joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor ecx, ecx
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x4725b1
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea eax, [edx + edx*4]
sub eax, ecx
mov al, byte [eax + ebx + 4]
xor byte [edi + ecx], al
inc ecx
cmp ecx, esi
jb 0x472595
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x477fe0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5569c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x67452301
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 0xefcdab89
push edi
mov edi, dword [ebp + 8]
sub eax, ecx
sar eax, 2
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], 0x98badcfe
mov dword [ebp - 8], 0x10325476
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
test eax, eax
je 0x478066
push esi
push eax
mov ecx, edi
call fcn.00477f40
mov esi, dword [edi]
lea ecx, [ebp - 0x14]
lea eax, [ebp - 4]
sub eax, ecx
push eax
mov dword [ebp - 0x18], eax
mov eax, ecx
push eax
push esi
call fcn.004b4120
mov eax, dword [ebp - 0x18]
add esp, 0xc
sar eax, 2
lea ecx, [esi + eax*4]
mov dword [edi + 4], ecx
pop esi
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.004b25dd
mov esp, ebp
pop ebp
ret 4

Function at 0x478330
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5569c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x67452301
lea eax, [ebp - 4]
mov dword [ebp - 0x14], 0xefcdab89
push edi
mov edi, dword [ebp + 8]
sub eax, ecx
sar eax, 2
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], 0x98badcfe
mov dword [ebp - 0xc], 0x10325476
mov dword [ebp - 8], 0xc3d2e1f0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
test eax, eax
je 0x4783bd
push esi
push eax
mov ecx, edi
call fcn.00477f40
mov esi, dword [edi]
lea ecx, [ebp - 0x18]
lea eax, [ebp - 4]
sub eax, ecx
push eax
mov dword [ebp - 0x1c], eax
mov eax, ecx
push eax
push esi
call fcn.004b4120
mov eax, dword [ebp - 0x1c]
add esp, 0xc
sar eax, 2
lea ecx, [esi + eax*4]
mov dword [edi + 4], ecx
pop esi
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.004b25dd
mov esp, ebp
pop ebp
ret 4
Function at 0x478510
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x5569c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x15c], ebx
lea eax, [edi + esi*4]
push eax
call fcn.004903a0
mov dword [ebp + esi*4 - 0x144], eax
add esp, 4
inc esi
cmp esi, 0x10
jb 0x478533
lea esi, [ebp - 0x13c]
mov edi, 0x10
mov eax, dword [esi + 0x2c]
xor eax, dword [esi + 0x18]
xor eax, dword [esi - 8]
xor eax, dword [esi]
push 1
push eax
call fcn.00477b20
add esp, 8
mov dword [esi + 0x38], eax
lea esi, [esi + 4]
sub edi, 1
jne 0x478557
lea esi, [ebp - 0x134]
mov edi, 0x30
mov eax, dword [esi + 0x58]
xor eax, dword [esi + 0x30]
xor eax, dword [esi - 0x10]
xor eax, dword [esi]
push 2
push eax
call fcn.00477b20
add esp, 8
mov dword [esi + 0x70], eax
lea esi, [esi + 4]
sub edi, 1
jne 0x478583
mov eax, dword [ebx + 0x28]
mov edx, dword [eax]
mov ecx, dword [eax + 0xc]
mov edi, dword [eax + 4]
mov ebx, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x158], eax
xor eax, eax
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x154], eax
jmp 0x4785dd
mov ecx, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x150]
cmp eax, 0x14
jae 0x4785fa
mov esi, edi
mov dword [ebp - 0x148], 0x5a827999
not esi
mov eax, ebx
and esi, ecx
and eax, edi
or esi, eax
jmp 0x478638
cmp eax, 0x28
jae 0x47860b
mov dword [ebp - 0x148], 0x6ed9eba1
jmp 0x478632
cmp eax, 0x3c
jae 0x478628
mov esi, ebx
mov dword [ebp - 0x148], 0x8f1bbcdc
or esi, edi
mov eax, ebx
and esi, ecx
and eax, edi
or esi, eax
jmp 0x478638
mov dword [ebp - 0x148], 0xca62c1d6
mov esi, ecx
xor esi, ebx
xor esi, edi
push 5
push edx
call fcn.00477b20
mov ecx, eax
mov eax, dword [ebp - 0x154]
push 0x1e
push edi
add ecx, dword [ebp + eax*4 - 0x144]
add ecx, dword [ebp - 0x148]
add ecx, esi
mov esi, dword [ebp - 0x14c]
add ecx, dword [ebp - 0x158]
mov dword [ebp - 0x158], esi
mov esi, ebx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x14c], esi
call fcn.00477b20
mov edi, dword [ebp - 0x150]
mov ebx, eax
mov eax, dword [ebp - 0x154]
add esp, 0x10
mov edx, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x154], eax
cmp eax, 0x50
jb 0x4785d1
mov ecx, dword [ebp - 0x15c]
mov ecx, dword [ecx + 0x28]
add dword [ecx], edx
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 0x158]
mov eax, dword [ecx + 0x28]
add dword [eax + 4], edi
mov eax, dword [ecx + 0x28]
pop edi
add dword [eax + 8], ebx
mov eax, dword [ecx + 0x28]
add dword [eax + 0xc], esi
mov eax, dword [ecx + 0x28]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
add dword [eax + 0x10], edx
pop ebx
call fcn.004b25dd
mov esp, ebp
pop ebp
ret 4
Function at 0x4787b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da857
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5569c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x47880d
lea ecx, [edi + 0x78]
mov dword [edi], 0x4f20cc
mov dword [edi + 0x10], 0x4f20d4
call fcn.00445860
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [edi]
lea esi, [edi + 0x18]
push 0
push esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00448bf0
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 4]
mov dword [edi + eax + 0x10], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0xc], eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
push 8
mov dword [ebp - 4], 5
mov dword [ebp + 8], esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x78]
mov dword [ecx + edi - 4], eax
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.004b259f
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x478917
push 1
mov byte [ebp - 4], 6
call fcn.004b0dba
add esp, 4
mov dword [ebx + 4], eax
jmp 0x478919
xor ebx, ebx
mov ecx, esi
mov dword [esi + 0x34], ebx
call fcn.00447890
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
mov byte [esi + 0x48], 0
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea edx, [esi + 0x14]
mov byte [esi + 0x3d], 0
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
lea ebx, [esi + 0x18]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], ebx
mov dword [ecx], 0
mov dword [ebx], 0
mov dword [eax], 0
mov dword [esi + 4], 0
mov dword [edx], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x4c], 0
mov eax, dword [0x55a7f4]
mov ecx, dword [0x55a7f8]
mov dword [esi + 0x40], eax
mov eax, edi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47b5d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4db396
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5569c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x58], 0
push 0x28
mov dword [ebp - 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004b259f
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov edi, 1
mov dword [ebp - 4], 0
mov dword [ebp - 0x58], edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, eax
mov dword [ebp - 0x60], edx
test edx, edx
je 0x47b7c6
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
nop dword [eax]
mov eax, 1
shl eax, cl
test edx, eax
je 0x47b797
lea eax, [ecx + 0x41]
mov byte [ebp - 0x20], al
lea ecx, [ebp - 0x24]
sub esp, 8
mov dword [ebp - 0x24], 0x60000000
mov eax, esp
mov dword [ebp - 4], 3
mov byte [ebp - 4], 0
push 3
mov dword [eax], 1
mov dword [eax + 4], ecx
lea eax, [ebp - 0x3c]
push 0x4f62dc
push eax
call fcn.0043cd50
or edi, 2
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 4
cmp dword [ebp - 0x28], 0xf
lea ecx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmova ecx, dword [ebp - 0x3c]
add esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, esp
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0xc0000000
push 3
mov dword [eax], 1
mov dword [eax + 4], ecx
lea eax, [ebp - 0x54]
push 0x4f62e0
push eax
mov byte [ebp - 4], 4
call fcn.0043cd50
add esp, 0x14
lea eax, [ebp - 0x54]
or edi, 4
cmp dword [ebp - 0x40], 0xf
mov dword [ebp - 0x58], edi
cmova eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [ebp - 0x40]
mov edi, eax
cmp ecx, 0xf
jbe 0x47b746
mov edx, dword [ebp - 0x54]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x47b73c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47b7c1
push ecx
push edx
call fcn.004b25cf
add esp, 8
cmp edi, 5
jne 0x47b75a
lea eax, [ebp - 0x3c]
mov ecx, esi
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0047a350
mov edx, dword [ebp - 0x28]
mov byte [ebp - 4], 0
cmp edx, 0xf
jbe 0x47b78e
mov eax, dword [ebp - 0x3c]
inc edx
mov ecx, eax
cmp edx, 0x1000
jb 0x47b784
mov eax, dword [ecx - 4]
add edx, 0x23
sub ecx, eax
add ecx, 0xfffffffc
cmp ecx, 0x1f
ja 0x47b7c1
push edx
push eax
call fcn.004b25cf
add esp, 8
mov edi, dword [ebp - 0x58]
mov edx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
inc ecx
mov dword [ebp - 0x5c], ecx
cmp ecx, 0x20
jb 0x47b660
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b25dd
mov esp, ebp
pop ebp
ret
call fcn.004b789f
lea eax, [ebp - 0x54]
push eax
call fcn.0047b240
push eax
push 0xb
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 1
push str.SYSTEM___
push eax
call fcn.0043c660
add esp, 0x14
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00446130
push 0x543bbc
lea eax, [ebp - 0x1c]
push eax
call fcn.004b3d03
int3
Function at 0x47d210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x10], 0
xorps xmm0, xmm0
mov edx, ecx
movlpd qword [ebp - 8], xmm0
jb 0x47d277
push ebx
mov ebx, dword [ebp + 0xc]
ja 0x47d239
test ebx, ebx
jne 0x47d239
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
mov esi, dword [ebp - 8]
push edi
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
movzx eax, byte [esi + eax]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f6330]
add esi, 1
mov dword [edx], ecx
adc edi, 0
cmp edi, dword [ebp + 0x10]
jb 0x47d241
ja 0x47d26c
cmp esi, ebx
jb 0x47d241
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, edx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4888c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x4888f1
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4888e0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x492880
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd5ad
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5569c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.004b259f
mov edi, eax
add esp, 4
test edi, edi
je 0x49292d
push 1
mov dword [ebp - 4], 0
call fcn.004b0dba
add esp, 4
mov dword [edi + 4], eax
jmp 0x49292f
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.00447890
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
not ecx
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
and ecx, 1
mov dword [ebp - 4], 1
shl ecx, 2
mov edx, ecx
or edx, 2
test bl, 2
cmovne edx, ecx
mov ecx, edx
or ecx, 8
test bl, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
test bl, 4
cmove eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], eax
cmp dword [ecx + 0x14], 0xf
mov ebx, dword [ecx + 0x10]
jbe 0x492988
mov ecx, dword [ecx]
mov dword [ebp + 8], ecx
cmp ebx, 0x7fffffff
ja 0x492a4e
test ebx, ebx
je 0x492a2e
and eax, 6
cmp al, 6
je 0x492a2b
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [esi + 0x40]
push eax
call fcn.00460620
push ebx
push dword [ebp + 8]
mov edi, eax
push edi
call fcn.004b4120
mov eax, dword [ebp + 0xc]
lea ecx, [ebx + edi]
mov dword [esi + 0x38], ecx
add esp, 0x14
mov ecx, eax
and ecx, 4
mov dword [ebp + 8], ecx
jne 0x4929eb
mov eax, dword [esi + 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov eax, dword [esi + 0x2c]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
test al, 2
jne 0x492a26
mov edx, dword [esi + 0x38]
test al, 0x18
mov eax, dword [esi + 0x10]
mov ecx, edi
cmovne ecx, edx
sub edx, ecx
cmp dword [ebp + 8], 0
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], edx
je 0x492a23
mov eax, dword [esi + 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
or eax, 1
jmp 0x492a35
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.004b0c29
int3
Function at 0x496be0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dddf8
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x5569c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0xac]
mov dword [ebp - 0xb4], edi
push eax
call fcn.00442e90
mov ecx, eax
mov ax, word [ecx]
mov word [ebp - 0xa8], ax
mov al, byte [ecx + 2]
mov byte [ebp - 0xa6], al
lea eax, [esi + 0xa]
push eax
call fcn.00490390
mov cl, byte [esi]
add esp, 0xc
movzx eax, ax
mov dword [ebp - 0xac], eax
mov al, cl
and al, 0xf
shr cl, 4
mov byte [ebp - 0xa1], al
lea eax, [ebp - 0xac]
push eax
lea eax, [esi + 9]
mov byte [ebp - 0xa2], cl
push eax
lea eax, [esi + 8]
push eax
lea eax, [esi + 7]
push eax
lea eax, [esi + 6]
push eax
lea eax, [esi + 5]
push eax
lea eax, [esi + 4]
push eax
lea eax, [esi + 3]
push eax
lea eax, [esi + 2]
push eax
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0xa1]
push eax
lea eax, [ebp - 0xa2]
push eax
lea eax, [ebp - 0xa6]
push eax
lea eax, [ebp - 0xa7]
push eax
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.00495460
sub esp, 8
lea ecx, [ebp - 0xa0]
mov eax, esp
push 0x6b
mov dword [eax], 0xf
mov dword [eax + 4], ecx
lea eax, [ebp - 0x28]
push str.MSF:_:02::02::02_Q_Data:_:X:X:02X:02X_:02X::02X::02X_:02X_:02X::02X::02X_:04X
push eax
call fcn.0043cd50
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmova eax, dword [ebp - 0x28]
push eax
push edi
mov dword [ebp - 4], 0
call fcn.00436d30
mov edi, eax
add esp, 0x20
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov eax, dword [eax + edi + 0x30]
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [ebp - 0xac], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 1
push eax
call fcn.00445580
mov ecx, eax
add esp, 4
mov eax, dword [ecx]
push 0xa
mov edx, dword [eax + 0x20]
call edx
mov byte [ebp - 0xac], al
mov byte [ebp - 4], 0
test esi, esi
je 0x496d60
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x496d60
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push dword [ebp - 0xac]
mov ecx, edi
call fcn.00465000
mov ecx, edi
call fcn.004416d0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x496da4
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x496d9a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x496dc5
push ecx
push edx
call fcn.004b25cf
add esp, 8
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b25dd
mov esp, ebp
pop ebp
ret
call fcn.004b789f
int3
Function at 0x4a5430
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
xorps xmm0, xmm0
push esi
mov esi, ecx
movlpd qword [ebp - 8], xmm0
push edi
mov edi, dword [ebp + 0xc]
add dword [esi + 0x18], edi
adc dword [esi + 0x1c], ebx
test ebx, ebx
jb 0x4a548f
ja 0x4a5459
test edi, edi
je 0x4a548f
mov ecx, dword [esi + 0x20]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
movzx eax, byte [edx + eax]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f2220]
add edx, 1
mov dword [esi + 0x20], ecx
adc ebx, 0
cmp ebx, dword [ebp + 0x10]
jb 0x4a5462
ja 0x4a548c
cmp edx, edi
jb 0x4a5462
mov ebx, dword [ebp + 0x10]
push ebx
push edi
push dword [ebp + 8]
lea ecx, [esi + 0x28]
call fcn.00477d50
push ebx
push edi
push dword [ebp + 8]
lea ecx, [esi + 0x160]
call fcn.00477d50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4aa0d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push esi
mov dword [eax], 0
lea esi, [eax + 0x60]
mov dword [eax + 0x34], 0
mov word [eax + 0x1e], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x468], 0xffffffff
mov dword [eax + 0x46c], 0xffffffff
mov dword [eax + 0x30], 0x20
mov byte [eax + 0x1d], 1
mov dword [eax + 0x48], 4
mov word [eax + 0x58], 2
nop dword [eax]
mov ecx, edx
lea esi, [esi + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [esi - 4], eax
cmp edx, 0x100
jb 0x4aa130
pop esi
pop ebp
ret
Function at 0x4ac510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
movzx esi, word [edx]
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov eax, esi
xor eax, 0x7f0
shr esi, 4
shr eax, 4
mov dword [ebp - 4], ebx
mov ecx, dword [edi + esi*4]
mov eax, dword [edi + eax*4]
mov dword [ebp + 0xc], eax
movzx eax, word [edx + 0x10]
mov esi, dword [ebp + 0xc]
shr eax, 4
mov dword [ebp - 0x14], ecx
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4ac59c
mov esi, edx
mov dword [ebp - 8], eax
add ebx, 4
push edi
push ebx
push ecx
push esi
call fcn.004b0070
push edi
lea eax, [ebx + 0x20]
push eax
push dword [ebp - 0x10]
lea eax, [esi + 0x10]
push eax
call fcn.004b0070
mov ecx, dword [ebp - 0x14]
add esp, 0x20
add ebx, 0x440
add esi, 0x20
sub dword [ebp - 8], 1
jne 0x4ac564
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebx]
cmp ebx, 0x10
jbe 0x4ac679
mov eax, dword [ebp - 4]
add ebx, 0xfffffff1
add eax, 0x44
shr ebx, 1
mov dword [ebp - 0x10], eax
movzx eax, word [edx + 0x10]
xor eax, 0x7f0
shr eax, 4
add esi, dword [edi + eax*4]
lea eax, [ebx + 0x180]
mov dword [ebp + 0xc], esi
lea eax, [edx + eax*2]
dec ebx
sub eax, 2
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], ebx
lea eax, [ebx + 0x80]
mov ebx, dword [ebp + 8]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x200]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
add esi, dword [edi + ecx*4]
cmp eax, 2
jae 0x4ac5e3
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
movzx ecx, word [eax]
mov eax, ecx
xor ecx, 0x7f0
shr eax, 4
shr ecx, 4
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [edx + ebx*8], eax
mov eax, dword [edi + ecx*4]
add eax, esi
mov esi, dword [ebp + 0xc]
mov dword [edx + ebx*8 + 4], eax
mov eax, dword [ebp - 8]
test ebx, ebx
jne 0x4ac5d0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
lea ebx, [eax*4 - 0x40]
mov eax, dword [ebp - 0xc]
cmp eax, 1
jbe 0x4ac679
lea esi, [ecx + 0x484]
lea edi, [eax - 1]
nop dword [eax]
push ebx
push edx
push esi
call fcn.004b4120
mov edx, dword [ebp - 0x10]
add esp, 0xc
add esi, 0x440
sub edi, 1
jne 0x4ac660
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8