joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017ea
Capabilities:
Encode data using xor

Disassembly:
mov esi, edx
test dh, ch
imul ecx, ecx, 0x1c902530
push 0x2f959b
test ecx, 0x5ab65141
mov edi, ebx
adc eax, esi
mov ch, ch
inc esi
test ebp, ebx
xchg dl, al
sbb al, cl
and edx, 0
mov ebp, 0x1d43b770
mov edi, 0xea7b68fb
add ch, 0xee
imul ecx, eax
dec cl
mov eax, ebx
imul ecx, ebx
mov ah, 0x89
lea eax, [0xa3bbf777]
mov ecx, edi
test cl, dh
lea esi, [0xafe14]
inc ebp
xor esi, 0x6a8
mov edi, edi
or eax, 0x21485dad
dec ecx
push esi
test eax, edi
dec edi
pop ebx
xchg ch, al
sub al, 0xbf
sub ebx, 0xaf909
inc al
xadd edx, ebx
sub ch, bl
test eax, eax
add edx, 0x4e
test esi, 0x6669d8fa
imul ebp, ebx
test cl, 0xd6
mov ebx, ecx
lea edi, [0xdb23ec9c]
cmp edx, 0x70f
jl 0x40180f
inc eax
inc esi
test cl, 0xce
imul edi, ebp
call 0x401895
pop esi
test edx, 0xfafe1917
test ebx, 0xe6411406
mov eax, edi
mov ebx, edi
add eax, 0x396c1b89
test edx, 0x95483736
mov bh, al
lea edi, [0x4a49]
js 0x4018c6
add al, 0xb
imul ebp, esi, 0x781f5bc6
inc edx
sub edi, 0x223e
mov eax, 0x5a395847
imul ebx, ebx
add esi, edi
mov dh, 0x1c
adc ebx, ebp
inc ebp
jmp esi
Function at 0x428e60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c000]
push edi
jmp 0x428e7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x428e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x428e70
mov eax, 1
add ebx, ebx
jne 0x428e93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x428e88
jne 0x428ea4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428e88
xor ecx, ecx
sub eax, 3
jb 0x428eb8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x428f2a
mov ebp, eax
add ebx, ebx
jne 0x428ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428ed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428ef4
inc ecx
add ebx, ebx
jne 0x428ee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428ed5
jne 0x428ef1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428ed5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428f14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428f05
jmp 0x428e76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428f14
add edi, ecx
jmp 0x428e76
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428f32
cmp byte [edi], 9
jne 0x428f32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428f37
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x428faf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x32104]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x321cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x428f64
mov ecx, edi
jns 0x428f93
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x321d0]
or eax, eax
je 0x428fa9
mov dword [ebx], eax
add ebx, 4
jmp 0x428f81
call dword [esi + 0x321e0]
mov ebp, dword [esi + 0x321d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x428fe3
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x920020
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x508000]
push edi
jmp 0x92003a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x920041
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x920030
mov eax, 1
add ebx, ebx
jne 0x920053
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x920064
jne 0x920083
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x920083
dec eax
add ebx, ebx
jne 0x920070
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x920048
add ebx, ebx
jne 0x92007f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x9200d5
xor ecx, ecx
sub eax, 3
jb 0x92009b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x92010a
sar eax, 1
mov ebp, eax
jmp 0x9200a6
add ebx, ebx
jne 0x9200a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x920074
inc ecx
add ebx, ebx
jne 0x9200b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x920074
add ebx, ebx
jne 0x9200c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9200b6
jne 0x9200d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9200b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9200f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9200e6
jmp 0x920036
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9200f4
add edi, ecx
jmp 0x920036
pop esi
mov edi, esi
mov ecx, 0xe5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x920112
cmp byte [edi], 2
jne 0x920112
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x920117
lea edi, [esi + 0x51e000]
mov eax, dword [edi]
or eax, eax
je 0x92018f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5208cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x520908]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x920144
mov ecx, edi
jns 0x920173
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x520910]
or eax, eax
je 0x920189
mov dword [ebx], eax
add ebx, 4
jmp 0x920161
call dword [esi + 0x52090c]
mov ebp, dword [esi + 0x520914]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9201c3
sub esp, 0xffffff80
jmp 0x401f3c
Function at 0x401f9a
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x401218
call fcn.00402238
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x401fd5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401fd5
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401fed
cmp eax, 0x20b
je 0x401fda
mov dword [ebp - 0x1c], edi
jmp 0x402001
cmp dword [ecx + 0x84], 0xe
jbe 0x401fd5
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x401ffb
cmp dword [ecx + 0x74], 0xe
jbe 0x401fd5
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x40304c], 0xffffffff
or dword [0x403050], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x403044]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x403040]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x403048], eax
call fcn.0040222e
cmp dword [0x403030], edi
jne 0x40205c
push fcn.0040222e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.00402217
push 0x403014
push 0x403010
call sub.msvcrt.dll__initterm
mov eax, dword [0x40303c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x403038]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x40300c
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.00401551
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x4020d3
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x402108
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00402273
ret
Function at 0x403280
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4048b0
push 0x4033c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x5052d8], 0xffffffff
or dword [0x5052dc], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x50525c]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x505258]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x5052e0], eax
call fcn.004033b1
cmp dword [0x405234], 0
jne 0x403303
push 0x4033ae
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0040339c
push 0x40500c
push 0x405008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x505254]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x505250]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x405004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call section..text
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x4f6934
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x148
mov ecx, dword [ebp + 0x18]
push ebx
push esi
push edi
lea eax, [ebp - 0x148]
push eax
push 0x10
push ecx
lea ebx, [ebp - 0x10]
lea edi, [ebp - 0x40]
call fcn.004f6d64
mov esi, dword [ebp + 0x14]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
xor eax, esi
lea edx, [ebp - 0x148]
mov dword [ebp - 0x10], eax
push edx
mov eax, ebx
push eax
mov ecx, ebx
push ecx
call fcn.004f6ac4
xor dword [ebp - 0x10], esi
mov esi, dword [ebp + 0x10]
cmp esi, 0x10
jae 0x4f69c4
test esi, esi
jbe 0x4f6ab0
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, eax
sub edi, eax
lea ebx, [ebx]
mov dl, byte [ecx + eax]
xor dl, byte [eax]
inc eax
sub esi, 1
mov byte [edi + eax - 1], dl
jne 0x4f69a4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x30]
push ecx
push edi
mov dword [edi + 0xc], edx
mov dword [ebp + 0x18], 0x10
sub esi, 0x10
call fcn.004f6ac4
lea edx, [esi - 1]
cmp edx, 0xe
ja 0x4f6a71
mov eax, dword [ebp + 8]
push esi
push eax
push edi
call fcn.004f838e
add dword [ebp + 8], esi
mov edx, 0x10
sub edx, esi
push edx
lea ecx, [ebp + esi - 0x30]
lea eax, [esi + edi]
push ecx
push eax
call fcn.004f838e
add esp, 0x18
xor ecx, ecx
test esi, esi
jbe 0x4f6a58
mov edx, edi
lea eax, [ebp - 0x30]
sub edx, eax
mov dword [ebp + 0x18], edx
jmp 0x4f6a47
mov edx, dword [ebp + 0x18]
lea eax, [ebp + ecx - 0x30]
mov dl, byte [edx + eax]
xor dl, byte [eax]
inc ecx
mov byte [eax + 0x10], dl
cmp ecx, esi
jb 0x4f6a44
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x30]
push ecx
push edi
call fcn.004f6ac4
add esi, 0x10
mov dword [ebp + 0x18], esi
xor esi, esi
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
mov ecx, dword [ebx + 8]
xor dword [ebp - 0x30], edx
xor dword [ebp - 0x2c], eax
mov edx, dword [ebx + 0xc]
mov eax, dword [ebp + 0x18]
xor dword [ebp - 0x28], ecx
xor dword [ebp - 0x24], edx
mov edx, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x30]
push ecx
push edx
call fcn.004f838e
mov eax, dword [ebp + 0x18]
add dword [ebp + 0xc], eax
mov eax, ebx
add esp, 0xc
mov ebx, edi
mov edi, eax
test esi, esi
ja 0x4f69c4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4f6d64
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
cmp byte [0x100dbd0], 0
jne 0x4f6d7a
call fcn.004f7104
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ecx + 0x104], 0x12
push edi
mov edi, dword [eax]
mov dword [ecx], edi
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov dword [ebp - 0x1c], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], edx
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x100], 0xa
lea esi, [ecx + 0x14]
mov dword [ebp + 8], 0
lea esp, [esp]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x100c6d0]
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x100c6d0]
rol edx, 0x10
rol ebx, 8
xor edx, ebx
movzx ebx, al
mov ebx, dword [ebx*4 + 0x100c6d0]
rol ebx, 0x18
xor edx, ebx
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x100c6d0]
mov ebx, dword [ebp + 8]
xor edx, dword [ebx + 0x100c658]
mov ebx, dword [ebp - 0x18]
xor edi, edx
mov edx, dword [ebp - 0x1c]
xor edx, edi
xor ebx, edx
mov dword [esi], edx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp + 8]
xor eax, ebx
add edx, 4
mov dword [esi - 4], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], eax
add esi, 0x10
mov dword [ebp - 0x18], ebx
mov dword [ebp + 8], edx
cmp edx, 0x28
jb 0x4f6dc4
mov edx, dword [ecx + 0x100]
add edx, edx
mov eax, 4
add edx, edx
mov dword [ebp + 8], eax
cmp edx, eax
jbe 0x4f6ee4
mov edx, dword [ecx + eax*4]
mov eax, edx
shr eax, 7
and eax, 0x1010101
imul eax, eax, 0x1b
mov ecx, edx
and ecx, 0xff7f7f7f
add ecx, ecx
xor eax, ecx
mov ecx, eax
shr ecx, 7
and ecx, 0x1010101
imul ecx, ecx, 0x1b
mov esi, eax
and esi, 0xff7f7f7f
add esi, esi
xor ecx, esi
mov esi, ecx
shr esi, 7
and esi, 0x1010101
imul esi, esi, 0x1b
mov edi, ecx
and edi, 0xff7f7f7f
add edi, edi
xor esi, edi
xor edx, esi
mov edi, ecx
xor edi, edx
rol edi, 0x10
mov ebx, eax
xor ebx, edx
rol ebx, 0x18
xor edi, ebx
rol edx, 8
xor edi, edx
xor edi, esi
xor edi, ecx
mov ecx, dword [ebp + 0x10]
xor edi, eax
mov eax, dword [ebp + 8]
mov dword [ecx + eax*4], edi
mov edx, dword [ecx + 0x100]
add edx, edx
inc eax
add edx, edx
mov dword [ebp + 8], eax
cmp eax, edx
jb 0x4f6e58
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f7104
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x300
push ebx
push esi
xor ecx, ecx
mov eax, 1
push edi
mov edx, eax
and dl, 0x80
movzx edx, dl
mov byte [ebp + ecx - 0x300], al
mov byte [ebp + ecx - 0x201], al
mov byte [ebp + eax - 0x100], cl
inc ecx
neg edx
sbb edx, edx
and edx, 0x11b
lea esi, [eax + eax]
xor edx, esi
xor eax, edx
cmp eax, 1
jne 0x4f7119
xor ecx, ecx
jmp 0x4f7154
mov dword [ecx + 0x100c658], eax
test eax, eax
je 0x4f7170
movzx eax, byte [ebp + eax - 0x100]
movzx eax, byte [ebp + eax - 0x2e7]
jmp 0x4f7172
xor eax, eax
add ecx, 4
cmp ecx, 0x28
jb 0x4f7154
xor eax, eax
test al, al
je 0x4f7198
movzx ecx, al
movzx edx, byte [ebp + ecx - 0x100]
lea ecx, [ebp - 0x201]
sub ecx, edx
movzx ecx, byte [ecx]
jmp 0x4f719a
xor ecx, ecx
lea edx, [ecx + ecx]
xor edx, ecx
add edx, edx
xor edx, ecx
add edx, edx
xor edx, ecx
add edx, edx
xor ecx, edx
mov edx, ecx
shr edx, 8
xor dl, cl
xor dl, 0x63
je 0x4f71d4
movzx ecx, dl
movzx esi, byte [ebp + ecx - 0x100]
movzx ecx, byte [ebp + esi - 0x2ff]
movzx edi, byte [ebp + esi - 0x2e7]
jmp 0x4f71d8
xor ecx, ecx
xor edi, edi
shl ecx, 8
movzx esi, dl
or ecx, esi
shl ecx, 8
or ecx, esi
shl ecx, 8
or ecx, edi
mov byte [eax + 0x100cad0], dl
mov edx, ecx
rol edx, 8
mov dword [eax*4 + 0x100ba58], edx
mov edx, ecx
mov dword [eax*4 + 0x100b658], ecx
rol edx, 0x10
rol ecx, 0x18
mov dword [eax*4 + 0x100c258], ecx
mov dword [eax*4 + 0x100c6d0], esi
movzx esi, al
lea ecx, [esi*8]
xor ecx, esi
add ecx, ecx
add ecx, ecx
xor ecx, esi
mov dword [eax*4 + 0x100be58], edx
add ecx, ecx
mov edx, ecx
shr edx, 8
xor dl, cl
xor dl, 5
je 0x4f72a4
lea ecx, [esi*8]
xor ecx, esi
add ecx, ecx
add ecx, ecx
xor ecx, esi
add ecx, ecx
mov edx, ecx
shr edx, 8
movzx edx, dl
movzx ecx, cl
xor edx, ecx
xor edx, 5
movzx edx, byte [ebp + edx - 0x100]
lea ecx, [ebp - 0x201]
sub ecx, edx
mov bl, byte [ecx]
test bl, bl
je 0x4f72a6
movzx edx, bl
movzx edx, byte [ebp + edx - 0x100]
movzx ecx, byte [ebp + edx - 0x298]
movzx edi, byte [ebp + edx - 0x212]
movzx esi, byte [ebp + edx - 0x239]
movzx edx, byte [ebp + edx - 0x221]
jmp 0x4f72ae
xor bl, bl
xor ecx, ecx
xor edi, edi
xor esi, esi
xor edx, edx
shl ecx, 8
or ecx, edi
shl ecx, 8
or ecx, esi
shl ecx, 8
or ecx, edx
mov edx, ecx
rol edx, 8
mov dword [eax*4 + 0x100cfd0], edx
mov edx, ecx
mov dword [eax*4 + 0x100cbd0], ecx
rol edx, 0x10
rol ecx, 0x18
mov dword [eax*4 + 0x100d7d0], ecx
movzx ecx, bl
mov dword [eax*4 + 0x100d3d0], edx
mov dword [eax*4 + 0x100b258], ecx
inc eax
cmp eax, 0x100
jb 0x4f717c
pop edi
pop esi
mov byte [0x100dbd0], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f7544
Capabilities:
Compute adler32 checksum

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, eax
shr edi, 0x10
movzx ecx, ax
test esi, esi
je 0x4f7677
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jbe 0x4f766f
lea esp, [esp]
mov eax, ebx
cmp ebx, 0x15b0
jb 0x4f7583
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
mov dword [ebp + 0xc], ebx
jl 0x4f7632
mov edx, eax
shr edx, 4
mov ebx, edx
neg ebx
shl ebx, 4
add eax, ebx
jmp 0x4f75a4
movzx ebx, byte [esi]
add ecx, ebx
movzx ebx, byte [esi + 1]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 2]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 3]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 4]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 5]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 6]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 7]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 8]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 9]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xa]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xb]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xc]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xd]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xe]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xf]
add edi, ecx
add ecx, ebx
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x4f75a4
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x4f7643
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
sub eax, 1
jne 0x4f7636
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x4f7574
mov eax, edi
shl eax, 0x10
or eax, ecx
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x40dbd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x54
call fcn.005bcf10
mov eax, dword [0x6934c4]
xor eax, esp
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x58]
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push edi
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x14], 0x41
xor edi, edi
call fcn.0041eb30
lea edx, [esp + 0x18]
push 8
push edx
call fcn.0041f4a0
lea eax, [esp + 0x30]
push eax
call fcn.0041eb30
add esp, 0x10
xor ebx, ebx
test ebp, ebp
jg 0x40dc64
lea eax, [esp + 0x38]
push 0x14
push eax
call fcn.0041e850
lea ecx, [esp + 0x1c]
push ecx
call fcn.0041ed30
lea edx, [esp + 0x30]
push edx
call fcn.0041ed30
add esp, 0x10
pop edi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.005bd291
add esp, 0x54
ret
mov edi, dword [esp + 0x34]
add edi, 1
cmp edi, 0x10
mov dword [esp + 0x34], edi
ja 0x40dd9e
test edi, edi
jbe 0x40dc8b
mov ecx, dword [esp + 0x10]
push edi
push ecx
lea edx, [esp + 0x54]
push edx
call fcn.005cb3c0
add esp, 0xc
add byte [esp + 0x10], 1
push 0
call fcn.00419590
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0041ec10
push edi
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x38]
push edx
call fcn.0041eca0
mov eax, dword [esi + 0xbc]
mov ecx, dword [eax + 0x10]
push ecx
add eax, 0x14
push eax
lea edx, [esp + 0x44]
push edx
call fcn.0041eca0
mov eax, dword [esi + 0x58]
push 0x20
add eax, 0x98
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.0041eca0
mov edx, dword [esi + 0x58]
push 0x20
add edx, 0xb8
push edx
lea eax, [esp + 0x5c]
push eax
call fcn.0041eca0
push 0
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x68]
push edx
call fcn.0041ecb0
add esp, 0x48
push 0
call fcn.00419a90
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0041ec10
mov eax, dword [esi + 0xbc]
mov ecx, dword [eax + 0x10]
push ecx
add eax, 0x14
push eax
lea edx, [esp + 0x28]
push edx
call fcn.0041eca0
push 0x14
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.0041eca0
add esp, 0x24
lea edi, [ebx + 0x10]
cmp edi, ebp
push 0
jle 0x40dd78
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.0041ecb0
mov eax, dword [esp + 0x18]
mov ecx, ebp
sub ecx, ebx
push ecx
lea edx, [esp + 0x48]
push edx
push eax
call fcn.005cae40
add esp, 0x18
jmp 0x40dd8a
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0041ecb0
add esp, 0xc
add dword [esp + 0xc], 0x10
mov ebx, edi
cmp ebx, ebp
jl 0x40dc60
jmp 0x40dc24
push 0x9d
push str.._ssl_s3_enc.c
push 0x44
push 0xee
push 0x14
call fcn.00412a40
mov ecx, dword [esp + 0x70]
add esp, 0x14
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.005bd291
add esp, 0x54
ret