joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b6f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x557008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43b763
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x43b74d
cmp dword [ebp - 0x18], 4
jne 0x43b74d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a927c
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x43b74d

Function at 0x43b770
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.004aa000
mov esi, ecx
mov eax, dword [0x557008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, 0x800
lea edi, [ebp - 0x810]
push ebx
push 0xff
push edi
call fcn.004acae0
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], ebx
push ecx
push edi
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43b809
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 1
jne 0x43b80d
push edi
call fcn.004c1ee1
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00426170
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a927c
mov eax, esi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x43b7f0
cmp eax, 2
jne 0x43b859
lea ebx, [ebp - 0x1010]
push 0x800
push 0xff
push ebx
call fcn.004acae0
add esp, 0xc
push 0x400
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x43b860
push ebx
call fcn.004c1ee1
add esp, 4
mov ecx, esi
push eax
push ebx
jmp 0x43b7e9
mov esi, 0x3f4
jmp 0x43b7f0
mov esi, 0xea
jmp 0x43b7f0
Function at 0x442f40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov edi, ecx
mov eax, dword [0x557008]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
push edx
push ecx
push esi
call fcn.0046bc80
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x442f6e
mov esi, dword [ebp - 0x1c]
xor eax, eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
jns 0x442f8c
push dword [ebp - 0x1c]
call fcn.004a8b10
add esp, 4
cmp dword [ebp + 8], 0
je 0x443025
test esi, esi
je 0x443025
lea eax, [esi + esi]
xor ecx, ecx
dec ecx
test esi, esi
cmovns ecx, eax
push ecx
call fcn.004a8b43
add esp, 4
mov ecx, edi
mov edi, eax
mov eax, ebx
lea ebx, [ebp - 0x1c]
push eax
push ecx
push ebx
call fcn.0046bc80
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x442fcf
mov ebx, dword [ebp - 0x1c]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x442fe9
push dword [ebp - 0x1c]
call fcn.004a8b10
add esp, 4
test edi, edi
mov ebx, dword [ebp + 8]
je 0x44304a
push edi
call fcn.004c1ee1
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
push edi
push ecx
call fcn.0046c0f0
add esp, 0xc
cmp byte [ebx + 0xb], 0
js 0x44303e
mov eax, dword [ebp - 0x14]
mov dword [ebx + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebx], xmm0
push edi
call fcn.004a8b4c
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a927c
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [ebx]
call fcn.004a8b10
add esp, 4
jmp 0x44300d
push str.null_pointer_passed_to_non_null_argument_of_char_traits_..._::length
push str.__s___nullptr
push 0x109
push str....._third_partylibc_srcinclude_string_view
push str._s:_d:_assertion__s_failed:__s_n
call fcn.004d6920
int3
Function at 0x449670
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x557008]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x4496a0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a927c
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x4497a0
push 0
push eax
push 0x449600
push 0x56c100
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x44979b
cmp dword [0x56c104], 0
jne 0x44968c
push dword [0x56c108]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x44968c
mov esi, eax
mov eax, 0x56c10c
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x56c110]
mov ebx, dword [0x56c114]
mov eax, dword [0x56c118]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x56c11c]
mov dword [ebp - 0x20], eax
mov eax, dword [0x56c120]
mov dword [ebp - 0x24], eax
mov eax, 0x56c10c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x449734
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [section..00cfg]
push dword [ebp - 0x18]
call edi
add esp, 4
test ebx, ebx
je 0x449749
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x44975f
mov edi, dword [esi + 8]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
je 0x449778
mov edi, dword [esi + 0xc]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
test ebx, ebx
je 0x44978d
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
push esi
call fcn.00460250
add esp, 4
jmp 0x44968c
call fcn.004babff
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x56c108], eax
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [0x56c104], ecx
pop ebp
ret
Function at 0x4497c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x557008]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x4497a0
push 0
push eax
push 0x449600
push 0x56c100
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x4498a4
mov esi, dword [ebp + 0xc]
cmp dword [0x56c104], 0
jne 0x449891
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x56c108]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x44984b
push 0x14
push 1
call fcn.004602f0
add esp, 8
test eax, eax
je 0x449891
mov edi, eax
push eax
push dword [0x56c108]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x449888
mov ebx, dword [ebp + 8]
mov esi, 0x56c10c
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x56c110], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a927c
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.00460250
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x449874
call fcn.004babff
int3
Function at 0x44db20
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0xc]
movzx ebx, byte [edx + 0xb]
test bl, bl
js 0x44db3c
and ebx, 0x7f
jmp 0x44db41
mov ebx, dword [edx + 4]
mov edx, dword [edx]
mov eax, ebx
mov dword [ebp - 0x18], edx
mov esi, ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 4
jb 0x44db7e
mov eax, dword [ebp - 0x14]
mov esi, eax
mov edx, dword [ebp - 0x18]
imul ebx, dword [edx], 0x5bd1e995
mov edi, ebx
shr edi, 0x18
xor edi, ebx
imul edi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add edx, 4
add esi, 0xfffffffc
cmp esi, 3
ja 0x44db58
cmp esi, 3
je 0x44dba8
cmp esi, 2
je 0x44dbb1
cmp esi, 1
je 0x44dbba
mov edx, dword [ebp - 0x10]
mov esi, dword [edx + 4]
xor edi, edi
test esi, esi
jne 0x44dbcb
mov eax, dword [ebp + 8]
mov dword [eax], edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
movzx esi, byte [edx + 2]
shl esi, 0x10
xor eax, esi
movzx esi, byte [edx + 1]
shl esi, 8
xor eax, esi
movzx edx, byte [edx]
xor edx, eax
imul eax, edx, 0x5bd1e995
jmp 0x44db8d
xor edi, edi
jmp 0x44db99
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, 0x33333333
mov ebx, eax
and ebx, edx
shr eax, 2
and eax, edx
add eax, ebx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 1
jbe 0x44dcda
mov edx, ecx
cmp ecx, esi
jb 0x44dc2b
mov eax, ecx
xor edx, edx
div esi
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x44db99
mov eax, dword [eax]
test eax, eax
je 0x44db99
lea edi, [esi - 1]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
mov eax, dword [eax + 4]
cmp ecx, eax
je 0x44dc85
cmp dword [ebp - 0x24], 1
jbe 0x44dcd5
cmp eax, esi
jb 0x44dc6a
xor edx, edx
div esi
mov eax, edx
cmp eax, dword [ebp - 0x10]
jne 0x44dbc7
mov eax, ebx
mov eax, dword [ebx]
xor edi, edi
test eax, eax
mov ecx, dword [ebp - 0x20]
jne 0x44dc51
jmp 0x44db99
movzx ecx, byte [ebx + 0x13]
mov eax, ecx
and eax, 0x7f
mov edx, eax
test cl, cl
jns 0x44dc97
mov edx, dword [ebx + 0xc]
cmp edx, dword [ebp - 0x14]
jne 0x44dc73
test cl, cl
js 0x44dcbe
test al, al
je 0x44dcb7
xor ecx, ecx
mov dl, byte [ebx + ecx + 8]
mov edi, dword [ebp - 0x18]
cmp dl, byte [edi + ecx]
jne 0x44dc73
inc ecx
cmp eax, ecx
jne 0x44dca6
mov edi, ebx
jmp 0x44db99
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebx + 8]
call fcn.004aaedd
add esp, 0xc
test eax, eax
je 0x44dcb7
jmp 0x44dc73
and eax, dword [ebp - 0x1c]
jmp 0x44dc6a
lea edx, [esi - 1]
and edx, ecx
jmp 0x44dc2b
Function at 0x44f0e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x55adb0]
cmp eax, 0xffffffff
je 0x44f1a1
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x44f1a1
mov eax, dword [0x56d1c4]
mov ecx, dword [0x55ae20]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x44f1ab
mov edi, dword [0x56d1c0]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x44f1f0
mov ecx, dword [0x56c1b8]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx eax, al
mov ebx, eax
shl ebx, 4
cmp dword [ebx + 0x56c1bc], 0
jne 0x44f1fc
lea ecx, [ebx + 0x56c1bc]
mov dword [ecx], 1
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov edx, dword [0x56d1bc]
inc edx
mov dword [0x56d1bc], edx
mov dword [ecx + 0xc], edx
mov dword [0x56c1b8], eax
mov dword [esi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x44f20b
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0044f210
jmp 0x44f105
push 0x56d1c4
call fcn.004a8b87
add esp, 4
cmp dword [0x56d1c4], 0xffffffff
jne 0x44f126
push 4
call fcn.004a8ae0
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.00475010
mov dword [0x56d1c0], edi
push 0x56d1c4
call fcn.004a8bfd
add esp, 4
jmp 0x44f126
mov ecx, edi
call fcn.00475020
jmp 0x44f13b
inc edx
cmp edx, 0x100
jne 0x44f144
jmp 0x44f18b
int3

Function at 0x44f210
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov eax, dword [0x557008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x814], 0xffffffff
mov ecx, dword [0x55adb0]
mov dword [ebp - 0x814], ecx
cmp ecx, 0xffffffff
je 0x44f2bd
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x44f32e
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0
push ebx
call fcn.004acae0
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push dword [ebp - 0x814]
call fcn.00458540
add esp, 8
push edi
call fcn.004a8b43
add esp, 4
mov esi, eax
push edi
push ebx
push eax
call fcn.004ac560
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x814]
call fcn.00458540
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a927c
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x814]
push esi
call fcn.00458520
add esp, 4
test al, al
je 0x44f331
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xffffffff
je 0x44f306
xor eax, eax
dec eax
lock cmpxchg dword [0x55adb0], ecx
je 0x44f241
push ecx
call fcn.00529780
add esp, 4
mov ecx, dword [0x55adb0]
mov dword [ebp - 0x814], ecx
jmp 0x44f241
push esi
call fcn.00458520
add esp, 4
test al, al
je 0x44f334
cmp dword [ebp - 0x814], 0xffffffff
je 0x44f334
push 0xffffffffffffffff
call fcn.00529780
add esp, 4
mov ecx, dword [ebp - 0x814]
jmp 0x44f2db
int3
int3
int3
Function at 0x45c5b0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, edx
cmp edx, 4
jb 0x45c5f6
nop word cs:[eax + eax]
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x45c5d0
cmp edx, 3
je 0x45c61f
cmp edx, 2
je 0x45c628
cmp edx, 1
je 0x45c631
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 8
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
jmp 0x45c605
Function at 0x467fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm4
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x46808e
movdqa xmm4, xmmword [0x53f7e0]
movdqa xmm5, xmmword [0x53f7f0]
nop word cs:[eax + eax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm6
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
movdqu xmm6, xmmword [ecx]
pxor xmm0, xmm6
movdqu xmm6, xmmword [ecx + 0x10]
pxor xmm3, xmm6
movdqu xmm6, xmmword [ecx + 0x20]
pxor xmm2, xmm6
movdqu xmm6, xmmword [ecx + 0x30]
pxor xmm1, xmm6
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x468010
movdqa xmm4, xmmword [0x53f800]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x53f810]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp eax, 0x10
jb 0x468112
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add ecx, 0x10
add eax, 0xfffffff0
cmp eax, 0xf
ja 0x4680eb
movdqa xmm1, xmmword [0x53f810]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm2, xmm2
pxor xmm1, xmm1
pblendw xmm1, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x53f820], 0
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm1, 3
pclmulqdq xmm0, xmmword [0x53f830], 0x10
pblendw xmm0, xmm2, 0xfc
pclmulqdq xmm0, xmmword [0x53f840], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop ebp
ret

Function at 0x46b020
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x46b09e
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x46b087
lea eax, [edi + 1]
cmp eax, 2
jb 0x46b06b
mov dword [esi], edi
call fcn.0046e500
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 0
inc eax
cmp eax, 1
jbe 0x46b0a2
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.0046e500
push dword [esi]
call fcn.0046aff0
add esp, 4
mov dword [esi], 0
jmp 0x46b05c
mov byte [esi + 4], 0
int3
Function at 0x46b2d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x46b305
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x46b30c
lea eax, [ebx + 1]
cmp eax, 2
jb 0x46b2fe
mov dword [esi], ebx
call fcn.0046e500
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0046e500
push dword [esi]
call fcn.0046aff0
add esp, 4
mov dword [esi], 0
jmp 0x46b2ef

Function at 0x46b450
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 8], ecx
mov eax, dword [0x557008]
xor eax, ebp
mov dword [esp + 0x58], eax
xor ebx, ebx
dec ebx
lea edi, [esp + 0x20]
mov dword [edi + 0x34], ebx
mov dword [edi + 0x30], ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x5f
push str....._base_files_file_win.cc
push str.ReadAtCurrentPos
push esi
call fcn.0046e4d0
add esp, 0x10
mov ecx, edi
push 0
push esi
mov esi, dword [ebp + 0xc]
call fcn.00472710
test esi, esi
js 0x46b500
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.004745e0
test al, al
jne 0x46b537
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push 0
push eax
push esi
push edi
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46b525
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x46b520
lea ecx, [esp + 0x10]
call fcn.00474680
lea ecx, [esp + 0x20]
call fcn.00472790
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004a927c
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x46b4f7
lea ecx, [esp + 0x10]
push 0
push esi
push dword [esp + 0x10]
push str.File::ReadAtCurrentPos
call fcn.004f1b10
jmp 0x46b4d0
Function at 0x470490
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0046b360
mov dword [esi], 0
test eax, eax
je 0x4704d7
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x470509
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x4704d0
mov dword [esi], ebx
mov ebx, eax
call fcn.0046e500
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.0046e700
lea ecx, [esi + 0x10]
call fcn.00474610
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.0046e500
push dword [esi]
call fcn.0046aff0
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
jmp 0x4704bd
Function at 0x472cd0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x557008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x56adc4]
mov ecx, dword [0x55ae20]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x472d1d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a927c
mov eax, 0x56adc0
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x56adc4
call fcn.004a8b87
add esp, 4
cmp dword [0x56adc4], 0xffffffff
jne 0x472d03
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.004acae0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.004a8ae0
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x56adf4]
mov ecx, dword [0x55ae20]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x472dc6
mov ecx, esi
push ebx
push 0x56add0
push edi
call fcn.004328a0
mov dword [0x56adc0], esi
push 0x56adc4
call fcn.004a8bfd
add esp, 4
jmp 0x472d03
push 0x56adf4
call fcn.004a8b87
add esp, 4
cmp dword [0x56adf4], 0xffffffff
jne 0x472da0
xorps xmm0, xmm0
movups xmmword [0x56ade0], xmm0
movups xmmword [0x56add0], xmm0
mov dword [0x56adf0], 0
push 0x56add0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x56adf4
call fcn.004a8bfd
add esp, 4
jmp 0x472da0
Function at 0x472e20
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x557008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x56adc4]
mov ecx, dword [0x55ae20]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x472e70
mov esi, dword [0x56adc0]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a927c
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x56adc4
call fcn.004a8b87
add esp, 4
cmp dword [0x56adc4], 0xffffffff
jne 0x472e53
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.004acae0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.004a8ae0
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x56adf4]
mov ecx, dword [0x55ae20]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x472f19
mov ecx, esi
push ebx
push 0x56add0
push edi
call fcn.004328a0
mov dword [0x56adc0], esi
push 0x56adc4
call fcn.004a8bfd
add esp, 4
jmp 0x472e53
push 0x56adf4
call fcn.004a8b87
add esp, 4
cmp dword [0x56adf4], 0xffffffff
jne 0x472ef3
xorps xmm0, xmm0
movups xmmword [0x56ade0], xmm0
movups xmmword [0x56add0], xmm0
mov dword [0x56adf0], 0
push 0x56add0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x56adf4
call fcn.004a8bfd
add esp, 4
jmp 0x472ef3