joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482a70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, edx
xor al, al
mov dword [esp + 0x10], ecx
push edi
mov edi, dword [ebp + 0xc]
mov byte [esp + 0xf], al
mov dword [esp + 0x10], 0
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x482bae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x482b24
cmp byte [esp + 0xf], 0
jne 0x482ade
cmp dword [esi + 0x10], 0
je 0x482aca
mov dl, 1
mov ecx, esi
call fcn.0047dcb0
cmp dword [edi + 0x10], 0
je 0x482ad9
xor dl, dl
mov ecx, edi
call fcn.0047dcb0
mov byte [esp + 0xf], 1
cmp dword [esp + 0x10], 0x12c
jae 0x482ba3
cmp dword [esi + 0x10], 0
jne 0x482afe
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x482b08
mov eax, dword [edi]
jmp 0x482b08
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x482b08
mov eax, dword [esi]
mov ebx, dword [esp + 0x10]
mov edx, str.KLSTD
push eax
push 0x12c
push ebx
push 0x7cfd18
call fcn.00483da0
jmp 0x482b6e
cmp ebx, 0x20
je 0x482b31
cmp ebx, 0x4c8
jne 0x482bb0
mov eax, dword [esp + 0x10]
cmp eax, 0x64
jae 0x482ba3
cmp dword [esi + 0x10], 0
jne 0x482b4c
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x482b56
mov ecx, dword [edi]
jmp 0x482b56
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x482b56
mov ecx, dword [esi]
push ecx
push 0x64
push eax
push ebx
push 0x7cfb70
mov edx, str.KLSTD
call fcn.00483e30
mov ebx, dword [esp + 0x10]
cmp ebx, 0xa
mov ecx, 9
mov eax, ebx
cmovae eax, ecx
mov edx, dword [eax*8 + 0x782e54]
mov ecx, dword [eax*8 + str.2dd]
call fcn.00465820
mov ecx, eax
call fcn.00463730
mov ecx, dword [esp + 0x14]
inc ebx
mov dword [esp + 0x10], ebx
jmp 0x482a96
call fcn.0044aa50
test al, al
jne 0x482bb9
jmp 0x482bb0
xor ebx, ebx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00463800
int3
Function at 0x482e10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, edx
xor al, al
mov dword [esp + 0x10], ecx
push edi
mov edi, dword [ebp + 0xc]
mov byte [esp + 0xf], al
mov dword [esp + 0x10], 0
push dword [ecx]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x482f4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x482ec5
cmp byte [esp + 0xf], 0
jne 0x482e7f
cmp dword [esi + 0x10], 0
je 0x482e6b
xor dl, dl
mov ecx, esi
call fcn.0047dcb0
cmp dword [edi + 0x10], 0
je 0x482e7a
xor dl, dl
mov ecx, edi
call fcn.0047dcb0
mov byte [esp + 0xf], 1
cmp dword [esp + 0x10], 0x12c
jae 0x482f44
cmp dword [esi + 0x10], 0
jne 0x482e9f
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x482ea9
mov eax, dword [edi]
jmp 0x482ea9
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x482ea9
mov eax, dword [esi]
mov ebx, dword [esp + 0x10]
mov edx, str.KLSTD
push eax
push 0x12c
push ebx
push 0x7cfd18
call fcn.00483da0
jmp 0x482f0f
cmp ebx, 0x20
je 0x482ed2
cmp ebx, 0x4c8
jne 0x482f4d
mov eax, dword [esp + 0x10]
cmp eax, 0x64
jae 0x482f44
cmp dword [esi + 0x10], 0
jne 0x482eed
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x482ef7
mov ecx, dword [edi]
jmp 0x482ef7
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x482ef7
mov ecx, dword [esi]
push ecx
push 0x64
push eax
push ebx
push 0x7cfb70
mov edx, str.KLSTD
call fcn.00483e30
mov ebx, dword [esp + 0x10]
cmp ebx, 0xa
mov ecx, 9
mov eax, ebx
cmovae eax, ecx
mov edx, dword [eax*8 + 0x782e54]
mov ecx, dword [eax*8 + str.2dd]
call fcn.00465820
mov ecx, eax
call fcn.00463730
mov ecx, dword [esp + 0x14]
inc ebx
mov dword [esp + 0x10], ebx
jmp 0x482e36
call fcn.0044aa50
test al, al
jne 0x482f56
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00463800
int3
Function at 0x482f60
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, edx
xor al, al
mov dword [ebp - 0xc], ecx
push edi
mov edi, dword [ebp + 0xc]
mov byte [ebp - 1], al
mov dword [ebp - 8], 0
push dword [ecx]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x48308f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x48300b
cmp byte [ebp - 1], 0
jne 0x482fc7
cmp dword [esi + 0x10], 0
je 0x482fb4
xor dl, dl
mov ecx, esi
call fcn.0047dcb0
cmp dword [edi + 0x10], 0
je 0x482fc3
xor dl, dl
mov ecx, edi
call fcn.0047dcb0
mov byte [ebp - 1], 1
cmp dword [ebp - 8], 0x12c
jae 0x483086
cmp dword [esi + 0x10], 0
jne 0x482fe6
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x482ff0
mov eax, dword [edi]
jmp 0x482ff0
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x482ff0
mov eax, dword [esi]
mov ebx, dword [ebp - 8]
mov edx, str.KLSTD
push eax
push 0x12c
push ebx
push 0x7cfd18
call fcn.00483da0
jmp 0x483053
cmp ebx, 0x20
je 0x483018
cmp ebx, 0x4c8
jne 0x48308f
mov eax, dword [ebp - 8]
cmp eax, 0x64
jae 0x483086
cmp dword [esi + 0x10], 0
jne 0x483032
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x48303c
mov ecx, dword [edi]
jmp 0x48303c
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x48303c
mov ecx, dword [esi]
push ecx
push 0x64
push eax
push ebx
push 0x7cfb70
mov edx, str.KLSTD
call fcn.00483e30
mov ebx, dword [ebp - 8]
cmp ebx, 0xa
mov ecx, 9
mov eax, ebx
cmovae eax, ecx
mov edx, dword [eax*8 + 0x782e54]
mov ecx, dword [eax*8 + str.2dd]
call fcn.00465820
mov ecx, eax
call fcn.00463730
mov ecx, dword [ebp - 0xc]
inc ebx
mov dword [ebp - 8], ebx
jmp 0x482f80
call fcn.0044aa50
test al, al
jne 0x483098
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00463800
int3
Function at 0x485aa0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x707778
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x7c0ab4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [ebp + 8]
xor eax, eax
mov ecx, edx
mov dword [esi], vtable.KLSTD::DefaultGlobalReporterImpl.0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x485af0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.00449180
lea edx, [ebp - 0x2c]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00485960
cmp dword [eax + 0x14], 8
jb 0x485b23
mov eax, dword [eax]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov edx, dword [ebp - 0x30]
mov dword [esi + 4], eax
cmp edx, 8
jb 0x485b69
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x485b5f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x485c3b
push edx
push ecx
call fcn.006d0b31
add esp, 8
mov edx, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
cmp edx, 8
jb 0x485bb7
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x485bad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x485c40
push edx
push ecx
call fcn.006d0b31
add esp, 8
lea eax, [ebp - 0x74]
mov dword [ebp - 0x7c], vtable.KLDBG::CDbgTimeMeasurer3_char_.0
push eax
push 4
push str.KLSTD::DefaultGlobalReporterImpl::DefaultGlobalReporterImpl
mov ecx, str.KLSVC
mov dword [ebp - 0x54], str.KLSVC
mov dword [ebp - 0x50], str.KLSTD::DefaultGlobalReporterImpl::DefaultGlobalReporterImpl
mov dword [ebp - 0x4c], 4
mov byte [ebp - 0x48], 0
mov dword [ebp - 0x74], 3
call fcn.00484650
add esp, 0xc
mov byte [ebp - 0x48], al
mov dword [ebp - 0x7c], vtable.KLDBG::CDbgTimeMeasurer3_char_.0
test al, al
je 0x485c1c
push ecx
mov ecx, dword [ebp - 0x54]
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x4c]
xor edx, edx
push dword [ebp - 0x50]
call fcn.004848c0
add esp, 0x10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006d0856
mov esp, ebp
pop ebp
ret 4
call fcn.006d79b8
call fcn.006d79b8
int3
Function at 0x4869c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x705651
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x7c0ab4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
test edi, edi
je 0x486ae4
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
cmp word [edi], ax
je 0x486ad1
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 1
push eax
push 0x411
mov ecx, eax
call fcn.00455f60
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sub eax, ecx
sar eax, 1
dec eax
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x486a7e
push eax
push 0xdb
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_std_strings_stringsimpl.cpp
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
call fcn.00465440
add esp, 0x10
mov edx, dword [ebp - 0x20]
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x486a86
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00449180
mov edx, dword [ebp - 0x20]
test edx, edx
je 0x486ad1
mov ecx, dword [ebp - 0x18]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x486ac7
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x486b04
push ecx
push edx
call fcn.006d0b31
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.szwX
push 0
push 0xd4
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_std_strings_stringsimpl.cpp
push 0x4a3
push 0x7824b0
call fcn.00477ab0
call fcn.006d79b8
int3

Function at 0x487df0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
add ecx, 8
pop ebp
jmp fcn.00488130
Function at 0x488130
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x707ac0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x7c0ab4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x20], esi
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
call fcn.004882c0
mov edi, dword [ebp - 0x28]
xor ebx, ebx
mov ecx, dword [ebp - 0x24]
mov eax, edi
mov dword [ebp - 0x14], ebx
cmp eax, ecx
je 0x48818a
nop word [eax + eax]
mov eax, dword [eax]
inc ebx
cmp eax, ecx
jne 0x488180
mov dword [ebp - 0x14], ebx
mov eax, dword [esi + 4]
cmp edi, dword [eax]
jne 0x4881f2
cmp ecx, eax
jne 0x4881f2
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
call fcn.00488430
mov eax, dword [esi + 0x14]
sub eax, dword [esi + 0xc]
sar eax, 2
cmp eax, 0x10
jae 0x4881bb
push ecx
lea ecx, [esi + 0xc]
call fcn.0047c0e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], ecx
push ecx
lea ecx, [esi + 0xc]
call fcn.00488470
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp edi, ecx
je 0x4881dc
mov esi, edi
mov edi, dword [edi]
mov dword [ebp - 0x1c], esi
cmp dword [esi + 0x1c], 8
lea ebx, [esi + 8]
mov ecx, dword [esi + 0x18]
jb 0x48820c
mov ebx, dword [esi + 8]
xor eax, eax
mov dword [ebp - 0x10], edi
add ecx, ecx
mov edx, 0x811c9dc5
mov dword [ebp - 0x18], ecx
je 0x488239
mov esi, ecx
nop
movzx ecx, byte [eax + ebx]
inc eax
xor ecx, edx
imul edx, ecx, 0x1000193
cmp eax, esi
jb 0x488220
mov esi, dword [ebp - 0x1c]
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
add ecx, edx
cmp dword [ecx + 4], esi
jne 0x48826f
cmp dword [ecx], esi
jne 0x488267
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [ecx + edx + 4], eax
jmp 0x488278
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x488278
cmp dword [ecx], esi
jne 0x488278
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [esi + 4]
lea ecx, [esi + 8]
mov eax, dword [esi]
mov dword [edx], eax
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.00449120
push 0x24
push esi
call fcn.006d0b31
add esp, 8
cmp edi, dword [ebp - 0x24]
jne 0x4881f6
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4882c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, ecx
mov esi, eax
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
push edi
mov dword [ebp - 8], ecx
jb 0x4882de
mov esi, dword [eax]
lea edi, [ecx + ecx]
mov edx, 0x811c9dc5
xor ecx, ecx
test edi, edi
je 0x488301
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4882f0
mov ecx, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
and ecx, edx
mov edx, dword [ebx + 4]
mov dword [ebp - 0x10], esi
lea eax, [ecx*8]
add ecx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [eax + esi]
mov edi, dword [esi + ecx*4]
inc ecx
mov dword [ebp - 4], edi
lea ecx, [esi + ecx*4]
mov dword [ebp - 0xc], ecx
nop dword [eax + eax]
cmp edi, edx
jne 0x488338
mov ecx, edx
jmp 0x48833c
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x488412
mov ecx, dword [ebp + 0xc]
mov esi, ecx
cmp dword [ecx + 0x14], 8
jb 0x488351
mov esi, dword [ecx]
cmp dword [eax + 0x1c], 8
lea ebx, [eax + 8]
jb 0x48835d
mov ebx, dword [eax + 8]
mov edi, dword [eax + 0x18]
cmp edi, dword [ebp - 8]
jne 0x488399
test edi, edi
je 0x488381
sub ebx, esi
nop dword [eax + eax]
mov cx, word [ebx + esi]
cmp cx, word [esi]
jne 0x488399
add esi, 2
sub edi, 1
jne 0x488370
mov esi, eax
mov dword [ebp - 0x18], esi
mov esi, dword [ebp + 0xc]
nop dword [eax]
cmp dword [ebp - 4], edx
jne 0x4883a3
mov ecx, edx
jmp 0x4883af
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
jmp 0x488330
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebx + ecx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x4883f8
cmp dword [eax + 0x1c], 8
lea ecx, [eax + 8]
jb 0x4883bf
mov ecx, dword [eax + 8]
cmp dword [esi + 0x14], 8
mov edi, esi
jb 0x4883c9
mov edi, dword [esi]
mov esi, dword [ebp - 8]
cmp esi, dword [eax + 0x18]
mov esi, dword [ebp + 0xc]
jne 0x4883f8
mov ebx, dword [esi + 0x10]
test ebx, ebx
jbe 0x4883f4
sub edi, ecx
mov dword [ebp - 0xc], edi
mov di, word [edi + ecx]
cmp di, word [ecx]
jne 0x4883f8
mov edi, dword [ebp - 0xc]
add ecx, 2
sub ebx, 1
jne 0x4883e0
mov eax, dword [eax]
jmp 0x488390
mov esi, dword [ebp - 0x18]
cmp esi, eax
je 0x488412
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
pop esi
mov dword [ecx + 4], eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov dword [eax + 4], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x48af80
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x7ccc59], 0
jne 0x48b077
xor dl, dl
push ebx
mov byte [ebp - 1], dl
push esi
xor eax, eax
mov bh, 0x80
nop dword [eax]
mov cl, bh
mov bl, bh
and cl, dl
mov edx, eax
xor edx, 0x80000000
test cl, cl
cmove edx, eax
lea ecx, [edx + edx]
mov eax, ecx
xor eax, 0x4c11db7
test edx, edx
mov dl, byte [ebp - 1]
cmovns eax, ecx
shr bh, 1
cmp bl, 2
jae 0x48afa0
xor esi, esi
xor edx, edx
test al, 1
je 0x48afde
mov ecx, 0x1f
sub ecx, edx
bts esi, ecx
inc edx
shr eax, 1
cmp edx, 0x20
jb 0x48afd0
mov dl, byte [ebp - 1]
xor al, al
test dl, 1
je 0x48aff6
xor eax, eax
bts eax, 7
mov cl, dl
shr cl, 1
test cl, 1
je 0x48b006
movzx eax, al
bts eax, 6
shr cl, 1
test cl, 1
je 0x48b014
movzx eax, al
bts eax, 5
shr cl, 1
test cl, 1
je 0x48b022
movzx eax, al
bts eax, 4
shr cl, 1
test cl, 1
je 0x48b030
movzx eax, al
bts eax, 3
shr cl, 1
test cl, 1
je 0x48b03e
movzx eax, al
bts eax, 2
shr cl, 1
test cl, 1
je 0x48b04c
movzx eax, al
bts eax, 1
cmp cl, 2
jb 0x48b058
movzx eax, al
bts eax, 0
movzx eax, al
add dl, 1
mov byte [ebp - 1], dl
mov dword [eax*4 + 0x7ccc60], esi
jne 0x48af98
pop esi
mov byte [0x7ccc59], 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48bb20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
xor esi, esi
lea eax, [edx + ebx]
xor ecx, ecx
cmp edx, eax
cmova ebx, ecx
test ebx, ebx
je 0x48bb5c
mov eax, dword [edi]
mov cl, byte [edi]
lea edx, [edx + 1]
xor cl, byte [edx - 1]
inc esi
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x7ccc60]
mov dword [edi], eax
cmp esi, ebx
jb 0x48bb40
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x48dc40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7080d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x7c0ab4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edi, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
mov ebx, dword [ebx + 0x24]
mov dword [ebp - 0x2c], ebx
test ebx, ebx
je 0x48dc98
mov eax, dword [ebx]
mov esi, dword [eax]
mov ecx, esi
call dword [0x70d440]
mov ecx, ebx
call esi
mov byte [ebp - 4], 1
mov eax, dword [ebx]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x70d440]
mov ecx, ebx
call esi
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x10]
lea eax, [esi + 4]
mov dword [ebp - 0x28], eax
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
movzx eax, byte [ebp - 0xe]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp - 0xd]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x1c]
and ecx, eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x24], eax
mov esi, dword [eax + ecx*8]
add ecx, ecx
lea edx, [ecx*4 + 4]
mov ecx, dword [eax + ecx*4]
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x10]
mov edx, dword [edx + 8]
cmp dword [ebp - 0x1c], edx
jne 0x48dd20
mov eax, edx
jmp 0x48dd2b
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + eax]
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax]
cmp esi, eax
je 0x48dd3b
cmp dword [esi + 8], ecx
je 0x48dd3d
mov esi, dword [esi]
mov eax, dword [ebp - 0x24]
jmp 0x48dd17
mov esi, edx
mov eax, dword [ebp - 0x14]
cmp esi, dword [eax + 8]
je 0x48dd61
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x18]
call fcn.0048e490
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0048e780
mov edi, dword [ebp - 0x18]
mov byte [ebp - 4], 3
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x70d440]
mov ecx, ebx
call esi
mov byte [ebp - 4], 4
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x70d440]
mov ecx, ebx
call esi
cmp byte [ebp + 8], 0
mov byte [ebp - 4], 0
je 0x48ddaa
test edi, edi
je 0x48ddaa
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x70d440]
mov ecx, edi
call esi
lea ecx, [ebp - 0x18]
call fcn.0048e4f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48e780
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x48e7f3
cmp eax, edi
jne 0x48e7eb
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x48e7fb
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x48e7fb
cmp eax, edi
jne 0x48e7fb
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0xc]
dec dword [ebx + 8]
call fcn.0048e4f0
push 0x10
push edi
call fcn.006d0b31
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x48f9b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00492b60

Function at 0x48f9e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00492fc0

Function at 0x48f9f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x708358
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x7c0ab4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edx, ebx
push esi
call fcn.0048f3a0
add esp, 4
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.0048f510
test al, al
je 0x48fc1c
mov dword [ebp - 0x18], 0
lea eax, [edi + 4]
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x48fa65
mov eax, dword [eax]
sub esp, 0x14
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.0046c920
test eax, eax
je 0x48fa8d
push 0
push 0xe3
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_stdconfklflags.cpp
push ecx
mov edx, eax
call fcn.00465440
add esp, 0x10
test esi, esi
je 0x48fac1
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
cmp edi, method.KLSTD::RcClassImpl_class_KLSTD::CMemoryChunk__1_.virtual_12
jne 0x48fc3c
mov edi, dword [esi + 0xc]
mov ebx, dword [eax + 8]
cmp ebx, method.KLSTD::RcClassImpl_class_KLSTD::CMemoryChunk__1_.virtual_8
jne 0x48fc51
mov eax, dword [esi + 8]
mov ebx, dword [ebp + 8]
jmp 0x48fac5
mov ebx, dword [ebp + 8]
jmp 0x48fac5
xor edi, edi
xor eax, eax
mov esi, dword [ebp - 0x18]
push edi
push eax
push 3
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x48faf1
push 0
push 0xe4
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_stdconfklflags.cpp
push ecx
mov edx, eax
call fcn.00465440
add esp, 0x10
test esi, esi
je 0x48fc00
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48fc00
lea ecx, [ebp - 0x14]
call fcn.00448f20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.szwName
push 0
push 0xe0
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_stdconfklflags.cpp
push 0x4a3
push 0x7824b0
call fcn.00477ab0
mov ecx, edi
call dword [0x70d440]
mov ecx, esi
call edi
mov edi, eax
mov eax, dword [esi]
jmp 0x48faa5
mov ecx, ebx
call dword [0x70d440]
mov ecx, esi
call ebx
jmp 0x48fabc