joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55fa50
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x218
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea edi, [ebp - 0x220]
mov dword [edi + 4], eax
mov dword [edi], eax
push edi
call sub.ntdll.dll_RtlFormatCurrentUserKeyPath
test eax, eax
js 0x55fba1
mov dword [ebp - 0x224], eax
mov esi, 0xff
mov ebx, 0x73e93e
push esi
push dword [ebp - 0x21c]
push ebx
call fcn.00687cf5
add esp, 0xc
push ebx
call fcn.00687336
add esp, 4
sub esi, eax
push esi
push 0x7069e0
push ebx
call fcn.00687cf5
add esp, 0xc
push edi
call sub.ntdll.dll_RtlFreeUnicodeString
lea esi, [ebp - 0x218]
push 0x208
push 0
push esi
call fcn.006719e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
push 0x104
push esi
push 0x70b39c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x55fb0b
push eax
push esi
push edi
call fcn.00687d3a
add esp, 0xc
test eax, eax
je 0x55fb3a
push 0x104
push esi
push str.PROGRAMFILES_X86_
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x55fb36
push eax
push esi
push edi
call fcn.00687d3a
add esp, 0xc
test eax, eax
je 0x55fb3a
xor eax, eax
jmp 0x55fb3c
mov al, 1
mov byte [0x73e53d], al
mov dword [ebp - 0x218], 0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x7129f0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x55fb8c
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
mov ecx, edi
call dword [section..00cfg]
push esi
push ebx
call edi
test eax, eax
je 0x55fb8c
cmp dword [ebp - 0x218], 0
setne cl
jmp 0x55fb8e
xor ecx, ecx
mov eax, dword [ebp - 0x224]
mov byte [0x73eb3e], cl
mov byte [0x73e53c], 1
test eax, eax
setns bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066e1f1
mov eax, ebx
add esp, 0x218
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x55fe00
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov ebx, edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x55fe25
mov eax, dword [ecx + 4]
test eax, eax
je 0x55fe4e
bt ebx, 8
jae 0x55fe38
mov eax, ebx
and eax, 0x200
jne 0x55fe4e
cmp edi, 2
mov eax, 0x73e53e
mov ecx, 0x73e73e
cmove ecx, eax
cmp word [ecx], 0
je 0x55fe60
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066e1f1
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
xorps xmm0, xmm0
lea esi, [ebp - 0x34]
movups xmmword [esi + 0x10], xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x20], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [esi], 0
je 0x55fe4e
cmp byte [0x73eb3e], 0
setne al
bt ebx, 8
jb 0x55fe4e
shr ebx, 9
and ebx, 1
or bl, al
je 0x55fe4e
cmp edi, 2
mov eax, 0x712a34
mov edx, 0x712a48
cmove edx, eax
mov eax, dword [ebp + 8]
movzx ebx, byte [eax + 0xb]
test bl, bl
js 0x55febe
mov ecx, ebx
mov esi, eax
mov eax, ebx
jmp 0x55fec3
mov esi, dword [eax]
mov eax, dword [eax + 4]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x50], ecx
mov ebx, dword [edx + 4]
mov edi, eax
sub edi, ebx
jb 0x55ff08
push ebx
push dword [edx]
push esi
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], eax
call fcn.00682dfc
mov edx, dword [ebp - 0x4c]
add esp, 0xc
test eax, eax
mov eax, dword [ebp - 0x48]
je 0x55ff16
add edx, 0x14
mov ecx, dword [ebp - 0x50]
inc ecx
cmp ecx, dword [ebp - 0x44]
jb 0x55fee0
jmp 0x55ff76
movzx ecx, word [esi + ebx*2]
cmp ecx, 0x5c
je 0x55ff23
test ecx, ecx
jne 0x55ff08
lea eax, [esi + ebx*2]
mov ebx, dword [edx + 8]
cmp ebx, 1
je 0x55ff41
cmp ebx, 2
mov esi, ebx
jne 0x55ff4d
mov dword [ebp - 0x3c], str.WOW6432Node
mov dword [ebp - 0x38], eax
jmp 0x55ff4d
mov dword [ebp - 0x3c], str.WOW6432Node_
mov dword [ebp - 0x38], esi
mov esi, ebx
mov dword [ebp - 0x40], esi
cmp cx, 0x5c
jne 0x55ff65
lea esi, [eax + 2]
dec edi
cmp word [eax + 2], 0x5c
mov eax, esi
je 0x55ff56
jmp 0x55ff67
mov esi, eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x44], eax
mov edx, dword [edx + 0xc]
xor ecx, ecx
mov eax, edi
jmp 0x55ff0f
cmp dword [ebp - 0x40], 0
je 0x55fe4e
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x55ff8d
mov eax, dword [ecx]
mov edx, dword [ebp - 0x38]
sub edx, eax
sar edx, 1
push dword [ebp - 0x3c]
push edx
call fcn.006af2f0
jmp 0x55fe4e
Function at 0x5610c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x72a00c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
jne 0x5611de
lea eax, [ebp - 0x14]
mov dword [eax], 0x561200
push 0
push eax
push 0x561050
push 0x73eb40
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x5611f2
cmp dword [0x73eb44], 0
jne 0x5611de
push dword [0x73eb48]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5611de
mov esi, eax
mov eax, 0x73eb4c
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x73eb50]
mov ebx, dword [0x73eb54]
mov eax, dword [0x73eb58]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x73eb5c]
mov dword [ebp - 0x20], eax
mov eax, dword [0x73eb60]
mov dword [ebp - 0x24], eax
mov eax, 0x73eb4c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x56117c
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [section..00cfg]
push dword [ebp - 0x18]
call edi
add esp, 4
test ebx, ebx
je 0x561191
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x5611a7
mov edi, dword [esi + 8]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
je 0x5611c0
mov edi, dword [esi + 0xc]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
test ebx, ebx
je 0x5611d5
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
push esi
call fcn.00635020
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066e1f1
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
call fcn.006801da
int3
Function at 0x561220
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x561200
push 0
push eax
push 0x561050
push 0x73eb40
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x5612e8
mov esi, dword [ebp + 0xc]
cmp dword [0x73eb44], 0
jne 0x5612f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x73eb48]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x5612ab
push 0x14
push 1
call fcn.006350c0
add esp, 8
test eax, eax
je 0x5612f6
mov edi, eax
push eax
push dword [0x73eb48]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x5612ed
mov ebx, dword [ebp + 8]
mov esi, 0x73eb4c
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x73eb50], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066e1f1
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.006801da
push edi
call fcn.00635020
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x5612d4

Function at 0x561f20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x561f31
test eax, eax
jne 0x561f81
test eax, eax
jne 0x561f47
mov ecx, dword [0x73eb70]
test ecx, ecx
je 0x561f47
call dword [section..00cfg]
call ecx
cmp dword [0x73eb68], 0
je 0x561f81
mov esi, dword [0x73eb6c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x561f87
test esi, esi
je 0x561f81
mov ecx, dword [0x73eb68]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
pop esi
pop edi
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x561f6b
Function at 0x563090
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
mov dword [esi + 4], eax
push 6
push esi
push ecx
call fcn.00562b90
add esp, 0xc
test eax, eax
je 0x563235
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], edi
push esi
call fcn.006600a0
add esp, 4
movzx ebx, byte [0x714c25]
cmp eax, ebx
jne 0x563116
mov edi, eax
push esi
call fcn.00660090
add esp, 4
mov ecx, 0x714c18
test bl, bl
je 0x563226
push edi
push 0x714c1c
push eax
call fcn.0066ff2d
mov ecx, 0x714c18
add esp, 0xc
test eax, eax
je 0x563226
push esi
call fcn.006600a0
add esp, 4
movzx ebx, byte [0x714cc1]
cmp eax, ebx
jne 0x56315e
mov edi, eax
push esi
call fcn.00660090
add esp, 4
mov ecx, 0x714cb4
test bl, bl
je 0x563226
push edi
push 0x714cb8
push eax
call fcn.0066ff2d
mov ecx, 0x714cb4
add esp, 0xc
test eax, eax
je 0x563226
push esi
call fcn.006600a0
add esp, 4
movzx ebx, byte [0x714d5d]
cmp eax, ebx
jne 0x5631a6
mov edi, eax
push esi
call fcn.00660090
add esp, 4
mov ecx, 0x714d50
test bl, bl
je 0x563226
push edi
push 0x714d54
push eax
call fcn.0066ff2d
mov ecx, 0x714d50
add esp, 0xc
test eax, eax
je 0x563226
push esi
call fcn.006600a0
add esp, 4
movzx ebx, byte [0x714df9]
cmp eax, ebx
jne 0x5631e6
mov edi, eax
push esi
call fcn.00660090
add esp, 4
mov ecx, 0x714dec
test bl, bl
je 0x563226
push edi
push 0x714df0
push eax
call fcn.0066ff2d
mov ecx, 0x714dec
add esp, 0xc
test eax, eax
je 0x563226
push esi
call fcn.006600a0
add esp, 4
movzx ebx, byte [0x714e99]
cmp eax, ebx
jne 0x56323c
mov edi, eax
push esi
call fcn.00660090
add esp, 4
mov ecx, 0x714e8c
test bl, bl
je 0x563226
push edi
push 0x714e90
push eax
call fcn.0066ff2d
mov ecx, 0x714e8c
add esp, 0xc
test eax, eax
jne 0x56323c
mov eax, dword [ecx]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x56323c
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066e1f1
mov eax, dword [ebp - 0x1c]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x567d70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov edi, ecx
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
push edx
push ecx
push esi
call fcn.00636880
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x567d9e
mov esi, dword [ebp - 0x1c]
xor eax, eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
jns 0x567dbc
push dword [ebp - 0x1c]
call fcn.0066d8a0
add esp, 4
cmp dword [ebp + 8], 0
je 0x567e5f
test esi, esi
je 0x567e5f
lea eax, [esi + esi]
xor ecx, ecx
dec ecx
test esi, esi
cmovns ecx, eax
push ecx
call fcn.0066d8d3
add esp, 4
mov ecx, edi
mov edi, eax
mov eax, ebx
lea ebx, [ebp - 0x1c]
push eax
push ecx
push ebx
call fcn.00636880
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x567dff
mov ebx, dword [ebp - 0x1c]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x567e19
push dword [ebp - 0x1c]
call fcn.0066d8a0
add esp, 4
test edi, edi
mov ebx, dword [ebp + 8]
je 0x567e78
push edi
call fcn.00687336
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
push edi
push ecx
call fcn.00636cc0
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x567e47
push dword [ebx]
call fcn.0066d8a0
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebx], xmm0
push edi
call fcn.0066d8dc
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066e1f1
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x5f26c2
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x260
mov eax, dword fs:[0x30]
push esi
push 0
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
lea eax, [esp + 0x24]
mov edx, dword [esi + 0x2f4ada]
lea ecx, [esi + 0x2f4ada]
push eax
push dword [ecx + 4]
call fcn.005f25e2
lea eax, [esp + 0x20]
mov dword [esp + 0x18], eax
lea ecx, [esp + 4]
mov eax, dword [esp + 0x54]
add eax, esi
call eax
pop esi
add esp, 0x260
ret
Function at 0x6289b0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, edx
cmp edx, 4
jb 0x6289f6
nop word cs:[eax + eax]
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x6289d0
cmp edx, 2
je 0x628a28
cmp edx, 1
je 0x628a31
cmp edx, 3
je 0x628a1f
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 8
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
jmp 0x628a05
Function at 0x62df20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm4
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x62dfee
movdqa xmm4, xmmword [0x7064d0]
movdqa xmm5, xmmword [0x7064e0]
nop word cs:[eax + eax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm6
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
movdqu xmm6, xmmword [ecx]
pxor xmm0, xmm6
movdqu xmm6, xmmword [ecx + 0x10]
pxor xmm3, xmm6
movdqu xmm6, xmmword [ecx + 0x20]
pxor xmm2, xmm6
movdqu xmm6, xmmword [ecx + 0x30]
pxor xmm1, xmm6
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x62df70
movdqa xmm4, xmmword [0x7064f0]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x706500]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp eax, 0x10
jb 0x62e072
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add ecx, 0x10
add eax, 0xfffffff0
cmp eax, 0xf
ja 0x62e04b
movdqa xmm1, xmmword [0x706500]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm2, xmm2
pxor xmm1, xmm1
pblendw xmm1, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x706510], 0
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm1, 3
pclmulqdq xmm0, xmmword [0x706520], 0x10
pblendw xmm0, xmm2, 0xfc
pclmulqdq xmm0, xmmword [0x706530], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop ebp
ret

Function at 0x62e380
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x62e3b5
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x62e3bc
lea eax, [ebx + 1]
cmp eax, 2
jb 0x62e3ae
mov dword [esi], ebx
call fcn.0063cf00
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0063cf00
push dword [esi]
call fcn.00633790
add esp, 4
mov dword [esi], 0
jmp 0x62e39f
Function at 0x633640
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x72feac]
mov ecx, dword [0x72dff4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x633690
mov esi, dword [0x72fea8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066e1f1
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x72feac
call fcn.0066d917
add esp, 4
cmp dword [0x72feac], 0xffffffff
jne 0x633673
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.006719e0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.0066d870
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x72fedc]
mov ecx, dword [0x72dff4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x633739
mov ecx, esi
push ebx
push 0x72feb8
push edi
call fcn.0052a370
mov dword [0x72fea8], esi
push 0x72feac
call fcn.0066d98d
add esp, 4
jmp 0x633673
push 0x72fedc
call fcn.0066d917
add esp, 4
cmp dword [0x72fedc], 0xffffffff
jne 0x633713
xorps xmm0, xmm0
movups xmmword [0x72fec8], xmm0
movups xmmword [0x72feb8], xmm0
mov dword [0x72fed8], 0
push 0x72feb8
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x72fedc
call fcn.0066d98d
add esp, 4
jmp 0x633713
Function at 0x633d90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x633e0e
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x633df7
lea eax, [edi + 1]
cmp eax, 2
jb 0x633ddb
mov dword [esi], edi
call fcn.0063cf00
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 0
inc eax
cmp eax, 1
jbe 0x633e12
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.0063cf00
push dword [esi]
call fcn.00633790
add esp, 4
mov dword [esi], 0
jmp 0x633dcc
mov byte [esi + 4], 0
int3

Function at 0x634100
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dl, byte [0x72ff4c]
test dl, 1
jne 0x634125
test ecx, ecx
je 0x634123
push ecx
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x634130
pop ebp
ret
call fcn.00654fc0
pop ebp
jmp fcn.0063f8d0
int3

Function at 0x634e80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 8], ecx
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [esp + 0x58], eax
xor ebx, ebx
dec ebx
lea edi, [esp + 0x20]
mov dword [edi + 0x34], ebx
mov dword [edi + 0x30], ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x5f
push str........._base_files_file_win.cc
push str.ReadAtCurrentPos
push esi
call fcn.0063ced0
add esp, 0x10
mov ecx, edi
push 0
push esi
mov esi, dword [ebp + 0xc]
call fcn.00635f30
test esi, esi
js 0x634f30
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.00659db0
test al, al
jne 0x634f50
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push 0
push eax
push esi
push edi
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x634f67
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x634f79
lea ecx, [esp + 0x10]
call fcn.00659e50
lea ecx, [esp + 0x20]
call fcn.00635fb0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0066e1f1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea ecx, [esp + 0x10]
push 0
push esi
push dword [esp + 0x10]
push str.File::ReadAtCurrentPos
call fcn.006ccbe0
jmp 0x634f00
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x634f27
int3
Function at 0x639e60
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x639e7c
mov eax, dword [ebx + 4]
mov ebx, dword [ebx]
mov esi, eax
mov ecx, ebx
mov edx, eax
mov dword [ebp - 0x14], eax
cmp eax, 4
jb 0x639eb7
mov eax, dword [ebp - 0x14]
mov edx, eax
mov ecx, ebx
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x639e91
cmp edx, 2
je 0x63a004
cmp edx, 1
je 0x63a00d
cmp edx, 3
je 0x639ffb
mov ecx, dword [ebp - 0x10]
mov edi, dword [ecx + 4]
xor ecx, ecx
test edi, edi
je 0x639fec
mov dword [ebp - 0x18], ebx
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov ebx, eax
shr ebx, 0xf
xor ebx, eax
mov edx, edi
shr edx, 1
and edx, 0x55555555
mov eax, edi
sub eax, edx
mov edx, 0x33333333
mov esi, eax
and esi, edx
shr eax, 2
and eax, edx
add eax, esi
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 1
jbe 0x63a01d
mov esi, ebx
cmp ebx, edi
jb 0x639f47
mov eax, ebx
xor edx, edx
div edi
mov esi, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x639fec
mov dword [ebp - 0x10], ebx
mov ebx, dword [eax]
test ebx, ebx
je 0x639fec
lea eax, [edi - 1]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 4]
cmp eax, dword [ebp - 0x10]
jne 0x639fcc
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x639f7f
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x14]
jne 0x639fe0
lea ecx, [ebx + 8]
test al, al
jns 0x639f8d
mov ecx, dword [ecx]
js 0x639fb2
test eax, eax
je 0x639fea
xor ecx, ecx
mov dword [ebp - 0x20], edi
mov dl, byte [ebx + ecx + 8]
mov edi, esi
mov esi, dword [ebp - 0x18]
cmp dl, byte [esi + ecx]
mov esi, edi
mov edi, dword [ebp - 0x20]
jne 0x639fe0
inc ecx
cmp eax, ecx
jne 0x639f98
jmp 0x639fea
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x639fea
push eax
push dword [ebp - 0x18]
push ecx
call fcn.0066ff2d
add esp, 0xc
test eax, eax
je 0x639fea
jmp 0x639fe0
cmp dword [ebp - 0x24], 1
jbe 0x63a027
cmp eax, edi
jb 0x639fdc
xor edx, edx
div edi
mov eax, edx
cmp eax, esi
jne 0x639fe6
mov ebx, dword [ebx]
test ebx, ebx
jne 0x639f6a
xor ecx, ecx
jmp 0x639fec
mov ecx, ebx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
jmp 0x639ed2
lea esi, [edi - 1]
and esi, ebx
jmp 0x639f47
and eax, dword [ebp - 0x1c]
jmp 0x639fdc