joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a88d0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, byte [ecx + 0xb]
mov edi, ecx
test al, al
jns 0x4a88f8
mov edi, dword [ecx]
mov eax, dword [ecx + 4]
mov esi, eax
mov ecx, edi
mov edx, eax
mov dword [ebp - 0x28], eax
cmp eax, 4
jb 0x4a8933
mov eax, dword [ebp - 0x28]
mov edx, eax
mov ecx, edi
imul ebx, dword [ecx], 0x5bd1e995
mov esi, ebx
shr esi, 0x18
xor esi, ebx
imul esi, esi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x4a890d
cmp edx, 1
je 0x4a8950
cmp edx, 2
je 0x4a8955
cmp edx, 3
mov ebx, dword [ebp - 0x24]
jne 0x4a896c
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
jmp 0x4a8958
mov ebx, dword [ebp - 0x24]
jmp 0x4a8961
mov ebx, dword [ebp - 0x24]
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor ecx, dword [ebx + 8]
xor ecx, eax
mov edx, 0x7f4a7c15
mov eax, ecx
mul edx
imul ecx, ecx, 0x9e3779b9
add ecx, edx
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 0x10]
dec edx
and edx, ecx
mov esi, dword [eax + edx*4]
test esi, esi
je 0x4a8a1b
mov ecx, edx
xor ecx, 1
cmp esi, dword [eax + ecx*4]
je 0x4a8a45
mov dword [ebp - 0x20], edx
movzx eax, byte [esi + 0xb]
mov ecx, eax
test al, al
jns 0x4a89c2
mov ecx, dword [esi + 4]
cmp ecx, dword [ebp - 0x28]
jne 0x4a89ff
mov ecx, dword [esi]
mov edx, esi
test al, al
cmovs edx, ecx
js 0x4a89e9
test eax, eax
je 0x4a8a14
xor edx, edx
inc edx
cmp cl, byte [edi + edx - 1]
jne 0x4a89ff
cmp eax, edx
je 0x4a8a14
mov cl, byte [esi + edx]
inc edx
jmp 0x4a89d9
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4a8a14
push eax
push edi
push edx
call fcn.005065ad
add esp, 0xc
test eax, eax
je 0x4a8a14
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x4a89b5
xor esi, esi
xor ebx, ebx
xor eax, eax
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
jmp 0x4a8a24
mov edx, dword [ebp - 0x20]
mov eax, edx
jmp 0x4a8a21
xor esi, esi
xor ebx, ebx
xor eax, eax
mov edi, dword [ebp + 8]
mov dword [edi], esi
mov dword [edi + 4], ebx
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
and edx, 0xfffffffe
mov dword [ebp - 0x20], edx
mov ebx, dword [eax + edx*4]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
lea esi, [ebp - 0x1c]
mov ecx, ebx
push eax
push esi
call fcn.0058f310
mov eax, dword [esi]
add ebx, 4
cmp eax, ebx
mov edi, dword [ebp + 8]
je 0x4a8a85
mov ecx, dword [ebp + 0x10]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
je 0x4a8a7b
mov dword [ecx], eax
mov esi, dword [eax + 0x18]
mov edx, dword [ebp - 0x20]
mov eax, edx
jmp 0x4a8a24
xor esi, esi
xor ebx, ebx
xor eax, eax
jmp 0x4a8a0f
Function at 0x4a8a90
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, ecx
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 4]
cmp eax, 1
jne 0x4a8ad2
mov eax, 8
mov dword [esi + 0xc], eax
mov dword [esi + 4], eax
mov ecx, esi
push eax
call fcn.0058f3c0
xorps xmm0, xmm0
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
mov dword [esi + 0x10], eax
jmp 0x4a8c26
mov dword [ebp - 0x20], esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov esi, dword [eax + 0x10]
mov eax, dword [ebp - 0x20]
mov dword [eax + 4], edi
mov ecx, dword [ebp - 0x20]
push edi
call fcn.0058f3c0
mov ebx, eax
shl edi, 2
push edi
mov edi, dword [ebp - 0x20]
push 0
push eax
call fcn.00508060
mov edx, esi
add esp, 0xc
mov dword [edi + 0x10], ebx
mov eax, dword [edi + 4]
mov esi, dword [edi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x24]
cmp esi, eax
jae 0x4a8c17
mov dword [ebp - 0x28], edx
mov ebx, dword [edx + esi*4]
test ebx, ebx
je 0x4a8c0e
mov eax, esi
xor eax, 1
cmp ebx, dword [edx + eax*4]
je 0x4a8bfe
mov dword [ebp - 0x2c], esi
movzx edx, byte [ebx + 0xb]
mov eax, ebx
test dl, dl
jns 0x4a8b4b
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov ecx, edx
cmp edx, 4
jb 0x4a8b78
imul edi, dword [eax], 0x5bd1e995
mov esi, edi
shr esi, 0x18
xor esi, edi
imul esi, esi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x4a8b52
cmp edx, 1
je 0x4a8b9e
cmp edx, 2
je 0x4a8b90
cmp edx, 3
jne 0x4a8bae
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
mov edi, dword [ebp - 0x20]
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
jmp 0x4a8ba1
mov edi, dword [ebp - 0x20]
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
jmp 0x4a8bb1
mov edi, dword [ebp - 0x20]
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor ecx, dword [edi + 8]
xor ecx, eax
mov eax, ecx
mov edx, 0x7f4a7c15
mul edx
imul eax, ecx, 0x9e3779b9
add eax, edx
mov edx, dword [edi + 4]
dec edx
and edx, eax
mov esi, dword [ebx + 0x28]
mov ecx, edi
push ebx
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.0058f220
mov ebx, esi
test esi, esi
mov esi, dword [ebp - 0x2c]
jne 0x4a8b3c
jmp 0x4a8c08
mov ecx, edi
push esi
inc esi
push edx
call fcn.004a8c40
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
inc esi
cmp esi, eax
jb 0x4a8b20
cmp dword [edi + 0x14], 0
jne 0x4a8c26
push edx
call fcn.00503da5
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4a8c40
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [0x5ff014]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov eax, dword [ecx + eax*4]
mov esi, dword [eax]
mov dword [ebp - 0x20], eax
add eax, 4
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x14]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x4a8c7b
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, edx
cmp edx, 4
jb 0x4a8ca8
imul edi, dword [eax], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, edi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x4a8c82
cmp edx, 1
je 0x4a8cc9
cmp edx, 2
je 0x4a8cc0
cmp edx, 3
jne 0x4a8cd4
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul edi, eax, 0x5bd1e995
mov eax, edi
shr eax, 0xf
mov ecx, dword [ebp - 0x24]
xor edi, dword [ecx + 8]
xor edi, eax
mov eax, edi
mov edx, 0x7f4a7c15
mul edx
imul eax, edi, 0x9e3779b9
add eax, edx
mov edx, dword [ecx + 4]
dec edx
and edx, eax
push dword [esi + 0x18]
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.0058f220
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4a8d23
mov eax, ecx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x4a8d19
jmp 0x4a8d39
mov eax, dword [esi + 8]
cmp dword [eax], esi
je 0x4a8d39
add esi, 8
mov ecx, dword [esi]
lea esi, [ecx + 8]
mov eax, dword [ecx + 8]
cmp dword [eax], ecx
jne 0x4a8d2d
mov esi, eax
cmp eax, dword [ebp - 0x28]
jne 0x4a8c6b
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x14], 0
jne 0x4a8d53
cmp dword [ebp - 0x20], 0
jne 0x4a8d67
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, dword [ebp - 0x20]
mov ecx, esi
push dword [esi + 4]
call fcn.0058ef40
push esi
call fcn.00503da5
add esp, 4
jmp 0x4a8d53
Function at 0x4ab630
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [0x60bbc0]
mov ecx, dword [0x6033f4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4ab682
cmp edi, esi
je 0x4ab67b
xor eax, eax
dec eax
movzx ecx, byte [edi]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x60b7c0]
inc edi
cmp edi, esi
jne 0x4ab660
not eax
jmp 0x4ab67d
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x60bbc0
call fcn.00503e17
add esp, 4
cmp dword [0x60bbc0], 0xffffffff
jne 0x4ab659
push 0x400
push 0xff
push 0x60b7c0
call fcn.00508060
add esp, 0xc
xor eax, eax
mov ecx, 0xedb88320
mov edx, eax
shr edx, 1
mov ebx, eax
and ebx, 1
neg ebx
and ebx, ecx
xor ebx, edx
shr ebx, 1
and edx, 1
neg edx
and edx, ecx
xor edx, ebx
shr edx, 1
and ebx, 1
neg ebx
and ebx, ecx
xor ebx, edx
shr ebx, 1
and edx, 1
neg edx
and edx, ecx
xor edx, ebx
shr edx, 1
and ebx, 1
neg ebx
and ebx, ecx
xor ebx, edx
shr ebx, 1
and edx, 1
neg edx
and edx, ecx
xor edx, ebx
shr edx, 1
and ebx, 1
neg ebx
and ebx, ecx
xor ebx, edx
shr ebx, 1
and edx, 1
neg edx
and edx, ecx
xor edx, ebx
mov dword [eax*4 + 0x60b7c0], edx
inc eax
cmp eax, 0x100
jne 0x4ab6b6
push 0x60bbc0
call fcn.00503e8d
add esp, 4
jmp 0x4ab659

Function at 0x4b3880
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x4b3897
test eax, eax
je 0x4b3897
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
jne 0x4b38a5
mov ecx, dword [0x60dc38]
test ecx, ecx
jne 0x4b38e1
cmp dword [0x60dc30], 0
je 0x4b3891
mov esi, dword [0x60dc34]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x4b38eb
test esi, esi
je 0x4b3891
mov ecx, dword [0x60dc30]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x4b3891
call dword [section..00cfg]
call ecx
jmp 0x4b38a5
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4b38c9

Function at 0x4b64b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
push eax
push eax
push ecx
push 0x4b6520
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x4b64ec
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00504596
add esp, 8
pop esi
pop ebp
ret
lea esi, [ebp - 0xc]
push 0x1b
push str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
push esi
call fcn.0056d270
add esp, 0xc
mov ecx, esi
call fcn.0056d1b0
push 0xc
push 0x5e927f
push eax
call fcn.004d4870
add esp, 0xc
mov ecx, esi
call fcn.0056d1c0
jmp 0x4b64dc
Function at 0x4c47f0
Capabilities:
Decompress data using quicklz

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, esi
or eax, edi
test al, 1
je 0x4c480b
xor eax, eax
jmp 0x4c48a1
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
mov ebx, edx
and ebx, 0xf800d000
xor eax, eax
cmp ebx, 0xf0008000
jne 0x4c48a1
mov ebx, edx
and ebx, 0x3c00000
cmp ebx, 0x3c00000
je 0x4c48a1
sub edi, esi
lea ebx, [edi - 4]
and ebx, 1
lea ecx, [ebx + edi]
add ecx, 0xfffffffc
mov esi, ecx
and esi, 1
jne 0x4c48a1
lea esi, [ebx + edi]
add esi, 0xffffc
cmp esi, 0x1fffff
ja 0x4c48a1
mov eax, ecx
shl eax, 6
and eax, 0x4000000
mov esi, ecx
shl esi, 4
and esi, 0x3f0000
or esi, eax
mov eax, ecx
shr eax, 5
and eax, 0x2000
or eax, esi
mov esi, ecx
shr ecx, 8
and ecx, 0x800
or ecx, eax
shr esi, 1
and esi, 0x7ff
or ecx, esi
and edx, 0xfbc0d000
or ecx, edx
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4d4ba0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x4d4bd7
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jae 0x4d4bde
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4d4bd0
mov dword [esi], ebx
call fcn.004deab0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004deab0
push dword [esi]
call fcn.004e84d0
add esp, 4
mov dword [esi], 0
jmp 0x4d4bc1

Function at 0x4d75c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm4
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x4d76ae
nop word cs:[eax + eax]
nop
movdqa xmm6, xmm0
movdqa xmm5, xmmword [0x5dd570]
pclmulqdq xmm6, xmm5, 0
movdqa xmm5, xmmword [0x5dd580]
pclmulqdq xmm0, xmm5, 0x11
movdqa xmm7, xmm0
pxor xmm7, xmm6
movdqa xmm0, xmm3
movdqa xmm4, xmmword [0x5dd570]
pclmulqdq xmm0, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
movdqa xmm6, xmm3
pxor xmm6, xmm0
movdqa xmm0, xmm2
pclmulqdq xmm0, xmm4, 0
movdqa xmm3, xmm4
pclmulqdq xmm2, xmm5, 0x11
movdqa xmm4, xmm2
pxor xmm4, xmm0
movdqa xmm0, xmm1
pclmulqdq xmm0, xmm3, 0
pclmulqdq xmm1, xmm5, 0x11
movdqa xmm5, xmm1
pxor xmm5, xmm0
movdqu xmm0, xmmword [ecx]
pxor xmm0, xmm7
movdqu xmm3, xmmword [ecx + 0x10]
pxor xmm3, xmm6
movdqu xmm2, xmmword [ecx + 0x20]
pxor xmm2, xmm4
movdqu xmm1, xmmword [ecx + 0x30]
pxor xmm1, xmm5
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x4d7600
movdqa xmm4, xmmword [0x5dd590]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x5dd5a0]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp eax, 0x10
jb 0x4d7732
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add ecx, 0x10
add eax, 0xfffffff0
cmp eax, 0xf
ja 0x4d770b
movdqa xmm1, xmmword [0x5dd5a0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm2, xmm2
pxor xmm1, xmm1
pblendw xmm1, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x5dd5b0], 0
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm1, 3
pclmulqdq xmm0, xmmword [0x5dd5c0], 0x10
pblendw xmm0, xmm2, 0xfc
pclmulqdq xmm0, xmmword [0x5dd5d0], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop ebp
ret
Function at 0x4e6420
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x140c
call fcn.005056b0
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x600e84]
cmp eax, 0xffffffff
je 0x4e6452
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
jne 0x4e6467
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
add esp, 0x140c
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.00507560
add esp, 0xc
mov ecx, dword [0x600e84]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.00482ac0
add esp, 8
test ebx, ebx
je 0x4e64a8
push ebx
call fcn.00503ddc
add esp, 4
mov eax, dword [0x606ce0]
mov ecx, dword [0x6033f4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4e6595
mov esi, dword [0x606cdc]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4e65da
lea eax, [ebp - 0x1410]
push 0xc00
push 0x6060dc
push eax
call fcn.00507560
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ecx, 0x100
lea edx, [ebp - 0x1408]
test al, 1
je 0x4e6580
mov dword [ebp - 0x1418], ecx
xor esi, esi
mov edi, edx
xor eax, eax
jmp 0x4e652e
add esi, 1
add edi, 0xc
cmp esi, 0x100
je 0x4e6572
mov ebx, dword [ebp + esi*8 - 0x810]
test ebx, ebx
je 0x4e6520
cmp dword [edi - 8], 0
je 0x4e6520
mov ecx, dword [ebp + esi*8 - 0x80c]
cmp ecx, dword [edi]
jne 0x4e6520
mov ecx, dword [edi - 4]
test ecx, ecx
je 0x4e6520
mov dword [ebp + esi*8 - 0x810], 0
call dword [section..00cfg]
push ebx
call ecx
lea edx, [ebp - 0x1408]
add esp, 4
mov al, 1
jmp 0x4e6520
mov esi, dword [ebp - 0x1418]
lea ecx, [esi - 1]
cmp esi, 2
jae 0x4e650b
push 2
push dword [ebp - 0x1414]
call fcn.00482ac0
add esp, 8
jmp 0x4e6452
push 0x606ce0
call fcn.00503e17
add esp, 4
cmp dword [0x606ce0], 0xffffffff
jne 0x4e64c9
push 4
call fcn.00503d75
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.004e8440
mov dword [0x606cdc], esi
push 0x606ce0
call fcn.00503e8d
add esp, 4
jmp 0x4e64c9
mov ecx, esi
call fcn.004e8450
jmp 0x4e64de
Function at 0x4e8050
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, ecx
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x3e
push str..._.._base_files_file_win.cc
push str.Read
push ebx
call fcn.004dea80
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.004e60a0
cmp dword [ebp + 0x14], 0
js 0x4e814a
mov edi, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.004ee660
test al, al
jne 0x4e814f
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push ebx
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e8138
mov ebx, dword [esp + 0xc]
lea ecx, [esp + 0x28]
call fcn.004ee700
lea ecx, [esp + 0x30]
call fcn.004e6100
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x4e810f
xor ebx, ebx
dec ebx
jmp 0x4e8118
lea ecx, [esp + 0x28]
push 0
push dword [ebp + 0x14]
push esi
push str.File::Read
call fcn.00566930
jmp 0x4e80d0

Function at 0x4e8170
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 8], ecx
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x30]
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0x73
push str..._.._base_files_file_win.cc
push str.Write
push edi
call fcn.004dea80
add esp, 0x10
xor esi, esi
mov ecx, ebx
push esi
push edi
call fcn.004e60a0
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], esi
call fcn.004ee660
test al, al
jne 0x4e8250
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
lea ebx, [esp + 0xc]
mov dword [ebx], 0xffffffff
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [ebx]
lea ecx, [esp + 0x28]
call fcn.004ee700
lea ecx, [esp + 0x30]
call fcn.004e6100
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00504596
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov edx, dword [ebp + 0x14]
mov eax, edx
sar eax, 0x1f
lea ecx, [esp + 0x28]
push eax
push edx
push dword [esp + 0x10]
push str.File::Write
call fcn.00566930
jmp 0x4e81e2
Function at 0x4e8280
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x4e82bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4e82d2
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4e82b4
mov dword [esi], ebx
call fcn.004deab0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x4e82e9
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004deab0
push dword [esi]
call fcn.004e84d0
add esp, 4
mov dword [esi], 0
jmp 0x4e82a5
int3
Function at 0x4eb7e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004eb4b0

Function at 0x4ecf00
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x6091c8]
mov ecx, dword [0x6033f4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4ecf51
mov eax, dword [0x6091c4]
mov esi, dword [eax]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x6091c8
call fcn.00503e17
add esp, 4
cmp dword [0x6091c8], 0xffffffff
jne 0x4ecf33
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.00508060
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x58
call fcn.00503d75
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x6091f8]
mov ecx, dword [0x6033f4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x4ed01d
push 0x6091f8
call fcn.00503e17
add esp, 4
cmp dword [0x6091f8], 0xffffffff
jne 0x4ed01d
xorps xmm0, xmm0
movups xmmword [0x6091e4], xmm0
movups xmmword [0x6091d4], xmm0
mov dword [0x6091f4], 0
push 0x6091d4
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x6091f8
call fcn.00503e8d
add esp, 4
mov ecx, esi
push ebx
push 0x6091d4
push edi
call fcn.0047c1c0
mov dword [0x6091c4], esi
push 0x6091c8
call fcn.00503e8d
add esp, 4
jmp 0x4ecf33

Function at 0x4ed080
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x4ed0fe
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4ed0e7
lea eax, [edi + 1]
cmp eax, 2
jb 0x4ed0cb
mov dword [esi], edi
call fcn.004deab0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 1
inc eax
cmp eax, 1
jbe 0x4ed102
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.004deab0
push dword [esi]
call fcn.004e84d0
add esp, 4
mov dword [esi], 0
jmp 0x4ed0bc
mov byte [esi + 4], 1
int3

Function at 0x4eef30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x4eef6a
mov edx, dword [ebp + 0xc]
xor esi, esi
nop word cs:[eax + eax]
nop
movzx edi, al
movzx ebx, byte [edx + esi]
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x5eb548]
add esi, 1
cmp ecx, esi
jne 0x4eef50
pop esi
pop edi
pop ebx
pop ebp
ret