joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ae80
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563270
push 0x51bf78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov edi, edx
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi]
cmp eax, 0xc
jne 0x45af0c
mov ecx, edi
mov eax, str.msvcrt40.dll
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x45aee0
test dl, dl
je 0x45aedc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x45aee0
add eax, 2
add ecx, 2
test dl, dl
jne 0x45aec0
xor eax, eax
jmp 0x45aee5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x45afac
mov ecx, edi
call fcn.0045adf0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x10
je 0x45af4f
cmp eax, 0x42
je 0x45af4f
cmp eax, 0x43
je 0x45af4f
cmp eax, 0x44
je 0x45aeed
cmp eax, 0x3c
je 0x45aeed
cmp eax, 5
je 0x45af74
cmp eax, 0x3f
je 0x45af74
cmp eax, 0x40
je 0x45af74
cmp eax, 0x41
je 0x45af74
cmp eax, 0x50
jne 0x45afac
push ecx
mov edx, esi
mov ecx, edi
call fcn.004c3b40
add esp, 4
test eax, eax
jne 0x45afac
mov dword [esi], 0xc
mov ecx, edi
call fcn.0045adf0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi], 5
mov ecx, edi
call fcn.0045adf0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45bff0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5632c0
push 0x51bf78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov edi, ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0
mov edx, dword [0x5c6124]
mov esi, 0x811c9dc5
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], esi
cmp ecx, 4
jae 0x45c04d
movzx eax, byte [ebp + ecx - 0x20]
xor esi, eax
mov dword [ebp - 0x1c], esi
imul esi, esi, 0x1000193
inc ecx
jmp 0x45c02f
and esi, dword [0x5c6138]
mov eax, dword [0x5c612c]
lea ebx, [eax + esi*8]
mov esi, dword [ebx]
mov eax, esi
nop
cmp esi, edx
jne 0x45c06b
mov dword [ebp - 0x2c], edx
mov ecx, edx
jmp 0x45c073
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov dword [ebp - 0x2c], ecx
cmp eax, ecx
je 0x45c085
cmp dword [eax + 8], edi
jne 0x45c081
mov dword [ebp - 0x38], eax
jmp 0x45c087
mov eax, dword [eax]
jmp 0x45c060
mov eax, edx
cmp eax, edx
jne 0x45c0f3
mov edx, dword [0x5c6184]
mov esi, 0x811c9dc5
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], esi
cmp ecx, 4
jae 0x45c0b6
movzx eax, byte [ebp + ecx - 0x20]
xor esi, eax
mov dword [ebp - 0x24], esi
imul esi, esi, 0x1000193
inc ecx
jmp 0x45c098
and esi, dword [0x5c6198]
mov eax, dword [0x5c618c]
lea ebx, [eax + esi*8]
mov esi, dword [ebx]
mov eax, esi
cmp esi, edx
jne 0x45c0d3
mov dword [ebp - 0x34], edx
mov ecx, edx
jmp 0x45c0db
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov dword [ebp - 0x34], ecx
cmp eax, ecx
je 0x45c0ed
cmp dword [eax + 8], edi
jne 0x45c0e9
mov dword [ebp - 0x3c], eax
jmp 0x45c0ef
mov eax, dword [eax]
jmp 0x45c0c8
mov eax, edx
cmp eax, edx
je 0x45c120
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c140
Capabilities:
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5632d0
push 0x51bf78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 0
cmp dword [esi], 0
je 0x45c28e
cmp byte [0x5c101f], 0
je 0x45c1ff
mov edx, 0x811c9dc5
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
cmp ecx, 4
jae 0x45c1c0
movzx eax, byte [ebp + ecx - 0x24]
xor edx, eax
mov dword [ebp - 0x28], edx
imul edx, edx, 0x1000193
inc ecx
jmp 0x45c1a2
mov ecx, dword [0x5c6138]
and ecx, edx
mov eax, dword [0x5c612c]
lea ecx, [eax + ecx*8]
mov dword [ebp - 0x34], ecx
mov edi, dword [ecx]
mov eax, edi
mov edx, dword [0x5c6124]
nop dword [eax]
cmp edi, edx
jne 0x45c1eb
mov dword [ebp - 0x30], edx
mov ecx, edx
jmp 0x45c1f3
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
cmp eax, ecx
je 0x45c1ff
cmp dword [eax + 8], esi
jne 0x45c247
mov dword [ebp - 0x34], eax
push dword [ebp - 0x34]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x38]
push eax
mov ecx, 0x5c6120
call fcn.00461a10
mov eax, dword [0x5c33bc]
cmp dword [0x5c33c0], eax
je 0x45c24e
mov dword [eax], esi
add dword [0x5c33bc], 4
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, dword [eax]
mov ecx, dword [ebp - 0x34]
jmp 0x45c1e0
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.00461850
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x45cea0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563360
push 0x51bf78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], ecx
mov esi, ecx
mov dword [ebp - 4], 0
mov al, byte [ecx]
cmp al, 0xcc
jne 0x45cede
inc ecx
mov dword [ebp - 0x1c], ecx
jmp 0x45ced2
cmp esi, ecx
jne 0x45cef7
cmp al, 0x90
jne 0x45ceee
inc ecx
mov dword [ebp - 0x1c], ecx
mov al, byte [ecx]
jmp 0x45cee2
cmp esi, ecx
jne 0x45cef7
add ecx, edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f350
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5634b0
push 0x51bf78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x5aff70]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
mov edi, dword [0x5ab0ec]
add edi, dword [0x5ab0e4]
call fcn.004b2e90
test al, al
jne 0x45f3b5
call fcn.0045ca70
test al, al
je 0x45f3b5
push 1
mov edx, 0x14
lea ecx, [edx + 0x28]
call fcn.00425720
add esp, 4
cmp byte [0x5a0017], 0
jne 0x45f488
cmp byte [0x5af433], 0
jne 0x45f488
xor esi, esi
mov dword [ebp - 0x28], esi
cmp esi, dword [0x5b07a4]
jge 0x45f3fa
cmp esi, dword [0x59d9e4]
je 0x45f3f7
push 1
mov edx, edi
mov ecx, dword [esi*8 + 0x5afd38]
call fcn.0045d390
add esp, 4
inc esi
jmp 0x45f3d1
mov edx, dword [0x5c6184]
mov esi, 0x811c9dc5
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], esi
cmp ecx, 4
jae 0x45f427
movzx eax, byte [ecx + 0x5affec]
xor esi, eax
mov dword [ebp - 0x1c], esi
imul esi, esi, 0x1000193
inc ecx
jmp 0x45f407
and esi, dword [0x5c6198]
mov eax, dword [0x5c618c]
lea ecx, [eax + esi*8]
mov dword [ebp - 0x34], ecx
mov esi, dword [ecx]
mov eax, esi
mov ebx, dword [0x5affec]
cmp esi, edx
jne 0x45f44d
mov dword [ebp - 0x30], edx
mov ecx, edx
jmp 0x45f455
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
cmp eax, ecx
je 0x45f46a
cmp dword [eax + 8], ebx
jne 0x45f463
mov dword [ebp - 0x40], eax
jmp 0x45f46c
mov eax, dword [eax]
mov ecx, dword [ebp - 0x34]
jmp 0x45f442
mov eax, edx
cmp eax, edx
jne 0x45f543
push 1
mov edx, edi
mov ecx, dword [ebp - 0x24]
call fcn.0045d390
add esp, 4
jmp 0x45f543
xor esi, esi
mov dword [ebp - 0x38], esi
cmp esi, dword [0x5b07a4]
jge 0x45f4b1
cmp esi, dword [0x59d9e4]
je 0x45f4ae
push 1
mov ecx, dword [esi*8 + 0x5afd38]
call fcn.0045cfd0
add esp, 4
inc esi
jmp 0x45f48a
mov edx, dword [0x5c6184]
mov esi, 0x811c9dc5
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x20], esi
cmp ecx, 4
jae 0x45f4de
movzx eax, byte [ecx + 0x5affec]
xor esi, eax
mov dword [ebp - 0x20], esi
imul esi, esi, 0x1000193
inc ecx
jmp 0x45f4be
and esi, dword [0x5c6198]
mov eax, dword [0x5c618c]
lea ebx, [eax + esi*8]
mov esi, dword [ebx]
mov eax, esi
mov edi, dword [0x5affec]
cmp esi, edx
jne 0x45f501
mov dword [ebp - 0x34], edx
mov ecx, edx
jmp 0x45f509
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov dword [ebp - 0x34], ecx
cmp eax, ecx
je 0x45f51b
cmp dword [eax + 8], edi
jne 0x45f517
mov dword [ebp - 0x44], eax
jmp 0x45f51d
mov eax, dword [eax]
jmp 0x45f4f6
mov eax, edx
cmp eax, edx
jne 0x45f543
push 1
mov ecx, dword [ebp - 0x24]
call fcn.0045cfd0
add esp, 4
jmp 0x45f543
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461750
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
mov eax, dword [edi + 0x18]
imul ecx, ecx, 0x1000193
pop edi
pop esi
and eax, ecx
pop ebp
ret 4

Function at 0x461c50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x461cc3
cmp eax, edi
jne 0x461cbb
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x461ccb
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x461ccb
cmp eax, edi
jne 0x461cce
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push 0xc
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.004d40e3
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4624c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563968
push 0x51bf78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 4], 0
test esi, esi
je 0x46257b
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x46251d
mov ecx, str.IE_44
call fcn.004c65c0
jmp 0x46257b
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x46252e
mov eax, dword [esi]
mov dword [ecx], eax
mov al, byte [esi + 4]
mov byte [ecx + 4], al
mov edx, dword [ebp + 8]
mov ecx, esi
call fcn.00462360
test al, al
je 0x46257b
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.00462400
add esp, 4
test al, al
je 0x462511
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ddb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564838
push 0x51bf78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov edi, 1
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x46decc
mov edx, eax
mov dword [ebp - 0x20], edx
mov bl, byte [edx]
test bl, bl
je 0x46de1a
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46de03
sub ecx, esi
inc ecx
cmp bl, 0x3d
je 0x46de16
inc edi
mov dword [ebp - 0x2c], edi
add edx, ecx
jmp 0x46ddf5
lea eax, [edi*4]
push eax
call fcn.004da034
add esp, 4
mov esi, eax
mov dword [0x5b0948], esi
mov dword [0x5b0928], esi
test esi, esi
je 0x46df11
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], esi
nop dword [eax]
cmp edi, 1
jle 0x46df0b
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46de60
sub ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x28], eax
cmp byte [ebx], 0x3d
je 0x46df01
push eax
call fcn.004da034
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x46dee7
sub esi, 4
mov dword [ebp - 0x1c], esi
cmp esi, dword [0x5b0948]
jb 0x46dea1
push dword [esi]
call fcn.004e4978
add esp, 4
jmp 0x46de87
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push dword [0x5b0948]
call fcn.004e4978
add esp, 4
mov dword [0x5b0948], 0
mov dword [0x5b0928], 0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add esi, 4
mov dword [ebp - 0x1c], esi
push dword [ebp - 0x28]
push ebx
push eax
call fcn.004d79c0
add esp, 0xc
dec edi
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x28]
add ebx, eax
mov dword [ebp - 0x20], ebx
jmp 0x46de50
mov dword [esi], 0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x46df2f
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x5b0948]
neg eax
sbb eax, eax
neg eax
dec eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46df60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564848
push 0x51bf78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov edi, 1
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x46e089
mov edx, ebx
mov dword [ebp - 0x20], edx
movzx esi, word [edx]
test si, si
je 0x46dfd7
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46dfb7
sub ecx, ebx
sar ecx, 1
cmp esi, 0x3d
je 0x46dfcf
inc edi
mov dword [ebp - 0x2c], edi
lea edx, [edx + ecx*2]
add edx, 2
jmp 0x46dfa7
lea eax, [edi*4]
push eax
call fcn.004da034
add esp, 4
mov esi, eax
mov dword [0x5b0880], esi
mov dword [0x5b0944], esi
test esi, esi
je 0x46e0d3
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], esi
cmp edi, 1
jle 0x46e0cd
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46e014
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [ebp - 0x28], eax
cmp word [ebx], 0x3d
je 0x46e0c2
add eax, eax
push eax
call fcn.004da034
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x46e0a4
sub esi, 4
mov dword [ebp - 0x1c], esi
cmp esi, dword [0x5b0880]
jb 0x46e05e
push dword [esi]
call fcn.004e4978
add esp, 4
jmp 0x46e044
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push dword [0x5b0880]
call fcn.004e4978
add esp, 4
mov dword [0x5b0880], 0
mov dword [0x5b0944], 0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add esi, 4
mov dword [ebp - 0x1c], esi
mov edx, dword [ebp - 0x28]
lea ecx, [edx + edx]
push ecx
push ebx
push eax
call fcn.004d79c0
add esp, 0xc
dec edi
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x28]
lea ebx, [ebx + eax*2]
mov dword [ebp - 0x20], ebx
jmp 0x46e006
mov dword [esi], 0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x46e0f1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x5b0880]
neg eax
sbb eax, eax
neg eax
dec eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49aac0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x569058
push 0x51bf78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov ecx, dword fs:[0x30]
mov eax, dword [ecx + 0xc]
mov dword [0x5c61c0], eax
mov eax, dword [ecx + 8]
mov dword [0x5c61c4], eax
mov eax, dword [ecx + 0xa0]
mov dword [0x5c61c8], eax
call fcn.0049aa40
jmp 0x49ab29
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49ab50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x569068
push 0x51bf78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov ecx, dword fs:[0x30]
pushfd
pop eax
mov dword [0x5b0a3c], eax
and eax, 0xfffffbff
push eax
popfd
mov eax, dword [0x5c61c0]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5c61c4]
mov dword [ecx + 8], eax
mov eax, dword [0x5c61c8]
mov dword [ecx + 0xa0], eax
jmp 0x49abc2
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c060
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x569128
push 0x51bf78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
push 0x40
push 0x3000
push 0x400
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x49c196
mov eax, dword [ebp + 8]
dec eax
cmp eax, 9
ja case.0x49c0c2.8
jmp dword [eax*4 + 0x49c1e0]
mov eax, 0x49b600
jmp 0x49c10d
mov eax, 0x49b6f0
jmp 0x49c10d
mov eax, 0x49b7e0
jmp 0x49c10d
mov eax, 0x49b930
jmp 0x49c10d
mov eax, 0x49ba80
jmp 0x49c10d
mov eax, 0x49bbd0
jmp 0x49c10d
mov eax, 0x49bd20
jmp 0x49c10d
mov eax, 0x49be70
jmp 0x49c10d
mov eax, 0x49bf70
jmp 0x49c10d
mov eax, 0x49b510
lea ecx, [ebp - 0x28]
push ecx
push 0x200
push eax
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x49c196
cmp dword [ebp - 0x28], 0x200
jne 0x49c196
mov eax, 0x46
xor dl, dl
lea ecx, [ebx + 0x64]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x49c150
cmp dword [ecx], 0xdeadbeef
jne 0x49c18a
mov dl, 1
lea eax, [esi + edi]
mov dword [ecx], eax
test dl, dl
je 0x49c196
mov eax, 0x1ce
xor bl, bl
add ecx, 0x3c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x49c192
cmp dword [ecx], 0x90909090
jne 0x49c18e
mov bl, 1
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], esi
cmp edx, edi
jae 0x49c192
mov al, byte [esi]
mov byte [ecx], al
inc esi
inc ecx
inc edx
jmp 0x49c174
inc ecx
dec eax
jmp 0x49c137
inc ecx
dec eax
jmp 0x49c15e
test bl, bl
jne 0x49c1c3
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a1800
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x4a1873
cmp ecx, eax
jne 0x4a186b
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x4a187b
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x4a187b
cmp ecx, eax
jne 0x4a187b
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x10
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.004d40e3
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 8
Function at 0x4a42c0
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov byte [0x5c61f5], 0
push ecx
mov ecx, dword [0x5ad8a4]
mov dl, 1
mov byte [0x5c61ce], 0
mov byte [0x5c61cc], 0
mov byte [0x5c61cf], 0
mov byte [0x5c61cd], 0
mov byte [0x5c61f4], 0
mov dword [0x5c61f0], 0
call fcn.0045f810
add esp, 4
mov byte [0x5c61cd], al
test al, al
jne 0x4a433f
mov eax, dword [0x5ad8a4]
cmp eax, dword [0x5ad894]
jbe 0x4a4331
cmp eax, dword [0x5ad898]
jae 0x4a4331
mov byte [0x5c61cf], 1
jmp 0x4a433f
mov byte [0x5c61cf], 0
mov byte [0x5c61f4], 1
mov eax, dword fs:[4]
xor esi, esi
mov dword [0x5ab164], eax
mov eax, dword fs:[8]
mov ecx, dword fs:[0]
mov dword [0x5aff74], eax
test ecx, ecx
je 0x4a4369
call fcn.004a41a0
mov esi, eax
mov dword [0x5c61f0], esi
test esi, esi
je 0x4a43b8
push ecx
mov dl, 1
mov ecx, esi
call fcn.0045f810
mov esi, dword [0x5c61f0]
add esp, 4
mov byte [0x5c61f5], al
test al, al
jne 0x4a43bd
cmp esi, dword [0x5ad894]
jbe 0x4a43a8
cmp esi, dword [0x5ad898]
jae 0x4a43a8
mov byte [0x5c61ce], 1
jmp 0x4a43bd
mov byte [0x5c61ce], 0
mov byte [0x5c61cc], 1
jmp 0x4a43bd
mov al, byte [0x5c61f5]
cmp byte [0x5af430], 0
jne 0x4a44e6
mov ecx, dword [0x5ad8a4]
test ecx, ecx
je 0x4a44e6
cmp byte [0x5c61cd], 0
jne 0x4a44e6
mov dl, byte [0x5c61cf]
test dl, dl
jne 0x4a4430
cmp ecx, dword [0x5ab164]
ja 0x4a4403
cmp ecx, dword [0x5aff74]
jae 0x4a44e6
call fcn.004c2d90
test al, al
je 0x4a444f
mov ecx, dword [0x5ad8a4]
call fcn.0045f7b0
test al, al
jne 0x4a44e6
mov dl, byte [0x5c61cf]
mov esi, dword [0x5c61f0]
mov al, byte [0x5c61f5]
test esi, esi
je 0x4a44e6
test dl, dl
je 0x4a449b
cmp byte [0x5c61ce], 0
je 0x4a44e3
xor eax, eax
pop edi
pop esi
pop ecx
ret
cmp byte [0x5a0017], 0
je 0x4a44e6
mov eax, dword [0x5c7518]
inc eax
mov dword [0x5c7518], eax
cmp eax, 5
jle 0x4a44e6
xor cl, cl
call fcn.0045e690
xor dl, dl
xor cl, cl
call fcn.004c3d20
mov eax, dword [0x5ab0dc]
or eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 0xa
pop edi
pop esi
pop ecx
ret
cmp byte [0x5c61f4], 0
je 0x4a44e6
cmp byte [0x5c61cc], 0
jne 0x4a44d4
cmp byte [0x5ad878], 0
je 0x4a44da
test al, al
je 0x4a44e3
mov byte [0x5ad878], 0
mov ecx, dword fs:[0x30]
push dword [0x5b0a3c]
popfd
call fcn.0049aa40
xor eax, eax
pop edi
pop esi
pop ecx
ret
cmp byte [0x5c61ce], 0
jne 0x4a44c1
mov byte [edi], 1
pop edi
mov eax, 0xa
pop esi
pop ecx
ret