joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f5ee0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x78efc4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4f5fa4
cmp byte [esi + 0x3e], 0
je 0x4f5fa4
mov eax, dword [esi]
push edi
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x4f5f92
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x4f5f5a
sub eax, 1
je 0x4f5f5e
sub eax, 2
jne 0x4f5f92
mov byte [esi + 0x3e], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4f5f7b
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0068dc25
add esp, 0x10
cmp edi, eax
jne 0x4f5f92
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.006773ff
mov esp, ebp
pop ebp
ret

Function at 0x4f9c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x34
mov eax, dword [0x78efc4]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, 1
lea edi, [esp + 0x10]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movaps xmmword [esp + 0x14], xmm0
pop ebx
nop
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
test dword [esp + 0x18], 0x80000000
jne 0x4f9c6d
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
mov eax, 0x40000000
lea edi, [esp + 0x10]
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x30]
mov byte [esp + 0x3c], 0
push eax
mov dword [esp + 0x18], 0x7263694d
mov dword [esp + 0x1c], 0x666f736f
mov word [esp + 0x20], 0x74
call fcn.006794b0
add esp, 8
test eax, eax
je 0x4f9cff
call fcn.004486f0
lea ecx, [esp + 0x2c]
push ecx
push str.Hypervisor_has_been_detected._Name:__0
push ecx
mov ecx, eax
call fcn.004fafd0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
call fcn.004486f0
lea ecx, [esp + 0x2c]
push ecx
push str.Seems__app_is_working_on_a_VM:_a_Hypervisor_has_been_detected._Name:__0
push ecx
mov ecx, eax
call fcn.004fafd0
mov ecx, dword [esp + 0x3c]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
Function at 0x4f9d30
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bee79
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x78efc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004f9c10
cmp eax, 1
je 0x4f9ebe
test eax, eax
je 0x4f9e61
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
rdtsc
mov dword [ebp - 0x30], eax
rdtsc
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x30]
cmp eax, 0x1f4
jbe 0x4f9da5
call fcn.004486f0
push str.Seems__app_is_working_on_a_VM.__CPU_time_diff_detected_
jmp 0x4f9eb5
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x7a99d0]
cmp eax, dword [ecx + 4]
jg 0x4f9edc
lea ecx, [ebp - 0x28]
call fcn.004f99e0
cmp dword [ebp - 0x14], 8
mov esi, 0x7a9988
mov edi, dword [ebp - 0x28]
setae bl
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4f9ddf
mov eax, dword [esi]
push dword [esi + 0x10]
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
test bl, bl
push eax
cmovne ecx, edi
push 0
call fcn.004e49c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4f9e65
add esi, 0x18
cmp esi, 0x7a99d0
jne 0x4f9dd5
test bl, bl
je 0x4f9e3e
mov eax, dword [ebp - 0x14]
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x4f9e34
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f9f51
push ecx
push edi
call fcn.006779b1
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 0x18], eax
call fcn.004486f0
push str.No_signs_of_a_virtual_environment_has_been_detected
push 1
mov ecx, eax
call fcn.0044e9d0
xor al, al
jmp 0x4f9ec0
test bl, bl
je 0x4f9e9b
mov eax, dword [ebp - 0x14]
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x4f9e91
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f9f51
push ecx
push edi
call fcn.006779b1
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 0x18], eax
call fcn.004486f0
push str.Seems__app_is_working_on_a_VM.__SMBIOS_info_detected_
push 1
mov ecx, eax
call fcn.0044e9d0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
push 0x7a99d0
call fcn.00677540
add esp, 4
cmp dword [0x7a99d0], 0xffffffff
jne 0x4f9dbe
push str.VBOX
mov ecx, 0x7a9988
call fcn.0044d100
push str.QEMU
mov ecx, 0x7a99a0
mov dword [ebp - 4], 0
call fcn.0044d100
push str.BOCHS
mov ecx, 0x7a99b8
mov byte [ebp - 4], 1
call fcn.0044d100
push 0x6cb930
mov dword [ebp - 4], 0xffffffff
call fcn.00677997
push 0x7a99d0
call fcn.006774f6
add esp, 8
jmp 0x4f9dbe
call fcn.00682da2
int3
Function at 0x4fbcc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x7a9924
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.004796f0
mov eax, dword [eax + 4]
test eax, eax
je 0x4fbd2d
cmp eax, dword [0x7a9928]
je 0x4fbd2d
mov eax, dword [eax + 0xc]
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4fbd40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bf2a5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x78efc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
mov ecx, esi
push ebx
push edi
push eax
call fcn.004796f0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x4fbe6b
cmp dword [esi + 8], 0xfffffff
je 0x4fbe82
lea eax, [esi + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.00677616
mov ecx, eax
add esp, 4
mov dword [ebp + 8], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 1
mov eax, dword [edi]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 0
mov eax, dword [esi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x75bde0]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x75bde0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x4fbe5b
mov ecx, esi
call fcn.004fbf60
mov edi, dword [ebp + 8]
mov ecx, esi
push ebx
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004796f0
mov ecx, dword [eax]
jmp 0x4fbe61
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp + 8]
push edi
push ecx
push ebx
mov ecx, esi
call fcn.004fbff0
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.006625ce
int3
Function at 0x4feb30
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bf78c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x78efc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [edi + 8], eax
lea eax, [ebp - 0x10]
push eax
push 0x6e11b0
push 1
push 0
push 0x6e11a0
mov dword [ebp - 0x10], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4fec96
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
mov ecx, dword [edi]
test ecx, ecx
je 0x4feba5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
mov dword [edi], ebx
mov dword [ebp - 0x14], 0
mov eax, dword [ebx]
push 0xc
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
call fcn.00677616
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 1
test esi, esi
je 0x4fec02
mov ebx, dword [ebp + 8]
push ebx
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
jne 0x4febfd
test ebx, ebx
jne 0x4fecaa
mov ebx, dword [ebp - 0x18]
jmp 0x4fec04
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp + 8], esi
test esi, esi
je 0x4fecb4
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esi]
push ebx
call dword [ebp - 0x1c]
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.004fe9f0
test esi, esi
jns 0x4fec5e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x14]
mov dword [ebp - 4], 3
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4fec75
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push esi
mov dword [edi + 4], esi
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
xor ecx, ecx
test eax, eax
cmovs ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x8007000e
call fcn.005a8bf0
push 0x8007000e
call fcn.005a8bf0
int3
Function at 0x500930
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bfb3d
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x78efc4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x10c]
mov dword [ebp - 4], 0
call fcn.00500b20
lea eax, [ebp - 0x10c]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.00500780
test al, al
je 0x5009e9
lea eax, [esi + 0x58]
mov dword [ebp - 0x110], 0
push eax
lea eax, [ebp - 0x110]
push eax
push 0xf8
lea eax, [ebp - 0x10c]
push eax
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
test eax, eax
je 0x5009be
xor eax, eax
jmp 0x5009c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test bl, bl
jne 0x5009cf
cmp eax, 0x3e5
jne 0x5009e9
mov eax, dword [ebp + 8]
push ecx
mov edx, esp
mov dword [ebp + 8], 0
mov ecx, esi
mov dword [edx], eax
call fcn.005004d0
mov edi, eax
jmp 0x5009eb
xor edi, edi
mov esi, dword [ebp + 8]
test esi, esi
je 0x500aef
mov ecx, esi
call fcn.00507040
lea ecx, [esi + 0x1c8]
call fcn.00475fb0
lea ecx, [esi + 0x80]
call fcn.0046d1e0
mov ecx, dword [esi + 0x7c]
cmp ecx, 0x10
jb 0x500a47
mov eax, dword [esi + 0x68]
inc ecx
cmp ecx, 0x1000
jb 0x500a3d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x500b0f
mov eax, edx
push ecx
push eax
call fcn.006779b1
add esp, 8
mov byte [esi + 0x68], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0xf
mov ecx, dword [esi + 0x64]
cmp ecx, 0x10
jb 0x500a8d
mov eax, dword [esi + 0x50]
inc ecx
cmp ecx, 0x1000
jb 0x500a83
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x500b0f
mov eax, edx
push ecx
push eax
call fcn.006779b1
add esp, 8
mov byte [esi + 0x50], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0xf
mov ecx, dword [esi + 0x4c]
cmp ecx, 0x10
jb 0x500acf
mov eax, dword [esi + 0x38]
inc ecx
cmp ecx, 0x1000
jb 0x500ac5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x500b0f
mov eax, edx
push ecx
push eax
call fcn.006779b1
add esp, 8
mov byte [esi + 0x38], 0
push 0x6e8
mov dword [esi + 0x48], 0
push esi
mov dword [esi + 0x4c], 0xf
call fcn.006779b1
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret 4
call fcn.00682da2
int3
Function at 0x503450
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bffc5
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x78efc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x20]
lea edi, [esi + 0x20]
test eax, eax
je 0x503496
mov eax, dword [eax]
test eax, eax
je 0x503496
cmp eax, 0xffffffff
jne 0x503540
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x14], 0
test eax, eax
je 0x5034b6
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], vtable.std::_Func_impl_no_alloc_int____stdcall___void_const____int__void_const__.0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push dword [esi + 0x28]
mov eax, dword [esi + 0x1c]
push 0
push 0
push 6
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x3c], eax
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x44]
call fcn.00503d00
add esp, 4
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x44]
mov eax, dword [ecx]
test eax, eax
je 0x50355e
cmp eax, 0xffffffff
je 0x50355e
mov esi, dword [edi + 4]
mov eax, dword [ebp - 0x40]
mov dword [edi], ecx
mov dword [edi + 4], eax
test esi, esi
je 0x503528
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x503528
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x503528
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x503540
mov esi, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
push esi
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.0053cd90
push 0x78a550
lea eax, [ebp - 0x50]
push eax
call fcn.006798be
int3
Function at 0x503580
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bffc5
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x78efc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x20]
lea edi, [esi + 0x20]
test eax, eax
je 0x5035c6
mov eax, dword [eax]
test eax, eax
je 0x5035c6
cmp eax, 0xffffffff
jne 0x503675
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x14], 0
test eax, eax
je 0x5035e6
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], vtable.std::_Func_impl_no_alloc_int____stdcall___void_const____int__void_const__.0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
imul ecx, dword [esi + 0x28], 0xe50
mov eax, dword [esi + 0x1c]
push ecx
push 0
push 0
push 6
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x3c], eax
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x44]
call fcn.00503d00
add esp, 4
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x44]
mov eax, dword [ecx]
test eax, eax
je 0x503693
cmp eax, 0xffffffff
je 0x503693
mov esi, dword [edi + 4]
mov eax, dword [ebp - 0x40]
mov dword [edi], ecx
mov dword [edi + 4], eax
test esi, esi
je 0x50365d
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x50365d
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x50365d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x503675
mov esi, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
push esi
push 0
push 0xe50
lea ecx, [ebp - 0x50]
call fcn.0053cd90
push 0x78a550
lea eax, [ebp - 0x50]
push eax
call fcn.006798be
int3
Function at 0x505300
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b0890
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x78efc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [esi + 0x10]
movzx eax, byte [edi]
mov byte [esi], al
movzx eax, byte [edi + 1]
mov byte [esi + 1], al
mov eax, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov dword [esi + 8], eax
lea eax, [edi + 0x10]
push eax
mov dword [esi + 0xc], edx
call fcn.0044d220
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x3c]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ecx
mov eax, dword [edi + 0x40]
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x40], eax
lea eax, [edi + 0x48]
mov dword [esi + 0x44], ecx
lea ecx, [esi + 0x48]
cmp ecx, eax
je 0x5053b2
call fcn.0044d7a0
movups xmm0, xmmword [edi + 0x48]
movups xmmword [esi + 0x48], xmm0
movq xmm0, qword [edi + 0x58]
movq qword [esi + 0x58], xmm0
xor ecx, ecx
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 7
mov word [edi + 0x48], cx
lea eax, [edi + 0x60]
lea ecx, [esi + 0x60]
cmp ecx, eax
je 0x5053e7
call fcn.0044d7a0
movups xmm0, xmmword [edi + 0x60]
movups xmmword [esi + 0x60], xmm0
movq xmm0, qword [edi + 0x70]
movq qword [esi + 0x70], xmm0
xor ecx, ecx
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 7
mov word [edi + 0x60], cx
lea eax, [edi + 0x78]
lea ecx, [esi + 0x78]
cmp ecx, eax
je 0x505430
call fcn.0044d7a0
movups xmm0, xmmword [edi + 0x78]
movups xmmword [esi + 0x78], xmm0
movq xmm0, qword [edi + 0x88]
movq qword [esi + 0x88], xmm0
xor ecx, ecx
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 7
mov word [edi + 0x78], cx
nop dword [eax + eax]
lea eax, [edi + 0x90]
lea ecx, [esi + 0x90]
cmp ecx, eax
je 0x505480
call fcn.0044d7a0
movups xmm0, xmmword [edi + 0x90]
movups xmmword [esi + 0x90], xmm0
movq xmm0, qword [edi + 0xa0]
movq qword [esi + 0xa0], xmm0
xor ecx, ecx
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 7
mov word [edi + 0x90], cx
lea eax, [edi + 0xa8]
lea ecx, [esi + 0xa8]
cmp ecx, eax
je 0x5054d0
call fcn.0044d7a0
movups xmm0, xmmword [edi + 0xa8]
movups xmmword [esi + 0xa8], xmm0
movq xmm0, qword [edi + 0xb8]
movq qword [esi + 0xb8], xmm0
xor ecx, ecx
mov dword [edi + 0xb8], 0
mov dword [edi + 0xbc], 7
mov word [edi + 0xa8], cx
mov eax, dword [edi + 0xc0]
lea ecx, [esi + 0xc4]
mov dword [esi + 0xc0], eax
lea eax, [edi + 0xc4]
push eax
call fcn.0044d220
lea eax, [edi + 0xdc]
push eax
lea ecx, [esi + 0xdc]
call fcn.0044d220
lea eax, [edi + 0xf4]
push eax
lea ecx, [esi + 0xf4]
call fcn.0044d220
mov al, byte [edi + 0x10c]
mov byte [esi + 0x10c], al
mov eax, dword [edi + 0x110]
mov dword [esi + 0x110], eax
mov eax, dword [edi + 0x114]
mov dword [esi + 0x114], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x507bc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6c0660
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x78efc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CAT::HTTP::Request.0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
push dword [ebp + 8]
lea ecx, [edi + 0x14]
mov dword [ebp - 4], 0
call fcn.00456d70
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov byte [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
xor eax, eax
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 7
mov word [edi + 0x84], ax
mov dword [edi + 0x9c], eax
lea eax, [edi + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [edi + 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [edi + 0xd0], 0
mov eax, edi
mov dword [edi + 0xd4], 0
mov dword [edi + 0x40], 0x7530
mov dword [edi + 0x44], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x5099c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6c09e8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x78efc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp + 8]
lea esi, [eax + 0xa0]
mov dword [ebp - 0x68], ecx
mov ecx, dword [ebp + 0x10]
push 4
mov dword [ebp - 0x6c], ecx
call fcn.00677616
add esp, 4
mov edi, eax
mov dword [ebp - 0x70], edi
push esi
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x70], edi
mov eax, dword [ebp - 0x60]
mov dword [ebp - 4], 0
mov eax, dword [eax + 0xf0]
test eax, eax
je 0x509b26
mov ecx, dword [eax]
test ecx, ecx
je 0x509b26
cmp ecx, 0xffffffff
je 0x509b26
push 0
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], 0
push ecx
push dword [ebp + 0xc]
push dword [ebp - 0x68]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x509b5d
call fcn.004486f0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.00531420
mov ecx, dword [ebp - 0x60]
add ecx, 0xd8
mov byte [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x58]
call fcn.0044d190
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x40]
call fcn.0044d190
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
push ecx
lea eax, [ebp - 0x28]
push eax
push ecx
lea ecx, [ebp - 0x7c]
call fcn.0044fb00
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 4
push eax
push 0x751d28
push 3
mov ecx, esi
call fcn.004dd4f0
lea ecx, [ebp - 0x7c]
call fcn.0044d720
push fcn.0044bb60
push 2
push 0x18
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 1
push eax
call fcn.00677646
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x509b26
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x509b1c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x509b6b
push edx
push ecx
call fcn.006779b1
add esp, 8
mov byte [ebp - 0x59], 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 4
push edi
call fcn.006779b1
mov al, byte [ebp - 0x59]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x64]
mov byte [ebp - 0x59], 1
mov dword [ecx], eax
jmp 0x509b2a
call fcn.00682da2
int3