d2
xorps xmm0, xmm0
or ecx, edx
movlpd qword [esp + 0x30], xmm0
mov ecx, esi
movlpd qword [esp + 0x28], xmm0
je 0x61c1a8
lea edx, [esp + 0x30]
call fcn.006090b0
add esi, eax
jmp 0x61c1d2
lea edx, [esp + 0x20]
call fcn.006090b0
add esi, eax
mov eax, dword [esp + 0x18]
cmp byte [eax + 0xef], 0
je 0x61c1ca
sub ebx, dword [esp + 0x20]
sbb edi, dword [esp + 0x24]
jmp 0x61c1d2
add ebx, dword [esp + 0x20]
adc edi, dword [esp + 0x24]
cmp esi, ebp
jb 0x61c111
mov ebx, dword [esp + 0x18]
lea edx, [esp + 0x48]
mov ecx, ebx
call fcn.00617d30
mov esi, eax
cmp esi, 0x64
je 0x61c0d4
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
jmp 0x61c206
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
lea ecx, [esp + 0x48]
call fcn.00618370
mov ecx, dword [esp + 0x8c]
mov edx, edi
pop edi
mov eax, ebp
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
Function at 0x62be60
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebx
mov ebx, edx
mov edx, ecx
push esi
mov ecx, ebx
xor esi, esi
push edi
shr ecx, 2
xor edi, edi
test ecx, ecx
je 0x62be97
imul eax, dword [edx + esi*4], 0xcc9e2d51
inc esi
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edi, eax
rol edi, 0xd
add edi, 0xfaddaf14
lea edi, [edi + edi*4]
cmp esi, ecx
jb 0x62be74
mov eax, ebx
lea edx, [edx + ecx*4]
and eax, 3
xor ecx, ecx
sub eax, 1
je 0x62bec0
sub eax, 1
je 0x62beb7
sub eax, 1
jne 0x62bed6
movzx ecx, byte [edx + 2]
shl ecx, 0x10
movzx eax, byte [edx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edx]
xor eax, ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edi, eax
xor edi, ebx
mov eax, edi
shr eax, 0x10
xor eax, edi
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
Function at 0x635cc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x798d8e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x851070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x7e9b5c
mov dword [esi + 4], 1
mov dword [ebp - 4], 0
mov dword [esi], 0x7e9b68
mov dword [ebp - 4], 1
lea eax, [esi + 8]
mov dword [esi], 0x7ea3d0
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov byte [ebp - 4], 3
sub esp, 8
lea eax, [esi + 0x30]
push eax
push ecx
lea ecx, [esi + 0xc]
call fcn.00666d50
mov byte [ebp - 4], 4
push ecx
lea ecx, [esi + 0x4b8]
call fcn.0065b200
push 0
push 0
mov ecx, esi
call fcn.006359c0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x635fe0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x798ecd
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x851070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0x7e9b5c
mov dword [edi + 4], 1
mov dword [ebp - 4], 0
mov dword [edi], 0x7e9b68
mov dword [ebp - 4], 1
lea eax, [edi + 8]
mov dword [edi], 0x7ea3d0
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov byte [ebp - 4], 3
sub esp, 8
lea eax, [edi + 0x30]
push eax
push ecx
lea ecx, [edi + 0xc]
call fcn.00666d50
mov byte [ebp - 4], 4
lea esi, [edi + 0x4b8]
push ecx
mov ecx, esi
call fcn.0065b200
push 0x50
call fcn.00735c39
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
mov ecx, eax
push esi
push dword [ebp + 8]
call fcn.00635df0
mov byte [ebp - 4], 4
mov ecx, edi
push 1
push eax
call fcn.006359c0
mov esi, eax
or edx, 0xffffffff
lea ecx, [esi + 4]
lock xadd dword [ecx], edx
cmp edx, 1
jne 0x6360a7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x6360d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x798f1e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x851070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x7e9b5c
mov dword [esi + 4], 1
mov dword [ebp - 4], 0
mov dword [esi], 0x7e9b68
mov dword [ebp - 4], 1
lea eax, [esi + 8]
mov dword [esi], 0x7ea3d0
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov byte [ebp - 4], 3
sub esp, 8
lea eax, [esi + 0x30]
push eax
push ecx
lea ecx, [esi + 0xc]
call fcn.00666d50
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 8]
push 0
push ecx
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x4b8], eax
mov eax, dword [ecx + 0x18]
mov ecx, esi
mov dword [esi + 0x4bc], eax
call fcn.006359c0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4