joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4683e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ec1e1
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x68f500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x18]
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov al, byte [esi + 0x14]
mov byte [edi + 0x14], al
lea eax, [esi + 0x18]
push eax
call fcn.0040a5a0
lea eax, [esi + 0x30]
mov dword [ebp - 4], 0
lea ecx, [edi + 0x30]
push eax
call fcn.0040a5a0
lea eax, [esi + 0x48]
mov byte [ebp - 4], 1
lea ecx, [edi + 0x48]
push eax
call fcn.0040a5a0
lea eax, [esi + 0x60]
mov byte [ebp - 4], 2
lea ecx, [edi + 0x60]
push eax
call fcn.0040a5a0
lea eax, [esi + 0x78]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x78]
call fcn.0040a5a0
mov eax, dword [esi + 0x90]
mov dword [edi + 0x90], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x46bfe0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x46c041
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x46c024
cmp edi, 2
jb 0x46c024
cmp byte [esi], cl
jne 0x46c024
cmp byte [esi + 1], cl
jne 0x46c024
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x676e20]
jmp 0x46bff5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x676e20]
test edi, edi
jne 0x46bff5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x46c070
cmp cl, 0x23
jne 0x46c057
cmp byte [esi], cl
jne 0x46c057
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x676e20]
test cl, cl
jne 0x46c048
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x46c180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x46c193
mov dword [ebx], 0
mov edx, 0x676b34
call fcn.0046c080
mov esi, eax
test esi, esi
je 0x46c270
push esi
call fcn.005c0428
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x46c267
push 2
push 0
push esi
call fcn.005bf9d5
add esp, 0xc
test eax, eax
jne 0x46c267
push esi
call fcn.005c0428
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x46c267
push 0
push dword [ebp + 8]
push esi
call fcn.005bf9d5
add esp, 0xc
test eax, eax
jne 0x46c267
mov eax, dword [0x694270]
test eax, eax
je 0x46c206
inc dword [eax + 0xb0]
push edi
call fcn.005b20eb
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x46c267
push esi
push edi
push 1
push eax
call fcn.005bab58
add esp, 0x10
push esi
cmp eax, edi
je 0x46c251
call fcn.005b2743
mov eax, dword [0x694270]
add esp, 4
test eax, eax
je 0x46c23f
dec dword [eax + 0xb0]
push dword [ebp + 8]
call fcn.005b1e4a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.005b2743
add esp, 4
test ebx, ebx
je 0x46c25f
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.005b2743
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x46f600
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x68f500]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x18]
mov edi, 0x10
movss xmm1, dword [edx + 0x100]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x104]
subss xmm0, xmm1
mov ecx, dword [edx + 0xe4]
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xec]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 0xc], xmm0
not edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x676e20]
sub edi, 1
jne 0x46f680
mov ecx, dword [ebp - 8]
not edx
pop edi
xor ecx, ebp
mov eax, edx
pop esi
call fcn.005ab3d6
mov esp, ebp
pop ebp
ret 4

Function at 0x4716d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x694270]
mov ebx, edx
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
mov eax, dword [esi + 0x1ae8]
mov edx, dword [eax]
inc dword [esi + 0xa8]
mov ecx, dword [edi + 0x264]
mov dword [ebp - 4], edx
cmp dword [ecx + 0x7c], 1
jle 0x47170f
push ecx
add ecx, 0x78
call fcn.00486490
mov edx, dword [ebp - 4]
mov edi, dword [edi + 0x264]
mov esi, dword [edx + ebx*4 + 0x70]
mov eax, dword [edi]
test eax, eax
je 0x471782
cmp eax, 1
jne 0x471733
mov eax, dword [edi + 8]
cmp dword [eax + 0x1c], 0
jne 0x471733
cmp dword [eax + 0x20], 0
je 0x471782
mov eax, dword [esi]
mov ecx, dword [esi + 4]
cmp eax, ecx
jne 0x471769
lea edx, [eax + 1]
mov dword [ebp - 8], edx
test ecx, ecx
je 0x471754
mov eax, ecx
cdq
sub eax, edx
mov edx, dword [ebp - 8]
sar eax, 1
add eax, ecx
jmp 0x471759
mov eax, 8
cmp eax, edx
mov ecx, esi
cmovg edx, eax
push edx
call fcn.004816f0
mov edx, dword [ebp - 4]
mov ecx, dword [esi]
mov eax, dword [esi + 8]
mov dword [eax + ecx*4], edi
inc dword [esi]
inc dword [edx + 0x3c]
mov eax, dword [edi + 0x18]
add dword [edx + 0x44], eax
mov eax, dword [edi + 0xc]
add dword [edx + 0x40], eax
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + 0x188]
mov eax, dword [eax + 0x180]
lea edi, [esi + eax*4]
cmp esi, edi
je 0x4717c2
nop dword [eax + eax]
mov ecx, dword [esi]
cmp byte [ecx + 0xaa], 0
je 0x4717bb
cmp byte [ecx + 0xb1], 0
jne 0x4717bb
mov edx, ebx
call fcn.004716d0
add esi, 4
cmp esi, edi
jne 0x4717a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4729c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [0x694270]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], edx
mov ebx, dword [esi + 0x1160]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0xc]
and eax, 4
or eax, 0x1000103
or edi, eax
cmp dword [ebx + 0x190], 0
mov dword [ebp + 0x10], edi
jne 0x472a05
cmp dword [esi + 0x1d24], 0
mov eax, 0x228
je 0x472a0a
mov eax, 0x1f8
movss xmm4, dword [eax + ebx]
xorps xmm3, xmm3
movss xmm5, dword [eax + ebx + 4]
mov ecx, dword [ebp + 8]
subss xmm4, dword [ebx + 0xf0]
subss xmm5, dword [ebx + 0xf4]
movss xmm2, dword [0x67bc74]
cvttss2si eax, dword [ecx]
mov dword [ebp + 8], 0
mov dword [ebp - 4], 2
movd xmm1, eax
cvttss2si eax, dword [ecx + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm3
cvtdq2ps xmm0, xmm0
lahf
xor ecx, ecx
test ah, 0x44
mov eax, 1
cmovnp ecx, eax
ucomiss xmm0, xmm3
lahf
test ah, 0x44
mov eax, dword [ebp + 8]
cmovnp eax, dword [ebp - 4]
or eax, ecx
comiss xmm3, xmm1
mov dword [ebp + 8], eax
jb 0x472a8d
addss xmm1, xmm4
comiss xmm1, xmm2
jae 0x472a8d
movaps xmm1, xmm2
comiss xmm3, xmm0
jb 0x472a9e
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x472a9e
movaps xmm0, xmm2
or dword [esi + 0x1a10], 2
mov ecx, dword [ebp - 0xc]
movss dword [esi + 0x1a30], xmm1
movss dword [esi + 0x1a34], xmm0
mov dword [esi + 0x1a18], 1
mov eax, dword [ebx + 4]
push edx
test ecx, ecx
je 0x472ae1
push ecx
push eax
push str._s__s__08X
lea eax, [ebp - 4]
push 0
push eax
call fcn.0046bf30
add esp, 0x18
jmp 0x472af5
push eax
push str._s__08X
lea eax, [ebp - 4]
push 0
push eax
call fcn.0046bf30
add esp, 0x14
cmp byte [ebp + 0xc], 0
movss xmm0, dword [esi + 0xab8]
movss dword [ebp - 0xc], xmm0
jne 0x472b12
mov dword [esi + 0xab8], 0
mov ecx, dword [ebp - 4]
xor edx, edx
push edi
call fcn.00475260
mov edi, dword [esi + 0x1160]
add esp, 4
movss xmm0, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
movss dword [esi + 0xab8], xmm0
cmp word [edi + 0xb6], 1
mov byte [ebp + 0xf], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], edi
mov dword [edi + 0x74], edx
mov byte [edi + 0xc6], al
jne 0x472b64
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ebx + 0xf0], ecx
mov dword [ebx + 0xf4], eax
mov edi, edx
mov al, 0x23
not edi
mov edx, 0x676aa5
mov ebx, edi
cmp al, 0x23
jne 0x472b7f
cmp byte [edx], al
jne 0x472b7f
cmp byte [edx + 1], al
cmove ebx, edi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x676e20]
test al, al
jne 0x472b71
mov edi, dword [ebp - 0xc]
not ebx
cmp dword [esi + 0x11ac], ebx
jne 0x472baa
call fcn.0046f790
mov eax, dword [ebp - 8]
cmp dword [esi + 0x1af8], eax
jne 0x472bf8
test dword [ebp + 0x10], 0x800000
jne 0x472bf8
cmp word [edi + 0x14c], 0
jne 0x472bd1
cmp byte [edi + 0x152], 0
je 0x472bf8
xor edx, edx
mov ecx, edi
call fcn.00477c90
xor dl, dl
mov ecx, edi
call fcn.0047cc60
mov edx, edi
mov ecx, ebx
call fcn.0046f6b0
mov eax, dword [esi + 0x1b1c]
mov dword [esi + 0x11cc], eax
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x478630
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x68f500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x694270]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1160]
mov esi, 4
mov eax, dword [edi + 0xe4]
add edi, 0xe4
mov dword [ebp - 8], ecx
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x676e20]
sub esi, 1
jne 0x478670
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x4786b7
inc ecx
test esi, esi
je 0x4786a5
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x4786aa
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.004816f0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005ab3d6
mov esp, ebp
pop ebp
ret
Function at 0x4836f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x483726
mov eax, dword [0x694270]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x483716
dec dword [eax + 0xb0]
push ecx
call fcn.005b1e4a
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x48375a
mov eax, dword [0x694270]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x48374a
dec dword [eax + 0xb0]
push ecx
call fcn.005b1e4a
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x48378e
mov eax, dword [0x694270]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x48377e
dec dword [eax + 0xb0]
push ecx
call fcn.005b1e4a
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x4837de
mov eax, dword [0x694270]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x4837ce
dec dword [eax + 0xb0]
push ecx
call fcn.005b1e4a
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x483812
mov eax, dword [0x694270]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x483802
dec dword [eax + 0xb0]
push ecx
call fcn.005b1e4a
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x483846
mov eax, dword [0x694270]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x483836
dec dword [eax + 0xb0]
push ecx
call fcn.005b1e4a
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00486240
Function at 0x4abed0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1394
call fcn.005ac2c0
mov eax, dword [0x68f500]
xor eax, esp
mov dword [esp + 0x1390], eax
push ebx
push esi
mov ebx, ecx
push edi
mov edi, edx
mov dword [esp + 0xc], ebx
call fcn.00598c75
mov dword [esp + 0x1394], 0xffffffff
mov esi, 1
mov dword [esp + 0x14], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, esi
mov dword [esp + esi*4 + 0x14], eax
inc esi
cmp esi, 0x270
jb 0x4abf12
lea eax, [ebx - 0x80000000]
mov dword [esp + 0x10], 0x270
add ebx, 0x80000000
lea esi, [edi - 0x80000000]
cmp dword [esp + 0xc], 0x80000000
lea ecx, [esp + 0x10]
cmovae ebx, eax
cmp edi, 0x80000000
lea eax, [edi - 0x80000000]
cmovae esi, eax
sub esi, ebx
cmp esi, 0xffffffff
jne 0x4abf76
call fcn.004af3c0
mov ecx, eax
jmp 0x4abfb1
inc esi
call fcn.004af3c0
mul esi
mov dword [esp + 0xc], eax
mov ecx, edx
cmp eax, esi
jae 0x4abfb1
mov eax, esi
xor edx, edx
neg eax
div esi
mov edi, edx
cmp dword [esp + 0xc], edi
jae 0x4abfb1
nop dword [eax + eax]
lea ecx, [esp + 0x10]
call fcn.004af3c0
mul esi
mov ecx, edx
cmp eax, edi
jb 0x4abfa0
add ecx, ebx
cmp ecx, 0x80000000
pop edi
pop esi
lea edx, [ecx - 0x80000000]
lea eax, [ecx - 0x80000000]
mov ecx, dword [esp + 0x1394]
cmovae eax, edx
pop ebx
xor ecx, esp
call fcn.005ab3d6
mov esp, ebp
pop ebp
ret

Function at 0x4ac6e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4ac772
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x4ac6fd
mov eax, dword [esi]
push edi
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 4], eax
lea ecx, [eax + eax]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4ac76b
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi + 0x14], 0xf
jbe 0x4ac736
mov esi, dword [esi]
push dword [ebp - 4]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x4ac76b
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4af3c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x4af41d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x4af3e0
mov eax, dword [esi]
jmp 0x4af4fb
cmp eax, 0x4e0
jb 0x4af4fb
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x4af436
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x4af481
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b1a10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5edb55
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x68f500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 4
push eax
lea eax, [ebp - 0x54]
mov ecx, 0x692c20
push eax
call fcn.00411d60
mov esi, dword [ebp - 0x4c]
cmp byte [esi + 0xd], 0
jne 0x4b1ad3
cmp dword [esi + 0x10], 4
jg 0x4b1ad3
add esi, 0x14
mov edi, esi
cmp dword [esi + 0x14], 0xf
jbe 0x4b1a72
mov edi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [esi + 0x10], ecx
jbe 0x4b1a92
nop
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [esi + 0x10]
jb 0x4b1a80
push edx
push esi
lea eax, [ebp - 0x48]
mov ecx, ebx
push eax
call fcn.004b15d0
mov eax, dword [eax + 4]
test eax, eax
je 0x4b1acf
cmp eax, dword [ebx + 4]
je 0x4b1acf
cmp dword [ebx + 8], 1
jne 0x4b1add
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ab3d6
mov esp, ebp
pop ebp
ret
xor al, al
jmp 0x4b1ab3
push str.invalid_map_K__T__key
call fcn.00596d05
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.004b1b30
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push str.AcceptEncoding_does_not_accept_any_other_values_if_disabled_is_present._You_set_the_following_encodings:
push eax
call fcn.004565b0
add esp, 0xc
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 1
call fcn.004b19c0
push 0x689bd0
lea eax, [ebp - 0x54]
push eax
call fcn.005ad48b
int3
Function at 0x4ba4b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x78]
test eax, eax
je 0x4ba4d5
push dword [edi + 0x74]
call eax
add esp, 4
push ebx
push esi
mov esi, dword [edi + 0x54]
test esi, esi
je 0x4ba53b
nop
mov ebx, dword [esi + 4]
xor edx, edx
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x4ba534
mov ecx, dword [eax + 8]
cmp eax, esi
je 0x4ba507
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x4ba4f6
jmp 0x4ba534
test edx, edx
jne 0x4ba510
mov dword [ebx + 0x54], ecx
jmp 0x4ba513
mov dword [edx + 8], ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4ba520
push esi
call eax
add esp, 4
push esi
call fcn.004ba9d0
mov eax, dword [esp + 0x20]
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 0xc
mov esi, dword [edi + 0x54]
test esi, esi
jne 0x4ba4e0
lea eax, [edi + 0x6c]
test eax, eax
je 0x4ba5be
test ebp, ebp
je 0x4ba5be
mov ebx, dword [eax]
test ebx, ebx
je 0x4ba5b1
nop dword [eax]
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x4ba567
push esi
call eax
add esp, 4
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x4ba57b
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x4ba58c
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [esi + 0x28], 0
mov eax, dword [ebp + 8]
push esi
push ebp
call eax
mov eax, dword [ebp + 8]
push ebx
push ebp
call eax
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x4ba550
lea eax, [edi + 0x6c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0x30]
mov dword [edi + 0x58], 0
test eax, eax
je 0x4ba5d2
push edi
call eax
add esp, 4
push ebp
push edi
call fcn.004ba430
mov eax, dword [esp + 0x18]
add esp, 8
mov eax, dword [eax + 0x34]
test eax, eax
je 0x4ba5ed
push edi
call eax
add esp, 4
mov esi, dword [edi + 0x68]
mov eax, dword [edi + 8]
mov dword [esp + 0x20], eax
test esi, esi
je 0x4ba61f
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
test eax, eax
je 0x4ba60b
push esi
call eax
add esp, 4
test dword [esp + 0x20], 0x400
jne 0x4ba61f
mov eax, dword [ebx + 8]
push esi
push ebx
call eax
add esp, 8
mov eax, dword [edi + 0x80]
mov dword [edi + 0x68], 0
pop esi
pop ebx
test eax, eax
je 0x4ba646
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [edi + 0x80], 0
mov eax, dword [ebp + 8]
push edi
push ebp
call eax
add esp, 8
pop edi
pop ebp
pop ecx
ret
Function at 0x502b00
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esi + 0x58]
mov dword [eax], 0
cmp byte [esi + 0x35c], 0
mov dword [esp + 0x10], edi
jne 0x502b37
push dword [esi + 0x68]
push esi
call fcn.00509df0
add esp, 8
test eax, eax
jne 0x502cf0
mov edx, dword [esi + 0x348]
push ebx
mov ebx, dword [esi + 0x358]
add edx, 8
mov esi, 6
mov dword [esp + 0xc], esi
push ebp
lea ebp, [edx + ebx*4]
test edi, edi
je 0x502bbf
mov eax, dword [esp + 0x24]
test eax, eax
je 0x502bbf
mov ecx, eax
lea eax, [ecx + 1]
mov dword [esp + 0x14], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x502b70
sub ecx, dword [esp + 0x14]
mov dword [esp + 0x14], ecx
je 0x502bbf
test ebx, ebx
je 0x502bbf
movzx esi, byte [edx + 2]
lea edi, [edx + 4]
movzx eax, byte [edi - 1]
movzx ecx, byte [edx]
shl esi, 8
or esi, eax
shl ecx, 8
movzx eax, byte [edx + 1]
mov edx, dword [esp + 0x18]
or ecx, eax
movzx eax, word [edx + 0xe]
cmp ecx, eax
je 0x502bc9
lea eax, [esi + esi*4]
mov edx, edi
lea ebp, [ebp + eax*2]
sub ebx, 1
jne 0x502b85
mov esi, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret
test esi, esi
je 0x502bbb
lea edi, [ebp + 1]
movzx ebx, byte [edi + 4]
test bl, 0x10
je case.default.0x502c52
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
movzx ebp, byte [edi + 5]
mov edx, dword [esp + 0x20]
shl ecx, 8
or ecx, eax
shl ebp, 8
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 6]
or ebp, eax
movzx eax, byte [edi + 7]
shl ebp, 8
or ebp, eax
movzx eax, byte [edi + 8]
shl ebp, 8
or ebp, eax
mov eax, dword [edx + 0x354]
cmp ecx, eax
jae case.default.0x502c52
sub eax, ecx
cmp dword [esp + 0x14], eax
jae case.default.0x502c52
push eax
mov eax, dword [edx + 0x350]
add eax, ecx
push eax
push dword [esp + 0x2c]
call fcn.005c0af0
add esp, 0xc
test eax, eax
jne case.default.0x502c52
and ebx, 0xf
cmp ebx, 3
ja case.default.0x502c52
jmp dword [ebx*4 + 0x502cf8]
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x354]
cmp ebp, eax
jae case.default.0x502c52
push eax
mov eax, dword [edx + 0x350]
add eax, ebp
push 0
push eax
call fcn.005ad500
add esp, 0xc
test eax, eax
jne 0x502c99
add edi, 0xa
sub esi, 1
jne 0x502bd0
mov esi, dword [esp + 0x10]
mov eax, esi
pop ebp
pop ebx
pop edi
pop esi
add esp, 0xc
ret
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov dword [ecx], 1
mov eax, dword [esi + 0x350]
add eax, ebp
xor esi, esi
pop ebp
pop ebx
mov dword [ecx + 4], eax
mov eax, esi
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 0x28]
xor esi, esi
mov dword [eax + 4], ebp
pop ebp
pop ebx
mov dword [eax], 2
mov eax, esi
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 0x28]
xor esi, esi
mov dword [eax + 4], ebp
pop ebp
pop ebx
mov dword [eax], 3
mov eax, esi
pop edi
pop esi
add esp, 0xc
ret
mov esi, eax
pop edi
pop esi
add esp, 0xc
ret