joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af0f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x655248]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x4af1fe
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x301
mov dword [esp + 0x54], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x60], xmm0
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.004a7890
mov eax, dword [0x5e49b0]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
lea ebx, [esp + 0x50]
mov dword [esp + 0x3c], ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], edi
xorps xmm0, xmm0
movups xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x5d9740]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.004f64f0
sub esp, 0x44
mov al, byte [esp + 0x50]
test al, al
je 0x4af1fe
xor esi, esi
jmp 0x4af1da
add esi, 1
movzx ecx, al
cmp esi, ecx
jae 0x4af1fe
cmp byte [esp + esi + 0x51], 8
jne 0x4af1d0
mov ecx, dword [esp + esi*8 + 0x60]
test ecx, ecx
je 0x4af1d0
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
movzx eax, byte [esp + 0x50]
jmp 0x4af1d0
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.005aae21
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4b5560
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b51c0
Function at 0x4b5900
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b5570
Function at 0x4f82e0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 0xc]
movzx edx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test dl, dl
mov dword [ebp - 0x10], ecx
lea ecx, [eax + ecx]
mov dword [ebp - 0x20], edx
lea edx, [esi + edx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
jb 0x4f834d
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x4f8320
cmp edx, 1
jne 0x4f8356
jmp 0x4f8372
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x4f8372
cmp edx, 2
je 0x4f8369
cmp edx, 3
jne 0x4f837d
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx + 4]
xor ecx, ecx
test edi, edi
je 0x4f84d8
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov ebx, eax
shr ebx, 0xf
xor ebx, eax
mov eax, edi
shr eax, 1
and eax, 0x55555555
mov edx, edi
sub edx, eax
mov eax, edx
and eax, 0x33333333
shr edx, 2
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
ja 0x4f83e4
lea edx, [edi - 1]
and edx, ebx
jmp 0x4f83f0
mov edx, ebx
cmp ebx, edi
jb 0x4f83f0
mov eax, ebx
xor edx, edx
div edi
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x24], edx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4f84d8
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
mov ebx, dword [eax]
test ebx, ebx
je 0x4f84d8
mov eax, dword [ebp - 0x18]
add eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x10]
cmovns eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x4f8446
and eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
jne 0x4f84d6
mov ebx, dword [ebx]
test ebx, ebx
je 0x4f84d6
mov eax, dword [ebx + 4]
cmp dword [ebp - 0x14], eax
jne 0x4f84a0
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x4f845b
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x4f843c
lea ecx, [ebx + 8]
mov edx, dword [ecx]
test al, al
cmovs ecx, edx
js 0x4f84b8
cmp dword [ebp - 0x10], 0
je 0x4f84d2
cmp byte [esi], dl
jne 0x4f843c
add eax, 0xffffffff
xor ecx, ecx
nop dword [eax + eax]
cmp eax, ecx
je 0x4f84d2
movzx edx, byte [ebx + ecx + 9]
lea edi, [ecx + 1]
cmp dl, byte [esi + ecx + 1]
mov ecx, edi
je 0x4f8480
jmp 0x4f843c
cmp dword [ebp - 0x28], 1
jbe 0x4f8430
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x4f8433
xor edx, edx
div ecx
mov eax, edx
jmp 0x4f8433
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4f84d2
push eax
push esi
push ecx
call fcn.005ad7fd
add esp, 0xc
test eax, eax
jne 0x4f843c
mov ecx, ebx
jmp 0x4f84d8
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4fad3c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ecx + 4]
mov esi, dword [ecx + 0x3c]
movzx edx, word [ecx + esi + 6]
test edx, edx
je 0x4fad85
mov eax, dword [ebp + 8]
add esi, ecx
movzx edi, word [esi + 0x14]
add edi, esi
add edi, 0x18
xor ebx, ebx
test edi, edi
je 0x4fad85
mov esi, dword [edi + 0xc]
test esi, esi
je 0x4fad74
add esi, ecx
cmp esi, eax
jbe 0x4fad76
jmp 0x4fad7d
xor esi, esi
add esi, dword [edi + 8]
cmp esi, eax
ja 0x4fad8e
inc ebx
add edi, 0x28
cmp ebx, edx
jb 0x4fad61
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, edi
jmp 0x4fad87

Function at 0x4fae3a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4faf1d
mov ebx, ecx
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx + 0x74], 0
je 0x4faf1d
cmp word [eax + edx + 0x14], 0x68
jb 0x4faf1d
mov esi, dword [ebx]
mov ecx, ebx
push dword [eax + edx + 0x78]
call dword [esi + 4]
test eax, eax
je 0x4faf1d
mov esi, eax
mov eax, dword [ebp + 8]
cmp eax, 0xffff
ja 0x4fae94
mov word [edi], ax
jmp 0x4faf4a
mov eax, dword [ebx]
mov ecx, ebx
push dword [esi + 0x20]
call dword [eax + 4]
mov edx, eax
mov eax, dword [esi + 0x18]
lea ecx, [eax*4]
test ecx, ecx
je 0x4faf1d
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], ebx
lea esi, [edx + eax*4]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], edx
mov ebx, edx
mov edi, esi
sub edi, ebx
mov eax, edi
sar eax, 2
shr edi, 0x1f
add edi, eax
and edi, 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
push dword [ebx + edi*2]
call dword [eax + 4]
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x4faef7
mov edx, dword [ebp - 0x1c]
cmp cl, byte [eax]
jne 0x4faef9
inc eax
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4faeeb
xor ecx, ecx
lea edi, [ebx + edi*2]
movzx ecx, cl
movzx eax, byte [eax]
mov edx, ecx
sub edx, eax
test edx, edx
lea edx, [edi + 4]
cmovg ebx, edx
cmovle esi, edi
cmp ecx, eax
je 0x4faf29
xor eax, eax
cmp ebx, esi
jne 0x4faec3
jmp 0x4faf1f
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
mov esi, dword [ebp - 0x18]
push dword [esi + 0x24]
call dword [eax + 4]
sub edi, dword [ebp - 0x14]
sar edi, 1
movzx eax, word [eax + edi]
add ax, word [esi + 0x10]
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
mov al, 1
jmp 0x4faf1f
Function at 0x5175cc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword fs:[0x18]
cmp eax, dword [ecx + 0x24]
sete al
pop ebp
ret

Function at 0x51e3bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov ebx, ecx
mov eax, dword [0x655248]
xor eax, ebp
mov dword [esp + 0x78], eax
xor eax, eax
dec eax
lea esi, [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
add ecx, 0x30
push esi
call fcn.0051e552
mov edi, dword [esi]
mov eax, dword [esi + 4]
mov dword [esp + 0xc], eax
cmp edi, eax
mov dword [esp + 0x10], ebx
je 0x51e4ab
lea esi, [esp + 0x20]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov ecx, esi
call fcn.00516878
mov ecx, dword [ebx + 0x40]
mov eax, dword [ecx]
push esi
push edi
call dword [eax + 0x10]
test eax, eax
je 0x51e449
mov ebx, 3
xor esi, esi
jmp 0x51e461
mov ecx, ebx
push esi
call fcn.0051e59e
mov eax, ebx
xor ebx, ebx
cmp byte [eax + 0x28], 0
setne al
mov esi, eax
sete bl
cmp byte [esp + 0x47], 0
jns 0x51e474
push dword [esp + 0x3c]
call fcn.005aade6
add esp, 4
lea ecx, [esp + 0x30]
call fcn.00487db0
mov eax, esi
test al, al
mov eax, 0
cmovne ebx, eax
cmp ebx, 3
je 0x51e496
test ebx, ebx
jne 0x51e529
add edi, 0x10
cmp dword [esp + 0xc], edi
mov ebx, dword [esp + 0x10]
lea esi, [esp + 0x20]
jne 0x51e409
cmp byte [ebx + 0xb], 0
je 0x51e529
xor eax, eax
lea edx, [esp + 0x20]
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x40]
mov eax, dword [ecx]
push edx
call dword [eax + 0x14]
test eax, eax
jne 0x51e520
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
cmp ebx, eax
je 0x51e520
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
cmp edi, esi
je 0x51e505
mov ecx, edi
push ebx
call fcn.004d0280
test al, al
jne 0x51e501
add edi, 0x10
cmp esi, edi
jne 0x51e4ec
jmp 0x51e505
cmp esi, edi
jne 0x51e517
mov esi, dword [esp + 0x10]
mov ecx, esi
push ebx
call fcn.0051e59e
cmp byte [esi + 0x28], 0
je 0x51e520
add ebx, 0x50
cmp ebx, dword [esp + 0xc]
jne 0x51e4e0
lea ecx, [esp + 0x20]
call fcn.0040322c
mov eax, dword [esp + 0x14]
test eax, eax
je 0x51e53e
mov dword [esp + 0x18], eax
push eax
call fcn.005aade6
add esp, 4
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.005aae21
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x52481e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 8]
pop ebp
jmp 0x52482f
mov eax, edx
test edx, edx
jle 0x52489b
push ebp
mov ebp, esp
push ebx
push edi
push esi
xor edx, edx
movdqa xmm0, xmmword [0x5dcb30]
movdqa xmm1, xmmword [0x5f3700]
xor esi, esi
mov edi, eax
mov ebx, dword [ecx + edx*4]
movd xmm2, ebx
shr ebx, 0x1f
add esi, ebx
pshufd xmm2, xmm2, 0
pxor xmm2, xmm0
pcmpgtd xmm2, xmm1
movdqa xmm3, xmm2
psrld xmm3, 0x1f
pshufd xmm3, xmm3, 0xee
psubd xmm3, xmm2
pshufd xmm2, xmm3, 0x55
paddd xmm2, xmm3
movd ebx, xmm2
add edi, ebx
inc edx
cmp eax, edx
jne 0x524851
lea ecx, [esi + esi*4]
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
jmp 0x52489d
xor ecx, ecx
add eax, ecx
ret

Function at 0x5298e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
mov dword [ecx], 0x5f3bb0
mov dword [ecx + 4], 0x5f3c00
mov dword [ecx + 8], 0x5f3c18
mov dword [ecx + 0x38], 0x5f3c28
cmp byte [ecx + 0xb8], 0
je 0x529916
lea ecx, [esi + 0xc0]
call fcn.0053d4e0
mov edi, dword [esi + 0xb0]
mov dword [esi + 0xb0], 0
test edi, edi
je 0x52993a
mov ecx, edi
call fcn.00513b40
push edi
call fcn.005aade6
add esp, 4
lea ecx, [esi + 0xa0]
call fcn.00513a70
lea ecx, [esi + 0x94]
call fcn.00413ad0
mov ecx, dword [esi + 0x90]
mov dword [esi + 0x90], 0
test ecx, ecx
je 0x52996a
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [esi + 0x88]
call fcn.0056c8b0
lea ecx, [esi + 0x80]
call fcn.0056c7a0
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x52999d
lock sub dword [eax + 4], 1
jne 0x52999d
add eax, 4
add eax, 0xfffffffc
push eax
call fcn.00497bc0
add esp, 4
lea ecx, [esi + 0x78]
call fcn.00413ad0
lea ecx, [esi + 0x54]
call fcn.0056bcf0
mov edi, dword [esi + 0x48]
mov dword [esi + 0x48], 0
test edi, edi
je 0x5299cb
mov ecx, edi
call fcn.004991f0
push edi
call fcn.005aade6
add esp, 4
mov edi, dword [esi + 0x3c]
add esi, 8
test edi, edi
je 0x5299eb
lock sub dword [edi], 1
jne 0x5299eb
mov ecx, edi
call fcn.00413ad0
push edi
call fcn.005aade6
add esp, 4
mov ecx, esi
pop esi
pop edi
pop ebp
jmp fcn.0048f7b0
Function at 0x52b840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ecx + 4]
jmp 0x52b856
mov esi, dword [esi + 0x8c]
test esi, esi
je 0x52b88b
xor edi, edi
xchg dword [esi], edi
test edi, edi
je 0x52b850
nop word cs:[eax + eax]
nop dword [eax]
bsf ecx, edi
mov ebx, 1
shl ebx, cl
mov eax, dword [esi + ecx*4 + 8]
push eax
call dword [eax + 4]
add esp, 4
xor edi, ebx
jne 0x52b870
jmp 0x52b850
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x52e050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x655248]
xor eax, ebp
mov dword [esp + 0x78], eax
test byte [0x654bd8], 9
je 0x52e0d1
mov esi, ecx
mov eax, dword [ecx + 8]
mov edi, dword [eax + 4]
call fcn.00481e40
cmp edi, eax
jne 0x52e0d1
lea edi, [esi + 0x10]
mov dword [esp], edi
call dword [0x64dcf4]
sub esp, 4
test al, al
je 0x52e0e4
mov eax, dword [esi + 0x28]
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x6c]
mov ecx, dword [ecx + 8]
mov dword [esp + 0x44], ecx
mov eax, dword [eax + 8]
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0x74]
mov dword [esp + 0x38], eax
mov ebx, dword [esi + 0x70]
mov dword [esp], edi
call dword [0x64dc44]
sub esp, 4
test byte [0x654bd8], 0x19
jne 0x52e0ed
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.005aae21
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, edi
call fcn.004a3cb0
jmp 0x52e097
mov eax, dword [esp + 0x38]
sub eax, ebx
mov ebx, dword [esp + 0x44]
add ebx, dword [esp + 0x40]
add ebx, dword [esp + 0x3c]
sar eax, 3
imul eax, eax, 0xba2e8ba3
add ebx, eax
mov edi, dword [esi]
call fcn.00481e40
mov esi, eax
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.004a7890
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x301
mov dword [esp + 0x54], 0x5dcf9b
mov eax, ebx
sar eax, 0x1f
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], ebx
lea eax, [esp + 0x50]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], esi
pxor xmm0, xmm0
movdqu xmmword [esp + 0xc], xmm0
mov dword [esp + 8], edi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 4], 0x654bd8
mov dword [esp], 0x43
call fcn.004ada40
mov al, byte [esp + 0x50]
test al, al
je 0x52e0d1
xor esi, esi
jmp 0x52e1bf
add esi, 1
movzx ecx, al
cmp esi, ecx
jae 0x52e0d1
cmp byte [esp + esi + 0x51], 8
jne 0x52e1b1
mov ecx, dword [esp + esi*8 + 0x60]
test ecx, ecx
je 0x52e1b1
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
movzx eax, byte [esp + 0x50]
jmp 0x52e1b1
Function at 0x5714b0
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, ecx
lea esi, [ecx + 0xc]
push esi
call dword [0x64dcf4]
test al, al
je 0x571663
mov dword [ebp - 0x14], esi
mov esi, dword [edi + 0x14]
test esi, esi
je 0x5715b5
imul eax, dword [ebp + 8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0x6f47a654
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov eax, esi
shr eax, 1
and eax, 0x55555555
mov edx, esi
sub edx, eax
mov eax, edx
and eax, 0x33333333
shr edx, 2
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x10], eax
cmp eax, 1
ja 0x57154b
lea ebx, [esi - 1]
and ebx, ecx
jmp 0x57155d
mov ebx, ecx
cmp ecx, esi
mov edx, esi
jb 0x57155f
mov eax, ecx
mov esi, edx
xor edx, edx
div esi
mov ebx, edx
mov edx, esi
mov eax, dword [edi + 0x10]
mov eax, dword [eax + ebx*4]
test eax, eax
mov edi, dword [ebp - 0x10]
je 0x5715b5
mov esi, dword [eax]
test esi, esi
je 0x5715b5
lea eax, [edx - 1]
mov dword [ebp - 0x18], eax
jmp 0x57158e
mov eax, dword [ebp + 8]
cmp dword [esi + 8], eax
je 0x5715c8
mov esi, dword [esi]
test esi, esi
je 0x5715b5
mov eax, dword [esi + 4]
cmp eax, ecx
je 0x571580
cmp edi, 1
ja 0x5715a0
and eax, dword [ebp - 0x18]
jmp 0x5715b1
cmp eax, edx
jb 0x5715b1
mov edi, edx
xor edx, edx
div edi
mov eax, edx
mov edx, edi
mov edi, dword [ebp - 0x10]
cmp eax, ebx
je 0x571588
push dword [ebp - 0x14]
call dword [0x64dc44]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 8
push dword [ebp - 0x14]
call dword [0x64dc44]
mov esi, dword [0x65a018]
cmp esi, 1
ja 0x571633
push 0x65a018
call fcn.0048afa0
add esp, 4
test al, al
je 0x57162d
mov dword [0x65a020], 0
mov dword [0x65a01c], 0
mov esi, 0x65a01c
mov ecx, 0x65a01c
push 0
call fcn.00498fd0
push 0x65a018
push 0
push 0x65a01c
push 0x65a018
call fcn.0048b060
add esp, 0x10
jmp 0x571633
mov esi, dword [0x65a018]
mov ecx, esi
call fcn.00498f60
mov edi, eax
mov ecx, esi
mov eax, dword [ebp + 0xc]
mov ebx, eax
push eax
call fcn.00498f90
mov eax, dword [ebx + 0x14]
push dword [ebp + 8]
push eax
call dword [eax + 4]
add esp, 8
mov ecx, esi
push edi
call fcn.00498f90
jmp 0x5715be
mov ecx, esi
call fcn.004a3cb0
jmp 0x5714cd

Function at 0x571fa0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x572019
mov ecx, dword [ebp + 0xc]
cmp ebx, 1
jne 0x571fbc
xor esi, esi
jmp 0x571ffe
and ebx, 0xfffffffe
xor esi, esi
nop word cs:[eax + eax]
nop dword [eax + eax]
movzx edi, al
movzx edx, byte [ecx + esi]
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x5f8aa4]
movzx edx, al
movzx edi, byte [ecx + esi + 1]
xor edi, edx
shr eax, 8
xor eax, dword [edi*4 + 0x5f8aa4]
add esi, 2
cmp ebx, esi
jne 0x571fd0
mov edx, dword [ebp + 0x10]
test dl, 1
je 0x572019
movzx edx, al
movzx ecx, byte [ecx + esi]
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x5f8aa4]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x594c2a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov ebx, ecx
mov eax, dword [0x655248]
xor eax, ebp
mov dword [esp + 0xf8], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.005955c6
mov ecx, ebx
push esi
push 0
push 0x40
push edx
push eax
call fcn.0059ebe2
test al, al
je 0x594cf0
movzx eax, word [esp + 0xb0]
cmp eax, 0x5a4d
jne 0x594d29
mov ecx, edi
call fcn.005955c6
mov edi, eax
mov eax, dword [esp + 0xec]
mov esi, eax
sar esi, 0x1f
add edi, eax
adc esi, edx
mov ecx, ebx
push dword [ebp + 8]
push 0
push 0x108
push esi
push edi
call fcn.0059ebe2
test al, al
je 0x594d5f
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x594d91
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x594deb
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x594deb
push 1
call fcn.0048b7d0
add esp, 4
test al, al
je 0x594de9
lea edi, [esp + 8]
mov ecx, edi
push 1
push 0x154
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0048b870
lea eax, [esp + 0x10]
push 0x1f
push str.could_not_read_dos_header_from
jmp 0x594dc1
push 1
call fcn.0048b7d0
add esp, 4
test al, al
je 0x594de9
lea edi, [esp + 8]
mov ecx, edi
push 1
push 0x15a
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0048b870
lea eax, [esp + 0x10]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x594dc1
push 1
call fcn.0048b7d0
add esp, 4
test al, al
je 0x594de9
lea edi, [esp + 8]
mov ecx, edi
push 1
push 0x162
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0048b870
lea eax, [esp + 0x10]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x594dc1
push 1
call fcn.0048b7d0
add esp, 4
test al, al
je 0x594de9
lea edi, [esp + 8]
mov ecx, edi
push 1
push 0x168
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0048b870
lea eax, [esp + 0x10]
push 0x23
push str.invalid_signature_in_nt_headers_of
push eax
call fcn.00401c4a
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
jns 0x594dd7
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
push ecx
push ebx
push eax
call fcn.00401c4a
add esp, 0xc
mov ecx, edi
call fcn.0048bc40
xor ebx, ebx
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.005aae21
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x594e06
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov ebx, ecx
mov eax, dword [0x655248]
xor eax, ebp
mov dword [esp + 0xf8], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.005955c6
mov ecx, ebx
push esi
push 0
push 0x40
push edx
push eax
call fcn.0059ebe2
test al, al
je 0x594ecc
movzx eax, word [esp + 0xb0]
cmp eax, 0x5a4d
jne 0x594f05
mov ecx, edi
call fcn.005955c6
mov edi, eax
mov eax, dword [esp + 0xec]
mov esi, eax
sar esi, 0x1f
add edi, eax
adc esi, edx
mov ecx, ebx
push dword [ebp + 8]
push 0
push 0xf8
push esi
push edi
call fcn.0059ebe2
test al, al
je 0x594f3b
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x594f6d
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x594fc7
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x594fc7
push 1
call fcn.0048b7d0
add esp, 4
test al, al
je 0x594fc5
lea edi, [esp + 8]
mov ecx, edi
push 1
push 0x154
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0048b870
lea eax, [esp + 0x10]
push 0x1f
push str.could_not_read_dos_header_from
jmp 0x594f9d
push 1
call fcn.0048b7d0
add esp, 4
test al, al
je 0x594fc5
lea edi, [esp + 8]
mov ecx, edi
push 1
push 0x15a
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0048b870
lea eax, [esp + 0x10]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x594f9d
push 1
call fcn.0048b7d0
add esp, 4
test al, al
je 0x594fc5
lea edi, [esp + 8]
mov ecx, edi
push 1
push 0x162
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0048b870
lea eax, [esp + 0x10]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x594f9d
push 1
call fcn.0048b7d0
add esp, 4
test al, al
je 0x594fc5
lea edi, [esp + 8]
mov ecx, edi
push 1
push 0x168
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0048b870
lea eax, [esp + 0x10]
push 0x23
push str.invalid_signature_in_nt_headers_of
push eax
call fcn.00401c4a
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
jns 0x594fb3
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
push ecx
push ebx
push eax
call fcn.00401c4a
add esp, 0xc
mov ecx, edi
call fcn.0048bc40
xor ebx, ebx
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.005aae21
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x5d1bb7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005d1bc2