joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49ad70
Capabilities:
Get common file path
Get disk size
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x260
mov bl, byte [ebp + 8]
mov eax, dword [0x540010]
xor eax, ebp
mov dword [esp + 0x258], eax
xor edi, edi
lea esi, [esp + 0x50]
push 0x208
push edi
push esi
call fcn.004e3a90
add esp, 0xc
test bl, bl
mov eax, 0x26
mov ecx, 0x1c
cmovne ecx, eax
push esi
push edi
push edi
push ecx
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x49ae50
xor eax, eax
dec eax
mov ecx, esp
mov dword [ecx + 4], eax
mov dword [ecx], eax
push edi
push edi
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x49ae29
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 4]
mov bl, 1
cmp dword [esp], eax
sbb ecx, 0
jae 0x49ae83
lea esi, [esp + 8]
mov ecx, esi
push 0xfa
push str.HasEnoughDiskSpace
push 0
call fcn.00455190
lea ecx, [esp + 0x44]
push 0x5301e7
push str.There_is_not_enough_disk_space_to_install_browser
call fcn.004147c0
mov ecx, esi
call fcn.004553c0
xor ebx, ebx
jmp 0x49ae83
lea esi, [esp + 8]
mov ecx, esi
push 0xf4
push str.HasEnoughDiskSpace
push 0
call fcn.00455190
lea ecx, [esp + 0x44]
push 0x5301b5
push str.GetDiskFreeSpaceEx_failed
jmp 0x49ae75
lea esi, [esp + 8]
mov ecx, esi
push 0xee
push str.HasEnoughDiskSpace
push 0
call fcn.00455190
lea ecx, [esp + 0x44]
push 0x53019b
push str.SHGetFolderPath_failed
call fcn.004147c0
mov ecx, esi
call fcn.004553c0
mov bl, 1
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.004e0685
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49cba0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xd0
mov edx, dword [ebp + 8]
mov eax, dword [0x540010]
xor eax, ebp
mov dword [esp + 0xc8], eax
lea esi, [esp + 0x7c]
mov dword [esi], 0xffffffff
mov ecx, esi
call fcn.0049cd40
mov edi, dword [esi]
lea esi, [edi + 1]
cmp esi, 2
jae 0x49cc08
xor ebx, ebx
cmp esi, 2
jb 0x49cbf0
call fcn.00492150
push edi
call fcn.0047b600
add esp, 4
mov ecx, dword [esp + 0xc8]
xor ecx, ebp
call fcn.004e0685
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0xc], esi
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x80]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov dword [esi + 0x40], 0xffffffff
lea eax, [esp + 0x78]
mov dword [eax], 0x44
push eax
push esi
push 0
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x49ccc9
xor ebx, ebx
mov ecx, edi
lea edi, [esp + 0x20]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [esp + 0x10], ecx
mov edx, 2
push edi
call fcn.0049ce10
add esp, 4
mov edi, dword [edi]
test al, al
je 0x49cc9e
cmp dword [esp + 0x24], edi
je 0x49cd29
xor ebx, ebx
cmp dword [edi], 0
je 0x49cc9e
push dword [edi + ebx*8 + 4]
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x49cc9c
inc ebx
cmp ebx, dword [edi]
jb 0x49cc84
xor ebx, ebx
jmp 0x49cc9e
mov bl, 1
test edi, edi
mov esi, dword [esp + 0xc]
je 0x49ccc0
mov eax, dword [esp + 0x24]
mov ecx, eax
sub ecx, edi
dec eax
cmp ecx, eax
ja 0x49cd38
push edi
call fcn.004dfb35
add esp, 4
mov edi, dword [esp + 0x10]
jmp 0x49cbdd
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esp + 0x14]
push eax
push esi
call fcn.0050e3e0
add esp, 8
lea ebx, [esp + 0x20]
mov ecx, ebx
push esi
push 0x61
push str.IsUserAnAdminGroup
push 1
call fcn.00455540
lea ecx, [esp + 0x5c]
push 0x530753
push str.CreateWellKnownSid_failed
call fcn.004147c0
mov ecx, ebx
call fcn.00455590
cmp byte [esi + 0xb], 0
jns 0x49cd1e
push dword [esp + 0x14]
call fcn.004dfb35
add esp, 4
xor ebx, ebx
mov esi, dword [esp + 0xc]
jmp 0x49cbdd
push str....._third_partylibc_srcinclude_vector:1393:_assertion___n___size___failed:_vector___index_out_of_bounds_n
push 0x521354
call fcn.0044d640
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
jmp 0x49cd2e
Function at 0x49e500
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [0x540010]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x546b74]
mov ecx, dword [0x543ad4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x49e548
mov esi, dword [0x546b70]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004e0685
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret
push 0x546b74
call fcn.004dfba7
add esp, 4
cmp dword [0x546b74], 0xffffffff
jne 0x49e52f
push 0x18
call fcn.004dfb05
add esp, 4
mov esi, eax
xorps xmm0, xmm0
movsd qword [eax], xmm0
xor eax, eax
mov dword [esi + 8], eax
lea ecx, [esi + 0x10]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edi, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.0041e1b0
mov ecx, esi
push edi
call fcn.0049f7b0
cmp byte [edi + 0xb], 0
jns 0x49e5ac
push dword [ebp - 0x18]
call fcn.004dfb35
add esp, 4
mov ecx, esi
call fcn.0049f850
mov dword [0x546b70], esi
push 0x546b74
call fcn.004dfc1d
add esp, 4
jmp 0x49e52f

Function at 0x49f7b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x540010]
xor eax, ebp
mov dword [ebp - 0xc], eax
xorps xmm0, xmm0
lea edi, [ebp - 0x18]
movsd qword [edi], xmm0
mov dword [edi + 8], 0
mov edx, edi
call fcn.0049eed0
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x49f7ec
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x49f824
mov dword [ebp - 0x1c], 0
test al, al
jns 0x49f7fe
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x49f821
mov edi, eax
mov ecx, esi
push eax
push dword [ebp - 0x1c]
call fcn.0049fbb0
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, byte [ebp - 0xd]
test al, al
jns 0x49f833
push dword [ebp - 0x18]
call fcn.004dfb35
add esp, 4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004e0685
add esp, 0x14
pop esi
pop edi
pop ebp
ret 4
Function at 0x4a4c40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ebx, edx
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4a4caf
mov edi, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4a4caf
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4a4caf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4a4caf
mov ebx, eax
mov ecx, esi
mov edi, dword [ebp - 0x10]
push edi
call fcn.0041cbb0
mov eax, dword [esi]
cmp dword [esi + 4], eax
je 0x4a4cb9
push edi
push ebx
push eax
call fcn.004e3510
add esp, 0xc
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push str....._third_partylibc_srcinclude_vector:1393:_assertion___n___size___failed:_vector___index_out_of_bounds_n
push 0x521354
call fcn.0044d640
int3
Function at 0x4a6fc0
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov eax, dword [0x540010]
xor eax, ebp
mov dword [esp + 0x78], eax
lea esi, [ecx + 4]
xor eax, eax
push esi
push eax
push eax
push 0x8004
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4a7048
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov bl, 1
test eax, eax
jne 0x4a70e0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
lea esi, [esp + 4]
push eax
push esi
call fcn.0050e3e0
add esp, 8
lea ecx, [esp + 0x10]
push esi
push 0x3a
push str.HashData
push 1
call fcn.00455540
lea esi, [esp + 0x4c]
mov ecx, esi
push 0x532f26
push str.Failed_to_hash_data__error:
jmp 0x4a7081
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
lea esi, [esp + 4]
push eax
push esi
call fcn.0050e3e0
add esp, 8
lea ecx, [esp + 0x10]
push esi
push 0x35
push str.HashData
push 1
call fcn.00455540
lea esi, [esp + 0x4c]
mov ecx, esi
push 0x532f09
push str.Failed_to_initialize_hash_object__error:
call fcn.004147c0
call edi
lea edi, [esp + 0x6c]
push eax
push edi
call fcn.004dcea0
add esp, 8
movzx eax, byte [edi + 0xb]
test al, al
jns 0x4a70a6
mov eax, dword [esp + 0x70]
mov edi, dword [esp + 0x6c]
mov ecx, esi
push eax
push edi
call fcn.00478310
cmp byte [esp + 0x77], 0
jns 0x4a70c2
push dword [esp + 0x6c]
call fcn.004dfb35
add esp, 4
lea ecx, [esp + 0x10]
call fcn.00455590
cmp byte [esp + 0xf], 0
jns 0x4a70de
push dword [esp + 4]
call fcn.004dfb35
add esp, 4
xor ebx, ebx
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.004e0685
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4a76e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4a7725
movzx eax, word [esi]
cmp eax, 0x5a4d
jne 0x4a7725
mov eax, dword [esi + 0x3c]
cmp dword [esi + eax], 0x4550
jne 0x4a7725
mov edx, dword [esi + eax + 0x98]
xor eax, eax
test edx, edx
je 0x4a7727
add edx, esi
je 0x4a7727
mov eax, edx
add eax, 8
je 0x4a7725
cmp byte [eax], 0x30
jne 0x4a7725
cmp byte [edx + 9], 0x82
je 0x4a772d
xor eax, eax
pop esi
pop edi
pop ebp
ret 0xc
movzx eax, word [edx + 0xa]
rol ax, 8
movzx eax, ax
add eax, 0x13
and eax, 0x1fff8
je 0x4a7725
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], edx
add edx, eax
add esi, dword [ecx + 0x10]
cmp edx, esi
jae 0x4a7725
cmp dword [edx], 0x74636159
jne 0x4a7725
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
movzx ecx, word [edx + 4]
rol cx, 8
movzx edi, cx
test esi, esi
je 0x4a7786
cmp dword [eax], edi
jle 0x4a7725
add edx, 6
push edi
push edx
push esi
call fcn.004e3510
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x4a7789
inc edi
mov dword [eax], edi
mov al, 1
jmp 0x4a7727
Function at 0x4a7f70
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x540010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0x10]
push 0x4d
push str.file_version_info_win.cc
push str.CreateFileVersionInfoWin
push edi
call fcn.00492120
add esp, 0x10
mov ecx, esi
push 0
push edi
call fcn.00486fa0
mov dword [esp + 0xc], 0xffffffff
cmp byte [ebx + 0xb], 0
jns 0x4a7fd3
mov ebx, dword [ebx]
mov esi, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], ebx
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4a809c
mov ebx, eax
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
test eax, eax
js 0x4a80f4
push ebx
call fcn.004dfb05
add esp, 4
mov edi, eax
mov dword [esp + 0x10], eax
add eax, ebx
mov dword [esp + 0x18], eax
mov ecx, edi
add ecx, esi
je 0x4a80e5
mov byte [ecx], 0
inc esi
cmp ebx, esi
jne 0x4a801a
mov dword [esp + 0x14], eax
push edi
push ebx
push dword [esp + 0x14]
push dword [esp + 0x14]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4a80a4
lea eax, [esp + 0x54]
mov dword [eax], 0
lea ecx, [esp + 0x50]
mov dword [ecx], 0xffffffff
push ecx
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4a80a4
mov esi, dword [esp + 0x54]
test esi, esi
je 0x4a80a4
push 0x1c
call fcn.004dfb05
add esp, 4
mov edi, eax
movzx eax, word [esi + 2]
movzx edx, word [esi]
mov ecx, edi
push eax
push edx
lea eax, [esp + 0x18]
push eax
call fcn.004a8110
mov esi, dword [ebp + 8]
mov dword [esi], edi
mov edi, dword [esp + 0x10]
jmp 0x4a80ad
mov dword [esi], 0
jmp 0x4a80c7
mov esi, dword [ebp + 8]
mov dword [esi], 0
test edi, edi
je 0x4a80c7
mov eax, dword [esp + 0x14]
mov ecx, eax
sub ecx, edi
dec eax
cmp ecx, eax
ja 0x4a80fd
push edi
call fcn.004dfb35
add esp, 4
lea ecx, [esp + 0x20]
call fcn.00487010
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004e0685
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
push 0x521354
call fcn.0044d640
lea ecx, [esp + 0x10]
call fcn.00416ce0
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
jmp 0x4a80ea
Function at 0x4a8450
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x230
mov edi, ecx
mov eax, dword [0x540010]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, word [ecx + 0x14]
mov word [ebp - 0x28], ax
movzx eax, word [ecx + 0x16]
mov word [ebp - 0x26], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call esi
mov word [ebp - 0x24], ax
movzx eax, word [edi + 0x16]
mov word [ebp - 0x22], ax
mov dword [ebp - 0x23c], edi
movzx eax, word [edi + 0x14]
mov word [ebp - 0x20], ax
mov di, 0x4e4
mov word [ebp - 0x1e], di
call esi
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x1a], 0x40904e4
mov dword [ebp - 0x16], 0x40904b0
mov word [ebp - 0x12], di
mov esi, 2
lea edi, [ebp - 0x230]
push 0x208
push 0xff
push edi
call fcn.004e3a90
add esp, 0xc
movzx eax, word [ebp + esi - 0x28]
movzx ecx, word [ebp + esi - 0x2a]
push dword [ebp + 8]
push eax
push ecx
push str.StringFileInfo_04x_04x_ls
mov eax, 0x104
push eax
push eax
push edi
call fcn.004a4240
add esp, 0x1c
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x238], 0xffffffff
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x234]
push eax
push edi
mov eax, dword [ebp - 0x23c]
push dword [eax + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
setne cl
mov eax, dword [ebp - 0x234]
test eax, eax
setne dl
and dl, cl
mov ecx, dword [ebp - 0x238]
test ecx, ecx
setne bl
and bl, dl
cmp bl, 1
je 0x4a855f
add esi, 4
cmp esi, 0x1a
jne 0x4a84c5
jmp 0x4a8582
dec ecx
push ecx
push eax
call fcn.004fbd43
add esp, 8
mov edx, dword [ebp - 0x234]
test eax, eax
je 0x4a8578
test edx, edx
je 0x4a859b
mov ecx, dword [ebp + 0xc]
push eax
push edx
call fcn.004293b0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e0685
mov eax, ebx
add esp, 0x230
pop esi
pop edi
pop ebx
pop ebp
ret 8
push str....._third_partylibc_srcinclude_string:2489:_assertion___n__0____s___nullptr_failed:_string::assign_received_nullptr_n
push 0x521354
call fcn.0044d640
int3
Function at 0x4ac620
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
mov eax, dword [ecx]
jne 0x4ac641
test eax, eax
jne 0x4ac641
cmp dword [esi + 0xc], 0
je 0x4ac731
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x4ac660
call fcn.00492150
push dword [esi]
call fcn.0047b600
add esp, 4
mov dword [esi], 0
xor eax, eax
mov ecx, dword [esi + 4]
lea edx, [ecx + 1]
cmp edx, 2
jb 0x4ac686
call fcn.00492150
push dword [esi + 4]
call fcn.0047b600
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi]
xor ecx, ecx
xor edx, edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov ebx, dword [edi]
cmp eax, ebx
je 0x4ac6d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x4ac6b9
call fcn.00492150
push dword [esi]
call fcn.0047b600
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4ac6c8
mov dword [esi], ebx
call fcn.00492150
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esi + 4]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp ecx, ebx
je 0x4ac71e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jb 0x4ac704
call fcn.00492150
push dword [esi + 4]
call fcn.0047b600
add esp, 4
mov dword [esi + 4], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4ac714
mov dword [esi + 4], ebx
call fcn.00492150
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
cmp dword [esi + 4], 0
jne 0x4ac641
xor ecx, ecx
xor eax, eax
jmp 0x4ac68e
Function at 0x4b0150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [0x540010]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp dword [ebp + 8], 0x30
ja 0x4b025f
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea ebx, [esi + 0xfc]
call dword [0x53a380]
lea eax, [ebp - 0x40]
push esi
push eax
push ebx
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x53a380]
push esi
lea eax, [ebp - 0x30]
push eax
push ebx
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x53a380]
push esi
lea eax, [ebp - 0x20]
push eax
push ebx
call ecx
mov edx, dword [ebp + 8]
add esp, 0xc
test edx, edx
je 0x4b021b
xor eax, eax
mov cl, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp edx, eax
jne 0x4b020f
push 1
call fcn.004df940
add esp, 4
bt eax, 0x19
jae 0x4b0273
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403380
add esp, 0xc
mov eax, 0x401b90
mov ecx, section..text
lea edx, [ebp - 0x20]
mov dword [esi + 0xf4], ecx
mov dword [esi + 0xf8], eax
movups xmm0, xmmword [edx]
movups xmmword [ebx], xmm0
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e0685
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
bt eax, 9
jae 0x4b0294
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403ea0
add esp, 0xc
xor eax, eax
mov ecx, 0x403f50
jmp 0x4b0247
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00510a00
add esp, 0xc
mov eax, 0x510f30
mov ecx, 0x510910
jmp 0x4b0247

Function at 0x4b1070
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d08f0

Function at 0x4b23a0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, edx
mov esi, ecx
cmp byte [ebp + 8], 0
jne 0x4b23c9
mov al, byte [0x5513e0]
test al, 1
je 0x4b23c9
call fcn.004df970
push edi
push esi
call fcn.004afdb0
add esp, 8
jmp 0x4b23fe
mov eax, dword [0x5513e8]
mov ecx, dword [0x543ad4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4b2414
mov ecx, dword [0x5513e4]
test ecx, ecx
je 0x4b2402
call dword [0x53a380]
push edi
push esi
call ecx
test eax, eax
je 0x4b2459
pop esi
pop edi
pop ebp
ret
test edi, edi
je 0x4b23fe
push edi
push esi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x4b23fe
int3
push 0x5513e8
call fcn.004dfba7
add esp, 4
cmp dword [0x5513e8], 0xffffffff
jne 0x4b23e6
push str.bcryptprimitives.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4b245c
push str.ProcessPrng
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5513e4], eax
push 0x5513e8
call fcn.004dfc1d
add esp, 4
jmp 0x4b23e6
int3
int3
Function at 0x4bad20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
test ecx, ecx
js 0x4bad54
mov eax, dword [ebp + 8]
je 0x4bad4f
mov edx, dword [ebp + 0xc]
xor esi, esi
movzx edi, byte [edx + esi]
movzx ebx, al
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x533d78]
inc esi
cmp ecx, esi
jne 0x4bad37
pop esi
pop edi
pop ebx
pop ebp
ret
int3

Function at 0x4bf280
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.004fbc1b
add esp, 4
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4c12e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x540010]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
movzx ecx, byte [eax + 0xb]
test cl, cl
jns 0x4c1306
mov ecx, dword [eax + 4]
mov eax, dword [eax]
test ecx, ecx
js 0x4c13ed
je 0x4c1318
test eax, eax
je 0x4c13df
lea edx, [ebp - 0x2c]
push ecx
push eax
push edx
call fcn.004dba90
add esp, 0xc
lea eax, [ebp - 0x38]
mov byte [eax + 0xb], 0xa
cmp eax, str.partner_id
ja 0x4c1343
lea ecx, [ebp - 0x2e]
cmp ecx, str.partner_id
ja 0x4c13e6
add esi, 0x18
mov word [ebp - 0x30], 0x6469
mov dword [ebp - 0x34], 0x5f72656e
mov dword [ebp - 0x38], 0x74726170
mov byte [ebp - 0x2e], 0
lea edx, [ebp - 0x20]
mov dword [edx], eax
lea edi, [ebp - 0x19]
lea ebx, [ebp - 0x18]
mov ecx, esi
push edi
push edx
push 0x521940
push eax
push ebx
call fcn.004155d0
mov eax, dword [ebx]
lea esi, [eax + 0x1c]
cmp byte [eax + 0x27], 0
jns 0x4c138e
push dword [esi]
call fcn.004dfb35
add esp, 4
mov eax, dword [ebp - 0x24]
mov dword [esi + 8], eax
movsd xmm0, qword [ebp - 0x2c]
movsd qword [esi], xmm0
mov byte [ebp - 0x21], 0
mov word [ebp - 0x2c], 0
cmp byte [ebp - 0x2d], 0
js 0x4c13c1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e0685
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 4
push dword [ebp - 0x38]
call fcn.004dfb35
add esp, 4
cmp byte [ebp - 0x21], 0
jns 0x4c13ad
push dword [ebp - 0x2c]
call fcn.004dfb35
add esp, 4
jmp 0x4c13ad
push str....._third_partylibc_srcinclude_string_view:313:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
jmp 0x4c13f2
push str....._third_partylibc_srcinclude__stringchar_traits.h:245:_assertion__std::__is_pointer_in_range___s1____s1____n____s2__failed:_char_traits::copy:_source_and_destination_ranges_overlap_n
jmp 0x4c13f2
push str....._third_partylibc_srcinclude_string_view:311:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
push 0x521354
call fcn.0044d640
int3