joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f92b3de
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x4f92b6b4
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x6c3f2894
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x6c3e985a
push 0xffffffffffffffff
call fcn.4f9225de
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x4f92b448
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.4f92b460
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x4f92b6a8
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x4f92b67c
Function at 0x4f93aeae
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x4f93aed0
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x4f93aed0
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x4f93aed0
ret
cmp word [ebx + 4], 0x14c
jne 0x4f93aed0
test word [ebx + 0x16], 2
je 0x4f93aed0
test word [ebx + 0x16], 0x100
je 0x4f93aed0
cmp word [ebx + 0x18], 0x10b
jne 0x4f93aed0
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x4f93aed0
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x4f93af5c
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x4f93aef0
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.4f921e3b
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x4f93aed0
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x4f93af5c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x4f93aed0
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x4f93aed0
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x4f93aed0
ret
cmp word [ebx + 4], 0x14c
jne 0x4f93aed0
test word [ebx + 0x16], 2
je 0x4f93aed0
test word [ebx + 0x16], 0x100
je 0x4f93aed0
cmp word [ebx + 0x18], 0x10b
jne 0x4f93aed0
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x4f93aed0
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x4f93af5c
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x4f93aef0
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.4f921e3b
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x4f93aed0
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x4f93b013
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4f93b06c
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x4f93b013
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x4f93b022
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x4fd40cc5
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4f93b073
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.4f921ee9
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4f93b112
add edi, 4
add eax, 2
dec ecx
jne 0x4f93b058
call 0x4f93b0bf
loope 0x4f93b0b5
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4f93b10f
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4f93b120
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4f93b0d3
cmp eax, ecx
ja 0x4f93b0d3
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4f93b15d
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4f93b153
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.4f9223c8
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x4f93b022
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4f93b06c
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x4f93b013
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x4f93b022
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x4fd40cc5
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4f93b073
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.4f921ee9
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4f93b112
add edi, 4
add eax, 2
dec ecx
jne 0x4f93b058
call 0x4f93b0bf
loope 0x4f93b0b5
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4f93b10f
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4f93b120
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4f93b0d3
cmp eax, ecx
ja 0x4f93b0d3
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4f93b15d
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4f93b153
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.4f9223c8
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x481004]
jne 0x401010
repz ret
jmp fcn.00401753

Function at 0x409a9b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004047c6
and dword [ebp - 4], 0
cmp dword [0x4838c0], 0
mov ebx, eax
jne 0x409b4c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409bfd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409bfd
push eax
call fcn.00404754
mov dword [esp], 0x47ea64
push edi
mov dword [0x4838c0], eax
call esi
push eax
call fcn.00404754
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4838c4], eax
call esi
push eax
call fcn.00404754
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4838c8], eax
call esi
push eax
call fcn.00404754
pop ecx
mov dword [0x4838d0], eax
test eax, eax
je 0x409b4c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404754
pop ecx
mov dword [0x4838cc], eax
mov eax, dword [0x4838cc]
cmp eax, ebx
je 0x409ba4
cmp dword [0x4838d0], ebx
je 0x409ba4
push eax
call fcn.004047cf
push dword [0x4838d0]
mov esi, eax
call fcn.004047cf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409ba4
test edi, edi
je 0x409ba4
call esi
test eax, eax
je 0x409b9b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409b9b
test byte [ebp - 0xc], 1
jne 0x409ba4
or dword [ebp + 0x10], 0x200000
jmp 0x409bdd
mov eax, dword [0x4838c4]
cmp eax, ebx
je 0x409bdd
push eax
call fcn.004047cf
pop ecx
test eax, eax
je 0x409bdd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409bdd
mov eax, dword [0x4838c8]
cmp eax, ebx
je 0x409bdd
push eax
call fcn.004047cf
pop ecx
test eax, eax
je 0x409bdd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4838c0]
call fcn.004047cf
pop ecx
test eax, eax
je 0x409bfd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409bff
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x477c3b
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x481004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
cmp dword [ebp + 0xc], 0x19f
mov dword [ebp - 0x408], eax
jne 0x477c6b
push edi
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
xor ebx, ebx
cmp dword [ebp + 0xc], edi
jle 0x477cdd
push esi
lea esi, [ebp - 0x40c]
mov dword [ebp - 0x40c], edi
call fcn.00477c30
mov eax, dword [ebp - 0x408]
mov cl, byte [ebp - 0x40c]
add eax, ebx
xor byte [eax], cl
cmp dword [ebp + 0xc], 0xf
jne 0x477cd6
push edi
push dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push str.texeholiturafayeroj
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push str.rivarixux_lofoxu_hexekavoga_fucuwotahokariz
push edi
push edi
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
inc ebx
cmp ebx, dword [ebp + 0xc]
jl 0x477c73
pop esi
cmp dword [ebp + 0xc], 0x2d
pop edi
pop ebx
jne 0x477cf6
or dword [0x491844], 0xffffffff
mov dword [0x491840], 0xa62e7790
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401006
leave
ret
Function at 0x4012f0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x66c], ebx
call fcn.00401180
push 0x208
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.00408440
add esp, 0xc
lea eax, [ebp - 0x418]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x418]
push 0x418b48
push eax
call edi
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401379
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004074d1
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
nop
push 0x418b50
lea eax, [ebp - 0x63c]
push eax
call esi
test eax, eax
je 0x401434
push 0x418b54
lea eax, [ebp - 0x63c]
push eax
call esi
test eax, eax
je 0x401434
test dword [ebp - 0x668], 0x400
jne 0x401434
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00408440
add esp, 0xc
lea eax, [ebp - 0x210]
push dword [ebp - 0x66c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x210]
push eax
call edi
lea ecx, [ebp - 0x210]
call fcn.00401180
test byte [ebp - 0x668], 0x10
lea eax, [ebp - 0x210]
je 0x40142d
push 0x418b5c
push eax
call edi
lea ecx, [ebp - 0x210]
call fcn.004012f0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x401434
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x668]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401380
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0x66c]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004074d1
mov esp, ebp
pop ebp
ret
Function at 0x412565
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004123e4

Function at 0x41695c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004162ca

Function at 0x416967
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416505

Function at 0xeeb78c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xeeb796
pushal
call 0xeeb79c
pop ebp
sub ebp, 0x10
sub ebp, 0xaeb78c
jmp 0xeeb7b2
mov eax, 0xaeb78c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a6
mov edx, 0x175027f0
xor byte [eax], dl
inc eax
dec ecx
jne 0xeeb7c9
jmp 0xeeb7dc
jnp 0xeeb81b
jnp 0xeeb859
int3
wait
sbb ch, dh
invalid
invalid
Function at 0x4307d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x453e48
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x481b40]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.00451315
mov dword [esp + 0x28], 0
mov edi, dword [0x4889dc]
mov ecx, 0x4889e8
mov dword [esp + 0xc], edi
call fcn.00401120
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x43084b
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x43084f
cmp byte [eax + 0x14], 0
je 0x43084f
call fcn.004513a3
cmp esi, dword [eax + 0xc]
jae 0x430855
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x430851
xor ecx, ecx
jmp 0x430833
mov esi, ecx
test esi, esi
jne 0x4308a6
test edi, edi
je 0x43085d
mov esi, edi
jmp 0x4308a6
lea eax, [esp + 0xc]
push eax
call fcn.00430580
add esp, 4
cmp eax, 0xffffffff
jne 0x43088c
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.0043b784
push 0x46761c
lea ecx, [esp + 0x18]
push ecx
call fcn.0043c0c7
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x4889dc], esi
call fcn.004011a0
push esi
call fcn.00451471
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00451336
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x43b69b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x481b40]
jne 0x43b6a5
repz ret
jmp fcn.0044029c

Function at 0x44c3f2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043fceb
xor ebx, ebx
cmp dword [0x48b468], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x44c4c7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x44c432
xor eax, eax
jmp 0x44c58b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x44c42b
push eax
call fcn.0043fc88
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x48b468], eax
call esi
push eax
call fcn.0043fc88
mov dword [esp], 0x4656c8
push edi
mov dword [0x48b46c], eax
call esi
push eax
call fcn.0043fc88
mov dword [0x48b470], eax
lea eax, [ebp - 8]
push eax
call fcn.0043ecf1
test eax, eax
pop ecx
pop ecx
je 0x44c495
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043c1ca
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x44c4c7
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0043fc88
cmp eax, ebx
pop ecx
mov dword [0x48b478], eax
je 0x44c4c7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043fc88
pop ecx
mov dword [0x48b474], eax
mov eax, dword [0x48b474]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x44c540
cmp dword [0x48b478], esi
je 0x44c540
push eax
call fcn.0043fcf4
pop ecx
call eax
cmp eax, ebx
je 0x44c50d
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x48b478]
call fcn.0043fcf4
pop ecx
call eax
test eax, eax
je 0x44c50d
test byte [ebp - 0x18], 1
jne 0x44c540
lea eax, [ebp - 0xc]
push eax
call fcn.0043ed28
test eax, eax
pop ecx
je 0x44c528
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043c1ca
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x44c537
or dword [ebp + 0x10], 0x200000
jmp 0x44c571
or dword [ebp + 0x10], 0x40000
jmp 0x44c571
mov eax, dword [0x48b46c]
cmp eax, esi
je 0x44c571
push eax
call fcn.0043fcf4
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x44c571
mov eax, dword [0x48b470]
cmp eax, esi
je 0x44c571
push dword [ebp - 4]
push eax
call fcn.0043fcf4
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x48b468]
call fcn.0043fcf4
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x451176
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x481b40]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0045110b
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0043c120
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4511c5
cmp dword [ebp - 0x1c], 5
jb 0x4511dd
jmp 0x4511d9
cmp dword [ebp - 0x10], 1
jne 0x4511dd
cmp dword [ebp - 0x1c], 4
ja 0x4511d9
jne 0x4511dd
cmp dword [ebp - 0x18], 0
jbe 0x4511dd
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x46575c
call fcn.00450ffc
test eax, eax
jge 0x4511fe
mov byte [0x4889d8], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043b69b
add ebp, 0x78
leave
ret

Function at 0x452366
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x454573
call fcn.0043c8e8
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x452478
cmp byte [esi + 0x42], bl
je 0x452478
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp ax, di
jne 0x4523a2
xor al, al
jmp 0x45247a
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.00452340
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00452133
mov ecx, eax
call fcn.00451b91
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00452133
mov ecx, eax
call fcn.00451b91
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x452412
dec eax
je 0x452416
dec eax
dec eax
je 0x452474
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0042e5f0
mov al, bl
jmp 0x45247a
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00452133
mov ecx, eax
call fcn.00451b91
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x452456
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00452133
mov ecx, eax
call fcn.00451b91
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0043be74
add esp, 0x10
cmp edi, eax
jne 0x452400
cmp byte [esi + 0x42], 0
je 0x452474
test edi, edi
jne 0x4523b0
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0042fc60
jmp 0x4523b0
mov bl, 1
jmp 0x452402
mov al, 1
call fcn.0043c932
ret
Function at 0x4056a0
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4058e0
sub esp, 0x20
movzx eax, byte [0x5e11df]
test al, al
jne 0x4058b8
mov eax, dword [0x5e13c0]
mov ecx, dword [esp + 0x2c]
imul eax, ecx
mov edx, dword [esp + 0x28]
add eax, edx
mov ebx, dword [esp + 0x24]
jmp 0x405772
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
lea edx, [ebx + 4]
lea ecx, [ebx + 8]
add ebx, 0xc
mov edi, dword [esp + 0x1c]
mov edi, dword [edi]
xor eax, edi
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [edx]
xor ebp, edx
imul ebp, ebp, 0xc70f85e1
rol ebp, 0xf
imul ebp, ebp, 0x319bca41
mov ecx, dword [ecx]
xor esi, ecx
imul esi, esi, 0x319bca41
rol esi, 0xf
imul esi, esi, 0x8b421a21
mov edi, dword [ebx]
mov ecx, dword [esp + 0x10]
xor edi, ecx
imul edi, edi, 0x8b421a21
rol edi, 0xf
imul edi, edi, 0xbce2d621
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
mov edx, dword [esp + 0x14]
lea ebx, [edx + 0x10]
mov edx, dword [esp + 0x28]
cmp ecx, 0x10
jae 0x4056e4
xor eax, ebp
xor eax, esi
xor eax, edi
test ecx, ecx
je 0x4058b1
cmp ecx, 4
jb 0x40587a
je 0x405865
cmp ecx, 8
jbe 0x405837
cmp ecx, 0x10
jbe 0x4057b4
mov ebp, dword [0x5e13c4]
imul ebp, edx
mov esi, dword [0x5e13c8]
imul esi, edx
mov edi, dword [0x5e13cc]
imul edi, edx
jmp 0x405763
mov edx, ebx
lea ebp, [ebx + 4]
lea esi, [ecx + ebx - 8]
lea ecx, [ecx + ebx - 4]
mov edx, dword [edx]
xor eax, edx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [ebp]
xor edx, eax
imul edx, edx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
mov eax, dword [esi]
xor eax, edx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, dword [ecx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
mov eax, ecx
shr ecx, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0x30], eax
add esp, 0x20
ret
mov edx, ebx
lea ebx, [ecx + ebx - 4]
mov ecx, dword [edx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
mov eax, dword [ebx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
jmp 0x40580e
mov ecx, dword [ebx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
jmp 0x40580e
mov edx, ecx
shr ecx, 1
mov ebp, ebx
lea esi, [ecx + ebx]
lea edx, [edx + ebx - 1]
movzx ecx, byte [ebp]
xor ecx, eax
movzx eax, byte [esi]
shl eax, 8
xor ecx, eax
movzx eax, byte [edx]
shl eax, 0x10
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
jmp 0x40580e
mov ecx, eax
jmp 0x40580e
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call dbg.runtime.aeshash
mov eax, dword [esp + 0xc]
mov dword [esp + 0x30], eax
add esp, 0x20
ret
call dbg.runtime.morestack_noctxt
jmp dbg.runtime.memhash