joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d70d5
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x38
push esi
push edi
mov eax, dword [0x689140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x1c], esi
call fcn.0049dcb0
mov dword [ebp - 4], 0
mov edi, dword [eax]
push 0x6e8538
push 0x6913a4
mov eax, dword [edi]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x14], eax
call fcn.00599d05
mov edx, eax
mov dword [ebp - 0x24], 0
mov ecx, edx
mov dword [ebp - 0x20], 0
xorps xmm0, xmm0
add esp, 8
movups xmmword [ebp - 0x34], xmm0
lea eax, [ecx + 1]
mov dword [ebp - 0x18], eax
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4854a0
sub ecx, dword [ebp - 0x18]
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.004276d0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
call dword [0x5f2510]
mov ecx, edi
call dword [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0044c750
mov edi, dword [ebp - 0x38]
or esi, 0xffffffff
test edi, edi
je 0x485519
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x485519
mov eax, dword [edi]
mov esi, dword [eax]
mov ecx, esi
call dword [0x5f2510]
mov ecx, edi
call esi
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x485519
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5f2510]
mov ecx, edi
call esi
or esi, 0xffffffff
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, 0xf
jbe 0x485551
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x485547
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x485626
push ecx
push edx
call fcn.0059886a
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0x40]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
test edi, edi
je 0x4855a6
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x4855a6
mov eax, dword [edi]
mov esi, dword [eax]
mov ecx, esi
call dword [0x5f2510]
mov ecx, edi
call esi
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x4855a6
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5f2510]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x1c]
mov edi, dword [edi]
test edi, edi
je fcn.00485610
mov eax, dword [edi]
push 0
push 0x691678
push 0x69213c
mov esi, dword [eax + 0x18]
mov ecx, esi
push 0
call dword [0x5f2510]
mov ecx, edi
call esi
push eax
call fcn.005cb0ec
mov esi, eax
add esp, 0x14
test esi, esi
je fcn.00485610
mov ecx, dword [esi + 0x1c]
lea edi, [esi + 0x1c]
and cl, 3
cmp cl, 2
jne 0x4855f2
mov ecx, esi
call fcn.00483e70
mov eax, 1
xchg dword [edi], eax
lea eax, [esi + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x485a8c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
xor ecx, ecx
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov edx, dword [eax + 0x20]
mov ebx, dword [eax + 0x1c]
add edx, edi
mov ebp, dword [eax + 0x24]
add ebx, edi
mov eax, dword [eax + 0x18]
add ebp, edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
test eax, eax
je 0x485aed
mov edx, dword [edx + ecx*4]
add edx, edi
xor esi, esi
jmp 0x485ad6
movzx eax, al
or eax, 0x60
add esi, eax
inc edx
add esi, esi
mov al, byte [edx]
test al, al
jne 0x485acb
cmp esi, dword [esp + 0x10]
je 0x485af7
mov edx, dword [esp + 0x18]
inc ecx
cmp ecx, dword [esp + 0x14]
jb 0x485ac2
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
movzx eax, word [ebp + ecx*2]
mov eax, dword [ebx + eax*4]
add eax, edi
jmp 0x485aef
Function at 0x4a22b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d9b60
mov eax, dword fs:[0]
push eax
sub esp, 0x128
push esi
push edi
mov eax, dword [0x689140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [0x62eb08]
mov esi, dword [ebp + 0xc]
push dword [0x62eb04]
mov edi, dword [ebp + 8]
push esi
push edi
call fcn.0043caf0
add esp, 0x10
test al, al
jne 0x4a2497
push dword [0x62eb10]
push dword [0x62eb0c]
push esi
push edi
call fcn.0043caf0
add esp, 0x10
test al, al
jne 0x4a247f
push dword [0x633d40]
push dword [0x633d3c]
push esi
push edi
call fcn.0043caf0
add esp, 0x10
test al, al
je 0x4a234e
mov eax, 5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [0x62eb00]
push dword [0x62eafc]
push esi
push edi
call fcn.0043caf0
add esp, 0x10
test al, al
je 0x4a2380
mov eax, 3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [0x633dc8]
push dword [0x633dc4]
push esi
push edi
call fcn.0043caf0
add esp, 0x10
test al, al
jne 0x4a2497
push dword [0x633dac]
push dword [0x633da8]
push esi
push edi
call fcn.0043caf0
add esp, 0x10
test al, al
jne 0x4a247f
push dword [0x633d48]
push dword [0x633d44]
push esi
push edi
call fcn.0043caf0
add esp, 0x10
test al, al
je 0x4a23ee
mov eax, 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x18], 0x32383041
mov edx, 5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], 0x43433344
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x130]
push eax
mov dword [ebp - 0x30], 0x74746573
mov dword [ebp - 0x2c], 0x73676e69
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x1c], 0x118
call fcn.00425500
add esp, 4
push str.using_unknown_schema
lea ecx, [ebp - 0x130]
mov dword [ebp - 4], 0
call fcn.00426ca0
push dword [ebp + 0xc]
mov ecx, eax
push dword [ebp + 8]
call fcn.004a21e0
lea ecx, [ebp - 0x130]
call fcn.00426780
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4a2f20
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d9bf1
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
push esi
push edi
mov eax, dword [0x689140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], edx
mov esi, dword [ebx + 8]
lea edi, [edx + 4]
mov ecx, dword [ebx + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x2c], edx
mov eax, dword [esi + 0x3c]
mov dword [edx], eax
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [ecx]
movups xmmword [edi], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ecx + 0x10], 0
xorps xmm0, xmm0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
lea ecx, [edx + 0x1c]
mov eax, dword [esi + 0x2c]
mov edx, dword [esi + 0x28]
push eax
movups xmmword [ecx], xmm0
push edx
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00428c10
mov byte [ebp - 4], 1
xorps xmm0, xmm0
mov ecx, dword [ebp - 0x14]
mov eax, dword [esi + 0x34]
add ecx, 0x34
mov edx, dword [esi + 0x30]
push eax
push edx
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00428c10
mov ecx, dword [ebp - 0x14]
push esi
lea ecx, [ecx + 0x4c]
call fcn.004ba490
mov ecx, dword [ebp - 0x14]
mov eax, dword [esi + 0x3c]
lea esi, [ecx + 0x4c]
mov dword [esi + 0x3c], eax
mov byte [ebp - 4], 3
cmp dword [ecx], 0
je 0x4a3095
cmp dword [ecx + 0x14], 0
jne 0x4a302f
push str.PhysicalPath_cannot_be_empty
jmp 0x4a309a
cmp dword [edi + 0x14], 7
mov edx, dword [edi + 0x10]
jbe 0x4a303a
mov edi, dword [edi]
push 2
push 0x633ff0
push 0
mov ecx, edi
call fcn.00441d70
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4a308e
cmp dword [esi + 0x14], 7
mov ecx, esi
jbe 0x4a305c
mov ecx, dword [esi]
mov edx, dword [esi + 0x10]
push 2
push 0x633ff0
push 0
call fcn.00441d70
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4a308e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
push str.Illegal_characters_in_path
jmp 0x4a309a
push str.Invalid_store_specified__check_your_property_path
push 0x57
lea ecx, [ebp - 0x24]
call fcn.004a26f0
push 0x685bc4
lea eax, [ebp - 0x24]
push eax
call fcn.00599dcb
int3
Function at 0x4a3260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
push edi
mov edi, dword [ebx + 8]
mov dword [ebp - 0x10], esi
cmp dword [esi + 0x88], 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
je 0x4a32c5
cmp dword [esi + 0x70], 0
je 0x4a32c5
cmp dword [esi + 0x78], 0
jne 0x4a32a7
cmp dword [esi + 0x80], 0
jne 0x4a32c5
add esi, 0x4c
mov ecx, edi
push esi
call fcn.004ba3f0
mov ecx, dword [esi + 0x3c]
mov eax, edi
mov dword [edi + 0x3c], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
cmp dword [esi + 0x18], 7
lea edx, [esi + 4]
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
jbe 0x4a32d9
mov edx, dword [esi + 4]
mov edi, dword [esi + 0x14]
test edi, edi
je 0x4a337a
lea eax, [edi - 1]
or ecx, 0xffffffff
cmp eax, ecx
cmovb ecx, eax
cmp word [edx + ecx*2], 0x5c
lea eax, [edx + ecx*2]
je 0x4a330d
nop dword [eax]
cmp eax, edx
je 0x4a3331
sub eax, 2
cmp word [eax], 0x5c
jne 0x4a3300
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x4a3331
lea ecx, [eax + 1]
cmp edi, ecx
jb 0x4a33c4
mov eax, edi
lea edx, [edx + ecx*2]
sub eax, ecx
or edi, 0xffffffff
cmp eax, 0xffffffff
cmovb edi, eax
test edi, edi
je 0x4a337a
mov eax, edi
mov dword [ebp - 0xc], 0
mov ecx, edx
test eax, eax
je 0x4a3361
cmp word [edx], 0x2e
je 0x4a3364
nop word [eax + eax]
cmp eax, 1
je 0x4a3361
add ecx, 2
dec eax
cmp word [ecx], 0x2e
jne 0x4a3350
jmp 0x4a3364
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x4a337a
sub ecx, edx
sar ecx, 1
cmp ecx, 0xffffffff
je 0x4a337a
mov eax, edi
mov edi, ecx
cmp eax, ecx
cmovb edi, eax
cmp dword [esi + 0x48], 7
lea ecx, [esi + 0x34]
jbe 0x4a3386
mov ecx, dword [esi + 0x34]
cmp dword [esi + 0x30], 7
mov eax, dword [esi + 0x44]
mov dword [ebp - 4], eax
lea eax, [esi + 0x1c]
mov dword [ebp - 0xc], eax
jbe 0x4a33a0
mov esi, dword [eax]
mov dword [ebp - 0xc], esi
mov esi, dword [ebp - 0x10]
push dword [ebp - 4]
push ecx
push dword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0xc]
push edi
push edx
push dword [esi]
call fcn.0049e550
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.0043d9f0
int3
Function at 0x4a38e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d9d99
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x78
mov eax, dword [0x689140]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebx + 0xc]
lea ecx, [ebp - 0x68]
mov edi, dword [ebx + 8]
mov dword [ebp - 4], 0
push ecx
mov dword [ebp - 0x84], edi
mov ecx, eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x80], 0
call fcn.004a3260
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov eax, dword [esi]
mov ecx, dword [ebp - 0x6c]
cmp dword [ecx + 0x30], 7
mov dword [ebp - 0x80], 1
mov edx, dword [eax]
lea eax, [ecx + 0x1c]
mov dword [ebp - 0x7c], eax
jbe 0x4a3993
mov esi, dword [eax]
mov dword [ebp - 0x7c], esi
cmp dword [ecx + 0x18], 7
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x70], eax
lea eax, [ecx + 4]
mov ecx, eax
jbe 0x4a39a6
mov ecx, dword [eax]
push dword [eax + 0x10]
lea eax, [ebp - 0x1c]
movlpd qword [ebp - 0x1c], xmm0
push ecx
mov ecx, dword [edx + 0x20]
push eax
call fcn.004bbdb0
push dword [ebp - 0x70]
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x1c]
push dword [ebp - 0x7c]
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call dword [0x5f2510]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x80], 3
test edi, edi
je 0x4a3a20
or eax, 0xffffffff
lock xadd dword [edi + 4], eax
jne 0x4a3a20
mov eax, dword [edi]
mov esi, dword [eax]
mov ecx, esi
call dword [0x5f2510]
mov ecx, edi
call esi
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
jne 0x4a3a20
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5f2510]
mov ecx, edi
call esi
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x74]
mov dword [ebp - 0x70], eax
cmp esi, eax
je 0x4a3a84
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp - 0x6c]
add ecx, 0x1c
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x50]
push esi
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x78], eax
mov eax, dword [edi + 4]
push ecx
lea ecx, [ebp - 0x78]
push ecx
cmp eax, dword [edi + 8]
je 0x4a3a74
mov edx, eax
call fcn.004a53f0
add esp, 0x10
add dword [edi + 4], 0x40
jmp 0x4a3a7c
push eax
mov ecx, edi
call fcn.004a4d00
add esi, 0x18
cmp esi, dword [ebp - 0x70]
jne 0x4a3a34
lea ecx, [ebp - 0x28]
call fcn.00434510
lea ecx, [ebp - 0x68]
call fcn.00428f60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0059860b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x4a5a00
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da10e
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x689140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
xor ecx, ecx
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov dword [ebp - 0x14], eax
mov word [edi], cx
mov dword [ebp - 4], ecx
lea ecx, [eax + 2]
mov eax, 0x55555556
mov dword [ebp - 0x20], 1
imul ecx
xor ecx, ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
ja 0x4a5aa4
xor eax, eax
mov dword [edi + 0x10], ecx
mov word [edi + ecx*2], ax
jmp 0x4a5aae
push 0
push ecx
mov ecx, edi
call fcn.00428730
mov edx, dword [ebp - 0x18]
xor esi, esi
cmp dword [edx + 0x14], 7
jbe 0x4a5abb
mov edi, dword [edx]
mov ecx, dword [ebp - 0x14]
cmp ecx, 3
jl 0x4a5b65
mov eax, 0xaaaaaaab
mul ecx
mov ecx, edx
shr ecx, 1
mov dword [ebp - 0x1c], ecx
lea eax, [ecx*4]
sub eax, ecx
neg eax
add dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
mov eax, ecx
inc ecx
mov dword [ebp + 8], ecx
movzx edx, byte [eax]
mov eax, ecx
inc ecx
shl edx, 0x10
mov dword [ebp + 8], ecx
movzx eax, byte [eax]
shl eax, 8
or edx, eax
mov eax, ecx
inc ecx
mov dword [ebp + 8], ecx
movzx eax, byte [eax]
or edx, eax
mov eax, edx
shr eax, 0x12
movzx eax, word [eax*2 + 0x62a128]
mov word [edi + esi*2], ax
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, word [eax*2 + 0x62a128]
mov word [edi + esi*2 + 2], ax
mov eax, edx
shr eax, 6
and edx, 0x3f
and eax, 0x3f
movzx eax, word [eax*2 + 0x62a128]
mov word [edi + esi*2 + 4], ax
movzx eax, word [edx*2 + 0x62a128]
mov word [edi + esi*2 + 6], ax
add esi, 4
sub dword [ebp - 0x1c], 1
jne 0x4a5ae3
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
cmp ecx, 2
jne 0x4a5bc9
mov ecx, dword [ebp + 8]
mov eax, ecx
inc ecx
mov dword [ebp + 8], ecx
movzx edx, byte [eax]
movzx eax, byte [ecx]
shl edx, 8
or edx, eax
shl edx, 8
mov eax, edx
shr eax, 0x12
movzx eax, word [eax*2 + 0x62a128]
mov word [edi + esi*2], ax
mov eax, edx
shr eax, 0xc
and eax, 0x3f
shr edx, 6
and edx, 0x3f
movzx eax, word [eax*2 + 0x62a128]
mov word [edi + esi*2 + 2], ax
mov eax, 0x3d
mov cx, word [edx*2 + 0x62a128]
mov word [edi + esi*2 + 4], cx
mov word [edi + esi*2 + 6], ax
mov eax, dword [ebp - 0x18]
jmp 0x4a5c05
cmp ecx, 1
jne 0x4a5c03
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
shl ecx, 0x10
mov eax, ecx
shr ecx, 0xc
shr eax, 0x12
and ecx, 0x3f
movzx eax, word [eax*2 + 0x62a128]
mov word [edi + esi*2], ax
movzx eax, word [ecx*2 + 0x62a128]
mov word [edi + esi*2 + 2], ax
mov dword [edi + esi*2 + 4], 0x3d003d
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059860b
mov esp, ebp
pop ebp
ret
Function at 0x4acc20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0xc], ebx
mov edi, dword [ebx]
push edi
call fcn.004b3a80
mov edx, dword [ebp + 8]
and eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
mov esi, dword [ecx + eax*8 + 4]
cmp esi, dword [edx + 4]
jne 0x4acc50
xor esi, esi
jmp 0x4acc81
mov ebx, dword [ecx + eax*8]
lea eax, [esi + 8]
push eax
push edi
call fcn.004b36b0
test al, al
je 0x4acc7a
cmp esi, ebx
je 0x4acc78
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.004b36b0
test al, al
jne 0x4acc61
jmp 0x4acc7a
xor esi, esi
mov edx, dword [ebp + 8]
mov ebx, dword [esp + 0xc]
test esi, esi
je 0x4acd84
cmp esi, dword [edx + 4]
je 0x4acd84
cmp byte [esi + 0x50], 0
lea edi, [esi + 0x20]
mov eax, dword [ebx + 4]
jne 0x4acd2d
mov esi, dword [ebx + 8]
lea ecx, [esp + 0x18]
mov al, byte [eax]
push esi
mov byte [esp + 0x14], al
call fcn.004a05a0
mov al, byte [esi + 0x20]
lea esi, [edi + 8]
mov byte [esp + 0x38], al
mov al, byte [esp + 0x10]
mov byte [edi], al
lea eax, [esp + 0x18]
cmp byte [esi + 0x28], 0
push eax
je 0x4acd04
movsx ecx, byte [esp + 0x34]
lea edx, [esp + 0x10]
inc ecx
mov dword [esp + 0x10], esi
call fcn.004ac060
mov al, byte [esp + 0x3c]
lea ecx, [esp + 0x1c]
add esp, 4
mov byte [esi + 0x20], al
call int.004a29b0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.004a00b0
mov al, byte [esp + 0x38]
mov byte [esi + 0x20], al
mov byte [esi + 0x28], 1
lea ecx, [esp + 0x18]
call int.004a29b0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov cl, byte [eax]
cmp cl, byte [edi]
jbe 0x4acd41
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0xc]
cmp dword [eax], 2
jne 0x4acd8f
lea eax, [esp + 0x48]
mov byte [esp + 0x38], 0
push eax
mov ecx, edi
mov byte [esp + 0x4c], 0
mov byte [esp + 0x7c], 0
call fcn.004b13e0
cmp byte [esp + 0x78], 0
je 0x4acd74
lea ecx, [esp + 0x50]
call int.004a29b0
cmp byte [esp + 0x38], 0
je 0x4acd84
lea ecx, [esp + 0x10]
call int.004a29b0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebx + 8]
mov byte [esp + 0x10], cl
lea ecx, [esp + 0x18]
push esi
call fcn.004a05a0
mov al, byte [esi + 0x20]
lea esi, [edi + 8]
mov byte [esp + 0x38], al
mov al, byte [esp + 0x10]
mov byte [edi], al
lea eax, [esp + 0x18]
cmp byte [esi + 0x28], 0
push eax
je 0x4acd04
movsx ecx, byte [esp + 0x34]
lea edx, [esp + 0x10]
inc ecx
mov dword [esp + 0x10], esi
call fcn.004ac060
mov al, byte [esp + 0x3c]
add esp, 4
mov byte [esi + 0x20], al
jmp 0x4acd16
Function at 0x4b3a30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x811c9dc5
lea ebx, [esi + eax*2]
cmp esi, ebx
je 0x4b3a77
nop dword [eax + eax]
movzx edx, word [esi]
mov ecx, 0x19
lea eax, [edx - 0x61]
cmp cx, ax
sbb ecx, ecx
add esi, 2
and ecx, 0x20
add ecx, 0xffffffdf
and ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp esi, ebx
jne 0x4b3a50
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4b81d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dbed0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x689140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0xc]
add eax, 0x20
push eax
call fcn.005ca07f
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
add esp, 4
push eax
call fcn.004a2780
mov dword [ebp - 0x14], eax
mov esi, eax
cmp dword [eax + 0x14], 7
mov ebx, dword [eax + 0x10]
jbe 0x4b8228
mov esi, dword [eax]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x4b8247
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x4b8233
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
mov ecx, ebx
push edx
push eax
call fcn.004b8dd0
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00428f60
cmp esi, dword [ebx + 4]
jne 0x4b8269
mov esi, 3
jmp 0x4b82bf
mov al, byte [edi + 0x28]
add esi, 0x20
cmp byte [esi + 0x28], 0
je 0x4b82a8
push esi
test al, al
je 0x4b8295
movsx ecx, byte [esi + 0x18]
lea edx, [ebp - 0x10]
inc ecx
mov dword [ebp - 0x10], edi
call fcn.004963f0
mov al, byte [esi + 0x20]
add esp, 4
mov byte [edi + 0x20], al
jmp 0x4b82b7
mov ecx, edi
call fcn.004a05a0
mov al, byte [esi + 0x20]
mov byte [edi + 0x20], al
mov byte [edi + 0x28], 1
jmp 0x4b82b7
test al, al
je 0x4b82b7
mov ecx, edi
call int.004a29b0
mov byte [edi + 0x28], 0
mov eax, dword [esi + 0x30]
xor esi, esi
mov dword [edi + 0x30], eax
lea eax, [ebx + 0x20]
push eax
call fcn.005ca09b
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b82f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dbef0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x689140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
cmp dword [eax + 0x34], 0
je 0x4b83f3
lea ecx, [ebp - 0x38]
push ecx
mov ecx, eax
call fcn.004a2780
mov esi, eax
mov dword [ebp - 4], 0
mov edx, esi
cmp dword [esi + 0x14], 7
mov eax, dword [esi + 0x10]
jbe 0x4b834e
mov edx, dword [esi]
xor ecx, ecx
mov edi, 0x811c9dc5
add eax, eax
je 0x4b8374
mov ebx, eax
nop dword [eax + eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x4b8360
mov ebx, dword [ebp - 0x1c]
push edi
push esi
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.004b8870
mov esi, dword [eax + 4]
test esi, esi
je 0x4b83e9
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x4b83b0
cmp eax, esi
jne 0x4b83a8
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x4b83b8
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x4b83b8
cmp eax, esi
jne 0x4b83b8
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [ebx + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0x20]
cmp byte [ecx + 0x28], 0
je 0x4b83d6
call int.004a29b0
lea ecx, [esi + 8]
call fcn.00428f60
push 0x58
push esi
call fcn.0059886a
add esp, 8
lea ecx, [ebp - 0x38]
call fcn.00428f60
jmp 0x4b83fe
push eax
mov ecx, ebx
call fcn.004b8730
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059860b
mov esp, ebp
pop ebp
ret 4