joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c72f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x43c737
mov dword [edx*4 + 0x4c7c40], ecx
inc edx
cmp edx, 0x100
jb 0x43c732
mov esi, 0x800
jmp 0x43c77f
mov ecx, dword [edx*4 + 0x4c7840]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x4c7c40]
mov dword [edx*4 + 0x4c7c40], ecx
inc edx
cmp edx, esi
jb 0x43c763
mov dword [0x4c7bf0], 0x441b30
call fcn.00441c95
mov ecx, dword [0x4c7bf0]
test eax, eax
mov edx, 0x441bc9
cmove ecx, edx
mov dword [0x4c7bf0], ecx
pop esi
ret

Function at 0x43c85d
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43c887
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43c887
xor cl, cl
jmp 0x43c89b
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov cl, 1
mov dword [eax + 4], edx
call fcn.0043c7aa
pop esi
leave
ret 8

Function at 0x43c925
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
lea eax, [esp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push eax
inc ebx
add esi, 8
push ebx
push 0
push 0
mov ecx, esi
call fcn.0043c662
test al, al
jne 0x43c956
mov eax, 0x80004005
jmp 0x43c9b2
mov edi, dword [ebp + 0x10]
lea eax, [esp + 0x10]
push eax
push 0
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0043c662
test al, al
je 0x43c9a4
mov eax, dword [ebp + 0xc]
cmp dword [esp + 0x10], eax
jne 0x43c9a4
cmp dword [esp + 0x14], edi
jne 0x43c9a4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x43c9a4
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push 0
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.0043c662
test al, al
jne 0x43c9a6
xor bl, bl
xor ecx, ecx
mov eax, 0x80004005
test bl, bl
cmovne eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43eaa6
Capabilities:
Check if file exists

Disassembly:
push 0x2c
mov eax, 0x497710
call fcn.00459b1f
mov esi, ecx
mov dword [ebp - 0x14], esi
push dword [ebp + 8]
mov edi, 0x80004005
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x10], edi
call fcn.0043bed6
xor ebx, ebx
lea ecx, [ebp - 0x38]
push esi
mov dword [ebp - 4], ebx
call fcn.0043e36f
push 3
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call fcn.0043bf5d
mov byte [ebp - 4], 1
lea edx, [ebp - 0x2c]
mov ecx, dword [ebp - 0x38]
call fcn.0043ef22
push dword [ebp - 0x2c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43eb0f
mov ecx, dword [ebp - 0x2c]
call fcn.0043ed57
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x18], ebx
cmp ebx, 0xffffffff
je 0x43ebc4
xor eax, eax
push eax
push dword [esi + 0x10]
push eax
push 4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x43ebbf
push dword [esi + 0x10]
push 0
push 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x43ebb3
mov ecx, eax
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x18]
mov esi, dword [eax]
cmp esi, eax
je 0x43eba6
mov ebx, dword [ebp - 0x14]
mov edi, dword [esi + 8]
mov eax, dword [edi + 4]
sub eax, dword [edi]
push eax
push dword [edi]
push ecx
call fcn.00471db0
mov eax, dword [edi + 4]
add esp, 0xc
sub eax, dword [edi]
mov ecx, dword [ebp + 8]
mov esi, dword [esi]
add ecx, eax
mov dword [ebp + 8], ecx
cmp esi, dword [ebx + 0x18]
jne 0x43eb78
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
and dword [ebp - 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x10]
jmp 0x43ebc4
mov edi, 0x80004005
test ebx, ebx
je 0x43ebcf
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x2c]
call fcn.00459727
push dword [ebp - 0x38]
call fcn.00459727
pop ecx
pop ecx
mov eax, edi
call fcn.00459ae8
ret 4
Function at 0x43ed57
Capabilities:
Create directory

Disassembly:
push 0x64
mov eax, 0x49774b
call fcn.00459b53
push ecx
lea ecx, [ebp - 0x54]
call fcn.0043bed6
xor ebx, ebx
lea ecx, [ebp - 0x54]
push 0x5c
mov dword [ebp - 4], ebx
call fcn.0043f0f0
mov esi, dword [ebp - 0x50]
xor ecx, ecx
mov edx, eax
inc ecx
mov dword [ebp - 0x58], ecx
test edx, edx
jle 0x43edb6
lea eax, [esi - 1]
cmp edx, eax
jne 0x43edb6
cmp esi, 3
jne 0x43eda9
mov edi, dword [ebp - 0x54]
push 0x3a
pop eax
cmp word [edi + 2], ax
jne 0x43eda9
mov bl, cl
jmp 0x43eee2
push ecx
push edx
lea ecx, [ebp - 0x54]
call fcn.0043f09b
mov esi, dword [ebp - 0x50]
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x70]
call fcn.0043e467
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x54]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43ee7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x43ee3b
push 0x5c
lea ecx, [ebp - 0x54]
call fcn.0043f0f0
mov esi, eax
test esi, esi
js 0x43eed9
je 0x43eed9
push 0x3a
pop eax
cmp word [edi + esi*2 - 2], ax
je 0x43eed9
push esi
push ebx
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x54]
call fcn.0043f177
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x54]
call fcn.0043e421
mov byte [ebp - 4], 1
push dword [ebp - 0x64]
call fcn.00459727
pop ecx
jmp 0x43edc6
lea ecx, [ebp - 0x20]
call fcn.0043bf1e
push edi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00448394
test al, al
je 0x43ee64
mov eax, dword [ebp - 0x28]
xor ecx, ecx
shr eax, 4
inc ecx
test cl, al
jne 0x43ee72
mov byte [ebp - 0x58], bl
push dword [ebp - 0x20]
call fcn.00459727
mov bl, byte [ebp - 0x58]
pop ecx
jmp 0x43eed9
mov byte [ebp - 4], cl
push dword [ebp - 0x20]
call fcn.00459727
pop ecx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x54]
call fcn.0043e421
jmp 0x43eecf
lea eax, [esi + 1]
push eax
push 0x5c
lea ecx, [ebp - 0x54]
call fcn.0043f11f
mov esi, eax
lea ecx, [ebp - 0x54]
test esi, esi
lea eax, [ebp - 0x64]
cmovs esi, dword [ebp - 0x50]
push esi
push ebx
push eax
call fcn.0043f177
push ebx
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp - 0x64]
test eax, eax
setne bl
call fcn.00459727
pop ecx
test bl, bl
je 0x43eef1
push 0
pop ebx
cmp esi, dword [ebp - 0x50]
jl 0x43ee8c
mov bl, 1
mov edi, dword [ebp - 0x54]
push dword [ebp - 0x70]
call fcn.00459727
pop ecx
push edi
call fcn.00459727
pop ecx
mov al, bl
call fcn.00459afd
ret
xor ebx, ebx
jmp 0x43eed6

Function at 0x43eeff
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x43ef1e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x43ef1e
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
Function at 0x441339
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4978d7
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x4c206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x30]
mov dword [esi], vtable.CFilterCoder.10.0
mov dword [esi + 4], vtable.CFilterCoder.9.0
mov dword [esi + 8], vtable.CFilterCoder.8.0
mov dword [esi + 0xc], vtable.CFilterCoder.7.0
mov dword [esi + 0x10], vtable.CFilterCoder.6.0
mov dword [esi + 0x14], vtable.CFilterCoder.5.0
mov dword [esi + 0x18], vtable.CFilterCoder.4.0
mov dword [esi + 0x1c], vtable.CFilterCoder.3.0
mov dword [esi + 0x20], vtable.CFilterCoder.2.0
mov dword [esi + 0x24], vtable.CFilterCoder.1.0
mov dword [esi + 0x28], vtable.CFilterCoder.0
call fcn.004483e0
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x74]
test ecx, ecx
je 0x4413c3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 1
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x4413d7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 2
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x4413eb
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 3
mov ecx, dword [esi + 0x68]
test ecx, ecx
je 0x4413ff
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 4
mov ecx, dword [esi + 0x64]
test ecx, ecx
je 0x441413
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 5
mov ecx, dword [esi + 0x60]
test ecx, ecx
je 0x441427
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 6
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x44143b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 7
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x44144f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret
Function at 0x447df8
Capabilities:
Get system information on windows

Disassembly:
push 0x48
mov eax, 0x49820b
call fcn.00459b8a
mov ebx, dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebx + 0x240]
push dword [ecx + 8]
mov eax, dword [ecx]
push 0
call dword [eax + 4]
lea esi, [ebx + 0xc]
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.0044281c
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x40]
or dword [esi + 0x4c], 0xffffffff
or dword [esi + 0x50], 0xffffffff
and dword [esi + 0x44], 0
xor ebx, ebx
mov dword [esi + 0x48], eax
mov dword [esi + 4], 4
cmp ebx, dword [ebp + 0x14]
jge 0x447f37
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push dword [eax + ebx*4]
call fcn.0043bed6
mov byte [ebp - 4], 1
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_CharUpperW]
cmp dword [ebp - 0x1c], 0
jne 0x447e81
mov esi, 0x80070057
jmp 0x447f2a
mov ecx, dword [ebp - 0x20]
mov eax, ebx
shl eax, 4
add eax, dword [ebp + 0x10]
cmp word [ecx], 0x42
jne 0x447f1b
push 1
push 0
lea ecx, [ebp - 0x20]
call fcn.0043f09b
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x20]
call fcn.00447da1
mov esi, eax
pop ecx
test esi, esi
jne 0x447f2a
mov eax, dword [ebp - 0x20]
cmp word [eax], 0x3a
jne 0x447e77
push 1
push esi
lea ecx, [ebp - 0x20]
call fcn.0043f09b
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x20]
call fcn.00447da1
mov esi, eax
pop ecx
test esi, esi
jne 0x447f2a
cmp dword [ebp - 0x1c], eax
jne 0x447e77
test esi, esi
jne 0x447f2a
mov ecx, dword [ebp + 8]
lea esi, [ebp - 0x30]
sub esp, 0x10
mov edi, esp
lea ecx, [ecx + 0x240]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00448017
mov byte [ebp - 4], 0
push dword [ebp - 0x20]
call fcn.00459727
mov esi, dword [ebp - 0x14]
inc ebx
pop ecx
jmp 0x447e4d
push eax
push ecx
mov ecx, esi
call fcn.00442873
mov esi, eax
test esi, esi
je 0x447f05
push dword [ebp - 0x20]
call fcn.00459727
pop ecx
mov eax, esi
jmp 0x447f46
xor eax, eax
jmp 0x447f46
call fcn.00459ae8
ret 0x10

Function at 0x44a107
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, edx
xor edi, edi
mov ebx, ecx
or esi, 0x100
mov ecx, esi
mov eax, esi
shr ecx, 7
add esi, esi
shr eax, 8
and ecx, 1
neg ecx
sar ecx, 4
and ecx, 0x7f
movzx edx, word [ebx + eax*2]
mov eax, dword [ebp + 8]
shr edx, 4
xor edx, ecx
add edi, dword [eax + edx*4]
cmp esi, 0x10000
jb 0x44a119
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x44a14e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x100
mov dword [ebp - 4], ecx
xor edi, edi
or edx, esi
add ebx, ebx
mov ecx, esi
and ecx, ebx
mov eax, edx
add ecx, esi
shr eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
movzx ecx, word [ecx + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add edi, dword [eax + ecx*4]
mov ecx, edx
xor ecx, ebx
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x44a164
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44a236
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
bts esi, edx
mov ebx, ecx
cmp esi, 1
je 0x44a271
push edi
mov edi, dword [ebp + 0xc]
mov edx, esi
and esi, 1
shr edx, 1
neg esi
sar esi, 4
and esi, 0x7f
movzx ecx, word [ebx + edx*2]
shr ecx, 4
xor ecx, esi
mov esi, edx
add eax, dword [edi + ecx*4]
cmp esi, 1
jne 0x44a24e
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44a275
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor esi, esi
inc edi
test ebx, ebx
je 0x44a2bc
mov eax, dword [ebp + 8]
mov edx, eax
movzx ecx, word [ecx + edi*2]
and edx, 1
shr eax, 1
add edi, edi
mov dword [ebp + 8], eax
or edi, edx
mov eax, edx
shr ecx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add esi, dword [eax + ecx*4]
mov ecx, dword [ebp - 4]
sub ebx, 1
jne 0x44a28a
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x44bd7c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, ecx
xor ecx, ecx
push edi
push 8
pop edi
mov dword [esi + 0x3bcd4], ecx
lea ebx, [esi + 0x20c]
mov dword [esi + 0x3bcd0], ecx
mov edx, ecx
mov dword [esi + 0x1cc], ecx
mov dword [esi + 0x1e8], ecx
mov dword [esi + 0x1bc], ecx
mov dword [esi + 0x1c8], 0x20
mov dword [esi + 0x1f0], 1
mov dword [esi + 0x1e4], 4
mov dword [esi + 0x1f4], ecx
mov dword [ebp - 8], edi
mov ecx, edx
mov dword [ebp - 4], edi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub edi, 1
jne 0x44bdde
mov dword [ebx], ecx
inc edx
add ebx, 4
push 8
pop edi
cmp edx, 0x100
jb 0x44bdd9
xor ebx, ebx
lea eax, [esi + 0x19c]
mov dword [esi + 0x118], ebx
lea ecx, [ebp - 0x38]
mov dword [esi + 0x148], ebx
mov dword [esi + 0x170], ebx
mov dword [esi + 0x174], ebx
mov dword [esi + 0x158], ebx
mov dword [esi + 0x15c], ebx
mov dword [esi + 0x160], ebx
mov dword [esi + 0x164], ebx
mov dword [esi + 0x168], ebx
mov dword [esi + 0x16c], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x198], eax
call fcn.00449d37
mov edx, ecx
mov ecx, esi
call fcn.00449e39
push 2
pop edi
mov word [esi + 0x306a0], 0x100
mov ebx, edi
mov ecx, ebx
xor edx, edx
sar ecx, 1
inc edx
dec ecx
shl edx, cl
mov dword [ebp - 4], edx
test edx, edx
je 0x44beaf
push edx
lea eax, [esi + 0x306a0]
add eax, edi
push ebx
push eax
call fcn.00471be0
add esp, 0xc
add edi, dword [ebp - 4]
inc ebx
cmp ebx, 0x16
jl 0x44be88
mov edi, dword [ebp - 8]
push 4
mov ecx, edi
xor edx, edx
pop ebx
imul ecx, ecx
mov eax, 0x10000
add edx, edx
jmp 0x44bece
shr ecx, 1
inc edx
cmp ecx, eax
jae 0x44becb
sub ebx, 1
jne 0x44bebf
mov eax, edi
mov ecx, 0xa1
shr eax, 4
sub ecx, edx
add edi, 0x10
mov dword [esi + eax*4 + 0x30ea0], ecx
cmp edi, 0x800
jb 0x44beb8
and dword [esi + 0x325ac], ebx
and dword [esi + 0x3bd14], ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4528ee
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, edx
cmp dword [esi], ebx
je 0x452906
xor eax, eax
jmp 0x4529a8
lea ecx, [esi + 0x30]
call fcn.00454521
test eax, eax
jne 0x4529a5
lea ecx, [esi + 0x14]
mov dword [esi + 0x28], 1
call fcn.004544ba
test eax, eax
jne 0x4529a5
lea ecx, [esi + 0x18]
call fcn.004544ba
test eax, eax
jne 0x4529a5
lea ecx, [esi + 0x1c]
call fcn.004544ba
test eax, eax
jne 0x4529a5
push dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
lea ecx, [esi + 0x20]
call fcn.004544dc
pop ecx
test eax, eax
jne 0x4529a5
push ebx
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x452970
call fcn.0045444a
test eax, eax
jne 0x4529a5
lea eax, [ebp - 4]
mov dword [esi + 4], 1
push eax
push ebx
push dword [ebp + 8]
push edi
push ebx
push ebx
call fcn.0047ab56
add esp, 0x18
mov dword [esi + 0x10], eax
test eax, eax
jne 0x45299a
call fcn.0045444a
test eax, eax
jne 0x4529a5
mov dword [esi], 1
jmp 0x4528ff
push 0xc
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x45510e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 4], ebx
jne 0x455129
lea ecx, [esi + 4]
call fcn.004544ba
test eax, eax
jne 0x455191
push edi
lea edi, [esi + 8]
cmp dword [edi], ebx
jne 0x45513c
mov ecx, edi
call fcn.004544ba
test eax, eax
jne 0x455190
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x45514e
call fcn.0045444a
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x45515f
call fcn.0045444a
mov byte [esi + 0x10], bl
cmp dword [esi + 0xc], ebx
je 0x45516b
xor eax, eax
jmp 0x455190
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x4550ce
push ebx
push ebx
call fcn.0047ab56
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
jne 0x45518e
call fcn.0045444a
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45d110
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
sub edi, ecx
xor esi, esi
cmp ecx, dword [esp + 0x14]
cmova edi, ebx
test edi, edi
je 0x45d158
nop
movsx eax, byte [ecx]
lea ecx, [ecx + 1]
imul eax, eax, 0xcc9e2d51
inc edx
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xd
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
cmp edx, edi
jne 0x45d130
mov eax, 0x4e25
mov ecx, esi
mul esi
pop edi
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1e
imul ecx, ecx, 0x7fffd8ee
sub esi, ecx
lea eax, [esi + 0x2710]
pop esi
pop ebx
ret
Function at 0x466750
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499ae8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4c206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
lea edi, [esi + 0x6c]
mov dword [ebp - 0x18], edi
call fcn.0046fbf0
mov dword [edi], eax
add eax, 0xffc
mov dword [esi + 0x70], eax
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [esi + 0x74], 0x400
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x34], 0
or dword [esi + 0x30], 0x8000
test dword [esi + 0x30], 0x40000
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
jne 0x4667db
mov eax, dword [esi + 0x24]
mov edx, dword [eax]
test edx, edx
je 0x4667db
mov edx, dword [edx + 0x24]
jmp 0x4667e0
mov edx, 1
push dword [esi + 0x10]
mov ecx, dword [esi + 8]
push dword [esi + 0x1c]
call fcn.0046d8a0
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [esi + 0x24]
mov ebx, dword [ecx + 4]
mov eax, dword [ecx]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x466815
lea ecx, [ebx + 4]
mov eax, 1
lock xadd dword [ecx], eax
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x20]
push eax
add ecx, 0x1c
call fcn.0045fad0
mov byte [ebp - 4], 2
test ebx, ebx
je 0x466858
lea ecx, [ebx + 4]
or eax, 0xffffffff
lock xadd dword [ecx], eax
cmp eax, 1
jne 0x466858
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
lea eax, [ebx + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
cmp ecx, 1
jne 0x466858
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
test dword [esi + 0x30], 0x20000
mov byte [ebp - 4], 1
je 0x46686f
push dword [esi + 8]
mov ecx, dword [esi]
call fcn.0045f9e0
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
test ecx, ecx
je 0x46687d
mov ecx, dword [ecx + 0x14]
jmp 0x46687f
xor ecx, ecx
mov edx, dword [esi + 0x30]
call fcn.0046fcf0
mov ecx, esi
call fcn.00466c50
test al, al
jne 0x4668ba
mov ecx, dword [edi]
mov dword [ebp - 4], 3
call fcn.0046fc50
mov dword [edi], 0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi]
push 0
call fcn.0045fb70
mov eax, dword [eax + 4]
cmp eax, dword [esi + 0x10]
jne 0x4668df
mov ecx, dword [esi]
push 0
call fcn.0045fb70
mov eax, dword [eax]
cmp eax, dword [esi + 0xc]
jne 0x4668df
mov bl, 1
jmp 0x4668e1
xor bl, bl
mov ecx, dword [edi]
mov dword [ebp - 4], 4
call fcn.0046fc50
mov dword [edi], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46fd70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf4
mov eax, dword [0x4c206c]
xor eax, esp
mov dword [esp + 0xf0], eax
mov dword [esp], 0x49eb92
mov dword [esp + 4], 0x49eb98
mov dword [esp + 8], 0x49eb9c
mov dword [esp + 0xc], 0x49eba0
mov dword [esp + 0x10], 0x49eba4
mov dword [esp + 0x14], 0x49eba8
mov dword [esp + 0x18], 0x49eb94
mov dword [esp + 0x1c], 0x49ebac
mov dword [esp + 0x20], 0x49ebb0
mov dword [esp + 0x24], 0x49ebb4
mov dword [esp + 0x28], 0x49ebb8
mov dword [esp + 0x2c], 0x49ebbc
mov dword [esp + 0x30], 0x49ebc0
mov dword [esp + 0x34], 0x49ebc4
mov dword [esp + 0x38], 0x49ebc8
mov dword [esp + 0x3c], 0x49ebcc
mov dword [esp + 0x40], 0x49ebd0
mov dword [esp + 0x44], 0x49ebd4
mov dword [esp + 0x48], 0x49e7a8
mov dword [esp + 0x4c], 0x49e7ac
mov dword [esp + 0x50], 0x49ebe0
mov dword [esp + 0x54], 0x49ebe4
mov dword [esp + 0x58], 0x49eb92
mov dword [esp + 0x5c], 0x49eb92
mov dword [esp + 0x60], 0x49ebe8
mov dword [esp + 0x64], 0x49ebec
mov dword [esp + 0x68], str._n_:_
mov dword [esp + 0x6c], 0x49ebf4
mov dword [esp + 0x70], 0x49e7b0
mov dword [esp + 0x74], 0x49e7b4
mov dword [esp + 0x78], 0x49e7b8
mov dword [esp + 0x7c], 0x49e7bc
mov dword [esp + 0x80], 0x49e7c0
mov dword [esp + 0x84], 0x49e7c4
mov dword [esp + 0x88], 0x49e7c8
mov dword [esp + 0x8c], 0x49e7cc
mov dword [esp + 0x90], 0x49ebf8
mov dword [esp + 0x94], 0x49ebfc
mov dword [esp + 0x98], 0x49e7d0
mov dword [esp + 0x9c], 0x49eb92
mov dword [esp + 0xa0], 0x49eb92
mov dword [esp + 0xa4], 0x49eb92
mov dword [esp + 0xa8], 0x49eb92
mov dword [esp + 0xac], 0x49eb92
mov dword [esp + 0xb0], 0x49eb92
mov dword [esp + 0xb4], 0x49eb92
mov dword [esp + 0xb8], 0x49eb92
mov dword [esp + 0xbc], 0x49e7d4
mov dword [esp + 0xc0], 0x49e7d8
mov dword [esp + 0xc4], 0x49e7dc
mov dword [esp + 0xc8], str.C___.____
mov dword [esp + 0xcc], 0x49e7e0
mov dword [esp + 0xd0], 0x49e7e4
mov dword [esp + 0xd4], 0x49ec00
mov dword [esp + 0xd8], 0x49e7e8
mov dword [esp + 0xdc], 0x49e7ec
mov dword [esp + 0xe0], 0x49e7f0
mov dword [esp + 0xe4], 0x49ec04
mov dword [esp + 0xe8], 0x49e7f4
mov dword [esp + 0xec], 0x49e7f8
cmp cl, 0x3c
jb 0x46ffd6
mov eax, 0x49eb92
mov ecx, dword [esp + 0xf0]
xor ecx, esp
call fcn.004591b7
add esp, 0xf4
ret
movzx eax, cl
mov ecx, dword [esp + 0xf0]
xor ecx, esp
mov eax, dword [esp + eax*4]
call fcn.004591b7
add esp, 0xf4
ret

Function at 0x48813f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00487fbe