joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459e00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x542f1d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
xorps xmm0, xmm0
mov dword [ebp - 0x18], ecx
push esi
push edi
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x3c], 0
movq qword [ebp - 0x44], xmm0
call fcn.004347a0
push 0x14
mov esi, eax
mov dword [ebp - 0x38], 0
push 0x66c8ac
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.0040db70
mov dword [ebp - 4], 0
call fcn.00449440
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp - 0x24], 0x10
lea esi, [ebp - 0x38]
mov edi, dword [ebp - 0x38]
mov edx, 0x811c9dc5
setae byte [ebp - 0xd]
cmovae esi, edi
xor ecx, ecx
cmp dword [ebp - 0x28], ecx
jbe 0x459ea6
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebp - 0x28]
jb 0x459e94
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x38]
push edx
push eax
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.00435240
mov eax, dword [eax + 4]
test eax, eax
je 0x459ef2
cmp eax, dword [esi + 4]
je 0x459ef2
mov esi, dword [eax + 0x20]
mov eax, dword [ebp - 0x14]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x459efc
push 0
push 0x1c
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x18]
push 0
push dword [ebp + 8]
push dword [eax + 4]
call esi
mov esi, eax
jmp 0x459f01
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, 0xc0000138
cmp byte [ebp - 0xd], 0
je 0x459f2f
mov ecx, dword [ebp - 0x24]
mov eax, edi
inc ecx
cmp ecx, 0x1000
jb 0x459f25
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x459f96
push ecx
push edi
call fcn.005121df
add esp, 8
test esi, esi
je 0x459f47
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x50]
cdq
pop edi
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x4c]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x54]
mov dword [ecx + 0xc], edx
cdq
mov dword [ecx], eax
mov eax, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov eax, dword [ebp - 0x48]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x44]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp - 0x3c]
mov dword [ecx + 0x28], eax
xor eax, eax
mov dword [ecx + 4], edx
mov dword [ecx + 0x1c], 0
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
call fcn.00520c6d
int3
Function at 0x459fb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x542fce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
push esi
push edi
mov dword [ebp - 0x18], ecx
movups xmmword [ebp - 0x5c], xmm0
mov dword [ebp - 0x20], 0
movq qword [ebp - 0x4c], xmm0
call fcn.004347a0
push 0x19
mov esi, eax
mov dword [ebp - 0x44], 0
push 0x66c8c4
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
call fcn.0040db70
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
call fcn.00449440
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp - 0x30], 0x10
lea esi, [ebp - 0x44]
mov edi, dword [ebp - 0x44]
mov edx, 0x811c9dc5
setae byte [ebp - 0xe]
cmovae esi, edi
xor ecx, ecx
cmp dword [ebp - 0x34], ecx
jbe 0x45a064
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebp - 0x34]
jb 0x45a052
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x44]
push edx
push eax
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.00435240
mov eax, dword [eax + 4]
test eax, eax
je 0x45a0c3
cmp eax, dword [esi + 4]
je 0x45a0c3
mov esi, dword [eax + 0x20]
mov eax, dword [ebp - 0x14]
add eax, 0x20
mov dword [ebp - 0x24], esi
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x45a0cd
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x20]
push eax
push 0x18
lea eax, [ebp - 0x5c]
add esi, 4
push eax
push 0
push dword [esi]
call dword [ebp - 0x24]
mov ecx, esi
test eax, eax
js 0x45a0d3
cmp dword [ebp + 8], 0
je 0x45a0d3
mov byte [ebp - 0xd], 1
jmp 0x45a0d9
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x18]
add ecx, 4
mov byte [ebp - 0xd], 0
mov esi, ecx
cmp byte [ebp - 0xe], 0
je 0x45a107
mov ecx, dword [ebp - 0x30]
mov eax, edi
inc ecx
cmp ecx, 0x1000
jb 0x45a0fd
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45a138
push ecx
push edi
call fcn.005121df
add esp, 8
cmp byte [ebp - 0xd], 0
je 0x45a122
push 0
push 0x250
push dword [ebp + 8]
push dword [ebp - 0x58]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
pop edi
cdq
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
call fcn.00520c6d
int3
Function at 0x45a160
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x542f9e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
push esi
push edi
mov dword [ebp - 0x20], ecx
movups xmmword [ebp - 0x5c], xmm0
mov dword [ebp - 0x44], 0
movq qword [ebp - 0x4c], xmm0
mov dword [ebp - 0x1c], 0
call fcn.004347a0
push 0x18
mov esi, eax
mov dword [ebp - 0x40], 0
push 0x66c8e0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
call fcn.0040db70
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 1
call fcn.00449440
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp - 0x2c], 0x10
lea edi, [ebp - 0x40]
mov esi, dword [ebp - 0x40]
mov edx, 0x811c9dc5
setae byte [ebp - 0xd]
cmovae edi, esi
xor ecx, ecx
cmp dword [ebp - 0x30], ecx
jbe 0x45a222
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebp - 0x30]
jb 0x45a210
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x40]
push edx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00435240
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 4]
test eax, eax
je 0x45a278
cmp eax, dword [ecx + 4]
je 0x45a278
mov edi, dword [eax + 0x20]
lea eax, [ecx + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x45a284
lea eax, [ebp - 0x1c]
push eax
push 0x1c
lea eax, [ebp - 0x5c]
push eax
push 0
push dword [ebp + 8]
call edi
mov edi, dword [ebp + 0xc]
test eax, eax
js 0x45a287
test edi, edi
je 0x45a287
mov byte [ebp + 0xf], 1
jmp 0x45a28b
lea eax, [ecx + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x45a287
mov edi, dword [ebp + 0xc]
mov byte [ebp + 0xf], 0
cmp byte [ebp - 0xd], 0
je 0x45a2b9
mov ecx, dword [ebp - 0x2c]
mov eax, esi
inc ecx
cmp ecx, 0x1000
jb 0x45a2af
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45a2ed
push ecx
push esi
call fcn.005121df
add esp, 8
cmp byte [ebp + 0xf], 0
je 0x45a2d6
mov eax, dword [ebp - 0x20]
push 0
push 0x1000
push edi
push dword [ebp - 0x58]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x58]
xor edx, edx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
call fcn.00520c6d
int3
Function at 0x45b100
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
jb 0x45b11b
mov ebx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x45b13c
mov edx, eax
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x45b128
mov edx, dword [ebp + 8]
push esi
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [edi + 0x30]
call fcn.00434350
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x45b154
mov ecx, dword [edi + 0x34]
cmp ecx, dword [edi + 0x34]
je 0x45b177
mov ecx, dword [ecx + 0x20]
xor edx, edx
add ecx, dword [edi + 0x10]
mov eax, dword [ebp + 0xc]
adc edx, dword [edi + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, 0x806d0013
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45e7f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0xc], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x45e94b
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.00433a50
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x45e91e
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x45e8a4
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x45e911
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x45e8de
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x45e8d6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x45e911
cmp ebx, edx
je 0x45e8ee
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x45e927
cmp ebx, edx
jne 0x45e8e2
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 0xc]
mov eax, ecx
cmp ecx, esi
jne 0x45e852
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x45e911
push str.invalid_hash_bucket_count
call fcn.00510625
int3
Function at 0x45e9d0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
lea edx, [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jle 0x45e9f8
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
dec esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
jmp 0x45ea00
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
mov ecx, edx
test esi, esi
jle 0x45ea1a
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
jmp 0x45ea22
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov ecx, edx
test esi, esi
jle 0x45ea3c
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
jmp 0x45ea44
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov ecx, edx
test esi, esi
jle 0x45ea5e
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
jmp 0x45ea66
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov eax, edx
mov dword [ebp - 4], 0
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x40], eax
mov eax, esi
mov dword [ebp - 0x3c], edx
cdq
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x45eaa7
add dword [esp], 5
retf

Function at 0x45eb30
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5d0
push ebx
push esi
xorps xmm0, xmm0
push edi
movlpd qword [ebp - 0x10], xmm0
push 0x33
call 0x45eb4b
add dword [esp], 5
retf

Function at 0x45ee30
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x682a30]
sub esp, 0x1a4
mov edx, dword [0x682a34]
push ebx
push esi
push edi
test eax, eax
jne 0x45ee6b
test edx, edx
jne 0x45ee6b
call fcn.0045eb30
mov esi, eax
mov dword [0x682a30], eax
mov edi, edx
mov dword [0x682a34], edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edi
jmp 0x45ee75
mov esi, eax
mov dword [ebp - 0x10], eax
mov edi, edx
mov dword [ebp - 0x14], edx
test esi, esi
jne 0x45ee81
test edi, edi
je 0x45f27d
lea ecx, [ebp - 0x98]
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
push 0x33
call 0x45ee97
add dword [esp], 5
retf
pop edi
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474ce0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [ecx + 0xfc]
lea edx, [esp + 4]
push ebx
mov ebx, dword [ecx + 0x104]
push esi
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x545690]
sub esi, 1
jne 0x474d00
mov eax, dword [0x6815a8]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x474d39
push esi
push dword [esp + 0x10]
push 4
push ebx
call fcn.0046ae40
add esp, 0x10
pop esi
mov eax, ebx
pop ebx
ret 4

Function at 0x474da0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov edx, ecx
push esi
push edi
lea esi, [esp + 8]
mov edi, 0x10
movss xmm1, dword [edx + 0x118]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x11c]
subss xmm0, xmm1
mov ecx, dword [edx + 0xfc]
movss dword [esp + 8], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [esp + 0xc], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [esp + 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0x104]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [esp + 0x14], xmm0
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x545690]
sub edi, 1
jne 0x474e11
not edx
pop edi
mov eax, edx
pop esi
add esp, 0x10
ret 4

Function at 0x475ac0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
not ebx
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
test edi, edi
je 0x475b22
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x475b06
cmp edi, 2
jb 0x475b06
cmp byte [esi], cl
jne 0x475b06
cmp byte [esi + 1], cl
jne 0x475b06
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x545690]
jmp 0x475ad7
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x545690]
test edi, edi
jne 0x475ad7
pop edi
pop esi
not eax
pop ebx
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x475b58
nop dword [eax]
cmp cl, 0x23
jne 0x475b3f
cmp byte [esi], cl
jne 0x475b3f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x545690]
test cl, cl
jne 0x475b30
pop edi
pop esi
not eax
pop ebx
ret
Function at 0x475d70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
xor edx, edx
push ebx
push ebp
push esi
push edi
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x18], edx
test ebp, ebp
je 0x475d91
cmp eax, ebp
jae 0x475f0c
mov cl, byte [eax]
mov byte [esp + 0x12], cl
test cl, cl
je 0x475f0c
movzx ecx, cl
xor ebx, ebx
shr ecx, 3
mov edx, ebp
movsx ecx, byte [ecx + 0x546390]
test ecx, ecx
mov dword [esp + 0x14], ecx
sete bl
add ebx, ecx
test ebp, ebp
jne 0x475dc2
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [esp + 0x12]
mov byte [esp + 0x13], cl
cmp esi, edx
jae 0x475ddd
mov ch, byte [esi]
mov byte [esp + 0x11], ch
jmp 0x475de2
mov byte [esp + 0x11], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x475df1
mov ch, byte [esi]
mov byte [esp + 0x10], ch
jmp 0x475df6
mov byte [esp + 0x10], 0
lea esi, [eax + 3]
cmp esi, edx
jae 0x475e01
mov ch, byte [esi]
jmp 0x475e03
xor ch, ch
mov ebp, dword [esp + 0x14]
movzx esi, byte [esp + 0x11]
movzx edx, byte [esp + 0x10]
movzx edi, ch
mov ebp, dword [ebp*4 + 0x5463b0]
mov byte [esp + 0x12], ch
movzx ecx, cl
and ebp, ecx
mov ecx, esi
and ecx, 0x3f
shl ebp, 6
or ebp, ecx
and esi, 0xc0
shl ebp, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or ebp, ecx
mov ecx, edi
and ecx, 0x3f
shr edi, 2
or edi, edx
shl ebp, 6
or ebp, ecx
shr edi, 2
mov ecx, dword [esp + 0x14]
or edi, esi
mov esi, dword [esp + 0x14]
shr edi, 2
mov ecx, dword [ecx*4 + 0x5463d8]
shr ebp, cl
cmp ebp, dword [esi*4 + 0x5463c4]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, ebp
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, ebp
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [esi*4 + 0x5463ec]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x475ef0
xor edx, edx
cmp byte [esp + 0x13], dl
setne dl
xor ecx, ecx
cmp byte [esp + 0x12], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x10], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x11], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
mov edx, dword [esp + 0x18]
inc edx
jmp 0x475d7d
add eax, ebx
test ebp, ebp
je 0x475f00
mov edx, dword [esp + 0x18]
inc edx
jmp 0x475d7d
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
add esp, 0xc
ret
Function at 0x475f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
dec eax
push ebp
mov ebp, edx
lea eax, [edx + eax*2]
mov dword [esp + 0x14], eax
cmp edx, eax
mov eax, dword [esp + 0x24]
jae 0x476140
push esi
mov esi, dword [esp + 0x2c]
push ebx
push edi
nop dword [eax]
test esi, esi
je 0x475fac
cmp eax, esi
jae 0x476139
mov cl, byte [eax]
mov byte [esp + 0x2c], cl
test cl, cl
je 0x476139
movzx ecx, cl
xor ebx, ebx
shr ecx, 3
mov edx, esi
movsx ecx, byte [ecx + 0x546390]
test ecx, ecx
mov dword [esp + 0x18], ecx
sete bl
add ebx, ecx
mov dword [esp + 0x1c], ebx
test esi, esi
jne 0x475fe1
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [esp + 0x2c]
mov byte [esp + 0x13], cl
cmp esi, edx
jae 0x475ff8
mov bh, byte [esi]
jmp 0x475ffa
xor bh, bh
lea esi, [eax + 2]
mov byte [esp + 0x12], bh
cmp esi, edx
jae 0x476009
mov ch, byte [esi]
jmp 0x47600b
xor ch, ch
lea esi, [eax + 3]
mov byte [esp + 0x11], ch
cmp esi, edx
jae 0x47601a
mov bl, byte [esi]
jmp 0x47601c
xor bl, bl
movzx edx, ch
movzx ecx, cl
movzx esi, bh
movzx edi, bl
mov byte [esp + 0x2c], bl
mov ebx, dword [esp + 0x18]
mov ebx, dword [ebx*4 + 0x5463b0]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [esp + 0x14], ebx
shl dword [esp + 0x14], 6
and esi, 0xc0
or dword [esp + 0x14], ecx
mov ecx, edx
shl dword [esp + 0x14], 6
and ecx, 0x3f
or dword [esp + 0x14], ecx
and edx, 0xc0
shl dword [esp + 0x14], 6
mov ecx, edi
mov ebx, dword [esp + 0x14]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [esp + 0x18]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x5463d8]
shr ebx, cl
mov esi, ebx
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x18]
cmp esi, dword [ebx*4 + 0x5463c4]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x5463ec]
mov ebx, dword [esp + 0x1c]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x47611e
xor edx, edx
mov esi, 0xfffd
cmp byte [esp + 0x2c], dl
setne dl
xor ecx, ecx
cmp byte [esp + 0x11], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x12], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x13], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
jmp 0x476124
add eax, ebx
test esi, esi
je 0x476139
mov word [ebp], si
add ebp, 2
mov esi, dword [esp + 0x34]
cmp ebp, dword [esp + 0x20]
jb 0x475fa0
mov edx, dword [esp + 0x28]
pop edi
pop ebx
pop esi
xor ecx, ecx
mov word [ebp], cx
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x476150
mov dword [ecx], eax
sub ebp, edx
sar ebp, 1
mov eax, ebp
pop ebp
add esp, 0x14
ret
Function at 0x477510
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x53c0], 0
lea esi, [edi + 0x53c4]
je 0x477589
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x477544
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00486980
push dword [esp + 0x14]
mov ecx, esi
mov dword [esi], 0
push dword [esp + 0x14]
call fcn.00486370
mov edx, dword [esi]
mov ecx, 0x6815ac
push dword [edi + 0x53c0]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x53cc]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call fcn.0051fd2b
add esp, 0x10
pop edi
pop esi
ret
push dword [esp + 0x14]
mov ecx, esi
push dword [esp + 0x14]
call fcn.00486370
pop edi
pop esi
ret
Function at 0x47fd90
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x6815a8]
push esi
mov esi, dword [esp + 8]
mov dword [eax + 0x5374], 0
test esi, esi
je 0x47fde8
lea eax, [esp + 8]
mov dword [esp + 8], 0
push edi
push eax
call fcn.0047fdf0
push 0x5468dc
push esi
mov edi, eax
call fcn.00475810
mov esi, eax
add esp, 0xc
test esi, esi
je 0x47fde7
push esi
push dword [esp + 0x10]
push 1
push edi
call fcn.0051fd2b
push esi
call fcn.0051b0d6
add esp, 0x14
pop edi
pop esi
ret

Function at 0x483ca0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, dword [0x6815a8]
cmp byte [edi + 0x5370], 0
lea eax, [edi + 0x20]
jne 0x483db7
mov ecx, dword [eax]
push ebx
push ebp
test ecx, ecx
je 0x483dae
push esi
push 0x5468d8
push ecx
call fcn.00475810
mov esi, eax
add esp, 8
test esi, esi
je 0x483daa
push esi
call fcn.0052154a
mov ebp, eax
add esp, 4
cmp ebp, 0xffffffff
je 0x483da1
push 2
push 0
push esi
call fcn.00520a96
add esp, 0xc
test eax, eax
jne 0x483da1
push esi
call fcn.0052154a
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x483da1
push 0
push ebp
push esi
call fcn.00520a96
add esp, 0xc
test eax, eax
jne 0x483da1
mov eax, dword [0x6815a8]
test eax, eax
je 0x483d38
inc dword [eax + 0xb0]
push dword [0x6815b0]
push ebx
call dword [section..data]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x483da1
push esi
push ebx
push 1
push ebp
call fcn.005203ff
add esp, 0x10
push esi
cmp eax, ebx
je 0x483d89
call fcn.0051b0d6
add esp, 4
mov eax, dword [0x6815a8]
test eax, eax
je 0x483d77
dec dword [eax + 0xb0]
push dword [0x6815b0]
push ebp
call dword [0x67f004]
add esp, 8
jmp 0x483daa
call fcn.0051b0d6
add esp, 4
test ebx, ebx
je 0x483d68
push ebx
push ebp
call fcn.004770f0
add esp, 8
jmp 0x483d68
push esi
call fcn.0051b0d6
add esp, 4
lea eax, [edi + 0x20]
pop esi
pop ebp
mov byte [edi + 0x5370], 1
pop ebx
movss xmm0, dword [edi + 0x5374]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x483e05
subss xmm0, dword [edi + 0x18]
comiss xmm1, xmm0
movss dword [edi + 0x5374], xmm0
jb 0x483e05
mov eax, dword [eax]
test eax, eax
je 0x483df4
push eax
call fcn.0047fd90
add esp, 4
mov dword [edi + 0x5374], 0
pop edi
ret
mov byte [edi + 0x98], 1
mov dword [edi + 0x5374], 0
pop edi
ret