joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e720
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x44e80b
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x44e7fa
jg 0x44e760
test edx, edx
je 0x44e7fa
nop dword [eax]
call fcn.00440270
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x44e7b7
jg 0x44e777
test esi, esi
je 0x44e7b7
cmp ebx, eax
jg 0x44e787
jl 0x44e781
cmp edi, esi
jae 0x44e787
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0xc]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [esp + 0x18]
call fcn.004bddb0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x10]
jmp 0x44e7dc
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x44e7f4
mov eax, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [esp + 0xc]
add eax, esi
mov dword [esp + 0x10], eax
test ebx, ebx
jg 0x44e760
jl 0x44e7f4
test edi, edi
jne 0x44e760
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x44e82d
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x44e82f
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x44e8e5
jg 0x44e84a
test esi, esi
je 0x44e8e5
test eax, eax
jl 0x44e893
jg 0x44e854
test ebx, ebx
je 0x44e893
cmp edi, eax
jg 0x44e864
jl 0x44e85e
cmp esi, ebx
jae 0x44e864
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.004bddb0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 0x2c]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x44e89a
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test edi, edi
jl 0x44e8e5
jg 0x44e8a4
test esi, esi
je 0x44e8e5
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x44e8e5
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x44e8d0
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [esp + 0x1c]
call fcn.004d576c
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44ec60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x53e754]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x44ec90
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a65f2
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x44eccc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x44eccc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a65f2
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x44edb5
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x44ecf4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x44ed27
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004cb8d6
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a65f2
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x44edb5
cmp eax, 1
jle 0x44ed88
cmp eax, 3
jne 0x44edb5
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.004cb8d6
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a65f2
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x44eda5
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004cbda4
add esp, 0x10
cmp edi, eax
jne 0x44edb5
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x44ecb7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a65f2
mov esp, ebp
pop ebp
ret 4
Function at 0x44f330
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x53e754]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x44f3d3
cmp byte [esi + 0x3d], 0
je 0x44f3d3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x44f389
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x44f39b
sub eax, 1
je 0x44f39f
sub eax, 2
je 0x44f3d3
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a65f2
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x44f3bc
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004cbda4
add esp, 0x10
cmp edi, eax
jne 0x44f389
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a65f2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004a65f2
mov esp, ebp
pop ebp
ret
Function at 0x450ab0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f6180
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x53e754]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov byte [ebp - 0x44], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x44]
mov edx, esi
call fcn.00424170
add esp, 4
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00439a80
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call fcn.00419480
test bl, bl
je 0x450b80
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x450b1e
mov eax, dword [esi]
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x450b87
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x450b8e
cmp eax, 3
je 0x450b8e
cmp eax, 0x20
je 0x450b53
cmp eax, 5
je 0x450b8e
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.00432fe0
mov dword [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x450b6c
mov eax, dword [eax]
mov edx, eax
mov ecx, str.Skipping_log_file_because_it_was_in_use__file:__s_
call fcn.00441c90
lea ecx, [ebp - 0x28]
call fcn.00419480
xor al, al
jmp 0x450c19
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x450b98
mov ecx, dword [esi]
call fcn.0043c9b0
or eax, edx
jne 0x450c17
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.00432fe0
mov dword [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x450bba
mov eax, dword [eax]
mov edx, eax
mov ecx, str.Deleting_log_file_because_it_was_empty__file:__s_
call fcn.00441c90
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.00419480
cmp byte [esi + 0x18], 0
je 0x450b80
mov ecx, esi
call fcn.00439e20
test al, al
jne 0x450b80
mov edx, esi
lea ecx, [ebp - 0x40]
call fcn.00432fe0
mov dword [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x450bff
mov eax, dword [eax]
mov edx, eax
mov ecx, str.Couldnt_delete_empty_file__file:__s_
call fcn.00426560
lea ecx, [ebp - 0x40]
call fcn.00419480
xor al, al
jmp 0x450c19
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a65f2
mov esp, ebp
pop ebp
ret
Function at 0x4568d0
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x53e754]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x2b8]
push edi
push 0x2b4
push 0
push eax
mov dword [ebp - 0x2bc], ebx
call fcn.004be8b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx edi, ax
lea eax, [ebp - 0x2b8]
push 0xac
push eax
push 0x59
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0xac
lea eax, [ebp - 0x20c]
push eax
push 0x5a
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x160]
push str._ls__ls
push eax
call fcn.00438540
add esp, 0x10
lea edx, [ebp - 0x160]
mov ecx, ebx
call fcn.00439be0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.004a65f2
mov esp, ebp
pop ebp
ret 4

Function at 0x457ba0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ef5e0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x53e754]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
mov edi, edx
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + esi + 0x30]
rep stosb byte es:[edi], al
call fcn.00473430
add esp, 4
mov dword [ebp - 4], 1
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x457c0f
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x457c20
push 0x48
push esi
call fcn.004a6603
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x457ef0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7090
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x53e754]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
mov edi, edx
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + esi + 0x30]
rep stosb byte es:[edi], al
call fcn.00473430
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov edi, edx
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + esi + 0x20]
rep stosb byte es:[edi], al
call fcn.00473430
add esp, 8
mov dword [ebp - 4], 2
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x457f77
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x457f88
push 0x40
push esi
call fcn.004a6603
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4598d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f73c8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x53e754]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0xf
mov byte [ebp - 0x6c], 0
lea eax, [ebp - 0x74]
mov dword [ebp - 4], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], 0x40
mov dword [ebp - 0x78], 1
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push str.MachineGuid
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test esi, esi
jne 0x45998e
test eax, eax
jne 0x45998e
lea ecx, [ebp - 0x54]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x459978
sub ecx, edx
lea eax, [ebp - 0x54]
push ecx
push eax
lea ecx, [ebp - 0x6c]
call fcn.00418ea0
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
lea edx, [ebp - 0x6c]
cmp dword [ebp - 0x58], 0x10
mov ecx, edi
cmovae edx, dword [ebp - 0x6c]
call fcn.00439c70
mov edx, dword [ebp - 0x58]
cmp edx, 0x10
jb 0x459a46
mov ecx, dword [ebp - 0x6c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x459a3c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x459a64
jmp 0x459a3c
push edx
push ecx
call fcn.004a6603
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a65f2
mov esp, ebp
pop ebp
ret
call fcn.004c6cef
call fcn.004c6cef
int3
Function at 0x45ea50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x811c9dc5
push esi
mov dword [ebp - 8], ecx
xor esi, esi
push edi
lea ecx, [ebx + 4]
mov edx, ebx
cmp ecx, ebx
sbb edi, edi
and edi, 0xfffffffc
add edi, 4
cmp ebx, ecx
ja 0x45ea93
nop dword [eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
inc esi
imul eax, ecx, 0x1000193
cmp esi, edi
jne 0x45ea80
mov esi, dword [ebp - 8]
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0xc]
and ecx, eax
mov esi, dword [esi + 4]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
nop dword [eax]
cmp edi, esi
jne 0x45eab8
mov ecx, esi
jmp 0x45eabd
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x45ead0
mov ecx, dword [eax + 8]
cmp ecx, dword [ebx]
je 0x45eacc
mov eax, dword [eax]
jmp 0x45eab0
cmp eax, esi
jne 0x45eb1a
mov esi, dword [esi]
lea eax, [ebp - 0xc]
push ecx
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
mov dword [ebp - 0xc], ebx
call fcn.0045fd50
mov ebx, dword [ebp - 8]
mov edx, eax
mov ecx, 0x71c71c6
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x45eb26
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0045f910
mov eax, dword [ebp - 0x10]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.0048f84d
int3
Function at 0x45fd80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov edx, 0x811c9dc5
push ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 4], ecx
push edi
lea esi, [eax + 8]
xor edi, edi
lea ecx, [esi + 4]
cmp ecx, esi
sbb ebx, ebx
and ebx, 0xfffffffc
add ebx, 4
cmp esi, ecx
ja 0x45fdc3
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, edx
inc edi
imul edx, ecx, 0x1000193
cmp edi, ebx
jne 0x45fdb0
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
and ecx, edx
mov edx, dword [ebx + 0xc]
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x45fdfc
cmp ecx, eax
jne 0x45fdf4
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x45fe04
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x45fe04
cmp ecx, eax
jne 0x45fe04
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.0045f2f0
mov eax, dword [ebp - 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46053b
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x53e754]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
lea ecx, [ebp - 0x10]
push edi
call fcn.004601c7
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push esi
mov eax, 0x4000
push eax
push eax
push 1
push esi
push 0x40080003
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [ebx + 8], eax
cmp eax, 0xffffffff
jne 0x460584
mov dword [ebx + 8], esi
jmp 0x4605d8
lea esi, [ebx + 0x14]
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
push dword [ebx + 8]
mov dword [ebx + 0x24], eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x4605d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4605d8
push dword [ebx + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
xor eax, eax
lea edi, [ebx + 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push dword [ebx + 8]
call esi
and dword [ebx + 8], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a65f2
leave
ret
Function at 0x473440
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor cl, cl
mov edx, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 8], eax
push ebp
push esi
push edi
test bl, 3
jne 0x473571
test al, 3
jne 0x473571
mov edi, edx
mov dword [esp + 0x10], 0
shr edi, 2
xor esi, esi
test edi, edi
je 0x47352c
cmp edi, 8
jb 0x4734f5
mov ebp, dword [esp + 0x24]
mov ecx, edi
mov dword [esp + 0x14], ebx
and ecx, 0xfffffff8
add eax, 0x10
xorps xmm3, xmm3
sub dword [esp + 0x14], ebp
xorps xmm2, xmm2
mov ebp, dword [esp + 0x14]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, ecx
jb 0x4734a4
mov eax, dword [esp + 0x24]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edi
jae 0x473530
mov ebp, ebx
lea ecx, [eax + esi*4]
sub ebp, eax
mov dword [esp + 0x14], ebp
mov ebp, edi
mov ebx, dword [esp + 0x14]
sub ebp, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, dword [ecx + ebx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
or edi, eax
sub ebp, 1
jne 0x473512
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x10], edi
jmp 0x473534
xor edi, edi
jmp 0x473534
mov edi, dword [esp + 0x10]
shl esi, 2
sub edx, esi
jne 0x473548
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x24]
mov ecx, eax
shr eax, 0x10
add ebp, esi
shr ecx, 0x18
or cl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or cl, al
mov eax, ebp
or cl, byte [esp + 0x10]
xor edi, edi
test edx, edx
je 0x473630
cmp edx, 0x20
jb 0x47360a
mov esi, edx
xorps xmm3, xmm3
and esi, 0xffffffe0
xorps xmm2, xmm2
mov dword [esp + 0x10], esi
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x4735a5
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or cl, al
mov ebp, dword [esp + 0x14]
cmp edi, edx
jae 0x473630
sub ebx, ebp
lea esi, [edi + ebp]
sub edx, edi
nop dword [eax]
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or cl, al
sub edx, 1
jne 0x473620
pop edi
pop esi
test cl, cl
pop ebp
sete al
pop ebx
add esp, 0xc
ret
Function at 0x487a70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 8]
not eax
push esi
mov esi, dword [esp + 0x10]
push edi
cmp esi, 8
jbe 0x487b46
test bl, 7
je 0x487aa9
nop
movzx ecx, byte [ebx]
dec esi
movzx edx, al
inc ebx
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x504318]
test bl, 7
jne 0x487a90
mov edi, esi
and esi, 7
and edi, 0xfffffff8
add edi, ebx
cmp ebx, edi
jae 0x487b46
nop dword [eax + eax]
xor eax, dword [ebx]
add ebx, 4
mov dword [esp + 0x18], ebx
add dword [esp + 0x18], 4
mov ebx, dword [ebx]
mov ecx, ebx
shr ecx, 0x10
movzx edx, cl
mov ecx, ebx
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x504718]
xor edx, dword [ecx*4 + 0x504b18]
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
xor edx, dword [ecx*4 + 0x505718]
mov ecx, eax
shr ecx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x505b18]
mov ecx, ebx
shr ecx, 0x18
xor edx, dword [ecx*4 + 0x504318]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x505318]
movzx ecx, bl
mov ebx, dword [esp + 0x18]
xor edx, dword [ecx*4 + 0x504f18]
xor edx, dword [eax*4 + 0x505f18]
mov eax, edx
cmp ebx, edi
jb 0x487ac0
test esi, esi
je 0x487b6a
nop word [eax + eax]
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x504318]
sub esi, 1
jne 0x487b50
pop edi
pop esi
not eax
pop ebx
ret

Function at 0x487b70
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 8]
not eax
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x18]
not esi
cmp edi, 4
jbe 0x487c56
mov dword [esp + 0x1c], ebx
test bl, 3
je 0x487bc8
nop word [eax + eax]
movzx ecx, byte [ebx]
dec edi
movzx edx, al
inc ebx
shrd eax, esi, 8
xor edx, ecx
shr esi, 8
xor eax, dword [edx*8 + 0x506318]
xor esi, dword [edx*8 + 0x50631c]
test bl, 3
jne 0x487ba0
mov dword [esp + 0x1c], ebx
mov ebp, edi
xor edx, edx
and ebp, 0xfffffffc
and edi, 3
mov dword [esp + 0x18], edi
lea ecx, [ebx + ebp]
shr ebp, 2
cmp ebx, ecx
cmova ebp, edx
test ebp, ebp
je 0x487c56
xor edi, edi
mov ebx, dword [ebx]
inc edi
xor ebx, eax
mov eax, ebx
shr eax, 0x10
movzx edx, al
mov eax, ebx
shr eax, 8
movzx ecx, al
mov eax, dword [edx*8 + 0x506b18]
mov edx, dword [edx*8 + 0x506b1c]
xor eax, dword [ecx*8 + 0x507318]
xor edx, dword [ecx*8 + 0x50731c]
mov ecx, ebx
shr ecx, 0x18
xor eax, dword [ecx*8 + 0x506318]
xor edx, dword [ecx*8 + 0x50631c]
movzx ecx, bl
mov ebx, dword [esp + 0x1c]
add ebx, 4
mov dword [esp + 0x1c], ebx
xor eax, dword [ecx*8 + 0x507b18]
xor edx, dword [ecx*8 + 0x507b1c]
xor eax, esi
xor edx, 0
mov esi, edx
cmp edi, ebp
jb 0x487be7
mov edi, dword [esp + 0x18]
test edi, edi
je 0x487c85
nop word [eax + eax]
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
shrd eax, esi, 8
xor edx, ecx
shr esi, 8
xor eax, dword [edx*8 + 0x506318]
xor esi, dword [edx*8 + 0x50631c]
sub edi, 1
jne 0x487c60
not esi
not eax
pop edi
mov edx, esi
pop esi
pop ebp
pop ebx
ret