joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c43c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x4c44ce
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x301
mov dword [esp + 0x54], ecx
mov eax, dword [eax]
mov dword [esp + 0x60], eax
sar eax, 0x1f
mov dword [esp + 0x64], eax
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.004bd5e0
mov eax, dword [0x68bb98]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
lea ebx, [esp + 0x50]
mov dword [esp + 0x3c], ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], edi
pxor xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x676820]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.00572080
sub esp, 0x44
mov al, byte [esp + 0x50]
test al, al
je 0x4c44ce
xor esi, esi
jmp 0x4c44aa
add esi, 1
movzx ecx, al
cmp esi, ecx
jae 0x4c44ce
cmp byte [esp + esi + 0x51], 8
jne 0x4c44a0
mov ecx, dword [esp + esi*8 + 0x60]
test ecx, ecx
je 0x4c44a0
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
movzx eax, byte [esp + 0x50]
jmp 0x4c44a0
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.0064180a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c44f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x4c45fe
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x701
mov dword [esp + 0x54], ecx
cmp byte [eax + 0xb], 0
jns 0x4c453f
mov eax, dword [eax]
mov dword [esp + 0x60], eax
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.004bd5e0
mov eax, dword [0x68bb98]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
lea ebx, [esp + 0x50]
mov dword [esp + 0x3c], ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], edi
pxor xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x676820]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.00572080
sub esp, 0x44
mov al, byte [esp + 0x50]
test al, al
je 0x4c45fe
xor esi, esi
jmp 0x4c45da
add esi, 1
movzx ecx, al
cmp esi, ecx
jae 0x4c45fe
cmp byte [esp + esi + 0x51], 8
jne 0x4c45d0
mov ecx, dword [esp + esi*8 + 0x60]
test ecx, ecx
je 0x4c45d0
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
movzx eax, byte [esp + 0x50]
jmp 0x4c45d0
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.0064180a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c4620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x4c472e
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x301
mov dword [esp + 0x54], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x60], xmm0
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.004bd5e0
mov eax, dword [0x68bb98]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
lea ebx, [esp + 0x50]
mov dword [esp + 0x3c], ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], edi
xorps xmm0, xmm0
movups xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x676820]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.00572080
sub esp, 0x44
mov al, byte [esp + 0x50]
test al, al
je 0x4c472e
xor esi, esi
jmp 0x4c470a
add esi, 1
movzx ecx, al
cmp esi, ecx
jae 0x4c472e
cmp byte [esp + esi + 0x51], 8
jne 0x4c4700
mov ecx, dword [esp + esi*8 + 0x60]
test ecx, ecx
je 0x4c4700
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
movzx eax, byte [esp + 0x50]
jmp 0x4c4700
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.0064180a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ceae0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1a0
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [esp + 0x198], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0xd0], xmm0
movdqa xmmword [esp + 0xc0], xmm0
movdqa xmmword [esp + 0xb0], xmm0
movdqa xmmword [esp + 0xa0], xmm0
lea esi, [esp + 0xa0]
push esi
push 0x20
push dword [ebp + 0x10]
call fcn.004f1660
add esp, 0xc
and byte [esp + 0xa0], 0xf8
mov al, byte [esp + 0xbf]
and al, 0x3f
or al, 0x40
mov byte [esp + 0xbf], al
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x90], xmm0
movdqa xmmword [esp + 0x80], xmm0
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
movdqa xmmword [esp], xmm0
mov edi, esp
push 0x68c138
push esi
push edi
call fcn.004cbf40
add esp, 0xc
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x150], xmm0
movdqa xmmword [esp + 0x140], xmm0
mov dword [esp + 0x164], 0xffffffff
mov dword [esp + 0x160], 0xffffffff
movdqa xmmword [esp + 0x120], xmm0
movdqa xmmword [esp + 0x110], xmm0
mov dword [esp + 0x134], 0xffffffff
mov dword [esp + 0x130], 0xffffffff
movdqa xmmword [esp + 0xf0], xmm0
movdqa xmmword [esp + 0xe0], xmm0
mov dword [esp + 0x104], 0xffffffff
mov dword [esp + 0x100], 0xffffffff
movsd xmm0, qword [esp + 0x70]
movsd qword [esp + 0x190], xmm0
movdqa xmm0, xmmword [esp + 0x50]
movaps xmm1, xmmword [esp + 0x60]
movaps xmmword [esp + 0x180], xmm1
movdqa xmmword [esp + 0x170], xmm0
lea ebx, [esp + 0x140]
lea edx, [esp + 0x170]
mov ecx, ebx
call fcn.004d5740
lea esi, [esp + 0x110]
mov ecx, esi
mov edx, edi
push ebx
call fcn.004d5b10
add esp, 4
lea edx, [esp + 0x28]
lea edi, [esp + 0xe0]
mov ecx, edi
push ebx
call fcn.004d5b10
add esp, 4
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov edx, edi
call fcn.004ca2a0
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x180], xmm0
movdqa xmmword [esp + 0x170], xmm0
lea ecx, [esp + 0x170]
mov edx, esi
call fcn.004ca2a0
mov al, byte [esp + 0x170]
shl al, 7
xor byte [ebx + 0x1f], al
mov eax, dword [ebp + 0x10]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
mov eax, dword [ebp + 0xc]
movups xmmword [eax + 0x10], xmm1
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebx]
movups xmm1, xmmword [ebx + 0x10]
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x30], xmm1
mov ecx, dword [esp + 0x198]
xor ecx, ebp
call fcn.0064180a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4d4400
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x7024bc]
xor ecx, ebp
mov dword [esp + 0x148], ecx
movdqu xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movdqu xmmword [esp + 0x128], xmm0
movups xmmword [esp + 0x138], xmm1
and byte [esp + 0x128], 0xf8
mov esi, dword [ebp + 8]
mov al, byte [esp + 0x147]
and al, 0x3f
or al, 0x40
mov byte [esp + 0x147], al
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x110], xmm0
movdqa xmmword [esp + 0x100], xmm0
movdqa xmmword [esp + 0xf0], xmm0
movdqa xmmword [esp + 0xe0], xmm0
movdqa xmmword [esp + 0xd0], xmm0
movdqa xmmword [esp + 0xc0], xmm0
movdqa xmmword [esp + 0xb0], xmm0
movdqa xmmword [esp + 0xa0], xmm0
movdqa xmmword [esp + 0x90], xmm0
movdqa xmmword [esp + 0x80], xmm0
lea eax, [esp + 0x128]
lea ecx, [esp + 0x80]
push 0x68c138
push eax
push ecx
call fcn.004cbf40
add esp, 0xc
movdqa xmm0, xmmword [esp + 0xd0]
movdqu xmm1, xmmword [esp + 0xa8]
movdqu xmm2, xmmword [esp + 0xb8]
movdqa xmm3, xmm1
paddd xmm3, xmm0
movdqa xmm4, xmmword [esp + 0xe0]
movdqu xmmword [esp + 0x58], xmm3
movdqa xmm3, xmm2
paddd xmm3, xmm4
mov eax, dword [esp + 0xf0]
mov ecx, dword [esp + 0xc8]
lea edx, [ecx + eax]
mov edi, dword [esp + 0xf4]
mov ebx, dword [esp + 0xcc]
movdqu xmmword [esp + 0x68], xmm3
mov dword [esp + 0x78], edx
lea edx, [ebx + edi]
mov dword [esp + 0x7c], edx
sub eax, ecx
sub edi, ebx
pcmpeqd xmm3, xmm3
movdqu xmmword [esp + 0x48], xmm3
movdqu xmmword [esp + 0x3c], xmm3
psubd xmm0, xmm1
paddd xmm0, xmmword [0x68c080]
psubd xmm4, xmm2
paddd xmm4, xmmword [0x68c090]
add eax, 0x7fffffe
movdqu xmmword [esp + 0x30], xmm0
movdqu xmmword [esp + 0x40], xmm4
mov dword [esp + 0x50], eax
add edi, 0x3fffffe
mov dword [esp + 0x54], edi
movdqa xmmword [esp + 0x10], xmm3
movdqa xmmword [esp], xmm3
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x20], 0xffffffff
mov edi, esp
lea edx, [esp + 0x30]
mov ecx, edi
call fcn.004d5740
lea edx, [esp + 0x58]
mov ecx, edi
push edi
call fcn.004d5b10
add esp, 4
mov ecx, esi
mov edx, edi
call fcn.004ca2a0
mov ecx, dword [esp + 0x148]
xor ecx, ebp
call fcn.0064180a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4d90f0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
lea esi, [ebp - 0x18]
push 6
push esi
push ecx
call fcn.004c9e80
add esp, 0xc
test eax, eax
je 0x4d929c
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], edi
push esi
call fcn.004c9b60
add esp, 4
movzx ebx, byte [0x6c6581]
cmp eax, ebx
jne 0x4d917c
mov edi, eax
push esi
call fcn.004c9b50
add esp, 4
mov ecx, 0x6c6574
test bl, bl
je 0x4d928c
push edi
push 0x6c6578
push eax
call fcn.006443bd
mov ecx, 0x6c6574
add esp, 0xc
test eax, eax
je 0x4d928c
push esi
call fcn.004c9b60
add esp, 4
movzx ebx, byte [0x6c64f9]
cmp eax, ebx
jne 0x4d91c4
mov edi, eax
push esi
call fcn.004c9b50
add esp, 4
mov ecx, 0x6c64ec
test bl, bl
je 0x4d928c
push edi
push 0x6c64f0
push eax
call fcn.006443bd
mov ecx, 0x6c64ec
add esp, 0xc
test eax, eax
je 0x4d928c
push esi
call fcn.004c9b60
add esp, 4
movzx ebx, byte [0x6c6609]
cmp eax, ebx
jne 0x4d920c
mov edi, eax
push esi
call fcn.004c9b50
add esp, 4
mov ecx, 0x6c65fc
test bl, bl
je 0x4d928c
push edi
push 0x6c6600
push eax
call fcn.006443bd
mov ecx, 0x6c65fc
add esp, 0xc
test eax, eax
je 0x4d928c
push esi
call fcn.004c9b60
add esp, 4
movzx ebx, byte [0x6c6691]
cmp eax, ebx
jne 0x4d924c
mov edi, eax
push esi
call fcn.004c9b50
add esp, 4
mov ecx, 0x6c6684
test bl, bl
je 0x4d928c
push edi
push 0x6c6688
push eax
call fcn.006443bd
mov ecx, 0x6c6684
add esp, 0xc
test eax, eax
je 0x4d928c
push esi
call fcn.004c9b60
add esp, 4
movzx ebx, byte [0x6c671d]
cmp eax, ebx
jne 0x4d92a3
mov edi, eax
push esi
call fcn.004c9b50
add esp, 4
mov ecx, 0x6c6710
test bl, bl
je 0x4d928c
push edi
push 0x6c6714
push eax
call fcn.006443bd
mov ecx, 0x6c6710
add esp, 0xc
test eax, eax
jne 0x4d92a3
mov eax, dword [ecx]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov dword [ebp - 0x1c], 1
jmp 0x4d92a3
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064180a
mov eax, dword [ebp - 0x1c]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x505260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [esp + 0x48], eax
xor ebx, ebx
cmp dword [ebp + 8], 0x30
ja 0x50544a
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
lea ebx, [ecx + 0xfc]
lea eax, [ecx + 0xf4]
mov dword [esp + 8], eax
push dword [ecx + 0x108]
call fcn.006500b5
add esp, 4
add eax, 1
push eax
call fcn.006500b5
add esp, 4
mov dword [esi + 0x108], eax
lea eax, [esp + 0x10]
push esi
push eax
push ebx
call dword [esi + 0xf4]
add esp, 0xc
push dword [esi + 0x108]
call fcn.006500b5
add esp, 4
add eax, 1
push eax
call fcn.006500b5
add esp, 4
mov dword [esi + 0x108], eax
push esi
lea eax, [esp + 0x24]
push eax
push ebx
call dword [esi + 0xf4]
add esp, 0xc
push dword [esi + 0x108]
call fcn.006500b5
add esp, 4
add eax, 1
push eax
call fcn.006500b5
add esp, 4
mov dword [esi + 0x108], eax
push esi
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x14], ebx
push ebx
mov ebx, eax
call dword [esi + 0xf4]
mov edx, dword [ebp + 8]
add esp, 0xc
test edx, edx
je 0x50541f
xor eax, eax
cmp edx, 0x1f
jbe 0x505410
mov eax, edx
and eax, 0xffffffe0
lea ecx, [eax - 0x20]
mov ebx, ecx
shr ebx, 5
add ebx, 1
test ecx, ecx
je 0x50545f
mov edx, ebx
and edx, 0xfffffffe
neg edx
xor ecx, ecx
nop word [eax + eax]
movups xmm0, xmmword [edi + ecx]
movups xmm1, xmmword [edi + ecx + 0x10]
movups xmm2, xmmword [esp + ecx + 0x10]
xorps xmm2, xmm0
movups xmm0, xmmword [esp + ecx + 0x20]
xorps xmm0, xmm1
movups xmmword [esp + ecx + 0x10], xmm2
movups xmmword [esp + ecx + 0x20], xmm0
movups xmm0, xmmword [edi + ecx + 0x20]
movdqu xmm1, xmmword [edi + ecx + 0x30]
movups xmm2, xmmword [esp + ecx + 0x30]
xorps xmm2, xmm0
movdqu xmm0, xmmword [esp + ecx + 0x40]
pxor xmm0, xmm1
movups xmmword [esp + ecx + 0x30], xmm2
movdqu xmmword [esp + ecx + 0x40], xmm0
add ecx, 0x40
add edx, 2
jne 0x505380
test bl, 1
je 0x5053ff
movups xmm0, xmmword [edi + ecx]
movdqu xmm1, xmmword [edi + ecx + 0x10]
movups xmm2, xmmword [esp + ecx + 0x10]
xorps xmm2, xmm0
movdqu xmm0, xmmword [esp + ecx + 0x20]
pxor xmm0, xmm1
movups xmmword [esp + ecx + 0x10], xmm2
movdqu xmmword [esp + ecx + 0x20], xmm0
mov edx, dword [ebp + 8]
cmp eax, edx
lea ebx, [esp + 0x30]
je 0x50541f
nop word [eax + eax]
movzx ecx, byte [edi + eax]
xor byte [esp + eax + 0x10], cl
add eax, 1
cmp edx, eax
jne 0x505410
push 0x20
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x10]
push 0
push esi
call fcn.004f0e40
add esp, 0x14
mov dword [esi + 0xf8], eax
movups xmm0, xmmword [ebx]
mov eax, dword [esp + 0xc]
movups xmmword [eax], xmm0
mov ebx, 1
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0064180a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
test bl, 1
jne 0x5053d8
jmp 0x5053ff
Function at 0x516910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x5169e1
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov eax, 0
cmp edx, 7
jbe 0x516a50
mov edi, edx
and edi, 0xfffffff8
lea eax, [edi - 8]
mov ebx, eax
shr ebx, 3
add ebx, 1
test eax, eax
mov dword [ebp - 0x10], ebx
je 0x5169e5
and ebx, 0xfffffffe
neg ebx
pxor xmm2, xmm2
xor eax, eax
pxor xmm0, xmm0
pxor xmm1, xmm1
nop word cs:[eax + eax]
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx + eax]
mov edx, dword [edx + eax + 4]
mov esi, dword [ebp + 8]
xor ecx, dword [esi + eax]
xor edx, dword [esi + eax + 4]
movd xmm3, ecx
movd xmm4, edx
punpcklbw xmm3, xmm2
punpcklwd xmm3, xmm2
por xmm3, xmm0
punpcklbw xmm4, xmm2
punpcklwd xmm4, xmm2
por xmm4, xmm1
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx + eax + 8]
xor ecx, dword [esi + eax + 8]
movd xmm0, ecx
mov ecx, dword [edx + eax + 0xc]
xor ecx, dword [esi + eax + 0xc]
movd xmm1, ecx
punpcklbw xmm0, xmm2
punpcklwd xmm0, xmm2
por xmm0, xmm3
punpcklbw xmm1, xmm2
punpcklwd xmm1, xmm2
por xmm1, xmm4
add eax, 0x10
add ebx, 2
jne 0x516970
jmp 0x5169ef
xor eax, eax
jmp 0x516a63
pxor xmm0, xmm0
xor eax, eax
pxor xmm1, xmm1
test byte [ebp - 0x10], 1
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
je 0x516a2d
mov ecx, dword [ebx + eax + 4]
xor ecx, dword [esi + eax + 4]
mov edx, dword [ebx + eax]
movd xmm2, ecx
pxor xmm3, xmm3
punpcklbw xmm2, xmm3
punpcklwd xmm2, xmm3
por xmm1, xmm2
xor edx, dword [esi + eax]
movd xmm2, edx
punpcklbw xmm2, xmm3
punpcklwd xmm2, xmm3
por xmm0, xmm2
por xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd eax, xmm0
mov edx, dword [ebp + 0x10]
cmp edi, edx
je 0x516a63
nop
movzx ecx, byte [ebx + edi]
xor cl, byte [esi + edi]
movzx ecx, cl
or eax, ecx
add edi, 1
cmp edx, edi
jne 0x516a50
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x517df0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00517a50
Function at 0x518100
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00517e00
Function at 0x52bf90
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 0xc]
movzx edx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test dl, dl
mov dword [ebp - 0x10], ecx
lea ecx, [eax + ecx]
mov dword [ebp - 0x20], edx
lea edx, [esi + edx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
jb 0x52bffd
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x52bfd0
cmp edx, 1
jne 0x52c006
jmp 0x52c022
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x52c022
cmp edx, 2
je 0x52c019
cmp edx, 3
jne 0x52c02d
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx + 4]
xor ecx, ecx
test edi, edi
je 0x52c188
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov ebx, eax
shr ebx, 0xf
xor ebx, eax
mov eax, edi
shr eax, 1
and eax, 0x55555555
mov edx, edi
sub edx, eax
mov eax, edx
and eax, 0x33333333
shr edx, 2
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
ja 0x52c094
lea edx, [edi - 1]
and edx, ebx
jmp 0x52c0a0
mov edx, ebx
cmp ebx, edi
jb 0x52c0a0
mov eax, ebx
xor edx, edx
div edi
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x24], edx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x52c188
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
mov ebx, dword [eax]
test ebx, ebx
je 0x52c188
mov eax, dword [ebp - 0x18]
add eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x10]
cmovns eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x52c0f6
and eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
jne 0x52c186
mov ebx, dword [ebx]
test ebx, ebx
je 0x52c186
mov eax, dword [ebx + 4]
cmp dword [ebp - 0x14], eax
jne 0x52c150
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x52c10b
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x52c0ec
lea ecx, [ebx + 8]
mov edx, dword [ecx]
test al, al
cmovs ecx, edx
js 0x52c168
cmp dword [ebp - 0x10], 0
je 0x52c182
cmp byte [esi], dl
jne 0x52c0ec
add eax, 0xffffffff
xor ecx, ecx
nop dword [eax + eax]
cmp eax, ecx
je 0x52c182
movzx edx, byte [ebx + ecx + 9]
lea edi, [ecx + 1]
cmp dl, byte [esi + ecx + 1]
mov ecx, edi
je 0x52c130
jmp 0x52c0ec
cmp dword [ebp - 0x28], 1
jbe 0x52c0e0
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x52c0e3
xor edx, edx
div ecx
mov eax, edx
jmp 0x52c0e3
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x52c182
push eax
push esi
push ecx
call fcn.006443bd
add esp, 0xc
test eax, eax
jne 0x52c0ec
mov ecx, ebx
jmp 0x52c188
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x5586c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x558739
mov ecx, dword [ebp + 0xc]
cmp ebx, 1
jne 0x5586dc
xor esi, esi
jmp 0x55871e
and ebx, 0xfffffffe
xor esi, esi
nop word cs:[eax + eax]
nop dword [eax + eax]
movzx edi, al
movzx edx, byte [ecx + esi]
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x6c4320]
movzx edx, al
movzx edi, byte [ecx + esi + 1]
xor edi, edx
shr eax, 8
xor eax, dword [edi*4 + 0x6c4320]
add esi, 2
cmp ebx, esi
jne 0x5586f0
mov edx, dword [ebp + 0x10]
test dl, 1
je 0x558739
movzx edx, al
movzx ecx, byte [ecx + esi]
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x6c4320]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x560fa0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x705900]
mov ecx, dword [0x705840]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x560fcb
mov ecx, 0x7058f8
pop ebp
jmp fcn.004acf70
push 0x705900
call fcn.00641847
add esp, 4
cmp dword [0x705900], 0xffffffff
jne 0x560fc0
mov dword [0x7058fc], 0
mov dword [0x7058f8], 0
mov ecx, 0x7058f8
push 0
call fcn.004acff0
push 0x705900
call fcn.006418bd
add esp, 4
jmp 0x560fc0

Function at 0x563210
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x705928]
mov ecx, dword [0x705840]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x56323b
mov ecx, 0x705920
pop ebp
jmp fcn.004acf70
push 0x705928
call fcn.00641847
add esp, 4
cmp dword [0x705928], 0xffffffff
jne 0x563230
mov dword [0x705924], 0
mov dword [0x705920], 0
mov ecx, 0x705920
push 0
call fcn.004acff0
push 0x705928
call fcn.006418bd
add esp, 4
jmp 0x563230
Function at 0x56d080
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
je 0x56d097
mov eax, dword [esi]
mov ecx, eax
jmp 0x56d0bc
mov eax, dword [esi]
test eax, eax
je 0x56d0a1
mov ecx, eax
jmp 0x56d0bc
cmp dword [esi + 0xc], 0
je 0x56d0ad
mov ecx, eax
xor eax, eax
jmp 0x56d0bc
mov ecx, eax
xor eax, eax
cmp dword [esi + 4], 0
mov edx, 0
je 0x56d113
add ecx, 1
cmp ecx, 2
jb 0x56d0db
call fcn.00499510
push dword [esi]
call fcn.004bbc10
add esp, 4
mov dword [esi], 0
xor eax, eax
mov ecx, dword [esi + 4]
lea edx, [ecx + 1]
cmp edx, 2
jb 0x56d101
call fcn.00499510
push dword [esi + 4]
call fcn.004bbc10
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi]
xor ecx, ecx
mov edx, eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, ecx
mov ebx, dword [edi]
cmp edx, ebx
je 0x56d15c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x56d140
call fcn.00499510
push dword [esi]
call fcn.004bbc10
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x56d14f
mov dword [esi], ebx
call fcn.00499510
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp eax, ebx
je 0x56d1a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
add eax, 1
cmp eax, 2
jb 0x56d18d
call fcn.00499510
push dword [esi + 4]
call fcn.004bbc10
add esp, 4
mov dword [esi + 4], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x56d19d
mov dword [esi + 4], ebx
call fcn.00499510
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4