joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b660
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, edx
movzx eax, cx
and edx, 0x1f
shr ecx, 0x10
shr esi, 5
mov dword [ebp - 0x10], edx
test esi, esi
je 0x42b798
mov edx, esi
mov edi, esi
nop
cmp edx, 0xad
mov edi, 0xad
mov dword [ebp - 0x14], edx
movd xmm4, ecx
pxor xmm6, xmm6
mov dword [ebp - 0x18], ebx
cmovb edi, edx
mov edx, eax
mov ecx, edi
imul edx, edi
movd xmm5, edx
shl ecx, 5
mov edx, edi
nop dword [eax]
movdqu xmm1, xmmword [ebx]
movdqu xmm3, xmmword [ebx + 0x10]
movdqa xmm7, xmm6
pxor xmm2, xmm2
add ebx, 0x20
dec edx
paddd xmm5, xmm7
movdqa xmm0, xmm1
movdqa xmm6, xmm3
psadbw xmm0, xmm2
psadbw xmm6, xmm2
movdqa xmm2, xmmword [0x5c1c30]
paddd xmm6, xmm0
movdqa xmm0, xmmword [0x5c1c20]
paddd xmm6, xmm7
pmaddubsw xmm3, xmm2
movdqa xmm2, xmmword [0x5c1c10]
pmaddwd xmm3, xmm0
paddd xmm4, xmm3
pmaddubsw xmm1, xmm2
pmaddwd xmm1, xmm0
paddd xmm4, xmm1
jne 0x42b6c0
pshufd xmm0, xmm6, 0xb1
pslld xmm5, 5
mov ebx, dword [ebp - 0x18]
mov edx, 0x80078071
paddd xmm0, xmm6
paddd xmm4, xmm5
pshufd xmm1, xmm0, 0x4e
paddd xmm1, xmm0
pshufd xmm0, xmm4, 0xb1
movd esi, xmm1
paddd xmm0, xmm4
add ebx, ecx
add esi, eax
pshufd xmm1, xmm0, 0x4e
mov eax, esi
paddd xmm1, xmm0
mul edx
movd ecx, xmm1
shr edx, 0xf
imul eax, edx, 0xfff1
mov edx, 0x80078071
sub esi, eax
mov eax, ecx
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
mov edx, dword [ebp - 0x14]
sub ecx, eax
mov eax, esi
sub edx, edi
jne 0x42b690
jmp 0x42b79a
mov esi, eax
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x42b86e
cmp edx, 0x10
jb 0x42b83d
movzx eax, byte [ebx]
mov edi, ebx
add esi, eax
movzx eax, byte [ebx + 1]
mov ebx, edx
movzx edx, byte [edi + 2]
add ecx, esi
add eax, esi
movzx esi, byte [edi + 0xd]
add ecx, eax
add edx, eax
movzx eax, byte [edi + 3]
add ecx, edx
add eax, edx
movzx edx, byte [edi + 4]
add ecx, eax
add edx, eax
movzx eax, byte [edi + 5]
add ecx, edx
add eax, edx
movzx edx, byte [edi + 6]
add ecx, eax
add edx, eax
movzx eax, byte [edi + 7]
add ecx, edx
add eax, edx
movzx edx, byte [edi + 8]
add ecx, eax
add edx, eax
movzx eax, byte [edi + 9]
add ecx, edx
add eax, edx
movzx edx, byte [edi + 0xa]
add ecx, eax
add edx, eax
movzx eax, byte [edi + 0xb]
add ecx, edx
add eax, edx
movzx edx, byte [edi + 0xc]
add ecx, eax
add edx, eax
add ecx, edx
add esi, edx
movzx edx, byte [edi + 0xe]
add ecx, esi
add edx, esi
movzx esi, byte [edi + 0xf]
add ecx, edx
add esi, edx
mov edx, ebx
add ecx, esi
add edx, 0xfffffff0
je 0x42b84b
add edi, 0x10
jmp 0x42b840
mov edi, ebx
nop
movzx eax, byte [edi]
inc edi
add esi, eax
add ecx, esi
dec edx
jne 0x42b840
lea eax, [esi - 0xfff1]
cmp esi, 0xfff0
mov edx, 0x80078071
cmova esi, eax
mov eax, ecx
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
shl ecx, 0x10
or ecx, esi
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42b880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movd xmm0, dword [ebp + 0x10]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
pxor xmm0, xmm4
jb 0x42b962
movdqa xmm5, xmmword [0x5c1c50]
nop dword [eax]
movdqa xmm4, xmmword [0x5c1c40]
movdqa xmm6, xmm0
movdqa xmm7, xmm0
movdqu xmm0, xmmword [ecx]
add eax, 0xffffffc0
pclmulqdq xmm7, xmm5, 0x11
pclmulqdq xmm6, xmm4, 0
pxor xmm0, xmm6
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
movdqa xmm4, xmm3
movdqu xmm3, xmmword [ecx + 0x10]
pxor xmm0, xmm7
movdqa xmm7, xmm2
pclmulqdq xmm4, xmm5, 0x11
pclmulqdq xmm7, xmm5, 0x11
pxor xmm3, xmm6
movdqa xmm6, xmm2
movdqu xmm2, xmmword [ecx + 0x20]
pclmulqdq xmm6, xmmword [0x5c1c40], 0
pxor xmm3, xmm4
movdqa xmm4, xmm1
pclmulqdq xmm4, xmmword [0x5c1c40], 0
pxor xmm2, xmm6
movdqa xmm6, xmm1
movdqu xmm1, xmmword [ecx + 0x30]
add ecx, 0x40
cmp eax, 0x3f
pclmulqdq xmm6, xmm5, 0x11
pxor xmm2, xmm7
pxor xmm1, xmm4
pxor xmm1, xmm6
ja 0x42b8c0
movdqa xmm5, xmmword [0x5c1c70]
movdqa xmm4, xmmword [0x5c1c60]
movdqa xmm6, xmm0
cmp eax, 0x10
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm6, xmm4, 0
pxor xmm0, xmm3
pxor xmm0, xmm6
movdqa xmm3, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm3, xmm4, 0
pxor xmm0, xmm2
pxor xmm0, xmm3
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm2, xmm4, 0
pxor xmm0, xmm1
pxor xmm0, xmm2
jb 0x42b9e7
nop
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
add eax, 0xfffffff0
add ecx, 0x10
pclmulqdq xmm2, xmm4, 0
cmp eax, 0xf
pxor xmm0, xmm1
pxor xmm0, xmm2
ja 0x42b9c0
movdqa xmm1, xmmword [0x5c1c70]
pxor xmm2, xmm2
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pblendw xmm2, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm2, xmmword [0x5c1c80], 0
pxor xmm2, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm2, 3
pclmulqdq xmm0, xmmword [0x5c1c90], 0x10
pblendw xmm0, xmm1, 0xfc
pclmulqdq xmm0, xmmword [0x5c1ca0], 0
pxor xmm0, xmm2
pextrd eax, xmm0, 1
pop ebp
ret
Function at 0x43c850
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1b8
mov eax, dword [0x63a1e8]
mov esi, ecx
lea ebx, [ebp - 0x110]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push 0
push eax
push 0x100
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43c8e6
lea eax, [ebp - 0x1c4]
push 0
push dword [ebp - 0x114]
push ebx
push eax
call fcn.0043cf10
add esp, 0x10
mov ecx, dword [ebp - 0x1c4]
test ecx, ecx
je 0x43c94a
call fcn.0043d540
cmp eax, 7
jbe 0x43c94a
mov ecx, dword [ebp - 0x1c4]
mov edi, dword [ebp + 8]
call fcn.0043d310
cmp dword [eax], edi
jne 0x43c9a6
mov eax, dword [ebp - 0x1c4]
mov dword [esi], eax
jmp 0x43c933
push 2
call fcn.004824f0
add esp, 4
test al, al
je 0x43c92d
call fcn.00482ea0
lea edi, [ebp - 0x1c0]
mov ecx, edi
push eax
push 2
push 0x38
push str..._.._mojo_core_broker_win.cc
call fcn.00482fd0
lea eax, [ebp - 0x1b8]
push 0x19
push str.Error_reading_broker_pipe
push eax
call fcn.00401baa
add esp, 0xc
mov ecx, edi
call fcn.00483090
mov dword [esi], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005909f1
mov eax, esi
add esp, 0x1b8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004824f0
add esp, 4
test al, al
je 0x43c98b
lea esi, [ebp - 0x1c0]
mov ecx, esi
push 2
push 0x3f
push str..._.._mojo_core_broker_win.cc
call fcn.00482590
lea eax, [ebp - 0x1b8]
push 0x16
push str.Invalid_broker_message
push eax
call fcn.00401baa
add esp, 0xc
mov ecx, esi
call fcn.00482940
push ebx
call fcn.00413500
add esp, 4
lea eax, [ebp - 0x114]
push eax
call fcn.00413500
add esp, 4
int3
push 2
call fcn.004824f0
add esp, 4
test al, al
je 0x43c9e7
lea esi, [ebp - 0x1c0]
mov ecx, esi
push 2
push 0x4a
push str..._.._mojo_core_broker_win.cc
call fcn.00482590
lea eax, [ebp - 0x1b8]
push 0x1e
push str.Unexpected_broker_message_type
push eax
call fcn.00401baa
add esp, 0xc
mov ecx, esi
call fcn.00482940
push ebx
call fcn.00413500
add esp, 4
lea eax, [ebp - 0x114]
push eax
call fcn.00413500
add esp, 4
int3
Function at 0x43f040
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov edi, edx
mov ecx, edx
mov eax, dword [0x63a1e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0043d7e0
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
cmp ebx, esi
je 0x43f07e
nop dword [eax]
mov ecx, ebx
call fcn.00454670
add ebx, 0x10
cmp esi, ebx
jne 0x43f070
mov esi, dword [ebp - 0x20]
lea eax, [esi + 0x70]
push eax
push 0
push dword [edi + 8]
push dword [edi]
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43f0a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x43f0b8
mov byte [esi + 0x9a], 1
mov al, 1
lock inc dword [esi + 4]
mov dword [ebp - 0x20], eax
jmp 0x43f0bf
mov dword [ebp - 0x20], 0
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x43f102
mov esi, dword [ebp - 0x18]
cmp esi, ebx
je 0x43f0f4
mov edi, ebx
sub edi, esi
add esi, 0xfffffff0
nop word cs:[eax + eax]
nop
mov ecx, esi
call fcn.004545e0
add esi, 0xfffffff0
add edi, 0x10
jne 0x43f0e0
mov eax, dword [ebp - 0x1c]
jmp 0x43f0f6
mov eax, ebx
mov dword [ebp - 0x18], ebx
push eax
call fcn.005909b6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005909f1
mov eax, dword [ebp - 0x20]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442450
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x63a1e8]
mov esi, ecx
add ecx, 0x14
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], ecx
call fcn.00494c80
mov edi, dword [esi + 0x1c]
test edi, edi
je 0x442557
imul eax, dword [ebp + 8], 0x5bd1e995
mov edx, edi
mov ebx, esi
add esi, 0x18
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0x6f47a654
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov eax, edi
shr eax, 1
and eax, 0x55555555
sub edx, eax
mov eax, edx
shr edx, 2
and eax, 0x33333333
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
cmp eax, 1
mov dword [ebp - 0x2c], eax
jbe 0x4424fc
mov edx, dword [ebp + 8]
cmp ecx, edi
mov ebx, ecx
jb 0x442504
mov eax, ecx
xor edx, edx
div edi
mov ebx, edx
jmp 0x442501
lea ebx, [edi - 1]
and ebx, ecx
mov edx, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x24], esi
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x442557
mov esi, dword [eax]
test esi, esi
je 0x442557
lea eax, [edi - 1]
mov dword [ebp - 0x28], eax
jmp 0x44252b
cmp dword [esi + 8], edx
je 0x44257b
mov esi, dword [esi]
test esi, esi
je 0x442557
mov eax, dword [esi + 4]
cmp eax, ecx
je 0x442520
cmp dword [ebp - 0x2c], 1
jbe 0x442550
cmp eax, edi
jb 0x442545
xor edx, edx
div edi
mov eax, edx
mov edx, dword [ebp + 8]
cmp eax, ebx
je 0x442525
jmp 0x442557
and eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x442525
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov esi, 3
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005909f1
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ebx, dword [esi + 0xc]
mov ecx, dword [ebp - 0x24]
mov dword [esi + 0xc], 0
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.004441d0
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
test esi, esi
je 0x4425cd
cmp byte [ebp - 0x14], 0
je 0x4425c4
mov edi, dword [esi + 0xc]
mov dword [esi + 0xc], 0
test edi, edi
je 0x4425c4
mov ecx, edi
call fcn.00454bd0
push edi
call fcn.005909b6
add esp, 4
push esi
call fcn.005909b6
add esp, 4
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor esi, esi
test ebx, ebx
je 0x442565
mov ecx, ebx
call fcn.00454bd0
push ebx
call fcn.005909b6
add esp, 4
jmp 0x442565
Function at 0x449b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [0x63a1e8]
mov esi, dword [ebp + 8]
mov edi, ecx
lea edx, [esp + 0x10]
xor eax, ebp
mov dword [esp + 0x28], eax
mov eax, dword [ecx + 8]
mov ecx, dword [eax + 0x20]
lea eax, [edi + 0x10]
push edx
push eax
call fcn.004c4050
test eax, eax
je 0x449bbe
mov eax, dword [edi + 0x38]
test eax, eax
jne 0x449bac
cmp byte [edi + 0x40], 0
jne 0x449bac
mov eax, dword [edi + 0x44]
test eax, eax
je 0x449d31
mov dword [esi], 0
mov dword [esi + 4], 0
jmp 0x449c7c
movzx eax, byte [esp + 0x10]
cmp byte [esp + 0x12], 0
je 0x449be3
mov cl, byte [esp + 0x11]
or cl, al
or eax, 4
movzx edx, cl
mov ebx, eax
or edx, 0x24
cmp byte [edi + 0x68], 0
jne 0x449bfb
jmp 0x449c0a
movzx ebx, byte [esp + 0x13]
mov edx, 0x37
shl ebx, 4
or ebx, eax
or ebx, 2
cmp byte [edi + 0x68], 0
je 0x449c0a
mov eax, dword [edi + 0x70]
mov ecx, dword [edi + 0x74]
cmp eax, dword [esp + 0x14]
sbb ecx, 0
jb 0x449c25
cmp byte [edi + 0x78], 0
je 0x449c2a
mov eax, dword [edi + 0x80]
mov ecx, dword [edi + 0x84]
cmp eax, dword [esp + 0x18]
sbb ecx, 0
jae 0x449c2a
or ebx, 0x20
jmp 0x449c56
cmp byte [edi + 0x88], 0
je 0x449c56
mov eax, dword [edi + 0x90]
mov dword [esp + 4], edx
mov edx, ebx
mov ecx, dword [edi + 0x94]
or edx, 0x20
cmp eax, dword [esp + 0x1c]
sbb ecx, 0
cmovb ebx, edx
mov edx, dword [esp + 4]
mov eax, dword [edi + 0x3c]
test bl, 4
mov dword [edi + 0x3c], ebx
je 0x449c77
and eax, 4
jne 0x449c77
test byte [0x639844], 0x19
mov dword [esp + 4], edx
jne 0x449c93
mov edx, dword [esp + 4]
mov dword [esi + 4], edx
mov dword [esi], ebx
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.005909f1
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, 1
sub eax, dword [edi + 0x30]
mov ecx, eax
sar ecx, 0x1f
add eax, dword [edi + 0x28]
adc ecx, dword [edi + 0x2c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
call fcn.0047a2f0
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.004984d0
add esp, 4
push 0x82
push 0
lea eax, [esp + 0x28]
push eax
push edi
push dword [esp + 0x18]
push dword [esp + 0x20]
push 0
push 0
push 0
push str.MessagePipe_peer_closed
push 0x639844
push 0x58
call fcn.0049e480
add esp, 0x30
cmp byte [0x639844], 0
je 0x449c73
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
sub esp, 0x10
movsd xmm0, qword [esp + 0x30]
movsd qword [esp + 8], xmm0
mov dword [esp + 4], str.MessagePipe_peer_closed
mov dword [esp], 0x639844
call fcn.0049e5b0
add esp, 0x10
jmp 0x449c73
int3

Function at 0x454fd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x63b1c4]
cmp esi, 1
ja 0x455036
push 0x63b1c4
call fcn.00481d40
add esp, 4
test al, al
je 0x455030
mov esi, 0x63b1c8
mov dword [0x63b1cc], 0
mov dword [0x63b1c8], 0
mov ecx, 0x63b1c8
push 0
call fcn.0048cac0
push 0x63b1c4
push 0
push 0x63b1c8
push 0x63b1c4
call fcn.00481df0
add esp, 0x10
jmp 0x455036
mov esi, dword [0x63b1c4]
mov ecx, esi
pop esi
pop ebp
jmp fcn.0048ca50
Function at 0x456a60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [0x63a1e8]
mov esi, dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x48
call fcn.00590936
add esp, 4
mov edi, eax
mov ecx, eax
push 0
call fcn.004c2450
mov dword [esi], edi
push eax
mov esi, esp
push 0x50
call fcn.00590936
add esp, 4
mov ebx, eax
mov ecx, eax
push 0x5c33f4
call fcn.004c9010
movsd xmm0, qword [0x5cdba0]
movsd xmm1, qword [0x5cdba8]
mov dword [ebx], 0x5c33f8
mov dword [ebx + 8], edi
mov dword [ebx + 0x10], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
mov word [ebx + 0x1c], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x38], 0
movsd qword [ebx + 0x40], xmm0
movsd qword [ebx + 0x48], xmm1
mov ecx, dword [0x63e310]
mov edx, dword fs:[0x2c]
mov eax, dword [0x63b1e8]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x18]
jg 0x456b5e
lock inc dword [0x63b1e0]
mov ecx, edi
mov dword [esi], ebx
call fcn.004c2580
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005909f1
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x63b1e8
call fcn.00590a37
add esp, 4
cmp dword [0x63b1e8], 0xffffffff
jne 0x456b39
call fcn.00457ba0
push 0x63b1e8
call fcn.00590aad
add esp, 4
jmp 0x456b39

Function at 0x457350
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
lea ebx, [ebp + 8]
push 0x5c33f4
call fcn.004c9010
mov dword [esi], 0x5c33f8
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], 0
mov dword [esi + 0x18], eax
mov word [esi + 0x1c], 0x101
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
movsd xmm0, qword [0x5cdba8]
movsd qword [esi + 0x48], xmm0
movsd xmm0, qword [0x5cdba0]
movsd qword [esi + 0x40], xmm0
mov ecx, dword [0x63e310]
mov edx, dword fs:[0x2c]
mov eax, dword [0x63b1e8]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x18]
jg 0x45742b
lock inc dword [0x63b1e0]
mov edi, dword [ebx + 4]
mov dword [ebx + 4], 0
test edi, edi
je 0x457422
mov ecx, edi
call fcn.0043ceb0
push edi
call fcn.005909b6
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
push 0x63b1e8
call fcn.00590a37
add esp, 4
cmp dword [0x63b1e8], 0xffffffff
jne 0x4573fd
call fcn.00457ba0
push 0x63b1e8
call fcn.00590aad
add esp, 4
jmp 0x4573fd
Function at 0x45c6cc
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb0
mov edi, dword [0x63a1e8]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea ebx, [ebp + 0x10]
xor edi, ebp
mov dword [ebp - 0x10], edi
xor edi, edi
push edi
push ebx
push eax
push edi
push edx
push dword [ecx + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x45c705
mov byte [esi], 1
jmp 0x45c715
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f76
jne 0x45c72e
mov byte [esi], 0
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005909f1
mov eax, ebx
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004824f0
add esp, 4
test al, al
je 0x45c78c
lea esi, [ebp - 0xb8]
mov ecx, esi
push 2
push 0x1eb
push str..._.._chrome_chrome_cleaner_http_http_agent_impl.cc
call fcn.00482590
lea eax, [ebp - 0xb0]
push 0x1b
push str.WinHttpQueryHeaders_failed:
push eax
call fcn.00401baa
add esp, 0xc
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0xbc]
mov dword [ecx], eax
push ecx
push edi
call fcn.0045b2c0
add esp, 8
mov ecx, esi
call fcn.00482940
xor ebx, ebx
jmp 0x45c717
Function at 0x464750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x63a1e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x20]
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0x1c]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov esi, dword [ebp - 0x1c]
mov ebx, eax
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.005a9764
add esp, 0x10
cmp eax, esi
jne 0x4647c0
cmp ebx, 1
je 0x464769
cmp ebx, 2
mov esi, 0xffffffff
je 0x4647c3
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.005a8790
add esp, 4
neg eax
sbb esi, esi
jmp 0x4647c3
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005909f1
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4647e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x464804
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.005a9764
add esp, 0x14
jmp 0x464833
test esi, esi
jle 0x46482c
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, byte [eax + edi]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x46482e
inc edi
mov eax, ebx
cmp esi, edi
jne 0x46480d
mov edi, esi
jmp 0x46482e
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x464840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x63a1e8]
mov ebx, dword [ebp + 8]
xor eax, ebp
cmp ebx, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x464907
mov byte [ebp - 0x19], bl
mov esi, ecx
cmp byte [ecx + 0x2c], 0
je 0x46488e
xor edi, edi
lea eax, [ebp - 0x19]
inc edi
push dword [esi + 0x20]
push edi
push edi
push eax
call fcn.005a9764
add esp, 0x10
cmp eax, edi
je 0x464907
xor esi, esi
dec esi
jmp 0x46490f
lea ebx, [ebp - 0x19]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
mov ecx, dword [esi + 0x24]
lea edx, [ebp - 0x20]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push ebx
push dword [esi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], ebx
je 0x464886
mov edi, eax
cmp eax, 3
je 0x4648ef
cmp edi, 1
ja 0x464886
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub ebx, eax
push dword [esi + 0x20]
push ebx
push 1
push eax
call fcn.005a9764
add esp, 0x10
cmp eax, ebx
jne 0x464886
mov ebx, dword [ebp - 0x24]
cmp edi, 1
je 0x464899
jmp 0x464904
xor edi, edi
inc edi
push dword [esi + 0x20]
push edi
push edi
push ebx
call fcn.005a9764
add esp, 0x10
cmp eax, edi
jne 0x464886
mov ebx, dword [ebp + 8]
xor esi, esi
cmp ebx, 0xffffffff
cmovne esi, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005909f1
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x464960
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x464984
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.005a9764
add esp, 0x14
jmp 0x4649b4
test esi, esi
jle 0x4649ad
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, word [eax + edi*2]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x4649af
inc edi
mov eax, ebx
cmp esi, edi
jne 0x46498d
mov edi, esi
jmp 0x4649af
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4649c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x63a1e8]
movzx esi, word [ebp + 8]
xor eax, ebp
cmp si, 0xffff
mov dword [ebp - 0x10], eax
je 0x464a8b
mov word [ebp - 0x1a], si
mov edi, ecx
cmp byte [ecx + 0x2c], 0
je 0x464a11
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.005a9764
add esp, 0x10
cmp eax, 1
je 0x464a8b
xor esi, esi
dec esi
jmp 0x464a94
lea esi, [ebp - 0x1a]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0x20]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x464a09
mov ebx, eax
cmp eax, 3
je 0x464a72
cmp ebx, 1
ja 0x464a09
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.005a9764
add esp, 0x10
cmp eax, esi
jne 0x464a09
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x464a1c
jmp 0x464a87
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.005a9764
add esp, 0x10
cmp eax, ebx
jne 0x464a09
movzx esi, word [ebp + 8]
xor eax, eax
cmp si, 0xffff
cmove esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005909f1
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x464c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x464c4f
movsx esi, byte [edx]
shl eax, 4
inc edx
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
cmp ecx, edx
jne 0x464c31
pop esi
pop edi
pop ebp
ret 8

Function at 0x464d50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x464d81
movzx esi, word [edx]
shl eax, 4
add edx, 2
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
cmp ecx, edx
jne 0x464d61
pop esi
pop edi
pop ebp
ret 8