joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100dfab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10188068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x2c]
push esi
mov edx, dword [ebp + 0x10]
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x14]
push edi
push dword [ebp + 0x24]
mov edi, dword [ebp + 0xc]
push ebx
push eax
push dword [ebp + 0x1c]
push ecx
push dword [ebp + 0x14]
push edx
push edi
push 0
push esi
call fcn.100dfc00
add esp, 0x2c
test eax, eax
jne 0x100dfbe4
mov ecx, dword [ebp + 0x24]
xor esi, esi
test ecx, ecx
je 0x100dfbe2
mov edx, dword [ebp + 0x20]
cmp ecx, 8
jb 0x100dfb91
mov esi, ecx
xorps xmm4, xmm4
and esi, 0xfffffff8
xorps xmm3, xmm3
nop
movd xmm2, dword [edx + eax]
xorps xmm0, xmm0
movd xmm1, dword [ebp + eax - 0x14]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [ebp + eax - 0x10]
por xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [edx + eax + 4]
add eax, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp eax, esi
jb 0x100dfb20
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd esi, xmm3
cmp eax, ecx
jae 0x100dfbb9
lea ecx, [ebp - 0x14]
sub edx, ecx
mov dword [ebp + 0x20], edx
nop dword [eax]
lea ecx, [ebp - 0x14]
add ecx, eax
inc eax
movzx edx, byte [edx + ecx]
movzx ecx, byte [ecx]
xor edx, ecx
or esi, edx
mov edx, dword [ebp + 0x20]
cmp eax, dword [ebp + 0x24]
jb 0x100dfba0
test esi, esi
je 0x100dfbe2
test edi, edi
je 0x100dfbcc
mov byte [ebx], 0
lea ebx, [ebx + 1]
sub edi, 1
jne 0x100dfbc1
pop edi
pop esi
mov eax, 0xffffffee
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029ae5
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029ae5
mov esp, ebp
pop ebp
ret
Function at 0x100dffd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10188068]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x20], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], esi
test edx, edx
je 0x100e0198
lea eax, [esi + 0x170]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
movups xmmword [esi + 0x160], xmm0
push edi
lea edi, [esi + 0x160]
movups xmmword [esi + 0x170], xmm0
mov dword [esi + 0x180], eax
mov dword [esi + 0x140], 0
mov dword [esi + 0x144], 0
mov dword [esi + 0x148], 0
mov dword [esi + 0x14c], 0
cmp edx, 0xc
jne 0x100e006e
movq xmm0, qword [ebx]
movq qword [edi], xmm0
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov byte [esi + 0x16f], 1
jmp 0x100e0123
lea ecx, [edx*8]
mov eax, ecx
shr eax, 0x18
movups xmmword [ebp - 0x14], xmm0
mov byte [ebp - 8], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 7], al
mov al, dl
shr ecx, 8
shl al, 3
mov byte [ebp - 6], cl
mov byte [ebp - 5], al
test edx, edx
je 0x100e00d9
nop dword [eax + eax]
mov esi, 0x10
cmp edx, esi
cmovb esi, edx
xor ecx, ecx
test esi, esi
je 0x100e00bb
mov al, byte [ecx + ebx]
xor byte [edi + ecx], al
inc ecx
cmp ecx, esi
jb 0x100e00b0
push edi
push edi
push dword [ebp - 0x18]
call fcn.100df8e0
mov edx, dword [ebp + 0x14]
add esp, 0xc
sub edx, esi
add ebx, esi
mov dword [ebp + 0x14], edx
test edx, edx
jne 0x100e00a0
mov esi, dword [ebp - 0x18]
xor ecx, ecx
nop dword [eax + eax]
movzx eax, byte [ebp + ecx - 0x14]
xor byte [esi + ecx + 0x160], al
movzx eax, byte [ebp + ecx - 0x13]
xor byte [esi + ecx + 0x161], al
movzx eax, byte [ebp + ecx - 0x12]
xor byte [esi + ecx + 0x162], al
movzx eax, byte [ebp + ecx - 0x11]
xor byte [esi + ecx + 0x163], al
add ecx, 4
cmp ecx, 0x10
jb 0x100e00e0
push edi
push edi
push esi
call fcn.100df8e0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [esi + 0x150]
push eax
push 0x10
push edi
push esi
call fcn.100e2520
add esp, 0x14
test eax, eax
jne 0x100e0187
mov ebx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], eax
test ebx, ebx
je 0x100e0185
mov edx, dword [ebp - 0x1c]
mov esi, 0x10
cmp ebx, esi
cmovb esi, ebx
xor eax, eax
test esi, esi
je 0x100e0172
mov cl, byte [eax + edi]
xor byte [edx + eax], cl
inc eax
cmp eax, esi
jb 0x100e0167
push edx
push edx
push dword [ebp - 0x18]
call fcn.100df8e0
add esp, 0xc
add edi, esi
sub ebx, esi
jne 0x100e0154
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029ae5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffffffec
pop esi
xor ecx, ebp
pop ebx
call fcn.10029ae5
mov esp, ebp
pop ebp
ret
Function at 0x100e0a10
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x10188068]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x8c]
push edi
mov edi, dword [ebp + 0x10]
push 0x80
push 0
push eax
call fcn.1002ae80
mov eax, dword [ebp + 0x14]
xorps xmm0, xmm0
add esp, 0xc
mov dword [ebp - 8], 0
movlpd qword [ebp - 0xdc], xmm0
movlpd qword [ebp - 0xd4], xmm0
test eax, eax
jne 0x100e0b0b
mov dword [ebp - 0xcc], 0xf3bcc908
mov dword [ebp - 0xc8], 0x6a09e667
mov dword [ebp - 0xc4], 0x84caa73b
mov dword [ebp - 0xc0], 0xbb67ae85
mov dword [ebp - 0xbc], 0xfe94f82b
mov dword [ebp - 0xb8], 0x3c6ef372
mov dword [ebp - 0xb4], 0x5f1d36f1
mov dword [ebp - 0xb0], 0xa54ff53a
mov dword [ebp - 0xac], 0xade682d1
mov dword [ebp - 0xa8], 0x510e527f
mov dword [ebp - 0xa4], 0x2b3e6c1f
mov dword [ebp - 0xa0], 0x9b05688c
mov dword [ebp - 0x9c], 0xfb41bd6b
mov dword [ebp - 0x98], 0x1f83d9ab
mov dword [ebp - 0x94], 0x137e2179
mov dword [ebp - 0x90], 0x5be0cd19
jmp 0x100e0bab
mov dword [ebp - 0xcc], 0xc1059ed8
mov dword [ebp - 0xc8], 0xcbbb9d5d
mov dword [ebp - 0xc4], 0x367cd507
mov dword [ebp - 0xc0], 0x629a292a
mov dword [ebp - 0xbc], 0x3070dd17
mov dword [ebp - 0xb8], 0x9159015a
mov dword [ebp - 0xb4], 0xf70e5939
mov dword [ebp - 0xb0], 0x152fecd8
mov dword [ebp - 0xac], 0xffc00b31
mov dword [ebp - 0xa8], 0x67332667
mov dword [ebp - 0xa4], 0x68581511
mov dword [ebp - 0xa0], 0x8eb44a87
mov dword [ebp - 0x9c], 0x64f98fa7
mov dword [ebp - 0x98], 0xdb0c2e0d
mov dword [ebp - 0x94], 0xbefa4fa4
mov dword [ebp - 0x90], 0x47b5481d
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xdc]
push esi
push eax
call fcn.100e2270
lea eax, [ebp - 0xdc]
push edi
push eax
call fcn.100e0c00
add esp, 0x14
lea ecx, [ebp - 0xdc]
mov eax, 0xd8
pop edi
pop esi
nop dword [eax + eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x100e0be0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029ae5
mov esp, ebp
pop ebp
ret
Function at 0x100e2110
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x28
cmp dword [ebp + 0xc], 0
push ebx
mov dword [eax], 0
mov dword [eax + 4], 0
push esi
mov dword [eax + 8], 0
push edi
mov dword [eax + 0xc], 0
jne 0x100e21a7
mov edx, 0x137e2179
mov dword [ebp - 0x1c], 0x2b3e6c1f
mov esi, 0x5be0cd19
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], esi
mov edi, 0xfb41bd6b
mov ebx, 0x1f83d9ab
mov dword [ebp - 0x20], 0x9b05688c
mov dword [ebp - 0x18], 0x510e527f
mov ecx, 0xade682d1
mov dword [ebp - 0x10], 0x5f1d36f1
mov esi, 0xfe94f82b
mov dword [ebp - 0x14], 0xa54ff53a
mov edx, 0xf3bcc908
mov dword [ebp - 0xc], 0x3c6ef372
mov dword [ebp - 4], 0x84caa73b
mov dword [ebp - 8], 0xbb67ae85
mov dword [ebp + 8], 0x6a09e667
jmp 0x100e220f
mov edx, 0xbefa4fa4
mov dword [ebp - 0x1c], 0x68581511
mov esi, 0x47b5481d
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], esi
mov edi, 0x64f98fa7
mov ebx, 0xdb0c2e0d
mov dword [ebp - 0x20], 0x8eb44a87
mov ecx, 0xffc00b31
mov dword [ebp - 0x18], 0x67332667
mov dword [ebp - 0x10], 0xf70e5939
mov esi, 0x3070dd17
mov dword [ebp - 0x14], 0x152fecd8
mov edx, 0xc1059ed8
mov dword [ebp - 0xc], 0x9159015a
mov dword [ebp - 4], 0x367cd507
mov dword [ebp - 8], 0x629a292a
mov dword [ebp + 8], 0xcbbb9d5d
mov dword [eax + 0x10], edx
mov edx, dword [ebp + 8]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 8]
mov dword [eax + 0x1c], edx
mov edx, dword [ebp - 0x24]
mov dword [eax + 0x20], esi
mov esi, dword [ebp - 0xc]
mov dword [eax + 0x24], esi
mov esi, dword [ebp - 0x10]
mov dword [eax + 0x28], esi
mov esi, dword [ebp - 0x14]
mov dword [eax + 0x2c], esi
mov esi, dword [ebp - 0x28]
mov dword [eax + 0x30], ecx
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x34], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x38], ecx
mov ecx, dword [ebp - 0x20]
mov dword [eax + 0x3c], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x40], edi
mov dword [eax + 0x44], ebx
mov dword [eax + 0x48], edx
pop edi
mov dword [eax + 0x4c], esi
pop esi
mov dword [eax + 0xd0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x488256
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 8
call fcn.0049abae
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0049abae
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], 0
push 0x10
call fcn.0049abae
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x20], esp
mov eax, 0x23
call fcn.0049abba
cmp dword [ebp - 0x20], esp
je 0x488313
push 6
call fcn.0049abb4
add esp, 4
mov dword [ebp - 4], eax
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x48832c
push ebx
call fcn.0049aba2
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0xc]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 0x24
call fcn.0049abba
cmp dword [ebp - 0x20], esp
je 0x48835b
push 6
call fcn.0049abb4
add esp, 4
mov dword [ebp - 0x20], esp
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x52054b
mov eax, 0x25
call fcn.0049abba
cmp dword [ebp - 0x20], esp
je 0x488385
push 6
call fcn.0049abb4
add esp, 4
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x14]
add ebx, 8
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 0xc
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 2
mov dword [ebp - 0x20], esp
mov eax, 0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
push 0x1c
push dword [ebp - 0x14]
push 0
push dword [ebp - 0xc]
mov eax, 0x26
call fcn.0049abba
cmp dword [ebp - 0x20], esp
je 0x488419
push 6
call fcn.0049abb4
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 0xc]
mov eax, 0x27
call fcn.0049abba
cmp dword [ebp - 0x20], esp
je 0x48843e
push 6
call fcn.0049abb4
add esp, 4
mov eax, dword [ebp - 0x18]
jmp 0x488446
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x488457
push ebx
call fcn.0049aba2
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.0049aba2
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.0049aba2
add esp, 4
mov ebx, dword [ebp - 0x1c]
push ebx
call fcn.0049aba2
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x48a1a6
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 8
call fcn.0049abae
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0049abae
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], 0
push 0x10
call fcn.0049abae
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x20], esp
mov eax, 0x2d
call fcn.0049abba
cmp dword [ebp - 0x20], esp
je 0x48a263
push 6
call fcn.0049abb4
add esp, 4
mov dword [ebp - 4], eax
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x48a27c
push ebx
call fcn.0049aba2
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0xc]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 0x2e
call fcn.0049abba
cmp dword [ebp - 0x20], esp
je 0x48a2ab
push 6
call fcn.0049abb4
add esp, 4
mov dword [ebp - 0x20], esp
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x52054b
mov eax, 0x2f
call fcn.0049abba
cmp dword [ebp - 0x20], esp
je 0x48a2d5
push 6
call fcn.0049abb4
add esp, 4
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x14]
add ebx, 8
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 0xc
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 2
mov dword [ebp - 0x20], esp
mov eax, 0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
push 0x1c
push dword [ebp - 0x14]
push 0
push dword [ebp - 0xc]
mov eax, 0x30
call fcn.0049abba
cmp dword [ebp - 0x20], esp
je 0x48a369
push 6
call fcn.0049abb4
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 0xc]
mov eax, 0x31
call fcn.0049abba
cmp dword [ebp - 0x20], esp
je 0x48a38e
push 6
call fcn.0049abb4
add esp, 4
mov eax, dword [ebp - 0x18]
jmp 0x48a396
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x48a3a7
push ebx
call fcn.0049aba2
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.0049aba2
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.0049aba2
add esp, 4
mov ebx, dword [ebp - 0x1c]
push ebx
call fcn.0049aba2
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4976d8
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x4976f9
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x4976f0
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x4976e8
mov eax, ebx
leave
ret

Function at 0x49771f
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x49777e
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x4977ab
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x49779a
xor ecx, eax
xor edx, ebx
dec edi
jne 0x49778b
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x4977d1
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x497772
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8

Function at 0x497e50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
jmp 0x497e58
sub esp, 0x28
push ecx
mov ecx, dword [ebp + 8]
cmp ecx, 0
jle 0x497e9d
mov eax, dword [ecx]
mov dword [ebp - 8], eax
cmp word [ebp - 8], 0x5a4d
jne 0x497e9d
lea eax, [ecx + 0x3c]
mov eax, dword [eax]
add ecx, eax
mov eax, dword [ecx]
cmp eax, 0x4550
jne 0x497e9d
lea eax, [ecx + 0x16]
mov eax, dword [eax]
cwde
and eax, 0x2000
test eax, eax
je 0x497e9d
lea eax, [ecx + 0x28]
mov eax, dword [eax]
add eax, dword [ebp + 8]
jmp 0x497ea1
xor eax, eax
jmp 0x497ecc
nop
push 0
push 0
push 0
call eax
call fcn.00497ed1
push 0x700ed6df
push eax
push 0
call fcn.00497f24
push 0
push 0x8000
push 0
push dword [ebp + 8]
push 0xffffffffffffffff
call eax
pop ecx
leave
ret 4
Function at 0x497ed1
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x497eff
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x497ef6
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x497eee
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x497f20
mov esp, ebp
pop ebp
ret

Function at 0x497f24
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x497f90
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x497fbd
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x497fac
xor ecx, eax
xor edx, ebx
dec edi
jne 0x497f9d
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x497fe3
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x497f84
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x49800f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x498025
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x498035
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jle 0x498143
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cwde
call fcn.00498153
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5a4d
jne 0x498143
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call fcn.00498153
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4550
jne 0x498143
pop eax
push eax
mov eax, dword [eax + 0x7c]
call fcn.00498153
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x498143
pop eax
mov eax, dword [eax + 0x78]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push eax
mov eax, dword [eax + 0x20]
add eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
pop eax
mov eax, dword [eax + 0x18]
dec eax
mov dword [ebp - 4], eax
push dword [ebp - 4]
lea eax, [ebp - 4]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x498140
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.00498166
test eax, eax
je 0x49812f
push ecx
mov eax, dword [ebp - 0x10]
lea eax, [eax + 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx*4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop ecx
leave
ret 8
push dword [ebp - 8]
call fcn.0049819a
add dword [ebp - 0xc], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x4980ea
add esp, 0xc
mov eax, 0
jmp 0x49814d
mov esp, ebp
pop ebp
ret 8