joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d9d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53fbc5
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x58313c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0x10]
movzx eax, dl
xor eax, 0x811c9dc5
mov esi, dword [ebp + 0xc]
imul ecx, eax, 0x1000193
mov eax, edx
sar eax, 8
movzx eax, al
mov edi, dword [ebp + 8]
xor ecx, eax
mov eax, edx
sar eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0042ff40
lea ebx, [esi + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x46da6d
mov ecx, dword [ebx]
lea ebx, [esi + 4]
cmp eax, ecx
je 0x46da6d
mov eax, dword [eax + 0xc]
jmp 0x46db93
push 0x5522dc
xor eax, eax
push eax
push eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
push eax
push 0x82
push dword [ebp + 0x10]
push edi
call dword [sym.imp.GDI32.dll_GetGlyphOutlineW]
mov edx, dword [ebp + 0x10]
movzx eax, dl
xor eax, 0x811c9dc5
movsx edi, word [ebp - 0x14]
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
movzx eax, byte [ebp + 0x12]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0x13]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
push eax
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0042ff40
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x46db8e
cmp dword [esi + 8], 0xfffffff
je 0x46dbaf
mov dword [ebp - 0x30], ebx
push 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], eax
call fcn.00512877
mov ecx, dword [ebp + 0x10]
add esp, 4
mov dword [ebp - 0x2c], eax
add eax, 8
mov dword [ebp - 0x3c], eax
mov dword [eax], ecx
mov dword [eax + 4], 0
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x1c]
inc ecx
mov dword [ebp - 4], 1
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x5521b0]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5521b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x46db7c
mov ecx, esi
call fcn.004509e0
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
push ebx
push dword [ebp - 0x3c]
mov ecx, esi
push eax
call fcn.0042ff40
mov ecx, dword [eax]
jmp 0x46db82
mov ecx, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x28]
push dword [ebp - 0x2c]
push ecx
push ebx
mov ecx, esi
call fcn.00450910
mov dword [eax + 0xc], edi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512b0b
mov esp, ebp
pop ebp
ret
push str.unordered_map_set_too_long
call fcn.005104f6
int3
Function at 0x471110
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, ecx
cmp ebp, dword [edi + 0x6c]
jle 0x47113e
mov dword [edi + 0x6c], ebp
push dword [edi + 0x68]
call fcn.00518201
lea eax, [ebp*4]
push eax
call fcn.0051821c
add esp, 8
mov dword [edi + 0x68], eax
mov eax, dword [edi + 0x68]
mov ecx, edi
mov esi, dword [esp + 0x18]
push ebp
push esi
push eax
mov dword [esp + 0x28], eax
call fcn.00431e90
mov eax, dword [edi + 0x48]
mov ecx, dword [edi + 0x50]
imul ecx, dword [esp + 0x20]
mov eax, dword [eax + 0x10]
mov ebx, eax
imul ebx, esi
mov dword [esp + 0x10], eax
sar ecx, 8
mov dword [esp + 0x18], ecx
add ebx, dword [edi + 0x64]
cmp ecx, 0xfe
jge 0x471260
mov edx, dword [esp + 0x1c]
dec ebp
mov eax, edx
add edx, 4
mov dword [esp + 0x1c], edx
mov edx, dword [eax]
mov edi, edx
shr edi, 8
and edx, 0xff00ff
imul edx, dword [esp + 0x18]
and edi, 0xff00ff
imul edi, ecx
mov ecx, 0x100
shr edx, 8
shr edi, 8
and edx, 0xff00ff
and edi, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
add edi, eax
and esi, 0xff00ff
add esi, edx
mov eax, edi
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
mov ecx, esi
sub edx, eax
shr ecx, 8
shl edx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov ecx, dword [esp + 0x18]
mov dword [ebx], edx
add ebx, dword [esp + 0x10]
test ebp, ebp
jg 0x471180
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x1c]
dec ebp
mov edx, dword [ecx]
mov edi, edx
add ecx, 4
shr edi, 8
mov dword [esp + 0x1c], ecx
and edi, 0xff00ff
mov eax, edi
mov ecx, 0x100
shr eax, 0x10
and edx, 0xff00ff
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
add edi, eax
and esi, 0xff00ff
add esi, edx
mov eax, edi
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
mov ecx, esi
sub edx, eax
shr ecx, 8
shl edx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [esp + 0x10]
test ebp, ebp
jg 0x471260
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x471320
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, ecx
cmp ebp, dword [edi + 0x6c]
jle 0x47134e
mov dword [edi + 0x6c], ebp
push dword [edi + 0x68]
call fcn.00518201
lea eax, [ebp*4]
push eax
call fcn.0051821c
add esp, 8
mov dword [edi + 0x68], eax
mov eax, dword [edi + 0x68]
mov ecx, edi
mov esi, dword [esp + 0x18]
push ebp
push esi
push eax
mov dword [esp + 0x28], eax
call fcn.00432220
mov eax, dword [edi + 0x48]
mov ecx, dword [edi + 0x50]
imul ecx, dword [esp + 0x20]
mov eax, dword [eax + 0x10]
mov ebx, eax
imul ebx, esi
mov dword [esp + 0x10], eax
sar ecx, 8
mov dword [esp + 0x18], ecx
add ebx, dword [edi + 0x64]
cmp ecx, 0xfe
jge 0x471470
mov edx, dword [esp + 0x1c]
dec ebp
mov eax, edx
add edx, 4
mov dword [esp + 0x1c], edx
mov edx, dword [eax]
mov edi, edx
shr edi, 8
and edx, 0xff00ff
imul edx, dword [esp + 0x18]
and edi, 0xff00ff
imul edi, ecx
mov ecx, 0x100
shr edx, 8
shr edi, 8
and edx, 0xff00ff
and edi, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
add edi, eax
and esi, 0xff00ff
add esi, edx
mov eax, edi
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
mov ecx, esi
sub edx, eax
shr ecx, 8
shl edx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov ecx, dword [esp + 0x18]
mov dword [ebx], edx
add ebx, dword [esp + 0x10]
test ebp, ebp
jg 0x471390
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x1c]
dec ebp
mov edx, dword [ecx]
mov edi, edx
add ecx, 4
shr edi, 8
mov dword [esp + 0x1c], ecx
and edi, 0xff00ff
mov eax, edi
mov ecx, 0x100
shr eax, 0x10
and edx, 0xff00ff
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
add edi, eax
and esi, 0xff00ff
add esi, edx
mov eax, edi
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
mov ecx, esi
sub edx, eax
shr ecx, 8
shl edx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [esp + 0x10]
test ebp, ebp
jg 0x471470
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x471530
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, ecx
cmp ebp, dword [edi + 0x6c]
jle 0x471556
mov dword [edi + 0x6c], ebp
push dword [edi + 0x68]
call fcn.00518201
push ebp
call fcn.0051821c
add esp, 8
mov dword [edi + 0x68], eax
mov eax, dword [edi + 0x68]
mov ecx, edi
mov esi, dword [esp + 0x14]
push ebp
push esi
push eax
mov dword [esp + 0x24], eax
call fcn.00432640
mov eax, dword [edi + 0x48]
mov edx, dword [edi + 0x50]
imul edx, dword [esp + 0x1c]
mov eax, dword [eax + 0x10]
mov ebx, eax
imul ebx, esi
mov dword [esp + 0x14], eax
sar edx, 8
mov dword [esp + 0x1c], edx
add ebx, dword [edi + 0x64]
cmp edx, 0xfe
jge 0x471660
mov ecx, dword [esp + 0x18]
dec ebp
movzx eax, byte [ecx]
inc ecx
mov edi, eax
mov dword [esp + 0x18], ecx
shl edi, 0x10
mov ecx, 0x100
or edi, eax
imul edi, edx
mov edx, 0x100
shr edi, 8
and edi, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
test ebp, ebp
jg 0x471598
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov ecx, dword [esp + 0x18]
mov edx, 0x100
dec ebp
movzx eax, byte [ecx]
inc ecx
mov edi, eax
mov dword [esp + 0x18], ecx
shl edi, 0x10
mov ecx, 0x100
or edi, eax
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [esp + 0x14]
test ebp, ebp
jg 0x471660
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x471720
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, ecx
cmp ebp, dword [edi + 0x6c]
jle 0x471746
mov dword [edi + 0x6c], ebp
push dword [edi + 0x68]
call fcn.00518201
push ebp
call fcn.0051821c
add esp, 8
mov dword [edi + 0x68], eax
mov eax, dword [edi + 0x68]
mov ecx, edi
mov esi, dword [esp + 0x14]
push ebp
push esi
push eax
mov dword [esp + 0x24], eax
call fcn.004328e0
mov eax, dword [edi + 0x48]
mov edx, dword [edi + 0x50]
imul edx, dword [esp + 0x1c]
mov eax, dword [eax + 0x10]
mov ebx, eax
imul ebx, esi
mov dword [esp + 0x14], eax
sar edx, 8
mov dword [esp + 0x1c], edx
add ebx, dword [edi + 0x64]
cmp edx, 0xfe
jge 0x471850
mov ecx, dword [esp + 0x18]
dec ebp
movzx eax, byte [ecx]
inc ecx
mov edi, eax
mov dword [esp + 0x18], ecx
shl edi, 0x10
mov ecx, 0x100
or edi, eax
imul edi, edx
mov edx, 0x100
shr edi, 8
and edi, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
test ebp, ebp
jg 0x471788
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov ecx, dword [esp + 0x18]
mov edx, 0x100
dec ebp
movzx eax, byte [ecx]
inc ecx
mov edi, eax
mov dword [esp + 0x18], ecx
shl edi, 0x10
mov ecx, 0x100
or edi, eax
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [esp + 0x14]
test ebp, ebp
jg 0x471850
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x471910
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov dword [esp + 0x10], ebx
cmp esi, dword [ebx + 0x6c]
jle 0x471940
mov dword [ebx + 0x6c], esi
push dword [ebx + 0x68]
call fcn.00518201
lea eax, [esi + esi*2]
push eax
call fcn.0051821c
add esp, 8
mov dword [ebx + 0x68], eax
mov edi, dword [esp + 0x1c]
mov ecx, ebx
mov ebp, dword [ebx + 0x68]
push esi
push edi
push ebp
call fcn.00432c30
mov eax, dword [ebx + 0x48]
mov edx, dword [eax + 0x10]
mov ebx, edx
mov eax, dword [esp + 0x10]
imul ebx, edi
mov dword [esp + 0x14], edx
add ebx, dword [eax + 0x64]
mov eax, dword [eax + 0x50]
imul eax, dword [esp + 0x24]
mov dword [esp + 0x20], ebx
sar eax, 8
mov dword [esp + 0x1c], eax
cmp eax, 0xfe
jge 0x471a72
mov edi, dword [ebx]
mov ecx, ebp
add ebp, 3
mov edx, 0x100
mov dword [esp + 0x24], ebp
dec esi
movzx ebp, byte [ecx + 1]
movzx ebx, byte [ecx + 2]
or ebp, 0xff0000
imul ebp, eax
shl ebx, 0x10
shr ebp, 8
and ebp, 0xff00ff
mov eax, ebp
shr eax, 0x10
sub edx, eax
movzx eax, byte [ecx]
or ebx, eax
mov eax, edi
imul ebx, dword [esp + 0x1c]
and eax, 0xff00ff
imul eax, edx
shr edi, 8
and edi, 0xff00ff
imul edi, edx
mov edx, 0x100
shr ebx, 8
shr eax, 8
and ebx, 0xff00ff
and eax, 0xff00ff
add ebx, eax
shr edi, 8
mov ecx, ebx
and edi, 0xff00ff
shr ecx, 8
add ebp, edi
and ecx, 0xff00ff
mov eax, ebp
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, ebp
shl eax, 8
shl edx, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, ebx
mov ebx, dword [esp + 0x20]
xor edx, eax
mov eax, ebp
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl ebp, 8
sub ecx, eax
mov eax, dword [esp + 0x1c]
shl ecx, 8
or ecx, ebp
mov ebp, dword [esp + 0x24]
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebx
test esi, esi
jg 0x471985
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov ecx, ebp
dec esi
add ebp, 3
mov ax, word [ecx]
movzx ecx, byte [ecx + 2]
or ecx, 0xffffff00
mov word [esp + 0x20], ax
movzx eax, byte [esp + 0x21]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x20]
shl ecx, 8
or ecx, eax
mov dword [ebx], ecx
add ebx, edx
test esi, esi
jg 0x471a72
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x471ab0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov dword [esp + 0x10], ebx
cmp esi, dword [ebx + 0x6c]
jle 0x471ae0
mov dword [ebx + 0x6c], esi
push dword [ebx + 0x68]
call fcn.00518201
lea eax, [esi + esi*2]
push eax
call fcn.0051821c
add esp, 8
mov dword [ebx + 0x68], eax
mov edi, dword [esp + 0x1c]
mov ecx, ebx
mov ebp, dword [ebx + 0x68]
push esi
push edi
push ebp
call fcn.00432f90
mov eax, dword [ebx + 0x48]
mov edx, dword [eax + 0x10]
mov ebx, edx
mov eax, dword [esp + 0x10]
imul ebx, edi
mov dword [esp + 0x14], edx
add ebx, dword [eax + 0x64]
mov eax, dword [eax + 0x50]
imul eax, dword [esp + 0x24]
mov dword [esp + 0x20], ebx
sar eax, 8
mov dword [esp + 0x1c], eax
cmp eax, 0xfe
jge 0x471c12
mov edi, dword [ebx]
mov ecx, ebp
add ebp, 3
mov edx, 0x100
mov dword [esp + 0x24], ebp
dec esi
movzx ebp, byte [ecx + 1]
movzx ebx, byte [ecx + 2]
or ebp, 0xff0000
imul ebp, eax
shl ebx, 0x10
shr ebp, 8
and ebp, 0xff00ff
mov eax, ebp
shr eax, 0x10
sub edx, eax
movzx eax, byte [ecx]
or ebx, eax
mov eax, edi
imul ebx, dword [esp + 0x1c]
and eax, 0xff00ff
imul eax, edx
shr edi, 8
and edi, 0xff00ff
imul edi, edx
mov edx, 0x100
shr ebx, 8
shr eax, 8
and ebx, 0xff00ff
and eax, 0xff00ff
add ebx, eax
shr edi, 8
mov ecx, ebx
and edi, 0xff00ff
shr ecx, 8
add ebp, edi
and ecx, 0xff00ff
mov eax, ebp
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, ebp
shl eax, 8
shl edx, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, ebx
mov ebx, dword [esp + 0x20]
xor edx, eax
mov eax, ebp
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl ebp, 8
sub ecx, eax
mov eax, dword [esp + 0x1c]
shl ecx, 8
or ecx, ebp
mov ebp, dword [esp + 0x24]
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebx
test esi, esi
jg 0x471b25
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov ecx, ebp
dec esi
add ebp, 3
mov ax, word [ecx]
movzx ecx, byte [ecx + 2]
or ecx, 0xffffff00
mov word [esp + 0x20], ax
movzx eax, byte [esp + 0x21]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x20]
shl ecx, 8
or ecx, eax
mov dword [ebx], ecx
add ebx, edx
test esi, esi
jg 0x471c12
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x472ae0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x20]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, dword [esp + 0x2c]
inc edx
mov dword [esp + 0x18], edi
dec ebx
mov esi, dword [edi + 8]
mov eax, esi
mov ecx, esi
and eax, 0xff00ff
shr ecx, 8
imul eax, edx
and ecx, 0xffff00ff
imul ecx, edx
shr esi, 8
and esi, 0xff00ff
imul esi, edx
shr eax, 8
xor eax, ecx
and eax, 0xff00ff
xor eax, esi
mov esi, dword [edi]
mov edx, dword [esi + 0xc]
imul edx, dword [esp + 0x24]
mov ecx, dword [esi]
add ecx, edx
mov dword [edi + 4], ecx
mov ebp, dword [esi + 0x10]
imul ebp, dword [esp + 0x20]
mov dword [esp + 0x20], ebx
add ebp, ecx
mov ecx, eax
shr ecx, 0x18
mov dword [esp + 0x24], ebp
cmp cl, 0xff
jb 0x472b8d
test ebx, ebx
js 0x472c8f
nop
mov edx, dword [esp + 0x28]
mov ecx, ebp
mov esi, dword [esi + 0x10]
nop dword [eax]
mov dword [ecx], eax
dec edx
add ecx, esi
test edx, edx
jg 0x472b70
mov esi, dword [edi]
add ebp, dword [esi + 0xc]
sub ebx, 1
jns 0x472b60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x14
test ebx, ebx
js 0x472c8f
mov ecx, eax
shr ecx, 8
and ecx, 0xff00ff
and eax, 0xff00ff
mov dword [esp + 0x2c], ecx
nop dword [eax]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x30], edx
mov edx, dword [esi + 0x10]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov ebx, ecx
mov edx, 0x100
shr ecx, 0x10
mov esi, 0x100
sub edx, ecx
mov ecx, dword [ebp]
mov edi, ecx
shr ecx, 8
and ecx, 0xff00ff
and edi, 0xff00ff
imul ecx, edx
imul edi, edx
shr ecx, 8
and ecx, 0xff00ff
shr edi, 8
add ebx, ecx
and edi, 0xff00ff
mov ecx, ebx
add edi, eax
shr ecx, 8
mov edx, edi
and ecx, 0xff00ff
shr edx, 8
sub esi, ecx
and edx, 0xff00ff
shl esi, 8
mov ecx, ebx
shl ecx, 8
or esi, ecx
mov ecx, 0x100
sub ecx, edx
mov edx, 0x100
or ecx, edi
xor esi, ecx
mov ecx, ebx
shr ecx, 8
and esi, 0xff00ff
and ecx, 0xff00ff
shl ebx, 8
sub edx, ecx
mov ecx, dword [esp + 0x30]
shl edx, 8
dec ecx
or edx, ebx
mov dword [esp + 0x30], ecx
xor esi, edx
mov dword [ebp], esi
add ebp, dword [esp + 0x14]
test ecx, ecx
mov ecx, dword [esp + 0x2c]
jg 0x472bc3
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
mov esi, dword [ecx]
mov ecx, dword [esp + 0x2c]
add ebp, dword [esi + 0xc]
sub dword [esp + 0x20], 1
mov dword [esp + 0x24], ebp
jns 0x472bb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x14
Function at 0x47e9b0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x47e9dc
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x180]
cmp byte [eax + 8], 0
je 0x47ea63
mov ecx, dword [esi + 0x78]
lea ebx, [esi + 0x78]
nop
cmp ecx, dword [esi + 0x60]
jae 0x47ea36
mov eax, dword [esi + 8]
mov edi, ecx
test eax, eax
je 0x47ea17
mov dword [eax + 4], ecx
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
mov edi, dword [ebx]
add esp, 4
mov eax, dword [esi + 0x184]
push 0
push ebx
push 0
mov eax, dword [eax + 4]
push esi
call eax
mov ecx, dword [ebx]
add esp, 0x10
cmp ecx, edi
je 0x47ea79
cmp ecx, dword [esi + 0x60]
jb 0x47e9f5
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
xor ecx, ecx
mov eax, dword [esi + 0x180]
add esp, 8
cmp byte [eax + 8], cl
jne 0x47e9f0
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x497bf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540050
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x58313c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
js 0x497cfe
mov ebx, dword [ecx]
test ebx, ebx
jle 0x497ce8
mov byte [ebp - 0x1c], 0
lea esi, [ecx + 4]
push dword [ebp - 0x1c]
lea esi, [esi + ebx*8]
push ebx
lea eax, [ecx + 4]
mov dword [ebp - 0x24], esi
push esi
push eax
mov dword [ebp - 0x10], eax
call fcn.00430ce0
mov edx, dword [ebp - 0x10]
add esp, 0x10
xor edi, edi
mov ecx, edx
cmp edx, esi
jae 0x497cdc
add edi, dword [ecx + 4]
mov eax, dword [ecx]
add ecx, 8
mov dword [ebp - 0x20], eax
cmp ecx, esi
jae 0x497c85
cmp dword [ecx], eax
jne 0x497c85
add edi, dword [ecx + 4]
dec ebx
add ecx, 8
cmp ecx, esi
jb 0x497c76
mov eax, edi
cdq
mov esi, eax
xor esi, edx
sub esi, edx
mov eax, esi
cdq
and edx, 0xff
add eax, edx
sar eax, 8
test eax, eax
je 0x497cc4
cmp byte [ebp + 8], 0
je 0x497cad
mov esi, 0xff
jmp 0x497cc4
and esi, 0x1ff
mov eax, esi
cmp esi, 0x100
jb 0x497cc4
mov esi, 0x1ff
sub esi, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov dword [edx + 4], esi
mov esi, dword [ebp - 0x24]
mov dword [edx], eax
add edx, 8
mov dword [ebp - 0x10], edx
cmp ecx, esi
jb 0x497c67
mov ecx, dword [ebp - 0x14]
mov dword [ecx], ebx
mov dword [edx - 4], 0
sub dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x18]
lea ecx, [ecx + eax*4]
mov dword [ebp - 0x14], ecx
jns 0x497c31
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4