joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e6be0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x733a25
push eax
mov dword fs:[0], esp
sub esp, 0x10
cmp dword [edx + 0x14], 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jb 0x4e6c0d
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x4e6c32
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x4e6c20
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00493390
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4e6c62
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x4e6dbe
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.00503d60
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.0047b780
mov dword [edi + 0x20], 0
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x74c0b0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x74c0b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x4e6d5d
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
fstp qword [esp]
call fcn.00704910
fstp qword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x14]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.006f2860
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x4e6d41
cmp eax, 0x200
jae 0x4e6d3f
shl eax, 3
cmp eax, ecx
jae 0x4e6d41
mov eax, ecx
push eax
mov ecx, ebx
call fcn.004957d0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00493390
mov edx, dword [eax]
jmp 0x4e6d60
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x4e6d8c
mov dword [ecx + eax*8], edi
jmp 0x4e6d9e
cmp esi, edx
jne 0x4e6d95
mov dword [ecx + eax*8], edi
jmp 0x4e6da2
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4e6da2
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.006ddb1a
int3
Function at 0x4e73e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jb 0x4e73fe
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x4e7424
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x4e7410
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.00493390
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x4e7444
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4e7a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x733ac5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, dword [ebp + 0xc]
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp + 0xc], edi
cmp dword [edi + 0x14], 0x10
jb 0x4e7a63
mov eax, dword [edi]
mov dword [ebp + 0xc], eax
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x4e7a87
mov edx, dword [ebp + 0xc]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x4e7a72
mov edx, dword [ebp - 0x10]
push esi
push edi
lea eax, [ebp - 0x20]
mov ecx, edx
push eax
call fcn.00493390
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4e7aa7
mov eax, dword [ebp + 8]
mov dword [eax], ecx
xor cl, cl
jmp 0x4e7b9e
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0x4924924
je 0x4e7bb3
add eax, 4
mov dword [ebp - 0x18], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call fcn.00503d60
add esp, 4
mov dword [ebp - 0x14], eax
lea ecx, [eax + 8]
push edi
call fcn.0047b780
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
movups xmm0, xmmword [edi + 0x18]
movups xmmword [ecx + 0x20], xmm0
movq xmm0, qword [edi + 0x28]
movq qword [ecx + 0x30], xmm0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov byte [edi + 0x18], 0
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x74c0b0]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x74c0b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x4e7b85
mov ecx, edi
call fcn.004c8160
mov eax, dword [ebp - 0x14]
mov ecx, edi
push esi
add eax, 8
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00493390
mov ecx, dword [eax]
jmp 0x4e7b88
mov ecx, dword [ebp - 0x20]
push dword [ebp - 0x14]
push ecx
push esi
mov ecx, edi
call fcn.004c7b90
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov cl, 1
mov eax, dword [ebp + 8]
mov byte [eax + 4], cl
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.006ddb1a
int3
Function at 0x4e7c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x733af5
push eax
mov dword fs:[0], esp
sub esp, 0x10
cmp dword [edx + 0x14], 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jb 0x4e7cbd
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x4e7ce2
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x4e7cd0
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00493390
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4e7d12
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x6666666
je 0x4e7e76
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.00503d60
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.0047b780
xorps xmm0, xmm0
movq qword [edi + 0x20], xmm0
mov dword [edi + 0x24], 0
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x74c0b0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x74c0b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x4e7e15
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
fstp qword [esp]
call fcn.00704910
fstp qword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x14]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.006f2860
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x4e7df9
cmp eax, 0x200
jae 0x4e7df7
shl eax, 3
cmp eax, ecx
jae 0x4e7df9
mov eax, ecx
push eax
mov ecx, ebx
call fcn.004ea130
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00493390
mov edx, dword [eax]
jmp 0x4e7e18
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x4e7e44
mov dword [ecx + eax*8], edi
jmp 0x4e7e56
cmp esi, edx
jne 0x4e7e4d
mov dword [ecx + eax*8], edi
jmp 0x4e7e5a
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4e7e5a
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.006ddb1a
int3
Function at 0x4e80f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x733ac5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, dword [ebp + 0xc]
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp + 0xc], edi
cmp dword [edi + 0x14], 0x10
jb 0x4e8123
mov eax, dword [edi]
mov dword [ebp + 0xc], eax
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x4e8147
mov edx, dword [ebp + 0xc]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x4e8132
mov edx, dword [ebp - 0x10]
push esi
push edi
lea eax, [ebp - 0x20]
mov ecx, edx
push eax
call fcn.00493390
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4e8176
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0x4924924
je 0x4e8280
add eax, 4
mov dword [ebp - 0x18], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call fcn.00503d60
add esp, 4
mov dword [ebp - 0x14], eax
push edi
lea edi, [eax + 8]
mov ecx, edi
call fcn.0047b780
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x18], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
movups xmm0, xmmword [eax]
movups xmmword [edi + 0x18], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x28], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x74c0b0]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x74c0b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x4e8254
mov ecx, edi
call fcn.004c8160
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push esi
add ecx, 8
push ecx
push eax
mov ecx, edi
call fcn.00493390
mov ecx, dword [eax]
jmp 0x4e8257
mov ecx, dword [ebp - 0x20]
push dword [ebp - 0x14]
push ecx
push esi
mov ecx, edi
call fcn.004c7b90
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push str.unordered_map_set_too_long
call fcn.006ddb1a
int3
Function at 0x4ee3f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7342dd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push esi
push 0
push 0x77c6d8
lea ecx, [ebp - 0x24]
call fcn.004ee300
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 1
call fcn.005d1ee0
mov esi, eax
call fcn.005d0b80
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push str.logs
call fcn.005d02e0
add esp, 0x10
test esi, esi
je 0x4ee455
push esi
lea ecx, [ebp - 0x24]
call fcn.005d1f30
cmp dword [ebp - 0x10], 8
lea ecx, [ebp - 0x22c]
push ecx
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push eax
push 0
push 0
push 0x801c
push 0
call sub.SHELL32.dll_SHGetFolderPathAndSubDirW
test eax, eax
je 0x4ee4b6
cmp dword [ebp - 0x10], 8
lea ecx, [ebp - 0x22c]
push ecx
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push eax
push 0
push 0
push 0x8023
push 0
call sub.SHELL32.dll_SHGetFolderPathAndSubDirW
test eax, eax
je 0x4ee4b6
mov esi, dword [ebp + 8]
mov ecx, esi
push 0
push 0x749c2a
call fcn.004ee300
jmp 0x4ee4fe
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x22c]
xor eax, eax
lea edx, [ecx + 2]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ee4e0
sub ecx, edx
lea eax, [ebp - 0x22c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0047e880
lea ecx, [ebp - 0x24]
call fcn.0047c860
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4f4020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], edi
mov edx, ecx
lea eax, [edi + 0x6aa90]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax]
cmp eax, 0x2000
movzx eax, byte [ecx + 0x20]
setae byte [ebp - 1]
xor ebx, ebx
lea esi, [ecx + eax*2]
cmp ecx, esi
je 0x4f4073
mov ecx, ebx
mov eax, ebx
shr eax, 2
shl ecx, 6
add ecx, eax
movzx eax, word [edx]
add eax, 0x9e3779b9
add edx, 2
add eax, ecx
xor ebx, eax
cmp edx, esi
jne 0x4f4054
mov eax, 0x80060019
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0xd
imul eax, eax, 0x2aaa
sub ebx, eax
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], eax
add eax, ebx
xor edx, edx
mov esi, 0x2aaa
mov ecx, 1
div esi
mov ebx, edx
lea eax, [ebx + ebx*4]
lea edi, [edi + eax*8]
xor eax, eax
lea edx, [edi + 0x24]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edx
cmp byte [ebp - 1], al
je 0x4f40d7
mov ecx, 2
lock cmpxchg dword [edx], ecx
mov esi, eax
test esi, esi
jne 0x4f40e5
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
lock cmpxchg dword [edx], ecx
mov esi, eax
test esi, esi
je 0x4f41a2
cmp esi, 1
jne 0x4f416e
mov edi, dword [ebp - 0x10]
xor esi, esi
cmp esi, 0xa
jb 0x4f40ff
xor esi, esi
call sub.KERNEL32.dll_SwitchToThread
mov ebx, dword [edi]
nop
inc esi
cmp ebx, 1
je 0x4f40f3
mov edi, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov al, byte [edi + 0x20]
cmp al, byte [edx + 0x20]
jne 0x4f4185
movzx ecx, al
add ecx, ecx
sub ecx, 4
jb 0x4f4131
mov eax, dword [edi]
cmp eax, dword [edx]
jne 0x4f4136
add edi, 4
add edx, 4
sub ecx, 4
jae 0x4f4120
cmp ecx, 0xfffffffc
je 0x4f4163
mov al, byte [edi]
cmp al, byte [edx]
jne 0x4f4185
cmp ecx, 0xfffffffd
je 0x4f4163
mov al, byte [edi + 1]
cmp al, byte [edx + 1]
jne 0x4f4185
cmp ecx, 0xfffffffe
je 0x4f4163
mov al, byte [edi + 2]
cmp al, byte [edx + 2]
jne 0x4f4185
cmp ecx, 0xffffffff
je 0x4f4163
mov al, byte [edi + 3]
cmp al, byte [edx + 3]
jne 0x4f4185
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 2
je 0x4f40cc
push dword [ebp + 8]
mov ecx, edi
call fcn.004f3e50
test al, al
jne 0x4f41d3
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, 0x2aaa
jae 0x4f40cc
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0xc]
jmp 0x4f4095
mov eax, dword [ebp - 0x1c]
mov esi, 1
lock xadd dword [eax], esi
mov ecx, dword [ebp + 8]
lea eax, [ebx + ebx*4]
mov edi, dword [ebp - 0xc]
movups xmm0, xmmword [ecx]
movups xmmword [edi + eax*8], xmm0
movups xmm0, xmmword [ecx + 0x10]
movups xmmword [edi + eax*8 + 0x10], xmm0
mov cx, word [ecx + 0x20]
mov word [edi + eax*8 + 0x20], cx
nop
mov dword [edx], esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5008d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
xorps xmm0, xmm0
push 0xffffffffffffffff
push 0x734f2d
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 4]
push eax
mov dword [edi], vtable.std::exception.0
movq qword [eax], xmm0
lea eax, [esi + 4]
push eax
call fcn.006f4121
add esp, 8
mov dword [edi], vtable.boost::system::system_error.0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x14]
mov dword [edi + 0x10], ecx
lea ecx, [edi + 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.0047b780
mov ecx, dword [ebp - 0xc]
mov eax, edi
mov dword [edi + 0x2c], vtable.boost::exception.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5013c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x735115
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xorps xmm0, xmm0
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 4]
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.std::exception.0
push eax
movq qword [eax], xmm0
lea eax, [edi + 4]
push eax
call fcn.006f4121
add esp, 8
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x14]
mov dword [esi + 0x10], ecx
lea ecx, [esi + 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.0047b780
mov dword [esi], vtable.boost::thread_resource_error.0
mov dword [esi + 0x2c], vtable.boost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [ebp - 4], 1
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x501448
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [esi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x506780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
test ebx, ebx
je 0x5067d7
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x24]
xor ecx, ecx
movzx edx, byte [eax + edi]
mov eax, edx
and edx, 0x3f
shr eax, 6
lea esi, [esi + eax*8]
xor eax, eax
bts eax, edx
cmp edx, 0x20
cmovae ecx, eax
xor eax, ecx
cmp edx, 0x40
cmovae ecx, eax
or dword [esi], eax
or dword [esi + 4], ecx
inc edi
cmp edi, ebx
jne 0x5067a0
mov ecx, dword [ebp - 4]
mov ebx, dword [ecx + 4]
mov eax, dword [ebp + 0x10]
cmp ebx, eax
cmovb eax, ebx
cmp eax, ebx
je 0x506827
mov ecx, dword [ecx]
mov dword [ebp + 0x10], ecx
nop dword [eax + eax]
movzx edi, byte [ecx + eax]
xor esi, esi
mov ecx, edi
xor edx, edx
and ecx, 0x3f
bts esi, ecx
cmp ecx, 0x20
cmovae edx, esi
xor esi, edx
cmp ecx, 0x40
cmovae edx, esi
shr edi, 6
and esi, dword [ebp + edi*8 - 0x24]
and edx, dword [ebp + edi*8 - 0x20]
or esi, edx
je 0x50682a
inc eax
cmp eax, ebx
je 0x506827
mov ecx, dword [ebp + 0x10]
jmp 0x5067f0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x506840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
push edi
mov edx, ecx
xor edi, edi
mov dword [ebp - 4], edx
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
test ebx, ebx
je 0x506899
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x24]
xor ecx, ecx
movzx edx, byte [eax + edi]
mov eax, edx
and edx, 0x3f
shr eax, 6
lea esi, [esi + eax*8]
xor eax, eax
bts eax, edx
cmp edx, 0x20
cmovae ecx, eax
xor eax, ecx
cmp edx, 0x40
cmovae ecx, eax
or dword [esi], eax
or dword [esi + 4], ecx
inc edi
cmp edi, ebx
jne 0x506862
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
cmp dword [edx + 4], eax
cmovb eax, dword [edx + 4]
dec eax
cmp eax, 0xffffffff
je 0x5068e3
mov ebx, dword [edx]
nop dword [eax + eax]
movzx edi, byte [ebx + eax]
xor esi, esi
mov ecx, edi
xor edx, edx
and ecx, 0x3f
bts esi, ecx
cmp ecx, 0x20
cmovae edx, esi
xor esi, edx
cmp ecx, 0x40
cmovae edx, esi
shr edi, 6
and esi, dword [ebp + edi*8 - 0x24]
and edx, dword [ebp + edi*8 - 0x20]
or esi, edx
je 0x5068e6
dec eax
cmp eax, 0xffffffff
jne 0x5068b0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x507b20
Capabilities:
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x4c
push esi
push 0x800
push 0
push 0x77f440
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x507bbb
push str.IsWow64Process2
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x507bbb
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x507bb1
movzx ecx, word [ebp - 4]
cmp ecx, 0x14c
je 0x507c06
cmp ecx, 0x8664
je 0x507bf9
xor edx, edx
mov eax, 3
cmp ecx, 0xaa64
cmovne eax, edx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x40]
movaps xmmword [ebp - 0x40], xmm0
push eax
movaps xmmword [ebp - 0x30], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [ebp - 0x40]
test ecx, ecx
je 0x507c06
cmp ecx, 9
je 0x507bf9
xor edx, edx
mov eax, 3
cmp ecx, 0xc
cmovne eax, edx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, 2
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x507ca0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push 0x800
push 0
push 0x77f440
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x507d1c
push str.IsWow64Process2
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x507d1c
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x507d18
movzx ecx, word [ebp - 4]
cmp ecx, 0x14c
je 0x507d5b
cmp ecx, 0x8664
je 0x507d54
xor edx, edx
mov eax, 3
cmp ecx, 0xaa64
cmovne eax, edx
jmp 0x507d60
xor eax, eax
jmp 0x507d60
xorps xmm0, xmm0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x2c]
push eax
movups xmmword [ebp - 0x2c], xmm0
movups xmmword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [ebp - 0x2c]
test ecx, ecx
je 0x507d5b
cmp ecx, 9
je 0x507d54
xor edx, edx
mov eax, 3
cmp ecx, 0xc
cmovne eax, edx
jmp 0x507d60
mov eax, 2
jmp 0x507d60
mov eax, 1
mov ecx, dword [ebp + 8]
pop esi
cmp eax, ecx
je 0x507dba
cmp ecx, 2
jne 0x507db4
cmp eax, 3
jne 0x507db4
push 0x800
push 0
push 0x77f440
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x507db4
push str.GetMachineTypeAttributes
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x507db4
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push ecx
push 0x8664
call eax
test eax, eax
jne 0x507db4
test byte [ebp + 8], 3
jne 0x507dba
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret