joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ec70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x526014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x45eca0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004948c8
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x45ed80
push 0
push eax
push 0x45ec50
push 0x539c4c
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x45ed7b
cmp dword [0x539c50], 0
jne 0x45ec8c
push dword [0x539c54]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45ec8c
mov esi, eax
mov eax, 0x539c58
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov ebx, dword [0x539c5c]
mov edi, dword [0x539c60]
mov eax, dword [0x539c64]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x539c68]
mov dword [ebp - 0x20], eax
mov eax, 0x539c58
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test ebx, ebx
je 0x45ed2c
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, ebx
call dword [section..00cfg]
push dword [ebp - 0x18]
call ebx
add esp, 4
test edi, edi
je 0x45ed41
mov ebx, dword [esi + 4]
mov ecx, edi
call dword [section..00cfg]
push ebx
call edi
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x45ed57
mov edi, dword [esi + 8]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x45ed6d
mov edi, dword [esi + 0xc]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
push esi
call fcn.00489e50
add esp, 4
jmp 0x45ec8c
call fcn.004a7bd0
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x539c54], eax
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [0x539c50], ecx
pop ebp
ret

Function at 0x465510
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x465527
test eax, eax
je 0x465527
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
jne 0x465535
mov ecx, dword [0x539d24]
test ecx, ecx
jne 0x465571
cmp dword [0x539d1c], 0
je 0x465521
mov esi, dword [0x539d20]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x46557b
test esi, esi
je 0x465521
mov ecx, dword [0x539d1c]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x465521
call dword [section..00cfg]
call ecx
jmp 0x465535
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x465559
Function at 0x46acc0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x46acd5
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, edx
cmp edx, 4
jb 0x46ad06
nop dword [eax]
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x46ace0
cmp edx, 1
je 0x46ad27
cmp edx, 2
je 0x46ad1e
cmp edx, 3
jne 0x46ad32
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4

Function at 0x46b930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm4
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x46ba1e
nop word cs:[eax + eax]
movdqa xmm6, xmm0
movdqa xmm5, xmmword [0x50ee20]
pclmulqdq xmm6, xmm5, 0
movdqa xmm5, xmmword [0x50ee30]
pclmulqdq xmm0, xmm5, 0x11
movdqa xmm7, xmm0
pxor xmm7, xmm6
movdqa xmm0, xmm3
movdqa xmm4, xmmword [0x50ee20]
pclmulqdq xmm0, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
movdqa xmm6, xmm3
pxor xmm6, xmm0
movdqa xmm0, xmm2
pclmulqdq xmm0, xmm4, 0
movdqa xmm3, xmm4
pclmulqdq xmm2, xmm5, 0x11
movdqa xmm4, xmm2
pxor xmm4, xmm0
movdqa xmm0, xmm1
pclmulqdq xmm0, xmm3, 0
pclmulqdq xmm1, xmm5, 0x11
movdqa xmm5, xmm1
pxor xmm5, xmm0
movdqu xmm0, xmmword [ecx]
pxor xmm0, xmm7
movdqu xmm3, xmmword [ecx + 0x10]
pxor xmm3, xmm6
movdqu xmm2, xmmword [ecx + 0x20]
pxor xmm2, xmm4
movdqu xmm1, xmmword [ecx + 0x30]
pxor xmm1, xmm5
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x46b970
movdqa xmm4, xmmword [0x50ee40]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x50ee50]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp eax, 0x10
jb 0x46baa2
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add ecx, 0x10
add eax, 0xfffffff0
cmp eax, 0xf
ja 0x46ba7b
movdqa xmm1, xmmword [0x50ee50]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm2, xmm2
pxor xmm1, xmm1
pblendw xmm1, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x50ee60], 0
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm1, 3
pclmulqdq xmm0, xmmword [0x50ee70], 0x10
pblendw xmm0, xmm2, 0xfc
pclmulqdq xmm0, xmmword [0x50ee80], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop ebp
ret
Function at 0x46f070
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x46f0a5
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x46f0ac
lea eax, [ebx + 1]
cmp eax, 2
jb 0x46f09e
mov dword [esi], ebx
call fcn.00471300
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00471300
push dword [esi]
call fcn.00474440
add esp, 4
mov dword [esi], 0
jmp 0x46f08f

Function at 0x4737d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x140c
call fcn.00495240
mov eax, dword [0x526014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x527bc8]
cmp eax, 0xffffffff
je 0x473802
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
jne 0x473817
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004948c8
add esp, 0x140c
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.00497010
add esp, 0xc
mov ecx, dword [0x527bc8]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.00452b10
add esp, 8
test ebx, ebx
je 0x473858
push ebx
call fcn.00493dac
add esp, 4
mov eax, dword [0x52cb00]
mov ecx, dword [0x52a234]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x473943
mov esi, dword [0x52cafc]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x473988
lea eax, [ebp - 0x1410]
push 0xc00
push 0x52befc
push eax
call fcn.00497010
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ecx, 0x100
lea edx, [ebp - 0x1408]
test al, 1
je 0x47392e
mov dword [ebp - 0x1418], ecx
xor esi, esi
mov edi, edx
xor eax, eax
jmp 0x4738dc
inc esi
add edi, 0xc
cmp esi, 0x100
je 0x473920
mov ebx, dword [ebp + esi*8 - 0x810]
test ebx, ebx
je 0x4738d0
cmp dword [edi - 8], 0
je 0x4738d0
mov ecx, dword [ebp + esi*8 - 0x80c]
cmp ecx, dword [edi]
jne 0x4738d0
mov ecx, dword [edi - 4]
test ecx, ecx
je 0x4738d0
mov dword [ebp + esi*8 - 0x810], 0
call dword [section..00cfg]
push ebx
call ecx
lea edx, [ebp - 0x1408]
add esp, 4
mov al, 1
jmp 0x4738d0
mov esi, dword [ebp - 0x1418]
lea ecx, [esi - 1]
cmp esi, 2
jae 0x4738bb
push 2
push dword [ebp - 0x1414]
call fcn.00452b10
add esp, 8
jmp 0x473802
push 0x52cb00
call fcn.00493de7
add esp, 4
cmp dword [0x52cb00], 0xffffffff
jne 0x473879
push 4
call fcn.00493d3d
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.00473ed0
mov dword [0x52cafc], esi
push 0x52cb00
call fcn.00493e5d
add esp, 4
jmp 0x473879
mov ecx, esi
call fcn.00473ee0
jmp 0x47388e
Function at 0x473c70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, ecx
mov eax, dword [0x526014]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x3e
push str..._.._base_files_file_win.cc
push str.Read
push ebx
call fcn.004712d0
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.00478af0
cmp dword [ebp + 0x14], 0
js 0x473d6a
mov edi, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.004781f0
test al, al
jne 0x473d6f
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push ebx
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x473d58
mov ebx, dword [esp + 0xc]
lea ecx, [esp + 0x28]
call fcn.00478290
lea ecx, [esp + 0x30]
call fcn.00478b50
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.004948c8
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x473d2f
xor ebx, ebx
dec ebx
jmp 0x473d38
lea ecx, [esp + 0x28]
push 0
push dword [ebp + 0x14]
push esi
push str.File::Read
call fcn.004e3e10
jmp 0x473cf0

Function at 0x473d90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x473dcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x473de2
lea eax, [ebx + 1]
cmp eax, 2
jb 0x473dc4
mov dword [esi], ebx
call fcn.00471300
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x473df9
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00471300
push dword [esi]
call fcn.00474440
add esp, 4
mov dword [esi], 0
jmp 0x473db5
int3

Function at 0x473f30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x473fae
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x473f97
lea eax, [edi + 1]
cmp eax, 2
jb 0x473f7b
mov dword [esi], edi
call fcn.00471300
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 1
inc eax
cmp eax, 1
jbe 0x473fb2
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.00471300
push dword [esi]
call fcn.00474440
add esp, 4
mov dword [esi], 0
jmp 0x473f6c
mov byte [esi + 4], 1
int3
Function at 0x474470
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x526014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x52cb40]
mov ecx, dword [0x52a234]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4744c1
mov eax, dword [0x52cb3c]
mov esi, dword [eax]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004948c8
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x52cb40
call fcn.00493de7
add esp, 4
cmp dword [0x52cb40], 0xffffffff
jne 0x4744a3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.00497b10
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.00493d3d
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x52cb70]
mov ecx, dword [0x52a234]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x47456a
mov ecx, esi
push ebx
push 0x52cb4c
push edi
call fcn.0044b7a0
mov dword [0x52cb3c], esi
push 0x52cb40
call fcn.00493e5d
add esp, 4
jmp 0x4744a3
push 0x52cb70
call fcn.00493de7
add esp, 4
cmp dword [0x52cb70], 0xffffffff
jne 0x474544
xorps xmm0, xmm0
movups xmmword [0x52cb5c], xmm0
movups xmmword [0x52cb4c], xmm0
mov dword [0x52cb6c], 0
push 0x52cb4c
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x52cb70
call fcn.00493e5d
add esp, 4
jmp 0x474544
Function at 0x475d40
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00475a10
Function at 0x47c150
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x14], ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x47c16c
mov eax, dword [ebx + 4]
mov ebx, dword [ebx]
mov esi, eax
mov ecx, ebx
mov edx, eax
mov dword [ebp - 0x20], eax
cmp eax, 4
jb 0x47c1b6
mov eax, dword [ebp - 0x20]
mov edx, eax
mov ecx, ebx
nop word cs:[eax + eax]
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x47c190
cmp edx, 1
je 0x47c1d7
cmp edx, 2
je 0x47c1ce
cmp edx, 3
jne 0x47c1e2
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x14]
mov esi, dword [ecx + 4]
xor ecx, ecx
test esi, esi
je 0x47c31f
mov dword [ebp - 0x1c], ebx
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, 0x33333333
mov ebx, eax
and ebx, edx
shr eax, 2
and eax, edx
add eax, ebx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul ebx, edx, 0x1010101
shr ebx, 0x18
cmp ebx, 1
jbe 0x47c332
mov edx, edi
cmp edi, esi
jb 0x47c252
mov eax, edi
xor edx, edx
div esi
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x47c31f
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x2c], ebx
mov esi, dword [eax]
test esi, esi
je 0x47c31f
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 4]
cmp eax, edi
jne 0x47c2f4
movzx eax, byte [esi + 0x13]
mov ecx, eax
test al, al
jns 0x47c28d
mov ecx, dword [esi + 0xc]
cmp ecx, dword [ebp - 0x20]
jne 0x47c30f
mov dword [ebp - 0x18], edx
lea ecx, [esi + 8]
mov edx, dword [ecx]
test al, al
cmovs ecx, edx
jns 0x47c2be
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x47c31d
push eax
push dword [ebp - 0x1c]
push ecx
call fcn.004960fd
add esp, 0xc
test eax, eax
mov edx, dword [ebp - 0x18]
je 0x47c31d
jmp 0x47c30f
test eax, eax
je 0x47c31d
mov ecx, dword [ebp - 0x1c]
cmp byte [ecx], dl
mov edx, dword [ebp - 0x18]
jne 0x47c30f
dec eax
xor ecx, ecx
cmp eax, ecx
je 0x47c31d
mov dl, byte [esi + ecx + 9]
mov byte [ebp - 0xd], dl
lea edx, [ecx + 1]
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0x1c]
mov bl, byte [ebp - 0xd]
cmp bl, byte [edx + ecx + 1]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
je 0x47c2cf
jmp 0x47c30f
cmp dword [ebp - 0x2c], 1
jbe 0x47c33c
mov ecx, edx
mov ebx, dword [ebp - 0x14]
cmp eax, ebx
jb 0x47c309
xor edx, edx
div ebx
mov eax, edx
mov edx, ecx
cmp eax, edx
jne 0x47c32e
mov esi, dword [esi]
xor ecx, ecx
test esi, esi
jne 0x47c279
jmp 0x47c31f
mov ecx, esi
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ecx, ecx
jmp 0x47c31f
lea edx, [esi - 1]
and edx, edi
jmp 0x47c252
and eax, dword [ebp - 0x28]
jmp 0x47c30b
Function at 0x486560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
movzx eax, byte [ecx + 0x27]
test al, al
js 0x4865d4
test eax, eax
jne 0x4865c9
cmp dword [esi + 0x28], 0
jne 0x4865c9
mov byte [esi + 0x2c], 0
mov eax, dword [esi + 8]
mov dword [esi + 4], eax
cmp eax, dword [esi + 0xc]
je 0x4865bc
lea edi, [esi + 0x10]
mov ebx, 0x80001b
lea ecx, [eax + 1]
mov dword [esi + 8], ecx
movsx eax, byte [eax]
mov ecx, edi
push 0
push eax
call fcn.0046d990
cmp eax, 0xffffffff
jne 0x4865b1
cmp dword [esi + 0x30], 1
jne 0x4865ec
jmp 0x4865d9
mov eax, dword [esi + 8]
mov dword [esi + 4], eax
cmp eax, dword [esi + 0xc]
jne 0x486591
mov byte [esi + 0x2c], 1
xor ebx, ebx
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004f35b0
mov eax, dword [esi + 0x20]
jmp 0x486570
mov eax, dword [esi + 4]
mov al, byte [eax]
add al, 0xf7
cmp al, 0x17
ja 0x4865ec
movzx eax, al
bt ebx, eax
jb 0x4865b1
mov eax, dword [esi + 8]
mov bl, 1
cmp eax, dword [esi + 0xc]
je 0x4865c2
nop word cs:[eax + eax]
movsx eax, byte [eax]
mov ecx, edi
push 0
push eax
call fcn.0046d990
cmp eax, 0xffffffff
jne 0x4865c2
mov eax, dword [esi + 8]
cmp dword [esi + 0x30], 1
je 0x486626
inc eax
mov dword [esi + 8], eax
cmp eax, dword [esi + 0xc]
jne 0x486600
jmp 0x4865c2
mov cl, byte [eax]
add cl, 0xf7
cmp cl, 0x17
ja 0x48661b
movzx ecx, cl
mov edx, 0x80001b
bt edx, ecx
jae 0x48661b
jmp 0x4865c2
Function at 0x48d100
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x539cf8]
mov ecx, dword [0x52a234]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x48d12b
mov ecx, 0x539cf0
pop ebp
jmp fcn.004739a0
push 0x539cf8
call fcn.00493de7
add esp, 4
cmp dword [0x539cf8], 0xffffffff
jne 0x48d120
xor eax, eax
mov dword [0x539cf4], eax
mov dword [0x539cf0], eax
mov ecx, 0x539cf0
push eax
call fcn.00448480
push 0x539cf8
call fcn.00493e5d
add esp, 4
jmp 0x48d120
Function at 0x491260
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x491298
mov edx, dword [ebp + 0xc]
xor esi, esi
nop word cs:[eax + eax]
movzx edi, al
movzx ebx, byte [edx + esi]
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x51ed04]
inc esi
cmp ecx, esi
jne 0x491280
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4b60a7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b62f0

Function at 0x4b8ab0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b8abb

Function at 0x4c1b70
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov esi, ecx
mov eax, dword [0x526014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x212]
push 0x202
push 0xff
push ebx
call fcn.00497b10
add esp, 0xc
lea eax, [ebp - 0x218]
mov dword [eax], 0x101
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test eax, eax
je 0x4c1bd1
mov ecx, esi
push 0xa
push str.UICreated_
call fcn.00444770
mov ecx, esi
push ebx
call fcn.0046ec10
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004948c8
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4c2520
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
lea esi, [ebp - 0x18]
mov dword [esi - 4], esp
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x43cc80
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
call fcn.004a61ea
mov ecx, eax
call dword [section..00cfg]
mov dword [esi + 8], 1
call ecx
push 2
call fcn.0049871f
add esp, 4
push eax
push 1
push 0x28
push str.terminate_handler_unexpectedly_returned_n
call fcn.004abb50
add esp, 0x10
call fcn.004a7bd0
nop word cs:[eax + eax]
push ebp
sub esp, 0x10
add ebp, 0xc
call fcn.00495751
nop dword [eax]
push ebp
sub esp, 0x10
add ebp, 0xc
mov dword [ebp - 0x1c], esp
push 2
call fcn.0049871f
add esp, 4
push eax
push 1
push 0x32
push str.terminate_handler_unexpectedly_threw_an_exception_n
call fcn.004abb50
add esp, 0x10
call fcn.004a7bd0
int3
Function at 0x4c25a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
lea esi, [ebp - 0x18]
mov dword [esi - 4], esp
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x43cc80
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
call fcn.004a61ea
mov ecx, eax
call dword [section..00cfg]
mov dword [esi + 8], 1
call ecx
push 2
call fcn.0049871f
add esp, 4
push eax
push 1
push 0x28
push str.terminate_handler_unexpectedly_returned_n
call fcn.004abb50
add esp, 0x10
call fcn.004a7bd0
nop word cs:[eax + eax]
push ebp
sub esp, 0x10
add ebp, 0xc
call fcn.00495751
nop dword [eax]
push ebp
sub esp, 0x10
add ebp, 0xc
mov dword [ebp - 0x1c], esp
push 2
call fcn.0049871f
add esp, 4
push eax
push 1
push 0x32
push str.terminate_handler_unexpectedly_threw_an_exception_n
call fcn.004abb50
add esp, 0x10
call fcn.004a7bd0
int3

Function at 0x4c3190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x20], ecx
mov eax, dword [0x526014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
xor eax, eax
dec eax
mov dword [ecx - 4], eax
mov dword [ecx - 8], eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0xffffffff
mov ebx, dword [edi + 0x24]
mov eax, dword [edi + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [section..00cfg]
mov ecx, ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x24]
call esi
mov ebx, eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.004abb50
add esp, 0x10
cmp eax, esi
jne 0x4c3227
cmp ebx, 1
je 0x4c31b5
cmp ebx, 2
mov esi, 0xffffffff
je 0x4c322a
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.004aabe6
add esp, 4
xor esi, esi
neg eax
sbb esi, esi
jmp 0x4c322a
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004948c8
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4c3240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x4c326b
push dword [ecx + 0x20]
push edi
push 1
push eax
call fcn.004abb50
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
test edi, edi
jle 0x4c32a6
mov dword [ebp - 0x10], ecx
xor edi, edi
mov esi, dword [ebp - 0x10]
movzx eax, byte [eax + edi]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
mov ebx, dword [eax + 0x30]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push dword [ebp - 0x14]
call ebx
cmp eax, 0xffffffff
je 0x4c32a8
inc edi
mov edx, dword [ebp + 0xc]
cmp edx, edi
mov eax, dword [ebp + 8]
jne 0x4c3277
mov edi, edx
jmp 0x4c32a8
xor edi, edi
mov eax, edi
add esp, 8
jmp 0x4c3264