joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495de0
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x495dfe
mov eax, 0x1000000
pop esi
add esp, 0x50
ret
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x495e18
mov eax, 0x200
pop esi
add esp, 0x50
ret
mov eax, dword [esp + 0x20]
push ebp
mov edx, eax
xor ebp, ebp
and edx, 1
push edi
je 0x495e2c
mov ebp, 1
test al, 2
je 0x495e33
or ebp, 2
test al, 4
je 0x495e3a
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x495e44
or ebp, 0x10
test al, 0x20
je 0x495e4b
or ebp, 0x20
test ecx, ecx
je 0x495e57
or ebp, 0x40000000
jmp 0x495e5d
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x495e6d
or ebp, 0x800000
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x28
mov dword [esp + 0x14], eax
jbe 0x495f1b
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x6c]
push 2
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x24]
push 4
push ecx
push esi
call ebx
cmp word [esp + 0x64], 0x54ad
jne 0x495f1b
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
lea edx, [eax + 0x34]
cmp ecx, edx
jbe 0x495f1b
push 0
push 0
push eax
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x2c]
push 4
push ecx
push esi
call ebx
mov eax, dword [esp + 0x24]
cmp eax, 0x5a4d
je 0x495f15
cmp eax, 0x454e
je 0x495f15
cmp eax, 0x454c
je 0x495f15
cmp eax, 0x4550
jne 0x495f1b
or ebp, 0x400000
mov eax, dword [esp + 0x68]
pop ebx
test eax, eax
je 0x495f26
mov dword [eax], ebp
mov eax, dword [esp + 0x68]
test eax, eax
je 0x495f34
mov edx, dword [esp + 0x10]
mov dword [eax], edx
mov esi, dword [esp + 0x6c]
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test esi, esi
je 0x495f9e
lea eax, [esp + 0x20]
lea ecx, [esp + 0x34]
push eax
push ecx
call edi
lea edx, [esp + 0x18]
lea eax, [esp + 0x3c]
push edx
push eax
call edi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x2c]
push ecx
push edx
call edi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.00495d20
mov edx, dword [esp + 0x24]
mov dword [esi], eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.00495d20
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
mov dword [esi + 4], eax
call fcn.00495d20
add esp, 0x18
mov dword [esi + 8], eax
mov esi, dword [esp + 0x70]
test esi, esi
je 0x495fe1
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x3c]
push eax
push ecx
call edi
lea edx, [esp + 0x64]
lea eax, [esp + 0x60]
push edx
lea ecx, [esp + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
and edx, 0xffff
and eax, 0xffff
shl edx, 0x10
or edx, eax
mov dword [esi], edx
pop edi
pop ebp
xor eax, eax
pop esi
add esp, 0x50
ret
Function at 0x497a40
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x497ae3
test eax, eax
jbe 0x497ae3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x497ae3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x497a8e
xor esi, esi
jmp 0x497a94
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x497abf
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004999d0
add esi, eax
push esi
mov ebx, esi
call fcn.004999d0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x497aa0
pop ebp
test edi, edi
pop edi
jne 0x497ae3
test ebx, ebx
je 0x497ae3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004bd1b0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x497c05
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x497d1d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x497d1d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004cf3d4
mov esi, eax
test esi, esi
je 0x497d1d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x497d1d
mov ecx, esi
call fcn.00497b90
cmp edi, eax
jge 0x497d1d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x497ca3
mov dword [esp + 0x34], 1
jmp 0x497cfe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x497d1d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00497190
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x4a0740
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x4a078c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x4a078c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x4a0776
push eax
call ebp
test ax, ax
jl 0x4a0784
inc esi
add edi, 4
cmp esi, 6
jb 0x4a0768
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.004a0440
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4a4300
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x4a4360
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x4a4360
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x4a4360
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x4a4360
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x4a4370
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x4a7b40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x70b6bc]
xor edx, edx
cmp eax, edx
jne 0x4a7b66
xor eax, eax
mov byte [eax + 0x70b5bc], al
inc eax
cmp eax, 0x100
jl 0x4a7b4e
mov dword [0x70b6bc], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x70b5bc
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4a7bf7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4a7bca
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4a7b98
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4a7c00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4a7c53
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4a7c3a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ae5f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4dd62e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004aef10
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x696df4
call fcn.004cd6e8
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4ae683
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004cd6e8
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4ae67c
push 0
mov ecx, eax
call fcn.004a5770
mov dword [esi + 0xc], eax
jmp 0x4ae685
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4ae685
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4cfd78
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4cfdb0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004cde02
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004cddda
jmp 0x4cfdbc
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4d146a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4d14ac
call fcn.004d7366
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4d14ac
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4d14a3
xor eax, eax
jmp 0x4d14b4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004d14ba
pop edi
pop esi
pop ebx
ret 4

Function at 0x4d7896
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d78c4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d78e2
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d77fc
jmp 0x4d78e2
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d78e2
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d77fc
test edi, edi
mov eax, edi
jne 0x4d78cc
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, 0xf1a6
lea ecx, [0x4802ac]
lea esi, [0x480284]
add eax, 0x4ff0ff64
rol eax, 0x10
push 0x2b3
push esi
push 0x64c
push 0x6ef
call sub.user32.dll_GetClipboardSequenceNumber
pop edi
pop ecx
pop eax
pop ebx
push 0x40
push 0x3000
push 0x11c00
push 0
call sub.kernel32.dll_VirtualAlloc
call fcn.0047cbc4
ret

Function at 0x47cbc4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x47cbf1
call ebx
add esp, 0x368
ret
mov al, byte [esi]
nop
xor al, dl
mov byte [edi], al
inc esi
inc edi
nop
dec ecx
cmp ecx, 0
jne 0x47cbd8
jmp 0x47cbc9
sub esp, 0x368
mov esi, 0x47abc4
mov edi, 0x4800fc
mov dword [edi], eax
mov edi, eax
jmp 0x47cc0a
mov ebx, edi
nop
mov ecx, 0x368
mov edx, 0x29
jmp 0x47cbd8
Function at 0x401000
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
test byte [ebp - 4], 1
je 0x40102b
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x40102e
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x401016
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x5bea58], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x40100b
mov esp, ebp
pop ebp
ret

Function at 0x40370d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
push ecx
add byte [ebx], dh
rcl byte [ebp + 0x68], 0x50
nop
inc eax
add byte [ecx], al
push dword [eax]
mov dword fs:[eax], esp
dec eax
add byte [ebx + 0x4a7e40fb], al
lea eax, [ebp]
add ecx, ecx
mov edx, 0xe5000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
lodsd eax, dword [esi]
add byte [edx + 0x40], bh
call 0xff41375d
cmp ebx, 0x40
jle 0x403727
add dh, al
mov edx, dword [ebp - 4]
call 0x1403a55
call fcn.0040d1ed
mov dword [eax], eax
add al, 0
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x4037c0
add bl, bl
jle 0x4037b1
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0xbe406b49
add byte [ebp - 4], al
call fcn.004067ed
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call 0x3f381d
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
mov dh, 0
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
add eax, dword fs:[eax]
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
add byte [ecx], al
mov ebp, dword [edx]
add byte [eax], al
pop eax
cmpsb byte [esi], byte es:[edi]
add cl, ch
ja 0x4037ec
add byte [eax], al
jmp 0x4037be
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
add byte ds:[esi + 0x2d289], bh
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xf7
lea eax, [ebp - 4]
call fcn.00413841
mov eax, dword [ebp + 8]
mov ebx, dword [edx - 0x3aa7500]
call fcn.00403bc5
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
add eax, 0x2d200
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0xe7d3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
lea eax, [eax]
inc ebp
cld
call fcn.0040622d
add byte [ecx], al
loopne 0x40383d
in eax, dx
pop ds
add bh, ch
add dh, ch
pop ecx
pop ebp
ret
Function at 0x44b855
Capabilities:
Hash data with crc32

Disassembly:
mov al, byte [0x63a67845]
mov bl, cl
mov edx, 0x923764a2
aaa
xchg edx, eax
and al, byte [eax - 0x12]
pop esp
inc edx
invalid
hlt
mov edx, 0x26570bb9
push edx
test eax, 0x698561a2
int1
mov bl, 0xb0
add esp, ecx
inc ebx
push ds
cmpsb byte [esi], byte es:[edi]
sub byte [ebx - 0x77], dh
jnp 0x44b7d0
imul esi, dword [ebp + esi*8 - 0x69e79018], 0xe2737d2a
sub al, 0x81
out 0xa7, eax
xchg edi, eax
jbe 0x44b801
jecxz 0x44b8ab
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
test byte [ebp - 4], 1
je 0x44b880
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x44b883
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x44b86b
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x5bea58], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x44b860
mov esp, ebp
pop ebp
ret
in al, dx
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
add byte [ecx], al
daa
add byte [eax], al
add byte [ecx - 0xfff32], al
call dword [eax + 0x48]
or esi, 0xfffff000
push eax
dec eax
jne 0x44b8bb
add byte [ecx], al
cld
add esp, 0x57f7e0
push ebx
push esi
push edi
lea eax, [ebp + 0x10087dc]
xor ecx, ecx
mov edx, 0xbe8000
call fcn.0044d0b2
lea eax, [ebp - 0x1ff00]
xor ecx, ecx
mov edx, 0x10040
call fcn.0044d0b2
add byte [ecx], al
fadd qword [edi]
invalid
Function at 0x44e30d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
push ecx
add byte [ebx], dh
rcl byte [ebp + 0x68], 0x50
nop
inc eax
add byte [ecx], al
push dword [eax]
mov dword fs:[eax], esp
dec eax
add byte [ebx + 0x4a7e40fb], al
lea eax, [ebp]
add ecx, ecx
mov edx, 0xe5000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
lodsd eax, dword [esi]
add byte [edx + 0x40], bh
call 0xff45e35d
cmp ebx, 0x40
jle 0x44e327
add dh, al
mov edx, dword [ebp - 4]
call 0x144e655
call fcn.00457ded
mov dword [eax], eax
add al, 0
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x44e3c0
add bl, bl
jle 0x44e3b1
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0xbe451749
add byte [ebp - 4], al
call fcn.004513ed
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.0043e41d
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
mov dh, 0
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
add eax, dword fs:[eax]
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
add byte [ecx], al
mov ebp, dword [edx]
add byte [eax], al
pop eax
cmpsb byte [esi], byte es:[edi]
add cl, ch
ja 0x44e3ec
add byte [eax], al
jmp 0x44e3be
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
add byte ds:[esi + 0x2d289], bh
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xf7
lea eax, [ebp - 4]
call fcn.0045e441
mov eax, dword [ebp + 8]
mov ebx, dword [edx - 0x3aa7500]
call fcn.0044e7c5
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
add eax, 0x2d200
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0xe7d3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
lea eax, [eax]
inc ebp
cld
call fcn.00450e2d
add byte [ecx], al
loopne 0x44e43d
in eax, dx
pop ds
add bh, ch
add dh, ch
pop ecx
pop ebp
ret
Function at 0x498e0d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
push ecx
add byte [ebx], dh
rcl byte [ebp + 0x68], 0x50
nop
inc eax
add byte [ecx], al
push dword [eax]
mov dword fs:[eax], esp
dec eax
add byte [ebx + 0x4a7e40fb], al
lea eax, [ebp]
add ecx, ecx
mov edx, 0xe5000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
lodsd eax, dword [esi]
add byte [edx + 0x40], bh
call 0xff4a8e5d
cmp ebx, 0x40
jle 0x498e27
add dh, al
mov edx, dword [ebp - 4]
call 0x1499155
call fcn.004a28ed
mov dword [eax], eax
add al, 0
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x498ec0
add bl, bl
jle 0x498eb1
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0xbe49c249
add byte [ebp - 4], al
call fcn.0049beed
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.00488f1d
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
mov dh, 0
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
add eax, dword fs:[eax]
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
add byte [ecx], al
mov ebp, dword [edx]
add byte [eax], al
pop eax
cmpsb byte [esi], byte es:[edi]
add cl, ch
ja 0x498eec
add byte [eax], al
jmp 0x498ebe
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
add byte ds:[esi + 0x2d289], bh
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xf7
lea eax, [ebp - 4]
call int.004a8f41
mov eax, dword [ebp + 8]
mov ebx, dword [edx - 0x3aa7500]
call fcn.004992c5
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
add eax, 0x2d200
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0xe7d3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
lea eax, [eax]
inc ebp
cld
call fcn.0049b92d
add byte [ecx], al
loopne 0x498f3d
in eax, dx
pop ds
add bh, ch
add dh, ch
pop ecx
pop ebp
ret

Function at 0x4ab301
Capabilities:
Encode data using xor

Disassembly:
popal
lea eax, [ebx - 0x7e]
inc ebx
invalid
inc ebx
sub byte [ebx], 0xd5
sub edx, ebp
jg 0x4ab2ff
sal dword [edi], 1
cmpsd dword [esi], dword es:[edi]
add ah, byte [edx + 0x3018423a]
xchg ebx, eax
not edx
cmp byte [edi], 0x93
or edx, esi
dec esp
xor esi, edx
xor dword [esi + ebx*4 - 0x3a], edi
or eax, 0xd2c02a4d
xor byte [ecx + 0x38], 0x65
out dx, al
xor dword [0x4f341a7d], edx
loop 0x4ab303
sal dword [edi - 0x113e4e24], cl
fcomi st(6)
add ebp, esp
invalid
Function at 0x4e1370
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
test byte [ebp - 4], 1
je 0x4e139b
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x4e139e
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x4e1386
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x5bea58], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
add byte [ebp - 0x45], dh

Function at 0x4e3a6d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
push ecx
add byte [ebx], dh
rcl byte [ebp + 0x68], 0x50
nop
inc eax
add byte [ecx], al
push dword [eax]
mov dword fs:[eax], esp
dec eax
add byte [ebx + 0x4a7e40fb], al
lea eax, [ebp]
add ecx, ecx
mov edx, 0xe5000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
lodsd eax, dword [esi]
add byte [edx + 0x40], bh
call 0xff4f3abd
cmp ebx, 0x40
jle 0x4e3a87
add dh, al
mov edx, dword [ebp - 4]
call 0x14e3db5
call fcn.004ed54d
mov dword [eax], eax
add al, 0
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x4e3b20
add bl, bl
jle 0x4e3b11
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0xbe4e6ea9
add byte [ebp - 4], al
call fcn.004e6b4d
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.004d3b7d
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
mov dh, 0
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
add eax, dword fs:[eax]
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
add byte [ecx], al
mov ebp, dword [edx]
add byte [eax], al
pop eax
cmpsb byte [esi], byte es:[edi]
add cl, ch
ja 0x4e3b4c
add byte [eax], al
jmp 0x4e3b1e
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
add byte ds:[esi + 0x2d289], bh
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xf7
lea eax, [ebp - 4]
call fcn.004f3ba1
mov eax, dword [ebp + 8]
mov ebx, dword [edx - 0x3aa7500]
call fcn.004e3f25
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
add eax, 0x2d200
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0xe7d3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
lea eax, [eax]
inc ebp
cld
call fcn.004e658d
add byte [ecx], al
loopne 0x4e3b9d
in eax, dx
pop ds
add bh, ch
add dh, ch
pop ecx
pop ebp
ret