joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4747c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x588bdd
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x38]
mov dword [ebp - 4], 0
mov dword [ebp - 0x44], vtable.McSSConfig.0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
call fcn.00473950
xor ecx, ecx
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], cx
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x474833
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00425790
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00425730
push 0x800
call fcn.005541f3
add esp, 4
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x48]
push dword [ebp - 0x44]
push eax
call fcn.00477c90
cmp dword [ebp - 0x2c], 8
lea edx, [ebp - 0x40]
mov esi, dword [ebp - 0x4c]
lea ecx, [ebp + 0x20]
cmovae edx, dword [ebp - 0x40]
lea eax, [ebp + 8]
cmp dword [ebp + 0x34], 8
push edx
cmovae ecx, dword [ebp + 0x20]
cmp dword [ebp + 0x1c], 8
push 0x800
cmovae eax, dword [ebp + 8]
push esi
push 0x5bb418
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x474919
cmp eax, 0x7fe
jae 0x474919
xor ecx, ecx
mov dword [ebp - 0x28], 0
mov edx, 7
mov dword [ebp - 0x18], ecx
xor eax, eax
mov dword [ebp - 0x14], edx
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 8
test esi, esi
je 0x4748ef
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4748d0
sub eax, edx
lea ecx, [ebp - 0x28]
sar eax, 1
push eax
push esi
call fcn.00425790
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 9
cmp edi, eax
je 0x47490a
cmp edx, 8
push ecx
cmovae eax, dword [ebp - 0x28]
mov ecx, edi
push eax
call fcn.00425790
lea ecx, [ebp - 0x28]
call fcn.00425730
mov ebx, 1
jmp 0x47491b
xor ebx, ebx
mov byte [ebp - 4], 0xa
mov esi, dword [ebp - 0x48]
test esi, esi
je 0x474948
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x474948
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lock xadd dword [esi + 8], edi
dec edi
jne 0x474948
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 8]
lea ecx, [ebp - 0x40]
call fcn.00425730
lea ecx, [ebp + 8]
call fcn.00425730
lea ecx, [ebp + 0x20]
call fcn.00425730
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret 0x34
Function at 0x474b70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x588d1d
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x74], vtable.McSSConfig.0
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 0
push eax
call fcn.00473bf0
push 0x5bd3e8
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 1
push eax
call fcn.00434380
push str.ftconfig.ini
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
call fcn.00434380
add esp, 0x18
lea ecx, [ebp - 0x58]
call fcn.00425730
lea ecx, [ebp - 0x70]
call fcn.00425730
xor eax, eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 4
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x40]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00425790
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00425730
push 0x800
call fcn.005541f3
add esp, 4
mov dword [ebp - 0x7c], eax
lea ecx, [ebp - 0x78]
push dword [ebp - 0x74]
push eax
call fcn.00477c90
mov byte [ebp - 4], 7
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
mov edi, dword [ebp - 0x7c]
cmovae eax, dword [ebp - 0x40]
push eax
push 0x800
push edi
push 0x5bb418
push str.TrackingID
push str.DataAnalytics
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x474cf4
cmp eax, 0x7fe
jae 0x474cf4
xor ecx, ecx
mov dword [ebp - 0x28], 0
mov edx, 7
mov dword [ebp - 0x18], ecx
xor eax, eax
mov dword [ebp - 0x14], edx
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 8
test edi, edi
je 0x474ccf
mov eax, edi
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x474cb0
sub eax, edx
lea ecx, [ebp - 0x28]
sar eax, 1
push eax
push edi
call fcn.00425790
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 9
cmp esi, eax
je 0x474cea
cmp edx, 8
push ecx
cmovae eax, dword [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00425790
lea ecx, [ebp - 0x28]
call fcn.00425730
jmp 0x474d1a
push 0
push 0
mov ecx, esi
call fcn.0044c120
cmp dword [esi + 0x10], 0
mov ecx, esi
push 0xd
push str.UA_49812791_4
jne 0x474d15
call fcn.00425790
jmp 0x474d1a
call fcn.004258a0
mov byte [ebp - 4], 0xa
mov esi, dword [ebp - 0x78]
test esi, esi
je 0x474d47
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x474d47
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lock xadd dword [esi + 8], edi
dec edi
jne 0x474d47
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
lea ecx, [ebp - 0x40]
call fcn.00425730
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret 4
Function at 0x474d80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x588da2
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - method.McSSConfig.virtual_0], vtable.McSSConfig.0
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
push eax
call fcn.00473950
xor ecx, ecx
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], cx
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x474e04
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x248]
call fcn.00425790
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 4
call fcn.00425730
push 0x800
call fcn.005541f3
add esp, 4
mov dword [ebp - 0x258], eax
lea ecx, [ebp - 0x254]
push dword [ebp - 0x250]
push eax
call fcn.00477c90
mov byte [ebp - 4], 5
lea eax, [ebp - 0x248]
cmp dword [ebp - 0x234], 8
mov esi, dword [ebp - 0x258]
cmovae eax, dword [ebp - 0x248]
push eax
push 0x800
push esi
push 0x5bb418
push str.RequestedLanguage
push str.SecurityScan
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x474f23
cmp eax, 0x7fe
jae 0x474f23
xor ecx, ecx
mov dword [ebp - 0x230], 0
mov edx, 7
mov dword [ebp - 0x220], ecx
xor eax, eax
mov dword [ebp - 0x21c], edx
mov word [ebp - 0x230], ax
mov byte [ebp - 4], 6
test esi, esi
je 0x474eed
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x474ec5
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x230]
call fcn.00425790
mov edx, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 7
cmp edi, eax
je 0x474f0e
cmp edx, 8
push ecx
cmovae eax, dword [ebp - 0x230]
mov ecx, edi
push eax
call fcn.00425790
lea ecx, [ebp - 0x230]
call fcn.00425730
mov ebx, 1
jmp 0x474fa7
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
xor ecx, ecx
mov dword [ebp - 0x24c], eax
cmp cx, ax
je 0x474fa5
push 0x484e20
push 0x12
push 0x79
lea eax, [ebp - 0x24c]
push 0x611420
push eax
call fcn.0056a98f
add esp, 0x14
test eax, eax
je 0x474fa5
add eax, 2
push eax
lea eax, [ebp - 0x218]
push 0x82
push eax
call fcn.0056036b
lea ecx, [ebp - 0x218]
add esp, 0xc
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x474f80
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00425790
mov ebx, 1
jmp 0x474fa7
xor ebx, ebx
mov byte [ebp - 4], 8
mov esi, dword [ebp - 0x254]
test esi, esi
je 0x474fd7
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x474fd7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lock xadd dword [esi + 8], edi
dec edi
jne 0x474fd7
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 8]
lea ecx, [ebp - 0x248]
call fcn.00425730
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret 4
Function at 0x477950
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5837e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x61094c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00553f41
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0053eefa
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x478cc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5f5148
push fcn.005569f0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x61094c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x478d15
mov eax, dword [edi]
mov dword [ebp - 0x20], eax
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x24]
test edx, edx
je 0x478d36
mov dword [edx], ecx
cmp ecx, 1
je 0x478d44
cmp ecx, 7
jne 0x478e8c
test edi, edi
je 0x478e8c
mov esi, dword [edi]
test esi, esi
je 0x478e8c
test eax, eax
je 0x478d65
cmp eax, 0xea
jne 0x478e8c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], esi
mov dword [edi], eax
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x478d80
push eax
push 0
push ecx
call fcn.005561e0
add esp, 0xc
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 8]
cmp esi, ecx
sbb eax, eax
and eax, ecx
je 0x478df3
cmp eax, 0x400
ja 0x478dc9
call fcn.00554600
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x30], esi
test esi, esi
je 0x478df5
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x478e2c
push eax
call fcn.005602f1
add esp, 4
mov esi, eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x478df5
mov dword [esi], 0xdddd
add esi, 8
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x478e2c
xor esi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x478e2c
test esi, esi
jne 0x478e35
lea eax, [esi + 0xe]
jmp 0x478e8c
push dword [ebp - 0x20]
push 0
push esi
call fcn.005561e0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x478e73
push edi
push dword [ebp + 0x10]
push esi
push dword [ebp - 0x24]
mov ecx, ebx
call fcn.004793e0
mov edi, eax
jmp 0x478e76
mov edi, dword [ebp - 0x28]
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x478e8a
push esi
call fcn.0055e84d
add esp, 4
mov eax, edi
lea esp, [ebp - 0x44]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x479030
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5f5168
push fcn.005569f0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x61094c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov dword [ebp - 0x2c], edi
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x479078
mov dword [ebx], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x1f4
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov eax, 0x1fc
call fcn.00554600
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x30], esi
test esi, esi
je 0x4790b6
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4790ed
test esi, esi
je 0x479254
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
cmp edi, 0xea
jne 0x47920a
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x47912d
push esi
call fcn.0055e84d
add esp, 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x28]
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x4791b5
cmp edx, ecx
sbb eax, eax
and eax, ecx
cmp eax, 0x400
ja 0x479185
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.00554600
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x34], esi
test esi, esi
je 0x4791b7
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4791eb
cmp edx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.005602f1
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
test esi, esi
je 0x4791b7
mov dword [esi], 0xdddd
add esi, 8
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4791eb
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4791eb
test esi, esi
je 0x479254
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x47923c
cmp dword [ebp - 0x24], 3
je 0x47921b
mov edi, 0xd
jmp 0x47923c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
push esi
call fcn.00478eb0
add esp, 0x14
mov edi, eax
test ebx, ebx
je 0x47923c
mov eax, dword [ebp - 0x24]
mov dword [ebx], eax
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x479250
push esi
call fcn.0055e84d
add esp, 4
mov eax, edi
jmp 0x479259
mov eax, 0xe
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x488ca0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 4], edi
lea ebx, [esi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [esi + 0x10], 0xffffffff
jne 0x488d1d
mov eax, dword [esi]
test eax, eax
je 0x488ccb
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esi + 4]
cmp eax, dword [esi + 8]
je 0x488d14
mov eax, dword [esi + 0xc]
mov edi, ecx
mov dword [ebp - 4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x488d0a
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x488d03
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x488ce1
cmp dword [esi + 0x10], edi
jge 0x488ce1
push ebx
mov dword [esi + 0x10], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a6380
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov edx, 0x811c9dc5
lea esi, [eax + eax]
test esi, esi
je 0x4a63b2
push edi
mov edi, dword [ebp + 8]
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4a63a0
pop edi
mov eax, edx
pop esi
pop ebp
ret
Function at 0x4a6ef0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x4a6f1b
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4a6f04
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x4aa440
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59146c
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
push esi
push edi
mov eax, dword [0x61094c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov edi, dword [ebx + 8]
lea esi, [eax + 8]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], 0
movups xmmword [edi], xmm0
push esi
mov dword [ebp - 0x18], edi
movups xmmword [edi + 0x10], xmm0
mov dword [ebp - 0x20], esi
call fcn.0053fb7a
add esp, 4
test eax, eax
jne 0x4aa5f0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 1
push 0x38
mov eax, dword [eax + 0x38]
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.00553f41
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea ecx, [edi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
mov eax, dword [edx + 0x50]
mov dword [edi + 0x18], eax
mov eax, dword [edx + 0x54]
mov dword [edi + 0x1c], eax
mov eax, dword [edx + 0x48]
sub eax, dword [edx + 0x44]
push dword [edi + 4]
sar eax, 2
push eax
call fcn.004ab900
mov eax, dword [ebp - 0x14]
mov ecx, edi
mov eax, dword [eax + 0x3c]
push eax
push dword [eax]
call fcn.004ae770
push esi
call fcn.0053fb9f
add esp, 4
mov dword [ebp - 4], 0
mov edi, dword [0x620594]
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x20], edi
mov esi, dword [edi]
mov dword [ebp - 0x1c], esi
cmp esi, edi
je 0x4aa5d7
nop dword [eax]
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
mov dword [ebp - 0x14], eax
jb 0x4aa571
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov ecx, dword [eax + 0x10]
mov edx, 0x811c9dc5
xor eax, eax
add ecx, ecx
mov dword [ebp - 0x28], ecx
je 0x4aa59e
mov edi, dword [ebp - 0x14]
mov esi, ecx
movzx ecx, byte [eax + edi]
inc eax
xor ecx, edx
imul edx, ecx, 0x1000193
cmp eax, esi
jb 0x4aa587
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
lea eax, [esi + 8]
push edx
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004a6c00
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4aa5be
mov eax, dword [ebp - 0x18]
cmp dword [eax + 4], ecx
jne 0x4aa5ce
mov ecx, dword [ebp - 0x18]
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004acab0
mov esi, dword [esi]
mov dword [ebp - 0x1c], esi
cmp esi, edi
jne 0x4aa560
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
push eax
call fcn.0053fbca
int3
Function at 0x4ab4d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x4ab65e
cmp dword [edx + 0x1c], 8
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jb 0x4ab50b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
add eax, eax
je 0x4ab534
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x4ab520
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov ebx, esi
mov dword [ebp - 0x20], esi
mov esi, dword [esi]
lea ecx, [ebx + 0x20]
call fcn.004b13b0
lea ecx, [ebx + 8]
call fcn.00425730
push 0x3c
push ebx
call fcn.005541c2
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
mov eax, dword [ebp - 0x1c]
cmp ebx, eax
je 0x4ab5a8
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x4ab550
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x4ab653
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
jne 0x4ab5ba
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x4ab5bd
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x4ab653
nop dword [eax + eax]
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jb 0x4ab5de
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x4ab601
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x4ab5f0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [esi]
lea ecx, [ebx + 0x20]
call fcn.004b13b0
lea ecx, [ebx + 8]
call fcn.00425730
push 0x3c
push ebx
call fcn.005541c2
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp - 0x20]
dec dword [ecx + 8]
cmp ebx, eax
mov eax, dword [ebp + 0xc]
je 0x4ab664
cmp esi, eax
jne 0x4ab618
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x4ab5d0
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8