joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fe720
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
cmp edx, 8
ja case.default.0x4fe731
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
jmp dword [edx*4 + 0x79c95c]
mov edx, 0x40
jmp case.0x4fe731.2
push 0x4000
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4fe76a
mov edx, 4
jmp case.0x4fe731.2
mov edx, 0x20
push edx
push 0x1000
push ecx
push eax
call fcn.004fe050
add esp, 0x10
test eax, eax
setne al
pop ebp
ret
int3

Function at 0x4fe9a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x80d0e4]
cmp eax, 0xffffffff
je 0x4fea61
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x4fea61
mov eax, dword [0x81eda8]
mov ecx, dword [0x80d580]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4fea6b
mov edi, dword [0x81eda4]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4feab9
mov ecx, dword [0x81dd9c]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx eax, al
mov ebx, eax
shl ebx, 4
cmp dword [ebx + 0x81dda0], 0
jne 0x4feac5
lea ecx, [ebx + 0x81dda0]
mov dword [ecx], 1
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov edx, dword [0x81eda0]
inc edx
mov dword [0x81eda0], edx
mov dword [ecx + 0xc], edx
mov dword [0x81dd9c], eax
mov dword [esi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x4feab6
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004feae0
jmp 0x4fe9c5
push 0x81eda8
call fcn.005c580d
add esp, 4
cmp dword [0x81eda8], 0xffffffff
jne 0x4fe9e6
push 4
call fcn.005c5789
add esp, 4
mov edi, eax
mov dword [eax], 0
mov ecx, eax
call fcn.0054c5d0
mov dword [0x81eda4], edi
push 0x81eda8
call fcn.005c5887
add esp, 4
jmp 0x4fe9e6
int3
mov ecx, edi
call fcn.0054c5e0
jmp 0x4fe9fb
inc edx
cmp edx, 0x100
jne 0x4fea04
jmp 0x4fea4b
Function at 0x4feae0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x80d0e4]
mov dword [ebp - 0x814], ecx
cmp ecx, 0xffffffff
je 0x4feb83
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x4febcc
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0
push ebx
call fcn.005c9b00
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push dword [ebp - 0x814]
call fcn.00515a40
add esp, 8
push edi
call fcn.005c57f3
add esp, 4
mov esi, eax
push edi
push ebx
push eax
call fcn.005c9580
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x814]
call fcn.00515a40
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x814]
push esi
call fcn.00515a20
add esp, 4
test al, al
je 0x4febcf
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xffffffff
je 0x4febd2
xor eax, eax
dec eax
lock cmpxchg dword [0x80d0e4], ecx
je 0x4feb07
push ecx
call fcn.007198a0
add esp, 4
mov ecx, dword [0x80d0e4]
mov dword [ebp - 0x814], ecx
jmp 0x4feb07
int3
int3
push esi
call fcn.00515a20
add esp, 4
test al, al
je 0x4febfa
cmp dword [ebp - 0x814], 0xffffffff
je 0x4febfa
push 0xffffffffffffffff
call fcn.007198a0
add esp, 4
mov ecx, dword [ebp - 0x814]
jmp 0x4feba1
int3

Function at 0x4ff3d0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp byte [edx + 0xb], 0
jns 0x4ff3e9
mov edx, dword [edx]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x4ff401
cmp byte [esi + 0x28], 1
je 0x4ff472
or ebx, 0x20000000
test bl, 8
jne 0x4ff47a
mov dword [ebp - 0x10], 0
cmp byte [esi + 0x30], 0
mov eax, 0
je 0x4ff41b
mov eax, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x4ff429
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x18], eax
cmp byte [esi + 0x1c], 1
je 0x4ff4cc
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 1
je 0x4ff4e2
test ecx, ecx
jne 0x4ff49f
xor ecx, ecx
inc ecx
push dword [ebp - 0x18]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x4ff496
test esi, esi
sete al
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
or ebx, 0x80000000
jmp 0x4ff401
cmp byte [esi + 0x34], 1
jne 0x4ff48b
or ebx, 0x40000000
jmp 0x4ff406
or ebx, 0x10000000
jmp 0x4ff406
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4ff463
cmp ecx, 4
jne 0x4ff4ab
mov ecx, 6
jmp 0x4ff44c
mov esi, ecx
add ecx, 0xfffffffe
cmp ecx, 2
jae 0x4ff4bc
mov ecx, 7
jmp 0x4ff44c
cmp esi, 1
jne 0x4ff4c8
mov ecx, 4
jmp 0x4ff44c
xor ecx, ecx
jmp 0x4ff44c
lea ecx, [esi + 0x10]
mov dword [ebp - 0x14], edx
call fcn.004ac9a0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x4ff436
mov ecx, esi
mov esi, edx
call fcn.004ac9a0
mov ecx, dword [ebp + 0xc]
mov edx, esi
jmp 0x4ff445
Function at 0x4ff500
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x4ff52a
cmp byte [esi + 0x28], 1
je 0x4ff5b0
or ebx, 0x20000000
test bl, 8
jne 0x4ff5bb
xor eax, eax
cmp byte [esi + 0x30], 0
mov ecx, 0
je 0x4ff543
mov ecx, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x4ff551
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0x1c], 1
je 0x4ff5d7
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 1
je 0x4ff5ed
mov ecx, dword [ebp + 8]
cmp edx, 4
jne 0x4ff59f
mov edx, 6
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x4ff5e4
test esi, esi
sete al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov esi, edx
add edx, 0xfffffffe
cmp edx, 2
jae 0x4ff5fd
mov edx, 7
jmp 0x4ff579
or ebx, 0x80000000
jmp 0x4ff52a
cmp byte [esi + 0x34], 1
jne 0x4ff5cc
or ebx, 0x40000000
jmp 0x4ff533
or ebx, 0x10000000
jmp 0x4ff533
lea ecx, [esi + 0x10]
call fcn.004ac9a0
jmp 0x4ff55a
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4ff590
mov ecx, esi
mov esi, edx
call fcn.004ac9a0
mov edx, esi
jmp 0x4ff56c
test esi, esi
jne 0x4ff609
xor edx, edx
inc edx
jmp 0x4ff579
cmp esi, 1
jne 0x4ff618
mov edx, 4
jmp 0x4ff579
xor edx, edx
jmp 0x4ff579
Function at 0x501270
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x81ee08]
mov ecx, dword [0x80d580]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x5013eb
mov esi, dword [0x81edf8]
lea eax, [esi + 0xc]
mov dword [ebp - 0x20], eax
push eax
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x501421
mov edi, esi
mov esi, dword [esi + 0x18]
test esi, esi
je 0x5013ac
imul eax, dword [ebp + 8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0x6f47a654
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
mov ebx, edi
add ebx, 0x14
and edx, 0xf0f0f0f
imul edi, edx, 0x1010101
shr edi, 0x18
cmp edi, 1
jbe 0x5013e1
mov edx, ecx
cmp ecx, esi
jb 0x501349
mov eax, ecx
xor edx, edx
div esi
mov dword [ebp - 0x24], ebx
mov eax, dword [ebx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x5013ac
mov ebx, dword [eax]
test ebx, ebx
je 0x5013ac
cmp edi, 2
jb 0x501451
mov eax, dword [ebx + 4]
cmp eax, ecx
jne 0x5013c7
mov eax, dword [ebp + 8]
cmp dword [ebx + 8], eax
jne 0x5013d9
lea edi, [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
push ebx
push edi
call fcn.00501af0
mov esi, dword [edi]
mov dword [edi], 0
test esi, esi
je 0x5013ac
cmp byte [ebp - 0x14], 1
jne 0x5013a3
mov eax, dword [esi + 0xc]
test eax, eax
je 0x5013a3
lock dec dword [eax + 4]
je 0x50142e
push esi
call fcn.005c57c0
add esp, 4
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, edx
cmp eax, esi
jb 0x5013d3
xor edx, edx
div esi
mov eax, edx
mov edx, edi
cmp eax, edi
jne 0x5013ac
mov ebx, dword [ebx]
test ebx, ebx
jne 0x501364
jmp 0x5013ac
lea edx, [esi - 1]
and edx, ecx
jmp 0x501349
push 0x81ee08
call fcn.005c580d
add esp, 4
cmp dword [0x81ee08], 0xffffffff
jne 0x5012a4
mov ecx, 0x81edd0
call fcn.00501470
push 0x81ee08
call fcn.005c5887
add esp, 4
jmp 0x5012a4
mov ecx, dword [ebp - 0x20]
call fcn.0054c5e0
jmp 0x5012bf
push eax
call fcn.00553100
add esp, 4
jmp 0x5013a3
and eax, esi
cmp eax, edx
jne 0x5013ac
mov ebx, dword [ebx]
test ebx, ebx
jne 0x501452
jmp 0x5013ac
dec esi
mov eax, dword [ebx + 4]
cmp eax, ecx
jne 0x50143c
mov eax, dword [ebp + 8]
cmp dword [ebx + 8], eax
je 0x501373
jmp 0x501446
Function at 0x50fc20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x50fc31
test eax, eax
jne 0x50fc8a
test eax, eax
sete al
mov ecx, dword [0x81ee50]
test ecx, ecx
setne dl
and dl, al
cmp dl, 1
jne 0x50fc50
call dword [0x8010bc]
call ecx
cmp dword [0x81ee48], 0
je 0x50fc8a
mov esi, dword [0x81ee4c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x50fc90
test esi, esi
je 0x50fc8a
mov ecx, dword [0x81ee48]
call dword [0x8010bc]
push esi
call ecx
add esp, 4
pop esi
pop edi
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x50fc78
jmp 0x50fc8a
Function at 0x5149c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push eax
push ecx
push 0x514a40
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x5149fe
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005c6b46
add esp, 0x18
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x20]
push 0x1b
push str....._third_partycrashpadcrashpadutil_thread_thread_win.cc
push str.Start
push edi
call fcn.0055fb40
add esp, 0x10
lea esi, [ebp - 0x10]
push edi
push esi
call fcn.006453e0
add esp, 8
mov ecx, esi
push 0x7939b6
call fcn.006428f0
mov ecx, esi
call fcn.00645480
jmp 0x5149ed
Function at 0x516730
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x81fc60]
mov ecx, dword [0x80d580]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x51679a
mov ecx, 0x81fc58
call fcn.005862a0
test eax, eax
jne 0x51678d
push 4
call fcn.005c5789
add esp, 4
mov edi, eax
mov dword [eax], 0
mov ecx, 0x81fc58
call fcn.005862a0
mov esi, eax
mov ecx, 0x81fc58
push edi
call fcn.004fec00
test esi, esi
jne 0x5167dd
mov ecx, 0x81fc58
pop esi
pop edi
pop ebp
jmp fcn.005862a0
push 0x81fc60
call fcn.005c580d
add esp, 4
cmp dword [0x81fc60], 0xffffffff
jne 0x516752
xor eax, eax
mov dword [0x81fc5c], eax
mov dword [0x81fc58], eax
mov ecx, 0x81fc58
push 0x413900
call fcn.004fec40
push 0x81fc60
call fcn.005c5887
add esp, 4
jmp 0x516752
push esi
call fcn.005c57c0
add esp, 4
jmp 0x51678d
Function at 0x536090
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x5360c5
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x5360cc
lea eax, [ebx + 1]
cmp eax, 2
jb 0x5360be
mov dword [esi], ebx
call fcn.0055fb70
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0055fb70
push dword [esi]
call fcn.0054ae70
add esp, 4
mov dword [esi], 0
jmp 0x5360af
Function at 0x542fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm4
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x5430ae
movq xmm4, qword [0x783130]
movdqa xmm5, xmmword [0x783140]
nop word cs:[eax + eax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm6
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
movdqu xmm6, xmmword [ecx]
pxor xmm0, xmm6
movdqu xmm6, xmmword [ecx + 0x10]
pxor xmm3, xmm6
movdqu xmm6, xmmword [ecx + 0x20]
pxor xmm2, xmm6
movdqu xmm6, xmmword [ecx + 0x30]
pxor xmm1, xmm6
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x543030
movq xmm4, qword [0x783150]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
pmovzxdq xmm3, qword [0x783190]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp eax, 0x10
jb 0x543133
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add ecx, 0x10
add eax, 0xfffffff0
cmp eax, 0xf
ja 0x54310c
pmovzxdq xmm1, qword [0x783190]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm2, xmm2
pxor xmm1, xmm1
pblendw xmm1, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x783160], 0
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm1, 3
pclmulqdq xmm0, xmmword [0x783170], 0x10
pblendw xmm0, xmm2, 0xfc
pclmulqdq xmm0, xmmword [0x783180], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop ebp
ret
Function at 0x54abb0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x80f29c]
mov ecx, dword [0x80d580]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x54abfd
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, 0x80f298
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x80f29c
call fcn.005c580d
add esp, 4
cmp dword [0x80f29c], 0xffffffff
jne 0x54abe3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.005c9b00
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x58
call fcn.005c5789
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x80f2cc]
mov ecx, dword [0x80d580]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x54aca6
mov ecx, esi
push ebx
push 0x80f2a8
push edi
call fcn.004a5b70
mov dword [0x80f298], esi
push 0x80f29c
call fcn.005c5887
add esp, 4
jmp 0x54abe3
push 0x80f2cc
call fcn.005c580d
add esp, 4
cmp dword [0x80f2cc], 0xffffffff
jne 0x54ac80
xorps xmm0, xmm0
movups xmmword [0x80f2b8], xmm0
movups xmmword [0x80f2a8], xmm0
mov dword [0x80f2c8], 0
push 0x80f2a8
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x80f2cc
call fcn.005c5887
add esp, 4
jmp 0x54ac80
Function at 0x54ad00
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x80f29c]
mov ecx, dword [0x80d580]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x54ad50
mov esi, dword [0x80f298]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x80f29c
call fcn.005c580d
add esp, 4
cmp dword [0x80f29c], 0xffffffff
jne 0x54ad33
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.005c9b00
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x58
call fcn.005c5789
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x80f2cc]
mov ecx, dword [0x80d580]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x54adf9
mov ecx, esi
push ebx
push 0x80f2a8
push edi
call fcn.004a5b70
mov dword [0x80f298], esi
push 0x80f29c
call fcn.005c5887
add esp, 4
jmp 0x54ad33
push 0x80f2cc
call fcn.005c580d
add esp, 4
cmp dword [0x80f2cc], 0xffffffff
jne 0x54add3
xorps xmm0, xmm0
movups xmmword [0x80f2b8], xmm0
movups xmmword [0x80f2a8], xmm0
mov dword [0x80f2c8], 0
push 0x80f2a8
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x80f2cc
call fcn.005c5887
add esp, 4
jmp 0x54add3
Function at 0x54c250
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x54c2ce
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x54c2b7
lea eax, [edi + 1]
cmp eax, 2
jb 0x54c29b
mov dword [esi], edi
call fcn.0055fb70
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 0
inc eax
cmp eax, 1
jbe 0x54c2d2
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.0055fb70
push dword [esi]
call fcn.0054ae70
add esp, 4
mov dword [esi], 0
jmp 0x54c28c
mov byte [esi + 4], 0
int3

Function at 0x54fa40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x5f
push str....._base_files_file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.0055fb40
add esp, 0x10
mov ecx, edi
push 0
push ebx
mov ebx, dword [ebp + 0xc]
call fcn.00552b00
test ebx, ebx
js 0x54fb01
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.005704d0
test al, al
jne 0x54fb1d
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push 0
push eax
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x54fb0b
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x54fb06
lea ecx, [esp + 0x10]
call fcn.00570560
lea ecx, [esp + 0x20]
call fcn.00552b70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
dec ebx
jmp 0x54fae1
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x54fad8
lea ecx, [esp + 0x10]
push 0
push ebx
push esi
push str.File::ReadAtCurrentPos
call fcn.006b4be0
jmp 0x54fab5
Function at 0x54fb40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 8], ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
lea ebx, [esp + 0x10]
push 0x81
push str....._base_files_file_win.cc
push str.Write
push ebx
call fcn.0055fb40
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push ebx
call fcn.00552b00
mov edi, 0xffffffff
cmp dword [ebp + 0xc], 0
js 0x54fc13
mov esi, dword [ebp + 0x14]
test esi, esi
js 0x54fc13
mov edi, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.005704d0
test al, al
jne 0x54fc3a
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push ebx
push eax
push esi
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x54fc33
mov edi, dword [esp + 0xc]
lea ecx, [esp + 0x28]
call fcn.00570560
lea ecx, [esp + 0x30]
call fcn.00552b70
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.005c6b46
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov edi, 0xffffffff
jmp 0x54fc0a
lea ecx, [esp + 0x28]
push 0
push esi
push dword [esp + 0x10]
push str.File::Write
call fcn.006b4be0
jmp 0x54fbc7
Function at 0x5627d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0054f950
mov dword [esi], 0
test eax, eax
je 0x562817
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x562846
lea eax, [ebx + 1]
cmp eax, 2
jb 0x56280d
mov dword [esi], ebx
call fcn.0055fb70
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.0055fdf0
lea ecx, [esi + 0x10]
call fcn.00570500
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0055fb70
push dword [esi]
call fcn.0054ae70
add esp, 4
mov dword [esi], 0
jmp 0x5627fe

Function at 0x5647b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x5647e6
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
nop word [eax + eax]
movzx eax, byte [ecx + esi]
xor al, byte [edx + esi]
or bl, al
inc esi
cmp edi, esi
jne 0x5647d0
movzx eax, bl
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x5647e1