joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f05df
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4f0609
mov eax, 0x527fb4
push eax
push eax
push 0
push 0
call fcn.004ef07b
add esp, 0x10
xor eax, eax
pop ebp
ret
xor eax, eax
inc eax
pop ebp
ret

Function at 0x4f134b
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x4f188c
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x4f1b4b
Capabilities:
Check mutex on windows

Disassembly:
push 0xa4
mov eax, 0x525575
call fcn.004f3f50
mov esi, ecx
mov dword [ebp - 0xa0], esi
xor ebx, ebx
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
push 0x41
lea eax, [ebp - 0x98]
push eax
call fcn.004f2337
add esp, 0x14
xor eax, eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x98]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x9c], edi
test edi, edi
je 0x4f1c97
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4f1bc4
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], ebx
call fcn.004f218a
test eax, eax
je 0x4f1bf9
mov dword [esi], eax
mov eax, dword [esi]
inc dword [eax + 0x5bc]
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
jne 0x4f1c97
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4f1c97
push 0x5c0
call fcn.004f1e56
pop ecx
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x4f1c1c
push edi
mov ecx, eax
call fcn.004f1cd8
jmp 0x4f1c1e
mov eax, ebx
mov byte [ebp - 4], bl
mov dword [esi], eax
test eax, eax
je 0x4f1c9f
xor ebx, ebx
inc ebx
mov dword [ebp - 0xb0], ebx
push eax
call fcn.004f22d6
pop ecx
test eax, eax
jne 0x4f1bd2
mov dword [ebp - 0xa8], 3
push 0x55e1c4
lea eax, [ebp - 0xa8]
jmp 0x4f1cb4
mov eax, esi
call fcn.004f3eb0
ret
mov dword [ebp - 0xa4], 1
push 0x55e1c4
lea eax, [ebp - 0xa4]
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x4f1cd8
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x5255a8
call fcn.004f3ed0
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [esi], 0
lea ecx, [esi + 8]
or dword [esi + 4], 0xffffffff
call fcn.004f1b1c
and dword [ebp - 4], 0
and dword [esi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4f1d24
mov eax, dword [ebp + 8]
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004f3e90
ret 4
push 0x55e1c4
lea eax, [ebp + 8]
mov dword [ebp + 8], 2
push eax
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x4f1ef0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebx]
add ecx, 8
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x5a8]
mov dword [ecx + 0x5b0], eax
call fcn.004f2093
mov edi, eax
test edi, edi
je 0x4f1f7b
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jne 0x4f1f2b
mov esi, edi
jmp 0x4f1f67
push dword [edi]
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x4f1f60
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4f1f53
mov ecx, dword [ebx]
push edi
add ecx, 8
call fcn.004f202e
jmp 0x4f1f67
push 0x54c9b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4f1f67
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx]
add ecx, 8
call fcn.004f2093
mov edi, eax
test edi, edi
jne 0x4f1f20
test esi, esi
jne 0x4f1f90
mov ecx, dword [ebx]
add ecx, 8
call fcn.004f2227
mov esi, eax
test esi, esi
je 0x4f1f90
mov eax, dword [ebp - 4]
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4f34b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
movzx ecx, word [ecx + 6]
lea ecx, [ecx + ecx*4]
lea edi, [eax + ecx*8]
cmp eax, edi
je 0x4f34ee
mov esi, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
cmp esi, edx
jb 0x4f34e7
mov ecx, dword [eax + 8]
add ecx, edx
cmp esi, ecx
jb 0x4f34f0
add eax, 0x28
cmp eax, edi
jne 0x4f34d7
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x4f40e0
Capabilities:
Get process heap force flags

Disassembly:
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx + 0xa4]
shl eax, 0x10
or eax, dword [ecx + 0xa8]
ret

Function at 0x4f7110
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4f7510
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4f7525
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4f7537
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.004f7bb0
push 0x563cc8
lea eax, [ebp - 0x10]
push eax
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x4fc330
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4fc42b
mov eax, dword [ebp - 0x114]
sub eax, 5
je 0x4fc3b2
sub eax, 1
jne 0x4fc3a6
mov eax, dword [ebp - 0x110]
sub eax, 0
je 0x4fc38e
sub eax, 1
jne 0x4fc3a6
mov dword [0x5783b4], 4
jmp 0x4fc3d0
mov dword [0x5783b4], 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00522d04
mov esp, ebp
pop ebp
ret
mov dword [0x5783b4], 6
jmp 0x4fc3d0
mov eax, dword [ebp - 0x110]
sub eax, 0
je 0x4fc421
sub eax, 1
je 0x4fc409
sub eax, 1
je 0x4fc3f1
cmp dword [0x5783b4], 4
jl 0x4fc398
call fcn.004f6fe0
cmp dword [0x5783b4], 6
jl 0x4fc398
call fcn.00506ba0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00522d04
mov esp, ebp
pop ebp
ret
mov dword [0x5783b4], 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00522d04
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x5783b4], 1
call fcn.00522d04
mov esp, ebp
pop ebp
ret
mov dword [0x5783b4], 0
lea ecx, [ebp - 0x124]
call fcn.004f7bf0
push 0x563f54
lea eax, [ebp - 0x124]
push eax
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x4fe720
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor edx, edx
xor ecx, eax
imul eax, ecx, 0x1000193
div dword [esi]
mov eax, dword [esi + 8]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4fe77b
mov ecx, dword [edi]
lea esp, [esp]
cmp dword [eax + 4], ecx
je 0x4fe783
mov eax, dword [eax]
test eax, eax
jne 0x4fe770
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4fe77d
mov ecx, dword [eax + 8]
pop edi
mov dword [edx], ecx
pop esi
pop ebp
ret 8
Function at 0x4ff9b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor edx, edx
xor ecx, eax
imul eax, ecx, 0x1000193
div dword [esi]
mov eax, dword [esi + 8]
lea ebx, [edx*4]
mov eax, dword [ebx + eax]
test eax, eax
je 0x4ffa0f
mov ecx, dword [edi]
cmp dword [eax + 4], ecx
je 0x4ffa37
mov eax, dword [eax]
test eax, eax
jne 0x4ffa04
push 0xc
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
add esp, 4
mov dword [ebp + 8], edx
test edx, edx
je 0x4ffa40
mov dword [edx], 0
mov eax, dword [edi]
mov dword [edx + 4], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [edx + 8], eax
jmp 0x4ffa42
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
xor edx, edx
mov ecx, dword [esi + 8]
mov eax, edx
pop edi
mov ecx, dword [ebx + ecx]
mov dword [edx], ecx
mov ecx, dword [esi + 8]
mov dword [ebx + ecx], edx
inc dword [esi + 4]
pop esi
pop ebx
pop ebp
ret 8

Function at 0x501650
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525e94
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x56afe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x54]
mov dword [esi + 0x1c], eax
mov al, byte [ebp + 0xc]
mov dword [esi], vtable.Concurrency::details::ContextBase.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 1
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [esi + 0x4c], al
mov dword [ebp - 4], 0
mov dword [esi + 0x50], 0
call fcn.004f4c50
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x6c], 0xffffffff
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
push 0x1c
mov dword [esi + 0x80], 7
mov dword [esi + 0x84], 0
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ecx, dword [esi + 0x80]
shl ecx, 2
push ecx
push 0
push eax
mov dword [esi + 0x88], eax
call sub.msvcrt.dll_memset
push 0x10
mov byte [ebp - 4], 1
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
add esp, 0x14
mov dword [esi + 0x94], eax
mov ecx, dword [esi + 0x1c]
mov byte [ebp - 4], 2
call fcn.004feec0
mov ecx, dword [esi + 0x1c]
mov dword [esi + 8], eax
push eax
mov eax, dword [ecx]
call dword [eax + 4]
push eax
push 4
push 1
mov ecx, esi
call fcn.00502c40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x502a30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
xor eax, eax
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ebx
mov edx, dword [ebx + 0x80]
test edx, edx
jle 0x502a64
mov esi, dword [ebx + 0x88]
mov ecx, esi
cmp dword [ecx], edi
jne 0x502b34
inc eax
add ecx, 4
cmp eax, edx
jl 0x502a54
xor eax, eax
mov dword [ebp - 8], eax
test eax, eax
je 0x502b94
mov esi, dword [eax]
test esi, esi
jne 0x502aa6
mov edx, dword [ebx + 0x80]
inc edi
mov eax, edi
cmp edi, edx
jge 0x502aa1
mov esi, dword [ebx + 0x88]
lea ecx, [esi + edi*4]
lea ecx, [ecx]
cmp dword [ecx], 0
jne 0x502b3e
inc eax
add ecx, 4
cmp eax, edx
jl 0x502a90
xor esi, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
call fcn.005041d0
test al, al
je 0x502b87
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov ecx, eax
mov dword [ebp - 0xc], eax
call fcn.004921b0
mov ebx, eax
movzx ecx, bl
xor ecx, 0x811c9dc5
mov dword [ebp - 8], ebx
movzx eax, byte [ebp - 6]
imul edx, ecx, 0x1000193
movzx ecx, bh
xor edx, ecx
imul ecx, edx, 0x1000193
xor edx, edx
xor ecx, eax
movzx eax, byte [ebp - 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 4]
div dword [ecx + 0x80]
mov eax, dword [ecx + 0x88]
lea eax, [eax + edx*4]
xor edx, edx
mov dword [ebp - 8], eax
mov eax, dword [eax]
test eax, eax
je 0x502b67
lea esp, [esp]
mov ecx, dword [eax]
cmp dword [eax + 4], ebx
je 0x502b48
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x502b20
mov ebx, dword [ebp - 4]
jmp 0x502b69
mov edi, eax
mov eax, dword [esi + eax*4]
jmp 0x502a66
mov esi, dword [esi + eax*4]
mov edi, eax
jmp 0x502aa3
test edx, edx
jne 0x502b4f
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 4]
push 0xc
mov dword [edx], ecx
push eax
dec dword [ebx + 0x84]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
jmp 0x502b69
mov ebx, ecx
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x502b87
mov ecx, eax
call fcn.005030e0
push 0x90
push dword [ebp - 0xc]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
mov eax, esi
mov dword [ebp - 8], eax
test esi, esi
jne 0x502a71
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x505fa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525a88
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x56afe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x20]
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.004f50c0
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 4], 0
mov eax, dword [ebx]
call dword [eax]
mov edx, dword [edi + 0x10]
lea edi, [ebx + 8]
imul ecx, dword [ebx + 0x30], 0x34
imul eax, eax, 0x34
mov edx, dword [edx + eax + 0x30]
dec dword [edx + ecx + 0xc]
add edx, ecx
mov ecx, dword [edi + 0x38]
mov eax, dword [edi + 0x34]
mov dword [ecx + 0x34], eax
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x38]
mov dword [ecx + 0x38], eax
mov eax, dword [edx + 0x10]
cmp edi, eax
jne 0x506029
cmp eax, dword [eax + 0x38]
jne 0x506023
xor eax, eax
jmp 0x506026
mov eax, dword [eax + 0x34]
mov dword [edx + 0x10], eax
cmp byte [ebx + 0x45], 0
jne 0x506038
mov eax, dword [ebp - 0x10]
dec dword [eax + 0x9c]
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.004f5370
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5073a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5262c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x56afe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0x5783f0
mov eax, 1
mov esi, 0x5783f0
xchg dword [esi], eax
test eax, eax
je 0x5074a0
xor eax, eax
mov ecx, 0x4f79f0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
cmp eax, 4
ja case.default.0x5073f9
jmp dword [eax*4 + 0x5075f0]
pause
sub dword [ebp - 0x20], 1
jne case.default.0x5073f9
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
add eax, 3
mov dword [ebp - 0x18], eax
jmp case.default.0x5073f9
sub dword [ebp - 0x1c], 1
jne case.0x5073f9.4
mov dword [ebp - 0x18], 3
call ecx
jmp case.default.0x5073f9
mov dword [ebp - 0x18], 0
call fcn.004f5520
test eax, eax
jne 0x507445
mov dword [ebp - 0x18], 4
jmp case.default.0x5073f9
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 1
jmp case.default.0x5073f9
mov dword [ebp - 0x18], 0
call fcn.004f5520
test eax, eax
jne 0x507471
mov dword [ebp - 0x18], 4
jmp 0x507482
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x20]
call fcn.004f5400
mov eax, 1
xchg dword [esi], eax
test eax, eax
je 0x5074a0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
jmp 0x5073f0
cmp dword [0x578428], 0
mov dword [ebp - 4], 0
jne 0x5075d4
push 0x18
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
test edi, edi
je 0x507591
push 0x800
push 0
push str.advapi32.dll
mov byte [ebp - 4], 1
call dword [0x527b90]
mov ebx, eax
test ebx, ebx
jne 0x507508
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x507585
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x507585
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x54d23c
push ebx
call esi
push eax
call fcn.004f75f0
add esp, 4
mov dword [edi], eax
push str.UnregisterTraceGuids
push ebx
call esi
push eax
call fcn.004f75f0
add esp, 4
mov dword [edi + 4], eax
push str.TraceEvent
push ebx
call esi
push eax
call fcn.004f75f0
add esp, 4
mov dword [edi + 8], eax
push str.GetTraceLoggerHandle
push ebx
call esi
push eax
call fcn.004f75f0
add esp, 4
mov dword [edi + 0xc], eax
push str.GetTraceEnableLevel
push ebx
call esi
push eax
call fcn.004f75f0
add esp, 4
mov dword [edi + 0x10], eax
push str.GetTraceEnableFlags
push ebx
call esi
push eax
call fcn.004f75f0
add esp, 4
mov dword [edi + 0x14], eax
mov byte [ebp - 4], 0
mov dword [0x578428], edi
jmp 0x50759d
mov dword [0x578428], 0
xor edi, edi
mov esi, dword [edi]
push 0
call fcn.004f75f0
add esp, 4
cmp esi, eax
je 0x5075d4
push esi
call fcn.004f75f0
add esp, 4
push 0x578410
push 0
push 0
push 0x56b05c
push 7
push 0x54d16c
push 0
push 0x507200
call eax
mov dword [0x5783f0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50cd60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov dword [edi + 8], eax
mov dword [edi + 0x100], edx
mov eax, dword [edi + 0xc]
xor eax, dword [ecx]
and eax, 0xfffffff
xor dword [edi + 0xc], eax
mov eax, dword [ecx]
xor eax, dword [edi + 0xc]
and eax, 0xfffffff
xor eax, dword [ecx]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 8]
mov dword [edi + 0x14], eax
mov eax, dword [ecx + 4]
mov dword [edi + 0x10], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0x18], eax
lea eax, [ebp - 0xc]
mov dword [edi + 0x110], 0
mov dword [edi + 0x11c], 1
mov ecx, dword [edx + 4]
push eax
call fcn.004febe0
push dword [edi + 0x20]
lea ebx, [edi + 0x1c]
mov esi, eax
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
mov ecx, dword [esi]
mov dword [ebx], ecx
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov dword [esi], 0
mov dword [esi + 4], 0
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
mov ecx, dword [ebp + 0x10]
add esp, 8
mov eax, dword [ecx]
and eax, 0xfffffff
cmp eax, 3
jne 0x50ce77
mov ebx, dword [ecx + 8]
xor edx, edx
mov esi, dword [ebp + 8]
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
mov esi, dword [esi + 4]
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
div dword [esi + 0x168]
mov eax, dword [esi + 0x170]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x50ce6e
cmp dword [eax + 4], ebx
je 0x50ce9b
mov eax, dword [eax]
test eax, eax
jne 0x50ce63
mov eax, dword [ebp - 4]
mov dword [edi + 0x24], eax
lea ebx, [edi + 0x1c]
push ebx
lea ecx, [edi + 0x38]
call fcn.0050c690
cmp dword [edi + 0x48], 0
je 0x50ce92
mov ecx, dword [edi + 0x48]
add ecx, 4
push ebx
call fcn.0050c690
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [eax + 8]
jmp 0x50ce71

Function at 0x50e920
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x57842c], eax
cmp eax, 0xffffffff
je 0x50e93a
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x50e94c
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.004f7bb0
push 0x563cc8
lea eax, [ebp - 0x10]
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x5103a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx]
and eax, 0xfffffff
cmp eax, 3
ja case.default.0x5103b6
jmp dword [eax*4 + 0x510454]
push ebx
mov ebx, dword [edx + 8]
xor edx, edx
movzx eax, bl
xor eax, 0x811c9dc5
push esi
mov esi, dword [ecx + 0xc]
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
div dword [esi + 0x10]
mov eax, dword [esi + 0x18]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x51041b
nop
cmp dword [eax + 4], ebx
je 0x51041d
mov eax, dword [eax]
test eax, eax
jne 0x510410
xor eax, eax
test eax, eax
pop esi
setne al
pop ebx
pop ebp
ret 4
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + 0x2c]
cmp eax, dword [edx + 8]
sete al
pop ebp
ret 4
mov eax, dword [ecx + 8]
cmp eax, dword [edx + 8]
sete al
pop ebp
ret 4
mov al, 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4

Function at 0x5103bd
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx]
and eax, 0xfffffff
cmp eax, 3
ja case.default.0x5103b6
jmp dword [eax*4 + 0x510454]
push ebx
mov ebx, dword [edx + 8]
xor edx, edx
movzx eax, bl
xor eax, 0x811c9dc5
push esi
mov esi, dword [ecx + 0xc]
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
div dword [esi + 0x10]
mov eax, dword [esi + 0x18]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x51041b
nop
cmp dword [eax + 4], ebx
je 0x51041d
mov eax, dword [eax]
test eax, eax
jne 0x510410
xor eax, eax
test eax, eax
pop esi
setne al
pop ebx
pop ebp
ret 4
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + 0x2c]
cmp eax, dword [edx + 8]
sete al
pop ebp
ret 4
mov eax, dword [ecx + 8]
cmp eax, dword [edx + 8]
sete al
pop ebp
ret 4
mov al, 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4
Function at 0x512620
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x512647
mov ecx, 5
int 0x29
push 2
call fcn.004f4840
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x512752
test esi, esi
jne 0x512752
push 2
call fcn.004f4840
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00522d04
mov esp, ebp
pop ebp
ret