joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485a20
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x51e5c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.004828a0
push 0x5bd764
lea ecx, [esi + 4]
mov dword [esp + 0x20], 0
mov dword [esi], 0x576888
call fcn.00434676
mov ebx, dword [0x52fe14]
mov byte [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov byte [esi + 0xb1], 1
mov eax, dword [0x627a2c]
test eax, eax
jne 0x485aec
push 0x5b9904
push 0x5bd908
nop
nop
nop
nop
nop
nop
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x485ac7
xor edi, edi
xor eax, eax
push ebp
mov al, byte [edi + 0x5758d0]
xor eax, 0x7d
push eax
call ebx
add esp, 8
inc edi
cmp edi, 0x2ae
jb 0x485aa2
push ebp
nop
nop
nop
nop
nop
nop
add esp, 4
push 0x10
push 0
push 0
push 1
push 0x5bd908
push 0
nop
nop
nop
nop
nop
nop
push 0x5bd908
mov dword [0x627a2c], eax
nop
nop
nop
nop
nop
nop
mov eax, dword [0x627a30]
test eax, eax
jne 0x485b5a
push 0x5b9904
push 0x5bd8f0
nop
nop
nop
nop
nop
nop
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x485b35
xor edi, edi
xor ecx, ecx
push ebp
mov cl, byte [edi + 0x575b80]
xor ecx, 0x7d
push ecx
call ebx
add esp, 8
inc edi
cmp edi, 0x2ae
jb 0x485b10
push ebp
nop
nop
nop
nop
nop
nop
add esp, 4
push 0x10
push 0
push 0
push 1
push 0x5bd8f0
push 0
nop
nop
nop
nop
nop
nop
push 0x5bd8f0
mov dword [0x627a30], eax
nop
nop
nop
nop
nop
nop
mov eax, dword [0x627a24]
test eax, eax
jne 0x485bc8
push 0x5b9904
push 0x5bd8d0
nop
nop
nop
nop
nop
nop
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x485ba3
xor edi, edi
xor edx, edx
push ebp
mov dl, byte [edi + 0x575e30]
xor edx, 0x7d
push edx
call ebx
add esp, 8
inc edi
cmp edi, 0x2ae
jb 0x485b7e
push ebp
nop
nop
nop
nop
nop
nop
add esp, 4
push 0x10
push 0
push 0
push 1
push 0x5bd8d0
push 0
nop
nop
nop
nop
nop
nop
push 0x5bd8d0
mov dword [0x627a24], eax
nop
nop
nop
nop
nop
nop
mov eax, dword [0x627a28]
test eax, eax
jne 0x485c36
push 0x5b9904
push 0x5bd8b0
nop
nop
nop
nop
nop
nop
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x485c11
xor edi, edi
xor eax, eax
push ebp
mov al, byte [edi + 0x5760e0]
xor eax, 0x7d
push eax
call ebx
add esp, 8
inc edi
cmp edi, 0x2ae
jb 0x485bec
push ebp
nop
nop
nop
nop
nop
nop
add esp, 4
push 0x10
push 0
push 0
push 1
push 0x5bd8b0
push 0
nop
nop
nop
nop
nop
nop
push 0x5bd8b0
mov dword [0x627a28], eax
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x486ee0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x51e7f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x24], esi
call fcn.004828a0
mov al, byte [esp + 0x13]
lea edi, [esi + 0xb0]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov byte [edi], al
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov ebp, dword [0x52ff98]
push 0xf
mov byte [esp + 0x34], 1
mov dword [esi + 0xcc], 0x12
call ebp
push 0xf
mov dword [esi + 0xd0], eax
call ebp
mov dword [esi + 0xd4], eax
mov dword [esi], fcn.0047dc90
mov ecx, dword [0x5bd6a4]
lea ebp, [esi + 4]
push ecx
mov ecx, ebp
call fcn.00434676
push ebp
lea edx, [esp + 0x24]
push 0x5bd9c4
push edx
call fcn.00434a42
push 0x5bd9b8
push eax
lea eax, [esp + 0x24]
mov byte [esp + 0x38], 2
push eax
call fcn.0043462e
mov eax, dword [eax]
push ebx
push ebx
lea ecx, [esp + 0x20]
push eax
push ecx
mov byte [esp + 0x40], 3
call fcn.004108e0
add esp, 0x10
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 6
call fcn.004344e4
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 5
call fcn.004344e4
lea ecx, [esp + 0x14]
call fcn.0043450e
mov byte [esp + 0x30], 7
mov ebp, 1
mov edx, dword [esp + 0x18]
push ebp
push edx
lea eax, [esp + 0x1c]
push 0x5bd9b0
push eax
call fcn.00434502
mov eax, dword [edi + 8]
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
push 1
push eax
mov ecx, edi
call fcn.0046a440
inc ebp
cmp ebp, 2
jle 0x486fcd
mov eax, 0x78
mov ecx, 0x64
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ecx
lea ecx, [esp + 0x14]
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov byte [esp + 0x30], 5
call fcn.004344e4
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.004344e4
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x487720
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x51e888
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [esp + 8], edi
call fcn.004828a0
mov dword [edi], fcn.0047dc90
mov eax, dword [0x5bd6ac]
xor esi, esi
push eax
lea ecx, [edi + 4]
mov dword [esp + 0x18], esi
call fcn.00434676
mov eax, 0x18
mov dword [edi + 0xb0], esi
mov ecx, eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], ecx
mov eax, dword [0x627a08]
cmp eax, esi
jne 0x4877fd
push ebx
push 0x5b9904
push 0x5bd9dc
nop
nop
nop
nop
nop
nop
mov ebx, eax
add esp, 8
cmp ebx, esi
je 0x4877c4
push ebp
mov ebp, dword [0x52fe14]
xor ecx, ecx
push ebx
mov cl, byte [esi + 0x5736b0]
xor ecx, 0x7d
push ecx
call ebp
add esp, 8
inc esi
cmp esi, 0xcbe
jb 0x48779e
push ebx
nop
nop
nop
nop
nop
nop
add esp, 4
pop ebp
push 0x10
push 0
push 0
push 1
push 0x5bd9dc
push 0
nop
nop
nop
nop
nop
nop
push 0x5bd9dc
mov dword [0x627a08], eax
nop
nop
nop
nop
nop
nop
mov eax, edi
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x487dd0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x51e91c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x1c], esi
call fcn.004828a0
lea edi, [esi + 0xb4]
mov dword [esp + 0x28], 0
mov ecx, edi
call fcn.0043450e
lea ebp, [esi + 0xb8]
mov byte [esp + 0x28], 1
mov ecx, ebp
call fcn.0043450e
mov dword [esi], fcn.0047dc90
mov eax, dword [0x5bd6c0]
lea ebx, [esi + 4]
push eax
mov ecx, ebx
mov byte [esp + 0x2c], 2
call fcn.00434676
mov eax, 0x78
mov ecx, 0x15
mov dword [esi + 0x1c], eax
push 5
mov dword [esi + 0x20], ecx
nop
nop
nop
nop
nop
nop
push ebx
lea ecx, [esp + 0x1c]
push 0x5bd9c4
push ecx
mov dword [esi + 0x70], eax
mov dword [esi + 0xb0], 0
call fcn.00434a42
push 0x5bda14
lea edx, [esp + 0x18]
push eax
push edx
mov byte [esp + 0x34], 3
call fcn.0043462e
mov eax, dword [eax]
push 0
push 0
push eax
lea eax, [esp + 0x1c]
mov bl, 4
push eax
mov byte [esp + 0x38], bl
call fcn.004108e0
add esp, 0x10
push eax
mov ecx, edi
mov byte [esp + 0x2c], 5
call fcn.00434640
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call fcn.004344e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 3
call fcn.004344e4
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 2
call fcn.004344e4
push 0x5c669c
mov ecx, ebp
call fcn.00434676
mov eax, dword [0x627a0c]
mov ebp, dword [0x52fe14]
test eax, eax
jne 0x487f53
push 0x5b9904
push 0x5bda00
nop
nop
nop
nop
nop
nop
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x487f2e
xor edi, edi
xor ecx, ecx
push ebx
mov cl, byte [edi + 0x574370]
xor ecx, 0x7d
push ecx
call ebp
add esp, 8
inc edi
cmp edi, 0x47e
jb 0x487f09
push ebx
nop
nop
nop
nop
nop
nop
add esp, 4
push 0x10
push 0
push 0
push 1
push 0x5bda00
push 0
nop
nop
nop
nop
nop
nop
push 0x5bda00
mov dword [0x627a0c], eax
nop
nop
nop
nop
nop
nop
mov eax, dword [0x627a10]
test eax, eax
jne 0x487fc1
push 0x5b9904
push 0x5bd9ec
nop
nop
nop
nop
nop
nop
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x487f9c
xor edi, edi
xor edx, edx
push ebx
mov dl, byte [edi + 0x5747f0]
xor edx, 0x7d
push edx
call ebp
add esp, 8
inc edi
cmp edi, 0x47e
jb 0x487f77
push ebx
nop
nop
nop
nop
nop
nop
add esp, 4
push 0x10
push 0
push 0
push 1
push 0x5bd9ec
push 0
nop
nop
nop
nop
nop
nop
push 0x5bd9ec
mov dword [0x627a10], eax
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x489070
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x51ea50
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
mov ebp, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x489165
lea ecx, [esp + 0x34]
lea esi, [ebp + 0x2c]
push edi
push ecx
mov ecx, esi
call fcn.0048a460
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x34]
cmp ecx, eax
je 0x4890d3
mov ecx, dword [ecx + 0xc]
mov eax, dword [edi]
push ecx
push eax
nop
nop
nop
nop
nop
nop
add esp, 8
test eax, eax
jl 0x4890d3
lea eax, [esp + 0x34]
jmp 0x4890de
mov eax, dword [esi + 4]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x30]
cmp eax, ecx
jne 0x48915e
lea edx, [esp + 0x38]
lea eax, [esp + 0x14]
push edx
push edi
push eax
call fcn.0048bad0
add esp, 0xc
mov edi, eax
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0
call fcn.0043475a
mov ecx, dword [edi + 4]
mov dword [esp + 0x10], ecx
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x34], 1
call fcn.00489580
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.004344e4
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004344e4
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 8
mov ecx, dword [esp + 0x38]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret 8

Function at 0x48bdb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51eab6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
lea ebp, [esi + 4]
mov ecx, ebp
call fcn.0043450e
mov al, byte [esp + 0x2c]
mov cl, byte [esp + 0x2c]
xor ebx, ebx
push 0x18
mov dword [esp + 0x28], ebx
mov byte [esi + 8], al
mov byte [esi + 9], cl
mov byte [esi + 0x10], bl
call fcn.00434622
mov edi, eax
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [edi + 4], ebx
mov dword [edi + 0x14], 1
nop
nop
nop
nop
nop
nop
cmp dword [0x627a50], ebx
jne 0x48be34
mov dword [0x627a50], edi
mov dword [edi], ebx
mov edx, dword [0x627a50]
mov dword [esp + 0x10], ebx
mov dword [edx + 8], ebx
mov edx, dword [0x627a4c]
lea ecx, [esp + 0x14]
inc edx
mov dword [0x627a4c], edx
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x48be5c
push eax
call fcn.00434616
add esp, 4
mov edi, dword [0x627a50]
push 0x18
call fcn.00434622
mov dword [eax + 4], edi
mov dword [eax + 0x14], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [eax], eax
mov eax, dword [esi + 0xc]
add esp, 4
mov dword [eax + 8], eax
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, ebp
mov byte [esp + 0x28], 1
mov dword [esi], eax
call fcn.00434640
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x48ca80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51eb98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov esi, ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub esp, 0x10
mov dword [esp + 0x34], 0
mov eax, esp
push 0
mov dword [eax], ecx
mov ecx, dword [esp + 0x28]
push ecx
mov dword [eax + 4], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x20], esp
mov dword [eax + 8], ecx
mov ecx, esp
mov dword [eax + 0xc], edx
lea eax, [esp + 0x44]
push eax
call fcn.0043475a
lea ecx, [esi + 0xec]
call fcn.0048e5d0
mov edi, eax
lea ecx, [esp + 0x2c]
mov dword [esi + 0x64], edi
mov dword [esp + 0x24], 0xffffffff
call fcn.004344e4
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 4
Function at 0x496d00
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
push edi
jmp 0x496d1d
mov esi, dword [ebp + 8]
cmp word [esi], 0x5a4d
je 0x496d2f
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push esi
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0x4550
je 0x496d46
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x28]
push ebx
mov dword [ebp + 8], ecx
xor ecx, ecx
mov cx, word [eax + 6]
xor ebx, ebx
lea edi, [ebp - 0x403]
lea edx, [ecx + ecx*4]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov byte [ebp - 0x404], bl
add eax, ecx
mov ecx, 0xff
lea edx, [eax + edx*8 + 0x18]
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
lea ecx, [ebp - 0x404]
push eax
mov eax, dword [esi + 0x2c]
push 0x400
xor eax, 0x78
push ecx
push eax
push edx
call fcn.00496bd0
add esp, 0x14
or edx, 0xffffffff
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x800]
mov dword [ebp - 0x804], ebx
rep stosd dword es:[edi], eax
mov edi, dword [0x5bda8c]
lea esi, [ebp - 0x804]
test al, 1
je 0x496dd2
mov ebx, eax
lea ecx, [edi + 0x123456]
shr ebx, 1
xor ecx, ebx
jmp 0x496dd6
mov ecx, eax
shr ecx, 1
mov dword [esi], ecx
inc eax
add esi, 4
cmp eax, 0x100
jb 0x496dc0
xor eax, eax
pop ebx
xor ecx, ecx
mov esi, edx
mov cl, byte [ebp + eax - 0x400]
and esi, 0xff
xor ecx, esi
shr edx, 8
mov ecx, dword [ebp + ecx*4 - 0x804]
xor edx, ecx
inc eax
cmp eax, 0x10
jb 0x496de6
mov eax, dword [ebp - 0x404]
not edx
cmp edx, eax
je 0x496e1f
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov ecx, 5
lea esi, [ebp - 0x404]
rep movsd dword es:[edi], dword [esi]
mov dword [edx], eax
jmp 0x496e47
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x498e50
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
xor ebp, ebp
push esi
cmp ebx, 1
push edi
jl 0x498e6b
cmp ebx, 8
jg 0x498e6b
mov eax, 1
jmp 0x498e6d
xor eax, eax
mov esi, dword [esp + 0x14]
push 0x5bde5c
push eax
push esi
call fcn.004976d0
mov eax, dword [esi + 0x6af70]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af78], ebp
jne 0x498ea4
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
mov ecx, 0x7fff
xor eax, eax
lea edi, [esi + 0x4af70]
mov dword [esi + 0x6af6c], ebp
rep stosd dword es:[edi], eax
mov ax, word [ebx*8 + 0x57e58a]
xor ecx, ecx
mov dword [esi + 0x6af98], eax
mov cx, word [ebx*8 + 0x57e588]
xor edx, edx
mov dword [esi + 0x6af9c], ecx
mov dx, word [ebx*8 + 0x57e58c]
xor eax, eax
mov dword [esi + 0x6afa0], edx
mov ax, word [ebx*8 + 0x57e58e]
cmp ebx, 2
mov dword [esi + 0x6af94], eax
jg 0x498f05
mov eax, dword [esp + 0x1c]
or byte [eax], 4
jmp 0x498f11
cmp ebx, 8
jl 0x498f11
mov eax, dword [esp + 0x1c]
or byte [eax], 2
lea edi, [esi + 0x1af70]
push 0x10000
push edi
push esi
mov dword [esi + 0x6af84], ebp
mov dword [esi + 0x6af74], ebp
call dword [esi + 0xc]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af90], eax
je 0x498f8a
cmp eax, 0xffffffff
je 0x498f8a
cmp eax, 0x106
mov dword [esi + 0x6af8c], ebp
jae 0x498f55
push esi
call fcn.004991a0
add esp, 4
mov dword [esi + 0x6af7c], ebp
xor eax, eax
mov edx, dword [esi + 0x6af7c]
xor ecx, ecx
mov cl, byte [edi + eax]
and edx, 0x3ff
and ecx, 0x7fff
shl edx, 5
xor ecx, edx
inc eax
cmp eax, 2
mov dword [esi + 0x6af7c], ecx
jb 0x498f5d
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4992f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebp, ebp
xor edi, edi
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
test eax, eax
je 0x499534
push ebx
cmp eax, 3
jb 0x49936b
mov ecx, dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af7c]
xor eax, eax
and edx, 0x3ff
mov al, byte [ecx + esi + 0x1af72]
and eax, 0x7fff
shl edx, 5
xor eax, edx
and ecx, 0x7fff
mov dword [esi + 0x6af7c], eax
mov ebp, dword [esi + eax*4 + 0x4af70]
mov dword [esi + ecx*4 + 0x2af70], ebp
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
test ebp, ebp
je 0x4993ad
mov edx, dword [esi + 0x6af84]
sub edx, ebp
cmp edx, 0x7efa
ja 0x4993ad
mov eax, dword [esi + 0x6af90]
mov ecx, dword [esi + 0x6afa0]
cmp ecx, eax
jbe 0x499395
mov dword [esi + 0x6afa0], eax
push ebp
push esi
call fcn.00498fa0
mov edi, eax
mov eax, dword [esi + 0x6af90]
add esp, 8
cmp edi, eax
jbe 0x4993ad
mov edi, eax
cmp edi, 3
jb 0x4994a6
mov ecx, dword [esi + 0x6af84]
mov ebx, dword [esi + 0x6af88]
lea eax, [edi - 3]
sub ecx, ebx
push eax
push ecx
push esi
call fcn.004986a0
mov edx, dword [esi + 0x6af90]
mov ecx, dword [esi + 0x6af98]
add esp, 0xc
sub edx, edi
mov ebx, eax
cmp edi, ecx
mov dword [esi + 0x6af90], edx
mov eax, edx
ja 0x499454
cmp eax, 3
jb 0x499454
dec edi
mov ebp, dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af7c]
inc ebp
xor eax, eax
mov ecx, ebp
mov dword [esi + 0x6af84], ebp
and edx, 0x3ff
mov al, byte [esi + ecx + 0x1af72]
and ecx, 0x7fff
and eax, 0x7fff
shl edx, 5
xor eax, edx
dec edi
mov dword [esi + 0x6af7c], eax
mov ebp, dword [esi + eax*4 + 0x4af70]
mov dword [esi + ecx*4 + 0x2af70], ebp
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
jne 0x4993f4
jmp 0x4994d0
mov edx, dword [esi + 0x6af84]
xor eax, eax
add edx, edi
push 0x5bdeb8
mov dword [esi + 0x6af84], edx
push 1
mov al, byte [edx + esi + 0x1af70]
lea ecx, [edx + esi]
xor edx, edx
mov dword [esi + 0x6af7c], eax
mov dl, byte [ecx + 0x1af71]
and eax, 0x3ff
and edx, 0x7fff
push esi
shl eax, 5
xor edx, eax
xor edi, edi
mov dword [esi + 0x6af7c], edx
call fcn.004976d0
add esp, 0xc
jmp 0x4994d6
mov eax, dword [esi + 0x6af84]
xor ecx, ecx
mov cl, byte [eax + esi + 0x1af70]
push ecx
push 0
push esi
call fcn.004986a0
mov ecx, dword [esi + 0x6af90]
add esp, 0xc
dec ecx
mov ebx, eax
mov dword [esi + 0x6af90], ecx
inc dword [esi + 0x6af84]
test ebx, ebx
je 0x499510
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x4994ed
lea ecx, [eax + esi + 0x1af70]
jmp 0x4994ef
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.00498460
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x499525
push esi
call fcn.004991a0
add esp, 4
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x499314
pop ebx
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x499547
lea ecx, [eax + esi + 0x1af70]
jmp 0x499549
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.00498460
add esp, 0x10
pop edi
pop esi
pop ebp
ret
Function at 0x49a220
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x49a22b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x49a32e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x57e5d8]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x57e5d8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x57e5d8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x57e5d8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x57e5d8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x57e5d8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x57e5d8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x57e5d8]
xor eax, edx
inc ecx
dec edi
jne 0x49a246
pop edi
test esi, esi
je 0x49a350
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x57e5d8]
xor eax, edx
inc ecx
dec esi
jne 0x49a332
pop esi
pop ebx
not eax
ret

Function at 0x49a360
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [ecx]
and esi, 0xff
mov eax, edx
and eax, 0xff
xor eax, esi
shr edx, 8
mov eax, dword [eax*4 + 0x57e5d8]
xor eax, edx
mov edx, dword [ecx + 4]
mov dword [ecx], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 4], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x57e5d8]
xor eax, edx
mov dword [ecx + 8], eax
ret
Function at 0x49a570
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x44
lea eax, [esp + 0x10]
push esi
mov esi, dword [esp + 0x4c]
push eax
push esi
nop
nop
nop
nop
nop
nop
test eax, eax
jne 0x49a592
mov eax, 0x200
pop esi
add esp, 0x44
ret
mov eax, dword [esp + 0x14]
push ebp
mov edx, eax
xor ebp, ebp
and edx, 1
je 0x49a5a5
mov ebp, 1
test al, 2
je 0x49a5ac
or ebp, 2
test al, 4
je 0x49a5b3
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x49a5bd
or ebp, 0x10
test al, 0x20
je 0x49a5c4
or ebp, 0x20
test ecx, ecx
je 0x49a5d0
or ebp, 0x40000000
jmp 0x49a5d6
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x49a5e6
or ebp, 0x800000
push ebx
push edi
push 0
push esi
nop
nop
nop
nop
nop
nop
cmp eax, 0x28
mov dword [esp + 0x14], eax
jbe 0x49a695
mov edi, dword [0x52f130]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [0x52f234]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x60]
push 2
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 4
push ecx
push esi
call ebx
cmp word [esp + 0x58], 0x54ad
jne 0x49a695
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea edx, [eax + 0x34]
cmp ecx, edx
jbe 0x49a695
push 0
push 0
push eax
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x24]
push 4
push ecx
push esi
call ebx
mov eax, dword [esp + 0x1c]
cmp eax, 0x5a4d
je 0x49a68f
cmp eax, 0x454e
je 0x49a68f
cmp eax, 0x454c
je 0x49a68f
cmp eax, 0x4550
jne 0x49a695
or ebp, entry0
mov eax, dword [esp + 0x5c]
pop edi
test eax, eax
pop ebx
je 0x49a6a1
mov dword [eax], ebp
mov eax, dword [esp + 0x58]
pop ebp
test eax, eax
je 0x49a6b0
mov edx, dword [esp + 8]
mov dword [eax], edx
mov esi, dword [esp + 0x58]
test esi, esi
je 0x49a6f9
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.0049a4d0
mov dword [esi], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x34]
push edx
push eax
call fcn.0049a4d0
mov ecx, dword [esp + 0x2c]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov edx, dword [esp + 0x28]
push ecx
push edx
call fcn.0049a4d0
mov dword [esi + 0x10], eax
add esp, 0x18
mov dword [esi + 0x14], edx
mov esi, dword [esp + 0x5c]
test esi, esi
je 0x49a738
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x50]
lea ecx, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
call fcn.0049a500
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
and ecx, 0xffff
and edx, 0xffff
shl ecx, 0x10
add esp, 0x10
or ecx, edx
mov dword [esi], ecx
xor eax, eax
pop esi
add esp, 0x44
ret