joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473aa0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510ed5
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x569080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00473cd0
mov ecx, dword [edi + 0x10]
mov ebx, eax
cmp dword [ecx - 0xc], 0
je 0x473b44
mov eax, dword [edi + 4]
cmp eax, 6
je 0x473af6
cmp eax, 7
je 0x473af6
cmp eax, 8
je 0x473af6
cmp eax, 9
je 0x473af6
cmp eax, 0x12
jne 0x473b44
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x58]
movlpd qword [ebp - 0x44], xmm0
push eax
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x58], 0x3c
mov dword [ebp - 0x54], 0x8400
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x4c], str.open
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call fcn.0042b830
cmp byte [eax + 0x1c], 0
je 0x473c73
call fcn.0042b830
test byte [eax + 0x20], 8
je 0x473c73
call fcn.0042b830
mov dword [ebp - 0x1c], eax
call fcn.004047f0
mov dword [ebp - 0x10], eax
test eax, eax
je 0x473cc1
mov edx, dword [eax]
mov esi, dword [edx + 0xc]
mov ecx, esi
call dword [0x525578]
mov ecx, dword [ebp - 0x10]
call esi
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x14]
push 0x18
push 0x5385c8
call fcn.00402660
push dword [edi + 4]
lea ecx, [ebp - 0x14]
call fcn.0042b240
mov esi, eax
push 0xf
push str.._Return_code:
mov ecx, esi
call fcn.00402660
push ebx
mov ecx, esi
call fcn.0042b240
mov dword [ebp - 0x18], eax
call fcn.004047f0
mov edi, eax
test edi, edi
je 0x473cc1
mov edx, dword [edi]
mov esi, dword [edx + 0xc]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10]
push 0
push 0x530654
call fcn.00402660
push ecx
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x1c]
push eax
call fcn.0042bba0
mov byte [ebp - 4], 2
or edx, 0xffffffff
mov ecx, dword [ebp - 0x10]
mov eax, edx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x473c48
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
or edx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], edx
dec edx
test edx, edx
jg 0x473c73
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
test ebx, ebx
je 0x473cad
cmp ebx, 0xe0000011
je 0x473cad
cmp ebx, 0xe0000027
je 0x473cad
cmp ebx, 0xe0000008
je 0x473cad
cmp ebx, 0x4c7
je 0x473cad
cmp ebx, 0x642
je 0x473cad
cmp ebx, 0xe0000029
je 0x473cad
push ebx
call fcn.0047cc50
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004027d0
int3
Function at 0x475a70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511394
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x569080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 2
lea eax, [ebx + 0x30]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
add eax, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
mov ecx, dword [eax]
or eax, 0xffffffff
sub ecx, 0x10
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x475ade
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x1c]
call fcn.0047d2d0
mov byte [ebp - 4], 0
lea ecx, [ebx + 0x10]
call fcn.00409720
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebx + 4]
call fcn.00409720
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476230
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511495
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x569080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.purgenotifseen
push dword [edi + 0x184]
call fcn.004ddab3
add esp, 8
test eax, eax
jne 0x4763be
push SysReAllocString
lea ecx, [ebp - 0x20]
call fcn.004454e0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0x536400
mov dword [ebp - 4], 1
lea eax, [edi + 0x188]
push eax
lea ecx, [ebp - 0x18]
call fcn.00409df0
call fcn.004047f0
mov ebx, eax
test ebx, ebx
je 0x4763d4
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x525578]
mov ecx, ebx
call esi
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
push eax
push 5
lea ecx, [ebp - 0x20]
call fcn.00447340
test al, al
jne 0x4762eb
mov byte [ebp - 4], 1
or ebx, 0xffffffff
jmp 0x476360
push ecx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
call fcn.00409000
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x476313
push dword [edi + 0x18c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x476325
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 3
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 3
or ebx, 0xffffffff
mov ecx, dword [ebp - 0x24]
mov eax, ebx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x47635c
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov eax, ebx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x476386
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4763be
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004027d0
int3
Function at 0x480770
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x204]
sub esp, 0x204
push 0xffffffffffffffff
push 0x5133ed
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x569080]
xor eax, ebp
mov dword [ebp + 0x200], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x20c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
mov edi, dword [ebx + 4]
push ecx
or edi, 0x2001f
mov dword [ebp - 0x20], 0
push edi
push 0
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x18]
test esi, esi
jne 0x4808af
test eax, eax
je 0x480811
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x20]
and edi, 0x300
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
test esi, esi
jne 0x4808af
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0x100
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp]
push ecx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x480887
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x18]
call fcn.00480770
mov esi, eax
test esi, esi
jne 0x4808af
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x480851
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x48089c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], 0
push dword [ebp - 0x24]
mov ecx, ebx
mov dword [ebp - 0x14], 0
call fcn.00480900
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4808cb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], 0
mov eax, esi
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.004d3ce9
lea esp, [ebp + 0x204]
pop ebp
ret 4
Function at 0x481820
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x513495
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x569080]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x410]
mov ebx, dword [ebp + 0x414]
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp], 0
mov byte [ebp - 4], 1
push 0x60
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
jne 0x4818c7
push 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x18], eax
test esi, esi
jne 0x4818c7
call fcn.0047fb90
mov edi, eax
jmp 0x4819cb
push dword [ebp - 0x14]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4818e2
call fcn.0047fb90
jmp 0x4819be
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x4818fd
call fcn.0047fb90
jmp 0x4819be
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x1c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x48191b
mov edi, 0x8007000e
jmp 0x4819c0
mov byte [ebp - 4], 2
mov ecx, 2
mul ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
test edx, edx
jne 0x481a0d
cmp eax, 0xffffffff
ja 0x481a0d
cmp eax, 0x400
jbe 0x481956
push eax
lea ecx, [ebp]
call fcn.0040bcd0
mov dword [ebp - 4], 1
jmp 0x48197b
lea eax, [ebp + 4]
mov dword [ebp], eax
mov dword [ebp - 4], 1
jmp 0x48197b
mov eax, dword [ebp]
test eax, eax
jne 0x481989
mov edi, 0x8007000e
jmp 0x4819c0
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x4819a4
call fcn.0047fb90
jmp 0x4819be
xor edx, edx
mov eax, dword [ebp]
mov word [eax + ecx*2], dx
push dword [ebp + 0x41c]
push dword [ebp]
lea ecx, [ebp - 0x24]
call fcn.004816d0
mov edi, eax
test esi, esi
je 0x4819cb
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x4819df
lea ecx, [ebp]
call fcn.0040bc90
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.004d3ce9
lea esp, [ebp + 0x408]
pop ebp
ret 0x10
push 0x80070216
call fcn.004027d0
int3
Function at 0x4852b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0xa50]
sub esp, 0xa50
push 0xffffffffffffffff
push 0x5140fa
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x569080]
xor eax, ebp
mov dword [ebp + 0xa4c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x1c], ecx
push 0
push 2
mov dword [ebp - 0x30], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x2c], 0x5305e4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], 0
cmp ebx, 0xffffffff
jne 0x485321
mov byte [ebp - 0xd], 0
or ebx, eax
jmp 0x48545d
push 0x228
lea eax, [ebp + 4]
push 0
push eax
call fcn.004d5e00
add esp, 0xc
mov dword [ebp], 0x22c
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x485455
nop
push dword [ebp + 8]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x24], 0x5305e4
mov dword [ebp - 0x20], edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0x410
test edi, edi
je 0x485425
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x22c]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x485425
lea eax, [ebp + 0x22c]
push eax
mov eax, dword [ebp - 0x1c]
push dword [eax]
call fcn.004ddab3
add esp, 8
test eax, eax
jne 0x485425
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
cmp ebx, ecx
jne 0x485400
mov edx, dword [esi]
lea eax, [ebp + 8]
cmp eax, edx
jb 0x4853d6
lea eax, [edx + ecx*4]
lea edx, [ebp + 8]
cmp edx, eax
mov edx, dword [esi]
jb 0x4854a3
test ecx, ecx
jne 0x4853df
lea ebx, [ecx + 1]
jmp 0x4853eb
add ebx, ebx
js 0x485422
cmp ebx, 0x1fffffff
ja 0x485422
push 4
push ebx
push edx
call fcn.004ddcbc
add esp, 0xc
test eax, eax
je 0x485422
mov dword [esi + 8], ebx
mov dword [esi], eax
mov ecx, dword [esi + 4]
mov dword [ebp - 0x34], ecx
mov eax, dword [esi]
lea ecx, [eax + ecx*4]
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], 2
test ecx, ecx
je 0x48541b
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov byte [ebp - 4], 1
inc dword [esi + 4]
mov ebx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
mov dword [ebp - 0x24], 0x5305e4
test edi, edi
je 0x485442
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], 0
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x485350
cmp dword [esi + 4], 0
setg byte [ebp - 0xd]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2c], 0x5305e4
test ebx, ebx
je 0x48547d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x28], 0
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa4c]
xor ecx, ebp
call fcn.004d3ce9
lea esp, [ebp + 0xa50]
pop ebp
ret
push 0x80004005
call fcn.004027d0
int3
Function at 0x485a80
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
push esi
push edi
mov edi, ecx
xor esi, esi
nop dword [eax]
lea eax, [esp + 8]
mov dword [esp + 8], edi
push eax
push 0x487580
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x485ac8
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x14
jl 0x485a90
pop edi
pop esi
add esp, 8
ret
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
add esp, 8
ret
Function at 0x486d50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514645
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x569080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], edx
push 0x22
push 0
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
mov dword [ebp - 0x28], 0x5321b4
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x486e85
push 0xa
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x486e85
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
call fcn.004047f0
mov dword [ebp - 0x10], eax
test eax, eax
je 0x486eb7
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x525578]
mov ecx, dword [ebp - 0x10]
call esi
lea esi, [eax + 0x10]
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x486e5d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x486e5d
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x486e5d
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.0043a710
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x18]
push eax
call fcn.004203d0
mov byte [ebp - 4], 2
or eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x486e5d
mov ebx, dword [ecx]
push ecx
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x525578]
mov ecx, ebx
call edi
mov ebx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0
lea ecx, [esi - 0x10]
or esi, 0xffffffff
lock xadd dword [ecx + 0xc], esi
dec esi
test esi, esi
jg 0x486e85
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x28], 0x5321b4
test ebx, ebx
je 0x486ea5
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004027d0
int3
Function at 0x48b350
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514d24
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x569080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], 0x539a94
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov byte [ebp - 4], 1
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov byte [ebp - 4], 2
lea edi, [ebx + 0x30]
mov eax, dword [ebp + 0x10]
lea esi, [edi + 4]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], edi
mov dword [edi], 0x536cb4
mov dword [ebp - 0x18], esi
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.00402800
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 5
mov dword [ebx + 0x38], 0x5378c0
mov dword [ebx + 0x3c], edi
mov dword [ebx + 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48c5a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514fe5
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x569080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], 0x536c9c
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], 0x536cb4
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.00402800
add eax, 0x10
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp byte [ebx + 0x10], 0
mov dword [ebp - 0x34], 0x5378c0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0
je 0x48c6d5
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push dword [ebp - 0x24]
mov dword [ebp - 0x18], 0xfeff
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x20], 0x5305e4
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 3
cmp esi, 0xffffffff
jne 0x48c666
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x20], 0x5305e4
push esi
jmp 0x48c69f
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 2
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x48c6b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 2
mov dword [ebp - 0x20], 0x5305e4
test esi, esi
je 0x48c6ac
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], 0
test edi, edi
je 0x48c6d5
mov ebx, dword [ebp - 0x10]
jmp 0x48c75a
mov byte [ebp - 4], 2
mov dword [ebp - 0x20], 0x5305e4
test esi, esi
je 0x48c6d5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], 0
mov eax, dword [ebx + 4]
xor edi, edi
mov dword [ebp - 0x10], 0
test eax, eax
jle 0x48c746
xor esi, esi
test esi, esi
js 0x48c7ab
cmp edi, eax
jge 0x48c7ab
mov ecx, dword [ebx]
add ecx, esi
cmp byte [ecx + 0x15c], 0
je 0x48c725
cmp byte [ebp + 0xc], 0
je 0x48c713
test byte [ecx + 0x94], 1
je 0x48c725
lea eax, [ebp - 0x34]
push eax
call fcn.0046ac90
mov ecx, dword [ebp - 0x10]
inc ecx
mov dword [ebp - 0x10], ecx
jmp 0x48c728
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebx + 4]
inc edi
add esi, 0x16c
cmp edi, eax
jl 0x48c6e7
test ecx, ecx
jle 0x48c746
mov ecx, dword [ebx + 0xc]
lea eax, [ebp - 0x34]
push eax
call fcn.00451dc0
mov ecx, dword [ebx + 0xc]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ecx + 0xec]
call fcn.00448a00
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x48c795
mov edi, dword [ecx]
push ecx
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x525578]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x8000000b
call fcn.004027d0
int3
Function at 0x4919a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
push esi
push edi
xor edx, eax
mov edi, ecx
imul ecx, edx, 0x1000193
mov eax, ebx
sar eax, 0x10
movzx eax, al
sar ebx, 0x18
xor ecx, eax
movzx eax, bl
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [edi + 0x694]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00493a80
mov eax, dword [eax + 4]
test eax, eax
jne 0x491a0f
mov eax, dword [edi + 0x698]
cmp eax, dword [edi + 0x698]
jne 0x491a40
lea eax, [esp + 0xf]
mov byte [esp + 0xf], 1
push eax
lea eax, [ebp + 8]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 0x694]
call fcn.00492d40
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4