joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479eea
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x4b8cc9
call fcn.00489011
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x479f92
push dword [ebp + 8]
call fcn.0047a215
mov dword [ebp - 0x10], eax
test eax, eax
je 0x47a024
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x479f7b
push ecx
call fcn.0046d49a
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x479f7b
xor edi, edi
inc edi
jmp 0x479f85
push dword [ebx]
call fcn.0046d495
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.00479e0f
jmp 0x47a022
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [0x4bb6b4]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x47a01a
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.0046d49a
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x47a014
mov esi, dword [ebp + 0x10]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
push ecx
lea ecx, [ebp - 0x10]
call fcn.0042caf0
lea ecx, [edi + edi]
mov bl, al
push ecx
lea ecx, [ebp - 0x10]
call fcn.0042caf0
mov ecx, dword [esi]
shl bl, 4
sub bl, 0x51
add al, bl
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x18]
add ecx, 2
mov dword [ebp - 0x18], ecx
cmp edi, dword [eax]
jb 0x479fdf
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.004037a0
mov eax, edi
call fcn.00488fdf
ret 0x10

Function at 0x47a02c
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x47a07f
push esi
push dword [ebp + 8]
call fcn.0047a215
mov edi, eax
test edi, edi
je 0x47a07a
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x47a07a
mov eax, dword [ebp - 8]
jmp 0x47a091
mov eax, dword [ebp + 0x10]
jmp 0x47a091
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc
Function at 0x47a097
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8cf6
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.00489190
mov eax, dword [0x4ef52c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2024], eax
cmp dword [ecx + 0x58], ebx
je 0x47a1c8
push ebx
push edx
call fcn.0047a215
mov ebx, eax
test ebx, ebx
jne 0x47a0ff
push esi
jmp 0x47a1f0
lea ecx, [ebp - 0x2014]
call fcn.004037c0
xor ecx, ecx
lea eax, [ebp - 0x2018]
push eax
push ecx
lea eax, [ebp - 0x2020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x2024]
mov dword [ebp - 0x2020], ecx
push ebx
mov dword [ebp - 0x2018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x201c], eax
test eax, eax
jne 0x47a187
mov eax, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2014]
shr eax, 1
push eax
call fcn.004036f0
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x2020]
push eax
push 0
push dword [ebp - 0x2024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x201c], eax
call fcn.00403530
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x201c], 0
jne 0x47a1b5
mov esi, dword [ebp - 0x2014]
add esi, 0xfffffff0
push esi
call fcn.00403430
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.004037a0
jmp 0x47a1f7
push esi
mov ecx, edi
call fcn.0040cc90
mov ecx, dword [ebp - 0x2014]
lea ecx, [ecx - 0x10]
jmp 0x47a1ae
test esi, esi
jne 0x47a1d1
mov esi, 0x4dadc8
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x2010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2010]
push eax
mov ecx, edi
call fcn.0040cc90
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00488461
leave
ret 0x10

Function at 0x47bf02
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x47bf2b
call fcn.0046dff5
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
je 0x47bf58
push esi
push eax
mov ecx, 0x4f3b58
call fcn.0047cda5
mov eax, esi
pop esi
pop ebp
ret 0x18
push 0
push dword [esi + 4]
call fcn.0047c370
int3
Function at 0x47c9ca
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, ecx
cmp dword [edi + 0x1c], 0
je 0x47cb1b
cmp dword [edi + 0x18], 0
je 0x47cb1b
cmp dword [edi + 0x40], 0
jne 0x47ca0f
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x47cb1f
mov eax, dword [ebp - 4]
jmp 0x47caf8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
cmp ebx, dword [edi + 0x38]
jb 0x47ca7a
mov eax, dword [edi + 0x44]
sub eax, dword [edi + 0x3c]
mov dword [ebp - 8], eax
jns 0x47ca2b
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x47ca33
cmp eax, ebx
ja 0x47caf4
mov esi, dword [ebp + 8]
push eax
lfence
mov eax, dword [edi + 0x3c]
add eax, dword [edi + 0x40]
push eax
push ebx
push esi
call fcn.0040cbc0
mov eax, dword [edi + 0x38]
add esp, 0x10
mov dword [edi + 0x3c], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
sub ebx, eax
push ebx
add eax, esi
push eax
push dword [edi + 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x47cb1f
mov ebx, dword [ebp - 8]
add ebx, dword [ebp - 4]
jmp 0x47cb17
mov ecx, dword [edi + 0x3c]
mov esi, dword [edi + 0x44]
lea eax, [ecx + ebx]
cmp eax, esi
jb 0x47cafd
sub esi, ecx
jns 0x47ca8f
xor esi, esi
jmp 0x47ca93
cmp esi, ebx
ja 0x47caf4
lfence
mov eax, dword [edi + 0x3c]
add eax, dword [edi + 0x40]
push esi
push eax
mov eax, dword [ebp + 8]
push ebx
push eax
call fcn.0040cbc0
add esp, 0x10
lea eax, [ebp - 8]
push eax
push dword [edi + 0x38]
push dword [edi + 0x40]
push dword [edi + 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x47cb1f
lfence
mov eax, dword [ebp - 8]
sub ebx, esi
mov dword [edi + 0x44], eax
cmp ebx, eax
jae 0x47cad3
mov eax, ebx
push eax
push dword [edi + 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
add eax, esi
push ebx
push eax
call fcn.0040cbc0
mov eax, dword [ebp - 8]
add esp, 0x10
mov dword [edi + 0x3c], eax
lea ebx, [eax + esi]
jmp 0x47cb17
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret 8
lfence
mov ecx, dword [edi + 0x3c]
add ecx, dword [edi + 0x40]
push ebx
push ecx
push ebx
push dword [ebp + 8]
call fcn.0040cbc0
add esp, 0x10
add dword [edi + 0x3c], ebx
mov eax, ebx
jmp 0x47caf6
push 6
jmp 0x47cb21
push 0
push dword [edi + 0x20]
call fcn.0047c370
int3
Function at 0x47cc03
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x40], ebx
jne 0x47cc44
push 0x1000
call fcn.0047ce0a
test eax, eax
je 0x47cc5c
lea eax, [ebp - 4]
push eax
push dword [esi + 0x38]
push dword [esi + 0x40]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x47cce9
mov eax, dword [ebp - 4]
mov dword [esi + 0x44], eax
mov dword [esi + 0x3c], ebx
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x3c]
add ecx, edx
push edi
mov edi, dword [ebp + 8]
lea ebx, [eax*2 - 2]
jmp 0x47cca5
xor eax, eax
jmp 0x47ccbf
cmp edx, dword [esi + 0x44]
jb 0x47cc8d
lea eax, [ebp - 4]
push eax
push dword [esi + 0x38]
push dword [esi + 0x40]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x47cce5
mov eax, dword [ebp - 4]
mov dword [esi + 0x44], eax
test eax, eax
je 0x47ccc5
and dword [esi + 0x3c], 0
mov ecx, dword [esi + 0x40]
mov al, byte [ecx]
cmp al, 0xd
je 0x47cc97
mov byte [edi], al
inc edi
dec ebx
mov edx, dword [esi + 0x3c]
inc edx
mov dword [esi + 0x3c], edx
mov al, byte [ecx]
inc ecx
cmp al, 0xa
je 0x47cca9
test ebx, ebx
jne 0x47cc60
and ebx, 1
add ebx, 2
push ebx
push 0
push edi
call fcn.0048ba70
mov eax, dword [ebp + 8]
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret 8
and ebx, 1
add ebx, 2
push ebx
push 0
push edi
call fcn.0048ba70
sub edi, dword [ebp + 8]
add esp, 0xc
neg edi
sbb edi, edi
and edi, dword [ebp + 8]
mov eax, edi
jmp 0x47ccbe
push 0
jmp 0x47ccea
push ebx
push dword [esi + 0x20]
call fcn.0047c370
int3

Function at 0x47ceb8
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x1c], 1
je 0x47cf69
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x47cf69
cmp dword [esi + 0x34], 0
mov edi, dword [ebp + 0xc]
jne 0x47cefc
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x47cf6d
cmp dword [ebp - 4], edi
jne 0x47cf6d
pop edi
pop esi
leave
ret 8
mov edx, dword [esi + 0x30]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x2c]
jb 0x47cf20
lea eax, [ebp - 4]
push eax
push edx
push dword [esi + 0x34]
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x47cf6d
and dword [esi + 0x30], 0
xor edx, edx
cmp edi, dword [esi + 0x2c]
jb 0x47cf3f
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
lfence
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x47cef6
jmp 0x47cf6d
lea eax, [edx + edi]
cmp eax, dword [esi + 0x2c]
ja 0x47cef6
lfence
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x30]
push edi
push dword [ebp + 8]
push eax
mov eax, dword [esi + 0x34]
add eax, dword [esi + 0x30]
push eax
call fcn.0040cbc0
add esp, 0x10
add dword [esi + 0x30], edi
jmp 0x47cef6
push 6
jmp 0x47cf6f
push 0
push dword [esi + 0x20]
call fcn.0047c370
int3
Function at 0x47db31
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], ecx
inc eax
inc ebx
mov dword [ebp - 4], eax
cmp dword [edi + 8], ebx
jle 0x47dba8
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x47db6e
mov eax, dword [ecx + 0x10]
cmp dword [eax + ebx*8 + 4], edx
je 0x47db6e
mov eax, dword [edi + 0xc]
cmp dword [eax + ebx*4], 0
je 0x47db9b
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x47db9e
mov eax, dword [edi + 0xc]
mov eax, dword [eax + ebx*4]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x47db94
mov eax, dword [eax]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x4bb6b4]
mov ecx, dword [ebp - 0xc]
call esi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [edi + 0xc]
and dword [eax + ebx*4], 0
mov eax, dword [ebp - 4]
inc ebx
cmp ebx, dword [edi + 8]
jl 0x47db51
test eax, eax
je 0x47dbef
lea esi, [ecx + 0x1c]
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 8]
push edi
add ecx, 0x14
call fcn.0047de28
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x4bb6b4]
mov ecx, edi
call esi
mov eax, dword [ebp - 8]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x47ddcf
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
lea ebx, [edi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
test esi, esi
jle 0x47de18
cmp esi, dword [edi + 0xc]
jge 0x47de18
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47de18
cmp dword [eax + 0xc], 0
je 0x47de18
cmp esi, dword [eax + 8]
jge 0x47de18
lfence
mov eax, dword [eax + 0xc]
push ebx
mov esi, dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x47de21
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x47de7b
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x4b909a
call fcn.0048907a
mov ebx, ecx
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x1c]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 8]
test edi, edi
jle 0x47df72
cmp edi, dword [ebx + 0xc]
jge 0x47df72
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x47ded2
cmp edi, dword [esi + 8]
jl 0x47df60
cmp dword [ebp + 0xc], 0
je 0x47df60
xor edi, edi
jmp 0x47df04
xor edi, edi
push 0x10
mov dword [ebp - 4], edi
call fcn.0047d930
mov esi, eax
test esi, esi
je 0x47deec
mov dword [esi], vtable.CThreadData.0
jmp 0x47deee
mov esi, edi
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
mov dword [esi + eax], ecx
mov dword [ebx + 0x14], esi
push 4
push dword [ebx + 0xc]
call fcn.0046d604
cmp dword [esi + 0xc], 0
pop ecx
pop ecx
jne 0x47df20
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x47df2c
push 2
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x47df99
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push edi
push eax
call fcn.0048ba70
mov eax, dword [ebx + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x47df72
cmp edi, dword [esi + 8]
jge 0x47df72
mov eax, dword [ebp + 0xc]
mov dword [ecx + edi*4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00488fdf
ret 8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0046da7b
int3

Function at 0x47eae9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x4ef52c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x47eb7f
test esi, esi
je 0x47eb7f
push esi
call fcn.0048efa2
mov ebx, eax
mov dword [esp], 0x1fe
xor eax, eax
push eax
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push eax
call fcn.0048ba70
mov eax, 0x100
add esp, 0xc
cmp ebx, eax
ja 0x47eb66
push eax
lea eax, [ebp - 0x204]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, ebx
jne 0x47eb66
push esi
lea eax, [ebp - 0x204]
push eax
lfence
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x47eb6e
push esi
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00488461
leave
ret 8
call fcn.0046da61
int3
Function at 0x480e9e
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x480eee
push esi
mov ebx, 0x811c9dc5
xor edi, edi
call fcn.0048efa2
xor edx, edx
mov dword [ebp - 4], 0xa
pop ecx
mov ecx, eax
div dword [ebp - 4]
inc eax
test ecx, ecx
je 0x480ee5
lfence
mov edx, ecx
movzx ecx, word [esi + edi*2]
add edi, eax
imul ebx, ebx, 0x1000193
xor ebx, ecx
cmp edi, edx
jb 0x480ed3
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
call fcn.0046da61
int3

Function at 0x4843ef
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x484419
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x48441f
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
leave
ret
lea ecx, [esi + 0xc]
call fcn.00403830
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0048622e
int3

Function at 0x484703
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
jne 0x484714
xor eax, eax
jmp 0x484730
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x484735
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
lea ecx, [esi + 0xc]
call fcn.00403830
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0048622e
int3

Function at 0x4847a7
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
push 0
push dword [ebp + 0xc]
mov eax, dword [edi]
push dword [ebp + 8]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x4bb6b4]
mov ecx, edi
call esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x4847da
pop edi
pop esi
pop ebp
ret 8
lea ecx, [edi + 0xc]
call fcn.00403830
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0048622e
int3

Function at 0x4848b5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
je 0x4848e0
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4848e6
cmp dword [ebp - 4], esi
jne 0x4848fd
pop edi
pop esi
leave
ret 8
lea ecx, [edi + 0xc]
call fcn.00403830
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0048622e
lea ecx, [edi + 0xc]
call fcn.00403830
push eax
push 0xffffffffffffffff
push 0xd
call fcn.00485e84
int3
Function at 0x484952
Capabilities:
Get disk information

Disassembly:
push 0x26c
mov eax, 0x4b96b9
call fcn.00489044
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x264], eax
test eax, eax
je 0x484b3d
test ebx, ebx
je 0x484b3d
lea ecx, [ebp - 0x270]
mov esi, 0x104
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x4849c2
push 0xffffffffffffffff
push ebx
push esi
push dword [ebp - 0x264]
call fcn.0049d9df
push eax
call fcn.004062f0
add esp, 0x14
push ebx
push edi
call fcn.00484910
xor eax, eax
call fcn.00488ff3
ret 0xc
cmp eax, esi
jb 0x4849ea
test edi, edi
je 0x4849b8
lfence
mov dword [edi + 8], 3
push ebx
lfence
call fcn.0048efa2
pop ecx
push eax
push ebx
lea ecx, [edi + 0x10]
call fcn.00406160
jmp 0x4849b8
lea ecx, [ebp - 0x268]
lfence
call fcn.004037c0
and dword [ebp - 4], 0
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x264]
call fcn.0048420e
mov esi, dword [ebp - 0x268]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
jne 0x484b02
xor ecx, ecx
lea eax, [ebp - 0x26c]
push ecx
push ecx
push eax
lea eax, [ebp - 0x278]
push eax
push ecx
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x484a5a
push ebx
push edi
lfence
call fcn.00484910
lea ecx, [esi - 0x10]
call fcn.004037a0
jmp 0x4849b8
mov eax, dword [ebp - 0x26c]
test al, 2
jne 0x484a79
push dword [ebp - 0x264]
lfence
call dword [sym.imp.USER32.dll_CharUpperW]
mov eax, dword [ebp - 0x26c]
test al, 4
jne 0x484b02
lea eax, [ebp - 0x260]
push eax
push ebx
lfence
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x484b02
push eax
lfence
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x484a43
cmp eax, dword [ebp - 0x264]
jbe 0x484a43
lea eax, [ebp - 0x234]
push eax
call fcn.0048efa2
pop ecx
mov ecx, dword [ebp - 0x270]
mov edx, ecx
sub edx, dword [ebp - 0x264]
sar edx, 1
mov dword [ebp - 0x274], ecx
add eax, edx
mov ecx, 0x104
cmp eax, ecx
jge 0x484b12
lea eax, [ebp - 0x234]
sub ecx, edx
push eax
push ecx
lfence
push dword [ebp - 0x274]
call fcn.00499101
push eax
call fcn.004062f0
add esp, 0x10
lea ecx, [esi - 0x10]
call fcn.004037a0
xor eax, eax
inc eax
jmp 0x4849ba
test edi, edi
je 0x484a4d
lfence
mov dword [edi + 8], 3
push ebx
lfence
call fcn.0048efa2
pop ecx
push eax
push ebx
lea ecx, [edi + 0x10]
call fcn.00406160
jmp 0x484a4d
call fcn.0046da61
int3