joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4569c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x682310]
lea edx, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1c48]
mov esi, 4
mov eax, dword [edi + 0x104]
add edi, 0xfc
mov dword [ebp - 4], ecx
mov ebx, dword [edi]
mov dword [ebp - 8], ebx
mov ebx, dword [eax + ebx*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x667dc0]
sub esi, 1
jne 0x4569f6
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [ebp - 8]
cmp ecx, esi
jne 0x456a40
inc ecx
test esi, esi
je 0x456a2c
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x456a31
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.00466ab0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45c0d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x3030], 0
lea esi, [edi + 0x3034]
je 0x45c152
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x45c10c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00466d10
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.0044a050
mov edx, dword [esi]
mov ecx, 0x68230c
push dword [edi + 0x3030]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x303c]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.0044a050
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45c580
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
or ecx, 0xffffffff
mov al, byte [edi]
lea esi, [edi + 1]
test al, al
je 0x45c5bc
push ebx
or ebx, 0xffffffff
cmp al, 0x23
jne 0x45c5a2
cmp byte [esi], al
jne 0x45c5a2
cmp byte [esi + 1], al
cmove ecx, ebx
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x667dc0]
test al, al
jne 0x45c594
pop ebx
not ecx
call fcn.0045c530
test eax, eax
jne 0x45c5d0
mov ecx, edi
pop edi
pop esi
jmp fcn.0045c450
pop edi
pop esi
ret
Function at 0x45c880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x682310]
push esi
mov esi, ecx
push edi
mov dword [eax + 0x2fe4], 0
test esi, esi
je 0x45c8d5
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.0045c8e0
mov edx, 0x6678c4
mov ecx, esi
mov edi, eax
call fcn.00449870
mov esi, eax
test esi, esi
je 0x45c8d5
push esi
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46ee80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x46eebc
mov eax, dword [0x682310]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x46eea6
dec dword [eax + 0x374]
push dword [0x682308]
push ecx
call fcn.004491c0
add esp, 8
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x46eef6
mov eax, dword [0x682310]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x46eee0
dec dword [eax + 0x374]
push dword [0x682308]
push ecx
call fcn.004491c0
add esp, 8
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x46ef30
mov eax, dword [0x682310]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x46ef1a
dec dword [eax + 0x374]
push dword [0x682308]
push ecx
call fcn.004491c0
add esp, 8
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x46ef86
mov eax, dword [0x682310]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x46ef70
dec dword [eax + 0x374]
push dword [0x682308]
push ecx
call fcn.004491c0
add esp, 8
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x46efc0
mov eax, dword [0x682310]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x46efaa
dec dword [eax + 0x374]
push dword [0x682308]
push ecx
call fcn.004491c0
add esp, 8
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x46effa
mov eax, dword [0x682310]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x46efe4
dec dword [eax + 0x374]
push dword [0x682308]
push ecx
call fcn.004491c0
add esp, 8
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.004717b0
Function at 0x4797b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jl 0x4797d0
pop edi
mov dword [ecx], 0x270
mov eax, ecx
pop esi
pop ebp
ret 4

Function at 0x479c60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x479cbe
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x479c80
mov eax, dword [edi]
jmp 0x479da9
cmp eax, 0x4e0
jb 0x479da9
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x479ce0
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x479d30
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4848e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
push edi
mov edi, edx
je 0x484951
mov cl, byte [edi]
lea esi, [edi + 1]
or eax, 0xffffffff
test cl, cl
je 0x484928
or edi, 0xffffffff
nop dword [eax]
cmp cl, 0x23
jne 0x48490f
cmp byte [esi], cl
jne 0x48490f
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x667dc0]
test cl, cl
jne 0x484900
mov ecx, dword [0x682310]
not eax
cmp dword [ecx + 0x1c84], eax
jne 0x48493e
mov dword [ecx + 0x1c88], eax
cmp dword [ecx + 0x1cbc], eax
jne 0x484996
pop edi
mov byte [ecx + 0x1cc0], 1
pop esi
pop ebp
ret
mov esi, dword [0x682310]
xor edx, edx
mov eax, dword [esi + 0x1c48]
mov ecx, dword [eax + 0xfc]
mov eax, dword [eax + 0x104]
push dword [eax + ecx*4 - 4]
mov ecx, edi
call fcn.004497e0
add esp, 4
cmp dword [esi + 0x1c84], eax
jne 0x484987
mov dword [esi + 0x1c88], eax
cmp dword [esi + 0x1cbc], eax
jne 0x484996
mov byte [esi + 0x1cc0], 1
pop edi
pop esi
pop ebp
ret
Function at 0x487ea0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f3200
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x67bbb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
mov edi, edx
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + esi + 0x30]
rep stosb byte es:[edi], al
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov dword [ebp - 4], 1
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x487f0f
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x487f20
push 0x48
push esi
call fcn.005ef4ad
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4884f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f333c
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x67bbb0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x20], edi
mov esi, dword [ebx + 0x10]
mov dword [ebp - 0x28], edi
push 0
mov dword [ebp - 0x20], 0
call fcn.004a3ff0
mov dword [ebp - 4], 0
mov dword [edi], vtable.CryptoPP::BaseN_Decoder.0
mov dword [edi + 4], vtable.CryptoPP::BaseN_Decoder.1.0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x30], 0xffffffff
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
push esi
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.004a4b40
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.004a66a0
mov dword [ebp - 0x1c], eax
push 0x14
mov byte [ebp - 4], 4
call fcn.005ef72a
mov esi, eax
xorps xmm0, xmm0
mov eax, dword [ebx + 8]
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 4], str.DecodingLookupArray
mov word [esi + 8], 1
mov dword [esi + 0xc], 0
mov dword [esi], vtable.CryptoPP::AlgorithmParametersTemplate_int_const__.0
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 5
mov ecx, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov dword [eax + 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x488615
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
mov dword [esi + 0xc], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], 0
test ecx, ecx
je 0x488632
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], esi
mov byte [eax + 8], 1
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 4
call fcn.004a6620
mov esi, eax
mov dword [ebp - 0x20], 1
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x488660
mov eax, dword [ecx]
push 1
call dword [eax]
lea eax, [ebx + 0xc]
mov byte [ebp - 4], 3
push eax
push str.Log2Base
mov ecx, esi
mov dword [ebp - 0x34], vtable.CryptoPP::NameValuePairs.0
call fcn.00494510
push eax
mov ecx, edi
call fcn.004aa500
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x488694
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005eee94
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x4886c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f3200
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x67bbb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x30]
cmp eax, dword [esi + 0x34]
mov edx, dword [esi + 0x38]
mov edi, edx
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + esi + 0x34]
rep stosb byte es:[edi], al
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov dword [ebp - 4], 1
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x488722
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x488733
push 0x3c
push esi
call fcn.005ef4ad
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x488750
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f3240
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x67bbb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
mov edi, edx
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + esi + 0x30]
rep stosb byte es:[edi], al
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov edi, edx
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + esi + 0x20]
rep stosb byte es:[edi], al
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 8
mov dword [ebp - 4], 2
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4887d7
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x4887e8
push 0x40
push esi
call fcn.005ef4ad
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x48ad00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x48ad22
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x71]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x48ad10
mov byte [esi + 4], 0
mov eax, esi
pop esi
ret
Function at 0x48e7b0
Capabilities:
Execute command
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f3e40
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x67bbb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x3c]
push str.start_cmd__C__color_b__title_Error__echo
push eax
call fcn.004942d0
push str.__timeout__t_5__nul_2_1
push eax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
call fcn.00494280
add esp, 0x18
mov ecx, eax
call fcn.004799a0
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
lea ecx, [ebp - 0x24]
call fcn.004799b0
lea ecx, [ebp - 0x3c]
call fcn.004799b0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x48e830
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f3e73
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x67bbb0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
call fcn.004ba430
mov edi, eax
test edi, edi
jne 0x48e8da
push 4
mov dword [esi + 0x10], eax
mov ecx, esi
mov dword [esi + 0x14], 0xf
push str.null
mov byte [esi], al
call fcn.004935f0
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x48ea22
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x48ea18
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x48ea18
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
mov byte [ebp - 4], 1
xor ecx, ecx
movaps xmm0, xmmword [0x66e3e0]
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x40], 0x8dcfc9e8
mov dword [ebp - 0x3c], 0x89ccd4c2
mov dword [ebp - 0x38], 0x85998696
mov word [ebp - 0x34], 0x100
lea eax, [ecx - 0x71]
xor byte [ebp + ecx - 0x50], al
inc ecx
cmp ecx, 0x1c
jb 0x48e918
lea eax, [ebp - 0x50]
mov byte [ebp - 0x33], 0
push eax
push 0x2712
push edi
call fcn.004be1f0
add esp, 0xc
push 0
push 0x40
push edi
call fcn.004be1f0
add esp, 0xc
push 0
push 0x51
push edi
call fcn.004be1f0
add esp, 0xc
lea eax, [ebx + 8]
cmp dword [ebx + 0x1c], 0x10
cmovae eax, dword [ebx + 8]
push eax
push 0x271f
push edi
call fcn.004be1f0
add esp, 0xc
push 0x48e750
push 0x4e2b
push edi
call fcn.004be1f0
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
push 0x2711
push edi
call fcn.004be1f0
add esp, 0xc
push edi
call fcn.004ba4d0
add esp, 4
test eax, eax
je 0x48e9b7
push 0x10
push 0
push eax
call fcn.004bae90
add esp, 4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call fcn.004ba3f0
add esp, 4
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0x200002
push edi
call fcn.004ba410
add esp, 0xc
cmp dword [ebp - 0x18], 0x1ad
je 0x48ea42
movups xmm0, xmmword [ebp - 0x30]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
mov byte [ebp - 0x30], 0
movq xmm0, qword [ebp - 0x20]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
jmp 0x48e8a2
push edx
push ecx
call fcn.005ef4ad
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005eee94
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
sub esp, 0x18
mov ecx, esp
push str.Youre_connecting_too_fast_to_loader__slow_down.
call fcn.00492600
call fcn.0048e7b0
int3
Function at 0x48f1e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f3f9a
mov eax, dword fs:[0]
push eax
mov eax, 0x1404
call fcn.005f01a0
mov eax, dword [0x67bbb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x13c8], esi
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x140c], esi
mov dword [ebp - 0x13c4], 0
movaps xmm0, xmmword [0x66e420]
movups xmmword [ebp - 0x1408], xmm0
mov dword [ebp - 0x13d8], 0x989898e8
movaps xmm0, xmmword [0x66e400]
movups xmmword [ebp - 0x13f8], xmm0
mov dword [ebp - 0x13d4], 0xf2f6f6f2
movaps xmm0, xmmword [0x66e410]
movups xmmword [ebp - 0x13e8], xmm0
mov dword [ebp - 0x13d0], 0xf2fefef2
mov dword [ebp - 0x13cc], 0x100fcf2
lea eax, [ecx - 0x71]
xor byte [ebp + ecx - 0x1408], al
inc ecx
cmp ecx, 0x3e
jb 0x48f285
push 0x3e
lea eax, [ebp - 0x1408]
mov byte [ebp - 0x13c9], 0
push eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
call fcn.004935f0
mov dword [ebp - 0x13c4], 6
mov dword [ebp - 4], 1
call dword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
push eax
lea ecx, [ebp - 0x13c0]
call fcn.004797b0
mov eax, dword [ebp - 0x24]
dec eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], eax
mov byte [esi], 0
mov ebx, dword [ebp - 0x34]
mov edi, 0xf
mov dword [ebp - 0x13c4], 7
lea eax, [ebp - 0x13c0]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00479a60
cmp dword [ebp - 0x20], 0x10
mov ecx, eax
mov edx, dword [esi + 0x14]
lea eax, [ebp - 0x34]
cmovae eax, ebx
mov al, byte [eax + ecx]
mov ecx, dword [esi + 0x10]
mov byte [ebp - 0x14], al
cmp ecx, edx
jae 0x48f35a
lea eax, [ecx + 1]
mov dword [esi + 0x10], eax
mov eax, esi
cmp edx, 0x10
jb 0x48f34d
mov eax, dword [esi]
mov dl, byte [ebp - 0x14]
mov byte [eax + ecx], dl
mov byte [eax + ecx + 1], 0
jmp 0x48f372
push dword [ebp - 0x14]
mov byte [ebp - 0x13c8], 0
push dword [ebp - 0x13c8]
push ecx
mov ecx, esi
call fcn.00479b10
sub edi, 1
jne 0x48f313
mov eax, dword [ebp - 0x20]
cmp eax, 0x10
jb 0x48f3ac
lea ecx, [eax + 1]
mov eax, ebx
cmp ecx, 0x1000
jb 0x48f3a2
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x48f3a2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push ebx
call fcn.005ef4ad
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005eee94
mov esp, ebp
pop ebp
ret
Function at 0x49eaf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4f80
mov eax, dword fs:[0]
push eax
push ebx
push ecx
push esi
mov eax, dword [0x67bbb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0049ef60
mov ecx, dword [ebx + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov word [esi + 0xc], 0
mov ecx, dword [ecx]
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
movups xmm0, xmmword [ecx]
movups xmmword [esi + 0x10], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [esi + 0x20], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
push 0
mov byte [esi + 0x28], 0
call fcn.004937a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc

Function at 0x49eff0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4ff0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x67bbb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.0049ef60
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov word [esi + 0xc], 0
push dword [ecx]
lea ecx, [esi + 0x10]
call fcn.00492640
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
push 0
mov byte [esi + 0x28], 0
call fcn.004937a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4a3a20
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x67ee84], 0
jne 0x4a3a2e
call fcn.004b8080
cmp byte [0x67ee8d], 0
je 0x4a3a4c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.004b8410
add esp, 0x10
ret
jmp fcn.004a1dd0