joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4782c0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x5519c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x15c], ebx
lea eax, [edi + esi*4]
push eax
call fcn.0048cdc0
mov dword [ebp + esi*4 - 0x144], eax
add esp, 4
inc esi
cmp esi, 0x10
jb 0x4782e3
lea esi, [ebp - 0x13c]
mov edi, 0x10
mov eax, dword [esi + 0x2c]
xor eax, dword [esi + 0x18]
xor eax, dword [esi - 8]
xor eax, dword [esi]
push 1
push eax
call fcn.004778d0
add esp, 8
mov dword [esi + 0x38], eax
lea esi, [esi + 4]
sub edi, 1
jne 0x478307
lea esi, [ebp - 0x134]
mov edi, 0x30
mov eax, dword [esi + 0x58]
xor eax, dword [esi + 0x30]
xor eax, dword [esi - 0x10]
xor eax, dword [esi]
push 2
push eax
call fcn.004778d0
add esp, 8
mov dword [esi + 0x70], eax
lea esi, [esi + 4]
sub edi, 1
jne 0x478333
mov eax, dword [ebx + 0x28]
mov edx, dword [eax]
mov ecx, dword [eax + 0xc]
mov edi, dword [eax + 4]
mov ebx, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x158], eax
xor eax, eax
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x154], eax
jmp 0x47838d
mov ecx, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x150]
cmp eax, 0x14
jae 0x4783aa
mov esi, edi
mov dword [ebp - 0x148], 0x5a827999
not esi
mov eax, ebx
and esi, ecx
and eax, edi
or esi, eax
jmp 0x4783e8
cmp eax, 0x28
jae 0x4783bb
mov dword [ebp - 0x148], 0x6ed9eba1
jmp 0x4783e2
cmp eax, 0x3c
jae 0x4783d8
mov esi, ebx
mov dword [ebp - 0x148], 0x8f1bbcdc
or esi, edi
mov eax, ebx
and esi, ecx
and eax, edi
or esi, eax
jmp 0x4783e8
mov dword [ebp - 0x148], 0xca62c1d6
mov esi, ecx
xor esi, ebx
xor esi, edi
push 5
push edx
call fcn.004778d0
mov ecx, eax
mov eax, dword [ebp - 0x154]
push 0x1e
push edi
add ecx, dword [ebp + eax*4 - 0x144]
add ecx, dword [ebp - 0x148]
add ecx, esi
mov esi, dword [ebp - 0x14c]
add ecx, dword [ebp - 0x158]
mov dword [ebp - 0x158], esi
mov esi, ebx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x14c], esi
call fcn.004778d0
mov edi, dword [ebp - 0x150]
mov ebx, eax
mov eax, dword [ebp - 0x154]
add esp, 0x10
mov edx, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x154], eax
cmp eax, 0x50
jb 0x478381
mov ecx, dword [ebp - 0x15c]
mov ecx, dword [ecx + 0x28]
add dword [ecx], edx
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 0x158]
mov eax, dword [ecx + 0x28]
add dword [eax + 4], edi
mov eax, dword [ecx + 0x28]
pop edi
add dword [eax + 8], ebx
mov eax, dword [ecx + 0x28]
add dword [eax + 0xc], esi
mov eax, dword [ecx + 0x28]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
add dword [eax + 0x10], edx
pop ebx
call fcn.004ae8e5
mov esp, ebp
pop ebp
ret 4
Function at 0x478560
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6847
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5519c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x4785bd
lea ecx, [edi + 0x78]
mov dword [edi], 0x4ee0d0
mov dword [edi + 0x10], 0x4ee0d8
call fcn.004459f0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [edi]
lea esi, [edi + 0x18]
push 0
push esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00448d70
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 4]
mov dword [edi + eax + 0x10], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0xc], eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
push 8
mov dword [ebp - 4], 5
mov dword [ebp + 8], esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x78]
mov dword [ecx + edi - 4], eax
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.004ae8a7
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4786c7
push 1
mov byte [ebp - 4], 6
call fcn.004ad0fa
add esp, 4
mov dword [ebx + 4], eax
jmp 0x4786c9
xor ebx, ebx
mov ecx, esi
mov dword [esi + 0x34], ebx
call fcn.00447a20
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
mov byte [esi + 0x48], 0
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea edx, [esi + 0x14]
mov byte [esi + 0x3d], 0
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
lea ebx, [esi + 0x18]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], ebx
mov dword [ecx], 0
mov dword [ebx], 0
mov dword [eax], 0
mov dword [esi + 4], 0
mov dword [edx], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x4c], 0
mov eax, dword [0x554f6c]
mov ecx, dword [0x554f70]
mov dword [esi + 0x40], eax
mov eax, edi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47b3a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7386
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5519c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x58], 0
push 0x28
mov dword [ebp - 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ae8a7
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov edi, 1
mov dword [ebp - 4], 0
mov dword [ebp - 0x58], edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, eax
mov dword [ebp - 0x60], edx
test edx, edx
je 0x47b596
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
nop dword [eax]
mov eax, 1
shl eax, cl
test edx, eax
je 0x47b567
lea eax, [ecx + 0x41]
mov byte [ebp - 0x20], al
lea ecx, [ebp - 0x24]
sub esp, 8
mov dword [ebp - 0x24], 0x60000000
mov eax, esp
mov dword [ebp - 4], 3
mov byte [ebp - 4], 0
push 3
mov dword [eax], 1
mov dword [eax + 4], ecx
lea eax, [ebp - 0x3c]
push 0x4f22cc
push eax
call fcn.0043ced0
or edi, 2
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 4
cmp dword [ebp - 0x28], 0xf
lea ecx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmova ecx, dword [ebp - 0x3c]
add esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, esp
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0xc0000000
push 3
mov dword [eax], 1
mov dword [eax + 4], ecx
lea eax, [ebp - 0x54]
push 0x4f22d0
push eax
mov byte [ebp - 4], 4
call fcn.0043ced0
add esp, 0x14
lea eax, [ebp - 0x54]
or edi, 4
cmp dword [ebp - 0x40], 0xf
mov dword [ebp - 0x58], edi
cmova eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [ebp - 0x40]
mov edi, eax
cmp ecx, 0xf
jbe 0x47b516
mov edx, dword [ebp - 0x54]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x47b50c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47b591
push ecx
push edx
call fcn.004ae8d7
add esp, 8
cmp edi, 5
jne 0x47b52a
lea eax, [ebp - 0x3c]
mov ecx, esi
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0047a120
mov edx, dword [ebp - 0x28]
mov byte [ebp - 4], 0
cmp edx, 0xf
jbe 0x47b55e
mov eax, dword [ebp - 0x3c]
inc edx
mov ecx, eax
cmp edx, 0x1000
jb 0x47b554
mov eax, dword [ecx - 4]
add edx, 0x23
sub ecx, eax
add ecx, 0xfffffffc
cmp ecx, 0x1f
ja 0x47b591
push edx
push eax
call fcn.004ae8d7
add esp, 8
mov edi, dword [ebp - 0x58]
mov edx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
inc ecx
mov dword [ebp - 0x5c], ecx
cmp ecx, 0x20
jb 0x47b430
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae8e5
mov esp, ebp
pop ebp
ret
call fcn.004b3b3f
lea eax, [ebp - 0x54]
push eax
call fcn.0047b010
push eax
push 0xb
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 1
push str.SYSTEM___
push eax
call fcn.0043c7e0
add esp, 0x14
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.004462c0
push 0x53f564
lea eax, [ebp - 0x1c]
push eax
call fcn.004affa3
int3
Function at 0x47ce70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x10], 0
xorps xmm0, xmm0
mov edx, ecx
movlpd qword [ebp - 8], xmm0
jb 0x47ced7
push ebx
mov ebx, dword [ebp + 0xc]
ja 0x47ce99
test ebx, ebx
jne 0x47ce99
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
mov esi, dword [ebp - 8]
push edi
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
movzx eax, byte [esi + eax]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f2320]
add esi, 1
mov dword [edx], ecx
adc edi, 0
cmp edi, dword [ebp + 0x10]
jb 0x47cea1
ja 0x47cecc
cmp esi, ebx
jb 0x47cea1
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, edx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4878c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x4878f1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4878e0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x48f2a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d913d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5519c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.004ae8a7
mov edi, eax
add esp, 4
test edi, edi
je 0x48f34d
push 1
mov dword [ebp - 4], 0
call fcn.004ad0fa
add esp, 4
mov dword [edi + 4], eax
jmp 0x48f34f
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.00447a20
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
not ecx
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
and ecx, 1
mov dword [ebp - 4], 1
shl ecx, 2
mov edx, ecx
or edx, 2
test bl, 2
cmovne edx, ecx
mov ecx, edx
or ecx, 8
test bl, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
test bl, 4
cmove eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], eax
cmp dword [ecx + 0x14], 0xf
mov ebx, dword [ecx + 0x10]
jbe 0x48f3a8
mov ecx, dword [ecx]
mov dword [ebp + 8], ecx
cmp ebx, 0x7fffffff
ja 0x48f46e
test ebx, ebx
je 0x48f44e
and eax, 6
cmp al, 6
je 0x48f44b
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [esi + 0x40]
push eax
call fcn.00460540
push ebx
push dword [ebp + 8]
mov edi, eax
push edi
call fcn.004b03c0
mov eax, dword [ebp + 0xc]
lea ecx, [ebx + edi]
mov dword [esi + 0x38], ecx
add esp, 0x14
mov ecx, eax
and ecx, 4
mov dword [ebp + 8], ecx
jne 0x48f40b
mov eax, dword [esi + 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov eax, dword [esi + 0x2c]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
test al, 2
jne 0x48f446
mov edx, dword [esi + 0x38]
test al, 0x18
mov eax, dword [esi + 0x10]
mov ecx, edi
cmovne ecx, edx
sub edx, ecx
cmp dword [ebp + 8], 0
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], edx
je 0x48f443
mov eax, dword [esi + 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
or eax, 1
jmp 0x48f455
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.004acf69
int3
Function at 0x493420
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9a08
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x5519c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0xac]
mov dword [ebp - 0xb4], edi
push eax
call fcn.00443010
mov ecx, eax
mov ax, word [ecx]
mov word [ebp - 0xa8], ax
mov al, byte [ecx + 2]
mov byte [ebp - 0xa6], al
lea eax, [esi + 0xa]
push eax
call fcn.0048cdb0
mov cl, byte [esi]
add esp, 0xc
movzx eax, ax
mov dword [ebp - 0xac], eax
mov al, cl
and al, 0xf
shr cl, 4
mov byte [ebp - 0xa1], al
lea eax, [ebp - 0xac]
push eax
lea eax, [esi + 9]
mov byte [ebp - 0xa2], cl
push eax
lea eax, [esi + 8]
push eax
lea eax, [esi + 7]
push eax
lea eax, [esi + 6]
push eax
lea eax, [esi + 5]
push eax
lea eax, [esi + 4]
push eax
lea eax, [esi + 3]
push eax
lea eax, [esi + 2]
push eax
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0xa1]
push eax
lea eax, [ebp - 0xa2]
push eax
lea eax, [ebp - 0xa6]
push eax
lea eax, [ebp - 0xa7]
push eax
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.00491a20
sub esp, 8
lea ecx, [ebp - 0xa0]
mov eax, esp
push 0x6b
mov dword [eax], 0xf
mov dword [eax + 4], ecx
lea eax, [ebp - 0x28]
push str.MSF:_:02::02::02_Q_Data:_:X:X:02X:02X_:02X::02X::02X_:02X_:02X::02X::02X_:04X
push eax
call fcn.0043ced0
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmova eax, dword [ebp - 0x28]
push eax
push edi
mov dword [ebp - 4], 0
call fcn.00436e60
mov edi, eax
add esp, 0x20
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov eax, dword [eax + edi + 0x30]
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [ebp - 0xac], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 1
push eax
call fcn.00445710
mov ecx, eax
add esp, 4
mov eax, dword [ecx]
push 0xa
mov edx, dword [eax + 0x20]
call edx
mov byte [ebp - 0xac], al
mov byte [ebp - 4], 0
test esi, esi
je 0x4935a0
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x4935a0
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push dword [ebp - 0xac]
mov ecx, edi
call fcn.00464f20
mov ecx, edi
call fcn.00441850
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x4935e4
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4935da
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x493605
push ecx
push edx
call fcn.004ae8d7
add esp, 8
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae8e5
mov esp, ebp
pop ebp
ret
call fcn.004b3b3f
int3
Function at 0x4a1740
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
xorps xmm0, xmm0
push esi
mov esi, ecx
movlpd qword [ebp - 8], xmm0
push edi
mov edi, dword [ebp + 0xc]
add dword [esi + 0x18], edi
adc dword [esi + 0x1c], ebx
test ebx, ebx
jb 0x4a179f
ja 0x4a1769
test edi, edi
je 0x4a179f
mov ecx, dword [esi + 0x20]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
movzx eax, byte [edx + eax]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ee228]
add edx, 1
mov dword [esi + 0x20], ecx
adc ebx, 0
cmp ebx, dword [ebp + 0x10]
jb 0x4a1772
ja 0x4a179c
cmp edx, edi
jb 0x4a1772
mov ebx, dword [ebp + 0x10]
push ebx
push edi
push dword [ebp + 8]
lea ecx, [esi + 0x28]
call fcn.00477b00
push ebx
push edi
push dword [ebp + 8]
lea ecx, [esi + 0x160]
call fcn.00477b00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4a63e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push esi
mov dword [eax], 0
lea esi, [eax + 0x60]
mov dword [eax + 0x34], 0
mov word [eax + 0x1e], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x468], 0xffffffff
mov dword [eax + 0x46c], 0xffffffff
mov dword [eax + 0x30], 0x20
mov byte [eax + 0x1d], 1
mov dword [eax + 0x48], 4
mov word [eax + 0x58], 2
nop dword [eax]
mov ecx, edx
lea esi, [esi + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [esi - 4], eax
cmp edx, 0x100
jb 0x4a6440
pop esi
pop ebp
ret
Function at 0x4a8830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
movzx esi, word [eax]
mov edi, dword [ebp + 0xc]
mov eax, esi
xor eax, 0x7f0
shr esi, 4
shr eax, 4
mov dword [ebp - 0xc], edx
mov edx, ecx
mov dword [ebp - 8], edx
mov ecx, dword [edi + esi*4]
mov ebx, dword [edi + eax*4]
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], ebx
mov dword [ebp - 0x14], ecx
movzx eax, word [esi + 0x10]
shr eax, 4
mov eax, dword [edi + eax*4]
add eax, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4a88b7
lea ebx, [edx + 4]
mov dword [ebp - 4], eax
push edi
push ebx
push ecx
push esi
call fcn.004ac3b0
push edi
lea eax, [ebx + 0x20]
push eax
push dword [ebp - 0x10]
lea eax, [esi + 0x10]
push eax
call fcn.004ac3b0
mov ecx, dword [ebp - 0x14]
add esp, 0x20
add ebx, 0x440
add esi, 0x20
sub dword [ebp - 4], 1
jne 0x4a8882
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ebx, dword [edx]
cmp ebx, 0x10
jbe 0x4a8999
movzx eax, word [esi + 0x10]
add ebx, 0xfffffff1
mov ecx, dword [ebp + 0xc]
xor eax, 0x7f0
shr eax, 4
add edx, 0x44
shr ebx, 1
mov dword [ebp - 0x10], edx
add ecx, dword [edi + eax*4]
lea eax, [ebx + 0x180]
mov dword [ebp + 0xc], ecx
lea eax, [esi + eax*2]
nop dword [eax + eax]
dec ebx
mov esi, ecx
sub eax, 2
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], eax
lea eax, [ebx + 0x80]
mov ebx, dword [ebp + 8]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x200]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
add esi, dword [edi + ecx*4]
cmp eax, 2
jae 0x4a8905
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
movzx ecx, word [eax]
mov eax, ecx
xor ecx, 0x7f0
shr eax, 4
shr ecx, 4
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [edx + ebx*8], eax
mov eax, dword [edi + ecx*4]
mov ecx, dword [ebp + 0xc]
add eax, esi
mov dword [edx + ebx*8 + 4], eax
mov eax, dword [ebp - 4]
test ebx, ebx
jne 0x4a88f0
mov esi, dword [ebp - 8]
mov eax, dword [esi]
lea ebx, [eax*4 - 0x40]
mov eax, dword [ebp - 0xc]
cmp eax, 1
jbe 0x4a8999
add esi, 0x484
lea edi, [eax - 1]
nop dword [eax + eax]
push ebx
push edx
push esi
call fcn.004b03c0
mov edx, dword [ebp - 0x10]
add esp, 0xc
add esi, 0x440
sub edi, 1
jne 0x4a8980
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4aab50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, 0x100
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
or ecx, esi
add edi, edi
mov edx, esi
and edx, edi
mov eax, ecx
add edx, esi
shr eax, 8
add eax, edx
mov edx, dword [ebp + 8]
movzx edx, word [edx + eax*2]
mov eax, ecx
shr eax, 7
add ecx, ecx
and eax, 1
shr edx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor edx, eax
mov eax, dword [ebp + 0x14]
add ebx, dword [eax + edx*4]
mov edx, ecx
xor edx, edi
not edx
and esi, edx
cmp ecx, 0x10000
jb 0x4aab65
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x4abe80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
movaps xmm0, xmmword [0x512540]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x400
push edi
mov edi, 0xc
mov eax, dword [esi + 0x78]
lea edx, [esi + 0x1e68]
mov dword [esi + 0x70], eax
lea eax, [esi + 0x2030]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x44], 1
mov dword [esi + 0x40], 1
mov dword [esi + 0x3c], 1
mov dword [esi + 0x38], 1
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
movups xmmword [esi + 0x1e30], xmm0
movups xmmword [esi + 0x1e40], xmm0
nop word [eax + eax]
mov ecx, 0x10
nop word [eax + eax]
mov word [eax - 0x180], bx
mov word [eax], bx
add eax, 2
sub ecx, 1
jne 0x4abf40
mov word [edx - 0x18], bx
mov word [edx], bx
mov word [edx + 0x18], bx
mov word [edx + 0x30], bx
add edx, 2
sub edi, 1
jne 0x4abf30
mov eax, 0x4000400
lea edi, [esi + 0x21b0]
mov ecx, 0x80
rep stosd dword es:[edi], eax
lea edi, [esi + 0x23b0]
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x98]
mov eax, 0x300
add ecx, dword [esi + 0x94]
shl eax, cl
test eax, eax
je 0x4abfb2
mov edi, dword [esi + 0x50]
mov ecx, eax
shr ecx, 1
mov eax, 0x4000400
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, 0x4000400
lea edi, [esi + 0x24b0]
mov ecx, 0x80
rep stosd dword es:[edi], eax
lea edi, [esi + 0x26b0]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov ecx, 0x80
lea edi, [esi + 0x28b0]
rep stosd dword es:[edi], eax
lea edi, [esi + 0x2ab0]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov dword [esi + 0x1c], 0
lea eax, [esi + 0xbcb8]
mov dword [esi + 0x18], 0
mov ecx, 0x800
mov dword [eax], 0x40000000
lea eax, [eax + 0x20]
sub ecx, 1
jne 0x4ac004
mov dword [esi + 0x34], ecx
mov eax, 1
mov ecx, dword [esi + 0x9c]
mov edx, 0x100
shl eax, cl
mov ecx, dword [esi + 0x98]
dec eax
mov dword [esi + 0x4c], eax
mov eax, edx
shl eax, cl
mov ecx, dword [esi + 0x94]
shr edx, cl
sub eax, edx
pop edi
mov dword [esi + 0x48], eax
pop esi
pop ebx
pop ebp
ret