joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bad40
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, dword [esp + 0x34]
mov esi, eax
mov eax, dword [esp + 0x38]
mov ecx, ebp
mov byte [eax], 0
mov eax, dword [ebp]
mov eax, dword [eax + 0x3c]
call eax
test al, al
jne 0x4bad77
pop esi
pop ebp
mov eax, 0x82020001
pop ebx
add esp, 0x24
ret 8
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 8]
sub esi, dword [edi + 0x38]
cmp esi, 0x1f4
jge 0x4bada3
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x24
ret 8
mov eax, dword [esp + 0x3c]
mov ecx, ebp
mov byte [eax], 1
mov eax, dword [ebp]
call dword [eax + 0x78]
push dword [edi + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x34], 0xffffffff
mov dword [esp + 0x10], 0xffffffff
mov edx, dword [edi + 0x2c]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
mov esi, dword [edi + 0x30]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov ecx, 0x570fe0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], esi
mov eax, dword [edi + 0x20]
test eax, eax
cmovne ecx, eax
mov dword [esp + 0x24], ecx
mov edx, dword [edi + 0x3c]
mov ecx, dword [ebx + 0x18]
shl edx, 0x1f
mov eax, edx
or eax, 0x40000000
test byte [edi + 0x3c], 2
cmove eax, edx
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0x40]
mov dword [esp + 0x2c], eax
test ecx, ecx
je 0x4bae2d
mov eax, dword [ecx]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x14]
push edx
call dword [eax]
jmp 0x4bae3f
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.004bae80
add esp, 8
mov esi, eax
test esi, esi
js 0x4bae63
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.004b6f00
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x38], eax
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0xc]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
Function at 0x4bafa0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c6d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.00414be0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4bb026
mov eax, dword [ebp + 8]
pop edi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x15555555
je 0x4bb176
lea eax, [edi + 4]
push esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
call fcn.00491411
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov dword [esi + 8], ecx
mov eax, dword [edi + 8]
fld dword [edi]
add eax, 1
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
mov dword [ebp - 4], 1
jns 0x4bb07f
fadd dword [0x573cf8]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov ebx, dword [edi + 0x1c]
fild dword [edi + 0x1c]
test ebx, ebx
jns 0x4bb095
fadd dword [0x573cf8]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fdivr st(1)
fcompi st(2)
jbe 0x4bb115
fdivrp st(1)
sub esp, 8
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fstp qword [esp]
call fcn.004a0720
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov ecx, 8
fnstcw word [ebp + 0xe]
movzx eax, word [ebp + 0xe]
add esp, 8
or eax, 0xc00
mov dword [ebp - 0x14], eax
fldcw word [ebp - 0x14]
fistp qword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
cmova ecx, eax
fldcw word [ebp + 0xe]
cmp ebx, ecx
jae 0x4bb0f7
cmp ebx, 0x200
jae 0x4bb0f5
shl ebx, 3
cmp ebx, ecx
jae 0x4bb0f7
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.004bb5a0
push dword [ebp - 0x10]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00414be0
mov edx, dword [eax]
jmp 0x4bb11c
mov edx, dword [ebp - 0x18]
fstp st(0)
fstp st(0)
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp - 0x10]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x20]
jne 0x4bb147
mov dword [ecx + eax*8], esi
jmp 0x4bb156
cmp edi, edx
jne 0x4bb150
mov dword [ecx + eax*8], esi
jmp 0x4bb15a
cmp dword [ecx + eax*8 + 4], ebx
jne 0x4bb15a
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], esi
pop esi
pop edi
mov byte [eax + 4], 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push 0x573cc0
call fcn.0048f815
int3
Function at 0x4bb4b0
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
call dword [eax]
mov edx, dword [esp + 0x18]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
movzx eax, byte [esp + 0x1a]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esp + 0x1b]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [esp + 0x18]
imul ebx, ecx, 0x1000193
lea ecx, [edi + 4]
push ebx
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00414be0
mov edx, dword [eax + 4]
test edx, edx
je 0x4bb558
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x10]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x4bb535
cmp eax, edx
jne 0x4bb52d
mov eax, dword [edi + 8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x4bb53d
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x4bb53d
cmp eax, edx
jne 0x4bb53d
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [edi + 0xc]
mov eax, dword [edx + 4]
push 0xc
push edx
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.00491173
add esp, 8
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
pop edi
pop esi
pop ebx
add esp, 8
ret 4

Function at 0x4bb8a8
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x1c], 0
push esi
mov esi, ecx
jbe 0x4bb935
mov eax, dword [esp + 0x1c]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
add eax, 8
push edi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push ebp
call fcn.004bbd70
mov eax, dword [ebp]
mov ebx, dword [esp + 0x10]
xor ebx, dword [esi]
mov edi, dword [esp + 0x14]
xor edi, dword [esi + 4]
mov edx, dword [esp + 0x18]
xor edx, dword [esi + 8]
mov ecx, dword [esp + 0x1c]
xor ecx, dword [esi + 0xc]
mov dword [esi], eax
mov eax, dword [ebp + 4]
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
add ebp, 0x10
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [eax - 8], ebx
mov dword [eax - 4], edi
mov dword [eax], edx
mov dword [eax + 4], ecx
add eax, 0x10
sub dword [esp + 0x2c], 1
mov dword [esp + 0x28], eax
jne 0x4bb8c3
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret 0xc
Function at 0x4bc240
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x20c
push ebp
mov ebp, ecx
mov dword [esp + 0xc], ebp
cmp dword [ebp + 0x2838], 0
jne 0x4bc485
push ebx
push esi
push edi
xor ebx, ebx
mov dl, 1
movzx eax, dl
mov cl, dl
sar cl, 7
and cl, 0x1b
mov byte [esp + ebx + 0x11c], dl
mov byte [esp + eax + 0x1c], bl
mov al, dl
add al, al
inc ebx
xor cl, al
xor dl, cl
cmp ebx, 0x100
jl 0x4bc261
mov cl, 1
lea edx, [ebp + 0x2810]
mov esi, 0xa
movzx eax, cl
lea edx, [edx + 4]
shl eax, 0x18
mov dword [edx - 4], eax
mov al, cl
sar al, 7
add cl, cl
and al, 0x1b
xor cl, al
sub esi, 1
jne 0x4bc295
mov dword [ebp + 0x159c], esi
lea edi, [ebp + 0x14]
mov dword [ebp + 0x10], 0x63
mov esi, 1
jmp 0x4bc2d0
movzx eax, byte [esp + esi + 0x1c]
lea ecx, [esp + 0x21b]
sub ecx, eax
lea edi, [edi + 4]
mov bl, byte [ecx]
mov cl, bl
mov al, bl
add al, al
shr cl, 7
or cl, al
xor bl, cl
mov al, cl
shr al, 7
add cl, cl
or al, cl
mov dl, al
xor dl, bl
mov bl, al
add al, al
shr bl, 7
or bl, al
mov al, bl
ror al, 7
movzx ecx, al
movzx eax, dl
xor ecx, eax
movzx eax, bl
xor ecx, eax
xor ecx, 0x63
mov dword [edi - 4], ecx
mov dword [ebp + ecx*4 + 0x1410], esi
inc esi
cmp esi, 0x100
jl 0x4bc2d0
lea ebx, [ebp + 0x410]
mov dword [esp + 0x10], 0xff
mov ebp, 0x100
mov dl, byte [ebx - 0x400]
mov cl, dl
movzx edi, dl
sar cl, 7
mov al, dl
and cl, 0x1b
add al, al
xor cl, al
movzx eax, dl
movzx esi, cl
shl esi, 8
xor esi, edi
movzx ecx, cl
xor ecx, eax
shl esi, 8
xor esi, edi
mov eax, esi
shl eax, 8
xor eax, ecx
bswap ecx
or ecx, esi
mov dword [ebx], eax
mov al, byte [ebx + 0x1000]
mov dword [ebx + 0x400], ecx
shr ecx, 8
bswap edi
or ecx, edi
mov dword [ebx + 0x800], ecx
shr ecx, 8
or ecx, edi
mov dword [ebx + 0xc00], ecx
test al, al
je 0x4bc422
movzx esi, al
xor edx, edx
mov eax, dword [esp + 0x29]
mov edi, 0xff
movzx eax, al
movzx ecx, byte [esp + esi + 0x1c]
add eax, ecx
div edi
mov eax, dword [esp + 0x25]
movzx eax, al
add eax, ecx
movzx edi, byte [esp + edx + 0x11c]
xor edx, edx
div dword [esp + 0x10]
movzx eax, byte [esp + edx + 0x11c]
xor edx, edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2a]
movzx eax, al
add eax, ecx
mov ecx, 0xff
div ecx
movzx eax, byte [esp + esi + 0x1c]
mov esi, 0xff
movzx ecx, byte [esp + edx + 0x11c]
mov edx, dword [esp + 0x27]
movzx edx, dl
add eax, edx
xor edx, edx
div esi
mov eax, dword [esp + 0x14]
movzx edx, byte [esp + edx + 0x11c]
jmp 0x4bc42a
xor edi, edi
xor eax, eax
xor ecx, ecx
xor edx, edx
shl ecx, 8
xor ecx, eax
shl ecx, 8
xor ecx, edi
shl ecx, 8
xor ecx, edx
mov edx, ecx
mov dword [ebx + 0x1400], ecx
shl edx, 0x18
shr ecx, 8
or edx, ecx
mov eax, edx
mov dword [ebx + 0x1800], edx
shl eax, 0x18
shr edx, 8
or eax, edx
mov dword [ebx + 0x1c00], eax
ror eax, 8
mov dword [ebx + 0x2000], eax
add ebx, 4
sub ebp, 1
jne 0x4bc341
mov ebp, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword [ebp + 0x2838], 1
pop ebp
add esp, 0x20c
ret
Function at 0x4bd9d0
Capabilities:
Get hostname
Get user security identifier

Disassembly:
sub esp, 0x50
push ebx
push esi
mov esi, dword [esp + 0x5c]
mov eax, dword [esi]
test eax, eax
je 0x4bd9e8
push eax
call fcn.0040bd60
add esp, 4
xor eax, eax
mov dword [esi], 0
mov dword [esp + 0x1c], eax
xor bl, bl
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0xc]
push eax
push 0x800
lea eax, [esp + 0x24]
mov dword [esi + 8], 0
push eax
push 0
mov dword [esi + 4], 0
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
jne 0x4bdb13
lea eax, [esp + 8]
mov dword [esp + 8], 0x10
push eax
lea eax, [esp + 0x38]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x4bdb0a
mov eax, dword [esp + 8]
lea ecx, [esp + 0x34]
lea edx, [ecx + 2]
mov dword [esp + eax*2 + 0x34], 0x5c
jmp 0x4bda70
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4bda70
sub ecx, edx
sar ecx, 1
cmp ecx, 0x7ffe
ja 0x4bda9f
lea eax, [esp + 0x34]
mov dword [esp + 0x18], eax
lea eax, [ecx + ecx]
mov word [esp + 0x14], ax
add eax, 2
mov word [esp + 0x16], ax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push dword [esp + 0x20]
call sub.ADVAPI32.dll_LsaLookupNames2
test eax, eax
jne 0x4bdb0a
mov ecx, dword [esp + 0x5c]
mov eax, dword [ecx]
cmp eax, 9
je 0x4bdacf
cmp eax, 3
jne 0x4bdaf8
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
test eax, eax
je 0x4bdaf8
push eax
mov eax, dword [esp + 0x60]
mov ecx, esi
push dword [eax + 4]
call fcn.0040e380
test al, al
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
push dword [esp + 0x10]
call sub.ADVAPI32.dll_LsaFreeMemory
push dword [esp + 0x5c]
call sub.ADVAPI32.dll_LsaFreeMemory
push dword [esp + 0xc]
call sub.ADVAPI32.dll_LsaClose
pop esi
mov al, bl
pop ebx
add esp, 0x50
ret

Function at 0x4bde20
Capabilities:
Hash data with md5

Disassembly:
push esi
push 0x40
mov esi, ecx
push 0
push esi
call fcn.00493640
add esp, 0xc
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x48], 0x67452301
mov dword [esi + 0x4c], 0xefcdab89
mov dword [esi + 0x50], 0x98badcfe
mov dword [esi + 0x54], 0x10325476
pop esi
ret

Function at 0x4bdf40
Capabilities:
Hash data with md5

Disassembly:
push esi
push 0x40
mov esi, ecx
push 0
push esi
call fcn.00493640
add esp, 0xc
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x48], 0x67452301
mov dword [esi + 0x4c], 0xefcdab89
mov dword [esi + 0x50], 0x98badcfe
mov dword [esi + 0x54], 0x10325476
pop esi
ret
Function at 0x507f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x34]
test eax, eax
push ebx
mov ebx, 0xb
cmovne ebx, eax
mov dword [esp + 0x18], ebx
push esi
cmp ebx, 5
jb 0x50818a
cmp ebx, 0xc
jbe 0x507fa0
pop esi
mov eax, 0xffffffd4
pop ebx
add esp, 0x2c
ret
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
bsr eax, eax
bsr ecx, esi
add eax, 2
inc ecx
cmp ecx, eax
cmovb eax, ecx
cmp ebx, eax
jb 0x50818a
push ebp
xor eax, eax
mov ebp, 0x3e
cmp dword [esp + 0x50], eax
push edi
sete al
sub ebp, ebx
push 0
push esi
push 0x40000000
lea eax, [eax*2 - 1]
mov dword [esp + 0x24], ebp
movzx eax, ax
push 0
mov dword [esp + 0x30], eax
call fcn.00491fd0
xor ecx, ecx
mov dword [esp + 0x28], edx
xor edx, edx
mov dword [esp + 0x2c], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0x14], 0
bts ecx, eax
mov ebp, 1
cmp eax, 0x20
cmovae edx, ecx
xor ecx, edx
cmp eax, 0x40
mov eax, dword [esp + 0x50]
cmovae edx, ecx
mov dword [esp + 0x34], ecx
mov ecx, ebx
mov dword [esp + 0x30], edx
mov edx, esi
shl ebp, cl
shr edx, cl
xor edi, edi
mov ecx, dword [esp + 0x48]
xor ebx, ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x38], edx
mov ecx, dword [ecx + ebx*4]
cmp ecx, esi
je 0x508180
test ecx, ecx
jne 0x508059
xor edx, edx
jmp 0x50810f
cmp ecx, edx
ja 0x50806a
mov ecx, dword [esp + 0x20]
dec ebp
movzx edx, cx
jmp 0x50810f
mov eax, dword [esp + 0x28]
mul ecx
mov esi, eax
mov eax, dword [esp + 0x2c]
mul ecx
mov ecx, dword [esp + 0x18]
add esi, edx
mov dword [esp + 0x10], eax
mov edx, esi
mov dword [esp + 0x44], esi
call fcn.00491dc0
movzx esi, ax
cmp si, 8
jge 0x5080e1
mov ecx, dword [esp + 0x18]
movsx edi, si
mov eax, edi
cdq
call fcn.00491da0
sub dword [esp + 0x10], eax
mov ecx, dword [edi*4 + 0x59b088]
sbb dword [esp + 0x44], edx
mov eax, dword [esp + 0x30]
mul ecx
mov edi, eax
mov eax, dword [esp + 0x34]
mul ecx
add edi, edx
cmp dword [esp + 0x44], edi
jb 0x5080d9
ja 0x5080d2
cmp dword [esp + 0x10], eax
jbe 0x5080d9
mov eax, 1
jmp 0x5080db
xor eax, eax
mov edi, dword [esp + 0x1c]
add esi, eax
movsx eax, si
sub ebp, eax
movzx ecx, si
cmp si, di
movzx edx, si
mov esi, dword [esp + 0x4c]
mov eax, ebx
cmovle eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
movzx eax, di
cmovle ecx, eax
mov eax, dword [esp + 0x50]
movzx edi, cx
mov dword [esp + 0x1c], edi
mov ecx, dword [esp + 0x40]
mov word [ecx + ebx*2], dx
inc ebx
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x48]
cmp ebx, eax
jbe 0x508043
mov ecx, dword [esp + 0x14]
mov eax, ebp
mov ebx, dword [esp + 0x40]
neg eax
movzx edi, word [ebx + ecx*2]
lea edx, [ebx + ecx*2]
movsx ecx, di
sar ecx, 1
cmp eax, ecx
jl 0x50816c
push dword [esp + 0x20]
push dword [esp + 0x54]
push esi
push dword [esp + 0x54]
mov esi, dword [esp + 0x34]
push esi
push ebx
call fcn.005081a0
add esp, 0x18
cmp eax, 0xffffff88
jbe 0x508176
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x2c
ret
mov esi, dword [esp + 0x24]
lea ecx, [edi + ebp]
mov word [edx], cx
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
add esp, 0x2c
ret
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x2c
ret
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x2c
ret
Function at 0x50a780
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
and ebp, 0x1f
push edi
mov edi, dword [esp + 0x1c]
cmp ebp, 8
jb 0x50a890
mov eax, ebp
shr eax, 3
cmp dword [esp + 0x24], 1
jne 0x50a81f
mov dword [esp + 0x20], eax
push 0xc2b2ae3d
push 0x27d4eb4f
push dword [edi + 4]
push dword [edi]
call fcn.00491a50
mov ecx, eax
add edi, 8
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.00491a50
mov ecx, eax
xor edx, esi
xor ecx, ebx
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.00491a50
mov ebx, eax
mov esi, edx
add ebx, 0xc2b2ae63
adc esi, 0x85ebca77
sub ebp, 8
sub dword [esp + 0x20], 1
jne 0x50a7b0
jmp 0x50a890
mov dword [esp + 0x20], eax
push 0xc2b2ae3d
push 0x27d4eb4f
push dword [edi + 4]
push dword [edi]
call fcn.00491a50
mov ecx, eax
add edi, 8
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.00491a50
mov ecx, eax
xor edx, esi
xor ecx, ebx
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.00491a50
mov ebx, eax
mov esi, edx
add ebx, 0xc2b2ae63
adc esi, 0x85ebca77
sub ebp, 8
sub dword [esp + 0x20], 1
jne 0x50a823
mov ecx, edi
cmp ebp, 4
jb 0x50a8e6
mov eax, 0x9e3779b1
add edi, 4
mul dword [ecx]
mov dword [esp + 0x20], edi
mov edi, eax
mov eax, 0x85ebca87
mul dword [ecx]
push 0xc2b2ae3d
add edi, edx
xor eax, ebx
xor edi, esi
mov ecx, eax
shld ecx, edi, 0x17
shld edi, eax, 0x17
push 0x27d4eb4f
push edi
push ecx
call fcn.00491a50
mov edi, dword [esp + 0x20]
mov ebx, eax
add ebx, 0x9e3779f9
mov esi, edx
adc esi, 0x165667b1
sub ebp, 4
test ebp, ebp
je 0x50a930
nop word [eax + eax]
movzx eax, byte [edi]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.00491a50
xor ebx, eax
lea edi, [edi + 1]
xor esi, edx
mov eax, ebx
push 0x9e3779b1
shld eax, esi, 0xb
push 0x85ebca87
shld esi, ebx, 0xb
push esi
push eax
call fcn.00491a50
mov ebx, eax
mov esi, edx
sub ebp, 1
jne 0x50a8f0
push 0xc2b2ae3d
xor ecx, ecx
mov edi, esi
push 0x27d4eb4f
xor ecx, esi
shr edi, 1
push ecx
xor edi, ebx
push edi
call fcn.00491a50
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.00491a50
xor esi, esi
mov ecx, edx
pop edi
xor edx, esi
xor eax, ecx
pop esi
pop ebp
pop ebx
ret
Function at 0x52a8b0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [ebp + 8]
mov ecx, eax
push esi
mov esi, dword [ebp + 0x10]
shr ecx, 0x10
movzx edx, ax
push edi
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], 0x15b0
mov dword [esp + 0x18], 0xfff1
jmp 0x52a8f4
mov edx, dword [esp + 0x10]
cmp edi, 0x10
jb 0x52aa70
xorps xmm7, xmm7
jmp 0x52a914
mov edx, dword [esp + 0x10]
movd xmm0, dword [esp + 0x14]
cmp edi, 0x15b0
mov eax, edi
movd xmm5, edx
cmova eax, dword [esp + 0x1c]
movaps xmm6, xmm7
and eax, 0xfffffff0
movaps xmmword [esp + 0x20], xmm0
sub edi, eax
movaps xmm4, xmm7
cmp eax, 0x20
jb 0x52a9af
mov edx, eax
shr edx, 5
movups xmm2, xmmword [esi]
sub eax, 0x20
movups xmm3, xmmword [esi + 0x10]
add esi, 0x20
movups xmmword [ecx], xmm2
movaps xmm1, xmm2
movaps xmm0, xmm3
pmaddubsw xmm2, xmmword [0x5a0200]
paddd xmm6, xmm5
movups xmmword [ecx + 0x10], xmm3
add ecx, 0x20
pmaddubsw xmm3, xmmword [0x5a01f0]
psadbw xmm1, xmm7
pmaddwd xmm2, xmmword [0x586e90]
psadbw xmm0, xmm7
pmaddwd xmm3, xmmword [0x586e90]
paddd xmm5, xmm1
paddd xmm5, xmm0
movaps xmm0, xmmword [esp + 0x20]
paddd xmm0, xmm2
movaps xmmword [esp + 0x20], xmm0
paddd xmm4, xmm3
sub edx, 1
jne 0x52a945
pslld xmm6, 5
paddd xmm4, xmm0
movaps xmm3, xmm7
paddd xmm4, xmm6
cmp eax, 0x10
jb 0x52aa0b
movaps xmm2, xmm5
shr eax, 4
nop word [eax + eax]
movups xmm1, xmmword [esi]
add esi, 0x10
paddd xmm3, xmm2
movaps xmm0, xmm1
psadbw xmm0, xmm7
movups xmmword [ecx], xmm1
add ecx, 0x10
paddd xmm5, xmm0
movaps xmm0, xmm1
pmaddubsw xmm0, xmmword [0x5a01f0]
movaps xmm2, xmm5
pmaddwd xmm0, xmmword [0x586e90]
paddd xmm4, xmm0
sub eax, 1
jne 0x52a9d0
movaps xmm0, xmm5
pslld xmm3, 4
psrldq xmm0, 8
xor edx, edx
paddd xmm0, xmm5
paddd xmm3, xmm4
movd eax, xmm0
movaps xmm1, xmm3
punpckhqdq xmm1, xmm3
paddd xmm1, xmm3
div dword [esp + 0x18]
pshufd xmm0, xmm1, 1
paddd xmm0, xmm1
mov dword [esp + 0x10], edx
movd eax, xmm0
xor edx, edx
div dword [esp + 0x18]
mov eax, edx
mov dword [esp + 0x14], eax
cmp edi, 0x10
jae 0x52a910
test edi, edi
jne 0x52a8f0
shl eax, 0x10
or eax, dword [esp + 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x52aa91
sub esi, ecx
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
movzx eax, al
add edx, eax
add dword [esp + 0x14], edx
sub edi, 1
jne 0x52aa76
mov dword [esp + 0x10], edx
mov esi, dword [esp + 0x10]
mov eax, 0x80078071
mul edx
mov eax, 0x80078071
shr edx, 0xf
imul ecx, edx, 0xfff1
mul dword [esp + 0x14]
sub esi, ecx
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, dword [esp + 0x14]
shl eax, 0x10
pop edi
or eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5316e0
Capabilities:
Create thread

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x10], 0
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 0x5317d0
push 0
push 0
call fcn.004a1ed1
add esp, 0x18
mov dword [esi], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0xc], 0
jne 0x531765
mov esi, dword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
push 0xffffffffffffffff
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
call esi
cmp dword [esp + 0xc], 0
je 0x531750
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
pop esi
add esp, 0x28
ret