joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d3120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x5de040]
xor eax, esp
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [edx + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
mov esi, dword [ebp + 0x24]
push edi
push 0
mov edi, ecx
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0
addsd xmm0, qword [eax*8 + 0x5c76b0]
mov eax, dword [edx + 0x1c]
push dword [edi + 0x290]
mov dword [esp + 0x58], 0
push esi
cvtpd2ps xmm3, xmm0
mov dword [esp + 0x58], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
movd xmm0, eax
divss xmm3, dword [0x5de11c]
shr eax, 0x1f
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x68], 0x3f800000
mov dword [esp + 0x54], 0x3f800000
mov dword [esp + 0x40], 0x3f800000
mov dword [esp + 0x2c], 0x3f800000
cvtdq2pd xmm0, xmm0
push dword [edi + 0x29c]
addsd xmm0, qword [eax*8 + 0x5c76b0]
push ecx
lea eax, [esp + 0x34]
cvtpd2ps xmm1, xmm0
divss xmm1, dword [0x5de11c]
movss dword [esp], xmm1
push eax
push ebx
call fcn.0048aaf0
mov eax, dword [edi + 0x298]
mov dword [esp + 0x7c], eax
mov eax, dword [edi + 0x29c]
mov dword [esp + 0x80], eax
mov eax, dword [edi + 0x288]
mov esi, dword [eax + 0x48]
sub esi, 1
js 0x4d32da
nop dword [eax]
mov eax, dword [edi + 0x2f8]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x4d32d5
cmp dword [eax + 0x28c], 0
jne 0x4d32d5
mov eax, dword [edi + 0x290]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [edi + 0x2f8]
lea edx, [esp + 0x64]
movss xmm0, dword [ebp + 0x28]
push 0
mov ecx, dword [eax + esi*4]
push ecx
movss dword [esp], xmm0
push dword [edi + 0x290]
mov eax, dword [ecx]
push dword [esp + 0x1c]
push edx
push dword [esp + 0x28]
push dword [esp + 0x30]
push ebx
push dword [esp + 0x3c]
call dword [eax + 0x20]
mov eax, dword [edi + 0x290]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
sub esi, 1
jns 0x4d3270
mov ecx, dword [esp + 0x84]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052d235
mov esp, ebp
pop ebp
ret 0x24
Function at 0x4dc920
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
push esi
mov dword [ecx], 0x1571
mov esi, 1
mov dword [ecx + 0x9c0], 1
nop word [eax + eax]
mov edx, dword [ecx + esi*4 - 4]
shr edx, 0x1e
xor edx, dword [ecx + esi*4 - 4]
imul eax, edx, 0x6c078965
add eax, esi
mov dword [ecx + esi*4], eax
mov esi, dword [ecx + 0x9c0]
inc esi
mov dword [ecx + 0x9c0], esi
cmp esi, 0x270
jl 0x4dc940
pop esi
pop ecx
ret 4

Function at 0x4dc970
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x9c0]
cmp eax, 0x270
jl 0x4dca3b
cmp eax, 0x271
jne 0x4dc991
push ecx
call fcn.004dc920
xor edx, edx
mov ecx, dword [esi + edx*4 + 4]
xor ecx, dword [esi + edx*4]
and ecx, 0x7fffffff
xor ecx, dword [esi + edx*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x5c1080]
xor ecx, dword [esi + edx*4 + 0x634]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, 0xe3
jl 0x4dc993
nop dword [eax]
nop dword [eax + eax]
mov ecx, dword [esi + edx*4 + 4]
xor ecx, dword [esi + edx*4]
and ecx, 0x7fffffff
xor ecx, dword [esi + edx*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x5c1080]
xor ecx, dword [esi + edx*4 - 0x38c]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, 0x26f
jl 0x4dc9d0
mov eax, dword [esi + 0x9bc]
mov ecx, dword [esi]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [eax*4 + 0x5c1080]
xor eax, dword [esi + 0x630]
xor eax, ecx
mov dword [esi + 0x9bc], eax
xor eax, eax
mov dword [esi + 0x9c0], 0
mov ecx, dword [esi + eax*4]
inc eax
mov dword [esi + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
ret
Function at 0x4ee220
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1bad
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x5de040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], 0
xorps xmm0, xmm0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
movups xmmword [esi + 0xc], xmm0
push 2
movq qword [esi + 0x1c], xmm0
mov dword [esi + 0x24], 0
push esi
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call dword [0x5a43dc]
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [esi + 0x30], edi
add esi, 0x34
push 8
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.0052d5e8
add esp, 0xc
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
add eax, 0x48
mov dword [ebp - 0x18], eax
push 0x4f3fe0
push 0x4f41d0
push 6
push 4
push eax
mov byte [ebp - 4], 2
call fcn.0052d748
lea eax, [edi + 0x2000]
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x10], 0
mov dword [ebp + 8], eax
nop dword [eax]
push 0x18
call fcn.0052d5e8
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 5
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x18], edx
test eax, eax
je 0x4ee383
neg ecx
cmp eax, ecx
jbe 0x4ee36e
push ecx
push eax
lea ecx, [esi + 0xc]
call fcn.00449620
jmp 0x4ee383
push eax
push 0
push edx
call fcn.00580daf
mov eax, dword [ebp + 8]
add esp, 0xc
add eax, dword [ebp - 0x18]
mov dword [esi + 0x10], eax
mov byte [ebp - 4], 3
mov esi, dword [edi]
mov eax, dword [ebp - 0x1c]
mov dword [edi], eax
test esi, esi
je 0x4ee3e2
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4ee3d7
mov ecx, dword [esi + 0x14]
sub ecx, eax
cmp ecx, 0x1000
jb 0x4ee3b8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ee40b
mov eax, edx
push ecx
push eax
call fcn.0052d5b7
mov dword [esi + 0xc], 0
add esp, 8
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
push 0x18
push esi
call fcn.0052d5b7
add esp, 8
mov eax, dword [ebp - 0x10]
add edi, 4
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 6
jb 0x4ee310
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call dword [0x5a47c4]
int3
Function at 0x4f6520
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2355
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x5de040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push dword [ebx + 8]
call fcn.004f6940
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [esi + 4]
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x2c
mov dword [ebp - 0x24], 0
call fcn.0052d5e8
mov edx, dword [ebx + 8]
xorps xmm0, xmm0
mov ecx, edx
mov dword [ebp - 0x24], eax
movups xmmword [eax + 8], xmm0
lea edi, [eax + 8]
add esp, 4
mov dword [edi + 0x10], 0
mov dword [ebp - 0x1c], edi
lea esi, [ecx + 2]
mov dword [edi + 0x14], 0
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f65c0
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00403ce0
movq xmm0, qword [ebp - 0x34]
movq qword [edi + 0x18], xmm0
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 1
cmp dword [edi + 0x14], 7
mov edx, dword [edi + 0x10]
mov dword [ebp - 0x18], edi
jbe 0x4f6601
mov eax, dword [edi]
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov esi, 0x811c9dc5
add edx, edx
je 0x4f6624
mov edi, dword [ebp - 0x18]
nop
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x4f6610
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push esi
push edi
push eax
call fcn.00406420
cmp dword [ebp - 0x1c], 0
je 0x4f6657
mov esi, dword [ebp - 0x24]
test esi, esi
je 0x4f66d3
mov ecx, edi
call fcn.00403a20
push 0x2c
push esi
call fcn.0052d5b7
add esp, 8
jmp 0x4f66d3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 8]
cmp eax, 0x5d1745d
jne 0x4f666f
push str.unordered_map_set_too_long
call dword [0x5a4440]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5c76b0]
mov eax, dword [ecx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5c76b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ecx]
jbe 0x4f66c6
call fcn.004f7420
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push esi
push edi
push eax
call fcn.00406420
mov ecx, dword [ebp - 0x14]
mov edx, dword [eax]
jmp 0x4f66c9
mov edx, dword [ebp - 0x20]
push dword [ebp - 0x24]
push edx
push esi
call fcn.004f7480
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x4f66f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, ecx
mov dword [esp], eax
push ebx
push esi
mov eax, dword [eax + 4]
push edi
mov esi, dword [eax]
cmp esi, eax
je 0x4f67ed
nop
cmp dword [esi + 0x1c], 7
lea edi, [esi + 8]
mov ebx, esi
mov eax, edi
mov dword [esp + 0x14], ebx
jbe 0x4f6723
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
push 1
push eax
push 2
call fcn.00520570
test eax, eax
je 0x4f67de
cmp dword [edi + 0x14], 7
jbe 0x4f6740
mov edi, dword [edi]
mov ecx, dword [ebp + 8]
push edi
push 2
call fcn.00520c20
cmp dword [ebx + 0x1c], 7
lea edx, [ebx + 8]
mov esi, dword [esi]
mov ecx, dword [edx + 0x10]
jbe 0x4f675b
mov edx, dword [edx]
xor eax, eax
mov edi, 0x811c9dc5
add ecx, ecx
mov dword [esp + 0x10], ecx
je 0x4f6785
mov ebx, ecx
nop dword [eax]
movzx ecx, byte [eax + edx]
inc eax
xor ecx, edi
imul edi, ecx, 0x1000193
cmp eax, ebx
jb 0x4f6770
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0xc]
and ecx, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], ebx
jne 0x4f67b1
cmp eax, ebx
jne 0x4f67a9
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x4f67b9
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
jmp 0x4f67b9
cmp eax, ebx
jne 0x4f67b9
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx]
dec dword [edx + 8]
mov eax, dword [ebx + 4]
mov dword [eax], ecx
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
lea ecx, [ebx + 8]
call fcn.00403a20
push 0x2c
push ebx
call fcn.0052d5b7
add esp, 8
jmp 0x4f67e0
mov esi, dword [esi]
mov eax, dword [esp + 0xc]
cmp esi, dword [eax + 4]
jne 0x4f6710
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f6800
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
mov eax, dword [0x5de040]
xor eax, esp
mov dword [esp + 0x44], eax
mov edx, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [esp + 8], ecx
mov ecx, edx
push esi
push edi
movss dword [esp + 0x14], xmm2
movaps xmmword [esp + 0x20], xmm0
lea esi, [ecx + 2]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f6840
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.00403ce0
cmp dword [esp + 0x34], 7
lea esi, [esp + 0x20]
mov edi, dword [esp + 0x20]
mov edx, 0x811c9dc5
mov eax, dword [esp + 0x30]
cmova esi, edi
xor ecx, ecx
add eax, eax
je 0x4f6895
mov edi, eax
nop dword [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4f6880
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00406420
mov esi, dword [eax + 4]
test esi, esi
jne 0x4f68b7
mov eax, dword [esp + 0x10]
mov esi, dword [eax + 4]
mov eax, dword [esp + 0x34]
cmp eax, 7
jbe 0x4f68f1
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x4f68e7
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4f68e7
call dword [0x5a47c4]
push ecx
push edi
call fcn.0052d5b7
add esp, 8
mov eax, dword [esp + 0x10]
cmp esi, dword [eax + 4]
je 0x4f6923
mov eax, dword [esi + 0x24]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5c76b0]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [esp + 0x14]
call fcn.00581060
mov dword [esi + 0x24], eax
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
xor ecx, esp
call fcn.0052d235
mov esp, ebp
pop ebp
ret 4
Function at 0x4f6940
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
mov eax, dword [0x5de040]
xor eax, esp
mov dword [esp + 0x44], eax
mov edx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
mov edi, ecx
movaps xmmword [esp + 0x20], xmm0
mov ecx, edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f6980
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.00403ce0
cmp dword [esp + 0x34], 7
lea esi, [esp + 0x20]
mov eax, dword [esp + 0x30]
mov edx, 0x811c9dc5
cmova esi, dword [esp + 0x20]
xor ecx, ecx
add eax, eax
je 0x4f69d5
mov edi, eax
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4f69c0
mov edi, dword [esp + 0x18]
push edx
lea eax, [esp + 0x24]
mov ecx, edi
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00406420
mov esi, dword [eax + 4]
test esi, esi
jne 0x4f69f1
mov esi, dword [edi + 4]
mov eax, dword [esp + 0x34]
cmp eax, 7
jbe 0x4f6a2f
mov edx, dword [esp + 0x20]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4f6a25
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4f6a25
call dword [0x5a47c4]
push ecx
push edx
call fcn.0052d5b7
add esp, 8
cmp esi, dword [edi + 4]
je 0x4f6a41
push esi
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
call fcn.004f7340
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
xor ecx, esp
call fcn.0052d235
mov esp, ebp
pop ebp
ret 4
Function at 0x4f6a60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a23a7
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5de040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx + 4]
mov edi, dword [eax]
cmp edi, eax
je 0x4f6bfa
mov eax, dword [0x5a4188]
mov dword [ebp - 0x14], eax
cmp dword [edi + 0x20], 0
lea ebx, [edi + 8]
je 0x4f6ac2
mov eax, dword [ebp + 8]
add dword [ebx + 0x20], eax
mov eax, dword [ebx + 0x20]
cmp eax, dword [ebx + 0x1c]
jb 0x4f6bb7
mov dword [ebx + 0x18], 0
mov ecx, dword [0x5e4414]
test ecx, ecx
jne 0x4f6b43
push 0x44
call fcn.0052d5e8
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
push esi
mov dword [ebp - 4], 0
call dword [ebp - 0x14]
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00441500
add esi, 0x30
mov byte [ebp - 4], 2
push 8
mov dword [ebp - 0x20], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.0052d5e8
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dword [0x5e4414], ecx
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
cmp dword [ebx + 0x14], 7
mov eax, ebx
jbe 0x4f6b4d
mov eax, dword [ebx]
push 0xffffffffffffffff
push 0
push eax
push 2
call fcn.0043f9c0
cmp dword [ebx + 0x14], 7
mov esi, edi
mov edi, dword [edi]
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x20], esi
jbe 0x4f6b6b
mov ebx, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
mov dword [ebp - 0x1c], eax
je 0x4f6b94
mov esi, eax
nop dword [eax + eax]
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4f6b80
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edx
lea edx, [eax + ecx*8]
mov eax, dword [edx]
cmp dword [edx + 4], esi
jne 0x4f6bc6
cmp eax, esi
jne 0x4f6bbe
mov eax, dword [ebx + 4]
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x4f6bce
mov edi, dword [edi]
mov ebx, dword [ebp - 0x10]
jmp 0x4f6bf1
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
jmp 0x4f6bce
cmp eax, esi
jne 0x4f6bce
mov eax, dword [esi]
mov dword [edx], eax
mov ecx, dword [esi]
dec dword [ebx + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 8]
call fcn.00403a20
push 0x2c
push esi
call fcn.0052d5b7
add esp, 8
cmp edi, dword [ebx + 4]
jne 0x4f6aa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f6c10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
mov eax, dword [0x5de040]
xor eax, esp
mov dword [esp + 0x44], eax
mov edx, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [esp + 0xc], ecx
mov ecx, edx
push esi
push edi
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x30], 0
lea esi, [ecx + 2]
mov dword [esp + 0x34], 0
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f6c50
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.00403ce0
cmp dword [esp + 0x34], 7
lea edi, [esp + 0x20]
mov esi, dword [esp + 0x20]
mov edx, 0x811c9dc5
mov eax, dword [esp + 0x30]
cmova edi, esi
xor ecx, ecx
add eax, eax
je 0x4f6ca5
mov esi, eax
nop dword [eax + eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4f6c90
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00406420
mov edi, dword [eax + 4]
test edi, edi
jne 0x4f6cc7
mov eax, dword [esp + 0x14]
mov edi, dword [eax + 4]
mov eax, dword [esp + 0x34]
cmp eax, 7
jbe 0x4f6d01
lea ecx, [eax*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x4f6cf7
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4f6cf7
call dword [0x5a47c4]
push ecx
push esi
call fcn.0052d5b7
add esp, 8
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp edi, dword [ecx + 4]
mov ecx, dword [esp + 0x4c]
pop edi
setne al
pop esi
xor ecx, esp
call fcn.0052d235
mov esp, ebp
pop ebp
ret 4
Function at 0x4f7190
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x20]
cmp ecx, eax
je 0x4f7304
cmp dword [ecx + 0x1c], 7
lea edx, [ecx + 8]
mov eax, dword [ebp + 4]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [edx + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 4]
push esi
mov dword [esp + 0xc], eax
mov esi, ecx
jbe 0x4f71cd
mov edx, dword [edx]
xor ecx, ecx
push edi
mov edi, 0x811c9dc5
add ebx, ebx
je 0x4f71f1
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x4f71e0
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x1c]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x14], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], eax
nop
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00403a20
push 0x2c
push edi
call fcn.0052d5b7
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x4f7261
mov eax, dword [esp + 0x30]
cmp esi, eax
jne 0x4f7210
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x2c]
jne 0x4f72f8
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], esi
mov ecx, dword [esp + 0xc]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
jne 0x4f7277
mov eax, dword [esp + 0x20]
mov dword [ecx], eax
jmp 0x4f727b
mov eax, dword [esp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x30]
cmp esi, eax
je 0x4f72f8
cmp dword [esi + 0x1c], 7
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x4f7294
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x4f72b1
nop
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x4f72a0
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x1c]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00403a20
push 0x2c
push edi
call fcn.0052d5b7
dec dword [ebp + 8]
add esp, 8
mov eax, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
je 0x4f730b
cmp esi, eax
jne 0x4f72c8
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x20]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x4f7286
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
Function at 0x4f7340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x1c], 7
push ebx
mov ebx, dword [eax + 0x18]
push ebp
lea ebp, [eax + 8]
mov dword [esp + 8], ecx
push esi
push edi
mov edi, ebp
jbe 0x4f735e
mov edi, dword [ebp]
xor edx, edx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x4f7381
nop dword [eax]
movzx ecx, byte [edx + edi]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, ebx
jb 0x4f7370
mov ebx, dword [esp + 0x10]
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and edx, esi
mov esi, dword [ecx + edx*8]
cmp dword [ecx + edx*8 + 4], eax
jne 0x4f73af
cmp esi, eax
jne 0x4f73a6
mov eax, dword [ebx + 4]
mov dword [ecx + edx*8], eax
mov dword [ecx + edx*8 + 4], eax
jmp 0x4f73b8
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x4f73b8
cmp esi, eax
jne 0x4f73bc
mov eax, dword [eax]
mov dword [ecx + edx*8], eax
mov eax, dword [esp + 0x1c]
mov esi, dword [eax]
mov ecx, ebp
dec dword [ebx + 8]
mov edx, dword [eax + 4]
mov dword [edx], esi
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
call fcn.00403a20
push 0x2c
push dword [esp + 0x20]
call fcn.0052d5b7
mov eax, dword [esp + 0x20]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8