joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439ef0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4de4e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x43a01e
cmp byte [ebx + 0x3d], 0
je 0x43a01e
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x439f34
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049510d
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [ebp - 0x1c], 0
xorps xmm0, xmm0
mov dword [ebp - 8], ecx
cmp ecx, 0x10
movq qword [ebp - 0x1c], xmm0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], 8
cmovae eax, dword [ebp - 0x1c]
push esi
push edi
mov byte [eax + 8], 0
mov ecx, dword [ebp - 8]
cmp ecx, 0x10
lea eax, [ebp - 0x20]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x1c]
cmovae edi, dword [ebp - 0x1c]
lea esi, [ebp - 0x1c]
cmovae esi, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x439fa0
sub eax, 1
je 0x439fa4
mov ecx, dword [ebp - 8]
sub eax, 2
je 0x439ff7
xor bl, bl
jmp 0x439ff9
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
cmp ecx, 0x10
mov esi, dword [ebp - 0x20]
cmovae eax, edx
sub esi, eax
je 0x439fd9
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0049edbf
mov ecx, dword [ebp - 8]
add esp, 0x10
cmp esi, eax
jne 0x439f9c
cmp byte [ebx + 0x3d], 0
je 0x439ff7
test esi, esi
jne 0x439f62
push esi
push 8
lea ecx, [ebp - 0x1c]
call fcn.00408a50
jmp 0x439f5f
mov bl, 1
pop edi
pop esi
cmp ecx, 0x10
jb 0x43a00d
inc ecx
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.00406730
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049510d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop ebx
call fcn.0049510d
mov esp, ebp
pop ebp
ret

Function at 0x43adf0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x43ae03
mov esi, dword [esi]
lea eax, [ebp - 4]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x43ae19
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 1
push ebx
call fcn.0049ac1b
mov edi, eax
add esp, 8
test edi, edi
je 0x43ae90
push edi
push ebx
push dword [ebp - 4]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43ae87
lea eax, [ebp - 8]
mov dword [ebp + 8], 0
push eax
lea eax, [ebp + 8]
push eax
push 0x4c1c1c
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43ae87
cmp dword [ebp + 8], 0
je 0x43ae87
push 0x10
call fcn.00494794
add esp, 4
test eax, eax
je 0x43ae90
mov edx, dword [ebp + 8]
movzx ecx, word [edx + 2]
push ecx
movzx ecx, word [edx]
push ecx
push edi
mov ecx, eax
call fcn.0043ad10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call fcn.0049a905
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43af40
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x4de4e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push edi
mov edi, ecx
mov dword [ebp - 0x228], eax
movzx eax, word [edi + 8]
mov word [ebp - 0x18], ax
movzx eax, word [edi + 0xa]
mov word [ebp - 0x16], ax
call esi
mov word [ebp - 0x14], ax
movzx eax, word [edi + 0xa]
mov word [ebp - 0x12], ax
movzx eax, word [edi + 8]
mov word [ebp - 0x10], ax
mov eax, 0x4e4
mov word [ebp - 0xe], ax
call esi
mov word [ebp - 0xc], ax
xor esi, esi
mov eax, 0x4e4
mov word [ebp - 0xa], ax
nop word [eax + eax]
movzx eax, word [ebp + esi*2 - 0x16]
movzx ecx, word [ebp + esi*2 - 0x18]
add esi, 2
push ebx
push eax
push ecx
push 0x4c1e28
push 0x104
lea eax, [ebp - 0x220]
push 0x104
push eax
call fcn.0043b2f0
add esp, 0x1c
mov dword [ebp - 0x224], 0
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [edi + 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43b013
mov edx, dword [ebp - 0x224]
test edx, edx
jne 0x43b02d
cmp esi, 8
jb 0x43afb0
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049510d
mov esp, ebp
pop ebp
ret 8
cmp word [edx], 0
jne 0x43b057
mov ecx, dword [ebp - 0x228]
xor eax, eax
push eax
push edx
call fcn.004064e0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049510d
mov esp, ebp
pop ebp
ret 8
mov eax, edx
lea esi, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43b060
mov ecx, dword [ebp - 0x228]
sub eax, esi
sar eax, 1
push eax
push edx
call fcn.004064e0
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049510d
mov esp, ebp
pop ebp
ret 8
Function at 0x43b8c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
cmp byte [esi], 0
je 0x43b8e1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x43b8e4
mov eax, dword [esi + 4]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne bl
test bl, bl
je 0x43b973
cmp byte [ebp + 0xc], 0
je 0x43b9cc
cmp byte [esi], 0
je 0x43b90e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x43b911
mov eax, dword [esi + 4]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43b9cc
push 2
call fcn.004235b0
add esp, 4
test al, al
je 0x43b96d
push 2
push 0x86
push str.d:webapps_b_build_slave_repo_build_src_baseprocessprocess_win.cc
lea ecx, [ebp - 0xb4]
mov dword [ebp - 4], 2
call fcn.00422790
mov ecx, dword [ebp + 8]
add eax, 8
push ecx
push str.Error_waiting_for_process_exit__exit_code:
push eax
call fcn.00401950
add esp, 8
mov ecx, eax
call fcn.00407580
test byte [ebp - 4], 2
jmp 0x43b9bf
push 2
call fcn.004235b0
add esp, 4
test al, al
je 0x43b9bb
push 2
push 0x8d
push str.d:webapps_b_build_slave_repo_build_src_baseprocessprocess_win.cc
lea ecx, [ebp - 0xb4]
mov dword [ebp - 4], 4
call fcn.00422790
mov ecx, dword [ebp + 8]
add eax, 8
push ecx
push str.Unable_to_terminate_process__exit_code:
push eax
call fcn.00401950
add esp, 8
mov ecx, eax
call fcn.00407580
test byte [ebp - 4], 4
je 0x43b9cc
lea ecx, [ebp - 0xb4]
call fcn.00422910
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43c830
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0
call fcn.00441d00
test al, al
jne 0x43c853
pop esi
mov esp, ebp
pop ebp
ret 4
cmp byte [esi + 0x34], 0
mov ecx, 0x1000002
push ebx
push 0
push 0
mov eax, 2
lea ebx, [esi + 0x30]
cmovne eax, ecx
mov ecx, esi
push 0
push eax
push 0
call fcn.004581a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
mov ecx, ebx
call fcn.0042ad50
mov eax, dword [ebx]
test eax, eax
je 0x43c892
cmp eax, 0xffffffff
jne 0x43c8ba
cmp byte [esi + 0x26], 0
je 0x43c8ba
push 0x4bf0ac
push 0x28
push str.d:webapps_b_build_slave_repo_build_src_base_filesmemory_mapped_file_win.cc
lea ecx, [ebp - 0xc4]
call fcn.00422710
lea ecx, [ebp - 0xc4]
call fcn.00422910
mov eax, dword [ebx]
test eax, eax
je 0x43ca32
cmp eax, 0xffffffff
je 0x43ca32
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
push 0x4c2018
mov ecx, edi
movq qword [ebp - 0xc], xmm0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
call fcn.0043ca90
test al, al
je 0x43c96a
mov ecx, esi
call fcn.00441c80
mov edi, edx
mov ebx, eax
test edi, edi
jl 0x43c91a
jg 0x43c91a
test ebx, ebx
je 0x43c91a
test edi, edi
jl 0x43c942
jg 0x43c91a
cmp ebx, 0x7fffffff
jbe 0x43c942
cmp byte [esi + 0x26], 0
je 0x43c942
push 0x4bf0ac
push 0x37
push str.d:webapps_b_build_slave_repo_build_src_base_filesmemory_mapped_file_win.cc
lea ecx, [ebp - 0xc4]
call fcn.00422710
lea ecx, [ebp - 0xc4]
call fcn.00422910
mov eax, ebx
add eax, 0xffffffff
adc edi, 0xffffffff
test edi, edi
ja 0x43ca27
jb 0x43c95f
cmp eax, 0x7ffffffe
ja 0x43ca27
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x2c], ebx
lea ebx, [esi + 0x30]
jmp 0x43c9cd
lea eax, [ebp - 4]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x14]
movlpd qword [ebp - 0xc], xmm0
push eax
lea eax, [ebp - 0xc]
movlpd qword [ebp - 0x14], xmm0
push eax
push dword [edi + 0xc]
push dword [edi + 8]
push dword [edi + 4]
push dword [edi]
call fcn.0043cac0
mov eax, dword [ebp - 4]
add esp, 0x1c
cdq
add eax, dword [edi + 8]
mov dword [ebp - 0x10], eax
adc edx, dword [edi + 0xc]
cmp dword [ebp - 8], 0
jl 0x43ca27
mov ecx, dword [ebp - 0xc]
jg 0x43c9b2
test ecx, ecx
jb 0x43ca27
test edx, edx
jl 0x43ca27
jg 0x43c9be
test eax, eax
jb 0x43ca27
test edx, edx
ja 0x43ca27
jb 0x43c9c7
cmp eax, 0xffffffff
ja 0x43ca27
mov eax, dword [edi + 8]
mov dword [esi + 0x2c], eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 8]
push ecx
push eax
push 4
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x28], eax
test eax, eax
jne 0x43ca0d
cmp byte [esi + 0x26], al
je 0x43ca0d
push 0x4bf0ac
push 0x5c
push str.d:webapps_b_build_slave_repo_build_src_base_filesmemory_mapped_file_win.cc
lea ecx, [ebp - 0xc4]
call fcn.00422710
lea ecx, [ebp - 0xc4]
call fcn.00422910
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x43ca27
mov eax, dword [ebp - 4]
pop edi
add eax, ecx
mov dword [esi + 0x28], eax
mov al, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43cf70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x4de4e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x64]
push esi
mov esi, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0x67452301
push eax
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
call fcn.0043d670
lea eax, [ebp - 0x5c]
push eax
push esi
call fcn.0043ced0
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop esi
call fcn.0049510d
mov esp, ebp
pop ebp
ret

Function at 0x43dc00
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00494a40
mov eax, dword [0x4de4e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x1008]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edx
lea edx, [ebp - 0x804]
mov dword [ebp - 0x1008], 0
push edx
lea edx, [ebp - 0x100c]
mov dword [ebp - 0x100c], 1
push edx
push 0
push eax
push dword [ecx]
mov dword [ebp - 0x1008], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x43dd4f
mov ecx, dword [ebp - 0x100c]
cmp ecx, 1
jne 0x43dce2
cmp word [ebp - 0x804], ax
jne 0x43dca0
xor ecx, ecx
lea eax, [ebp - 0x804]
push ecx
push eax
mov ecx, edi
call fcn.004064e0
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049510d
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x804]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43dcb0
sub ecx, edx
lea eax, [ebp - 0x804]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.004064e0
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049510d
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x43dd4a
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1008], eax
test eax, eax
je 0x43dd33
cmp eax, 0x400
ja 0x43dd33
lea eax, [ebp - 0x1004]
mov ecx, edi
push eax
call fcn.0043dbb0
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049510d
mov esp, ebp
pop ebp
ret 8
pop edi
mov eax, 0xea
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049510d
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0049510d
mov esp, ebp
pop ebp
ret 8

Function at 0x43dd70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
mov eax, edx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], 0
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43dd87
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4419d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00457840

Function at 0x447ac0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], 0xffffffff
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x447b14
push str.slot_____DWORD_0xFFFFFFFF_
lea eax, [ebp + 8]
push eax
push ecx
call fcn.0040ae70
add esp, 0xc
test eax, eax
je 0x447b14
push eax
push 0x11
push str.d:webapps_b_build_slave_repo_build_src_base_threading_thread_local_win.cc
lea ecx, [ebp - 0xb0]
call fcn.004227e0
lea ecx, [ebp - 0xb0]
call fcn.00422910
mov esp, ebp
pop ebp
ret

Function at 0x447b30
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
push dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x447b97
push 3
call fcn.004235b0
add esp, 4
test al, al
je 0x447b87
push 3
push 0x23
push str.d:webapps_b_build_slave_repo_build_src_base_threading_thread_local_win.cc
lea ecx, [ebp - 0xb4]
call fcn.00422790
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.00401950
add esp, 8
mov ebx, 1
test bl, 1
je 0x447b97
lea ecx, [ebp - 0xb4]
call fcn.00422910
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c560
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x44c5d1
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x44c5d1
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x44c615
cmp esi, eax
jne 0x44c5c5
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x44c5fe
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x44c643
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x44c665
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.0049478f
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
pop ebp
ret 0xc
cmp eax, esi
jne 0x44c64b
mov dword [ecx], edi
jmp 0x44c665
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x44c665
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.0044cda0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
pop ebp
ret 0xc
Function at 0x44c680
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
shl ecx, 3
mov dword [ebp - 8], ecx
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
cmp esi, eax
je 0x44c6ee
mov esi, dword [ecx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x44c6ee
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x44c70e
cmp esi, eax
jne 0x44c6e2
mov eax, dword [ebx + 4]
push 0x18
mov edi, dword [eax]
mov eax, dword [edi + 4]
mov dword [ebp - 4], eax
call fcn.00494794
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x44c720
jmp 0x44c7dd
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edx, [ecx + 4]
mov dword [ecx], edi
test edx, edx
je 0x44c72e
mov eax, dword [ebp - 4]
mov dword [edx], eax
lea eax, [ecx + 8]
test eax, eax
je 0x44c741
mov edx, dword [ebp + 0xc]
movups xmm0, xmmword [edx]
lea edx, [ecx + 4]
movups xmmword [eax], xmm0
mov eax, 0xaaaaaa9
sub eax, dword [ebx + 8]
cmp eax, 1
jb 0x44c7e2
inc dword [ebx + 8]
mov dword [edi + 4], ecx
mov eax, dword [edx]
mov dword [eax], ecx
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x44c788
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 8]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x44c7a2
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x44c7c4
cmp eax, esi
jne 0x44c7aa
mov dword [ecx], edi
jmp 0x44c7c4
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x44c7c4
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.0044cda0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.0049a721
push 0x4c137c
call fcn.00493569
int3
Function at 0x451d20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4de4e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0
push 0
sub esp, 8
mov dword [ebp - 0x38], esi
mov edx, esp
mov dword [edx], edi
test edi, edi
jne 0x451d4f
xor ecx, ecx
jmp 0x451d6c
cmp byte [edi], 0
jne 0x451d58
xor ecx, ecx
jmp 0x451d6c
mov ecx, edi
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x451d60
sub ecx, esi
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x1c]
mov dword [edx + 4], ecx
push eax
call fcn.0042f020
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x451d83
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 8]
mov ebx, eax
cmp ecx, 8
jb 0x451da1
inc ecx
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.00406780
test ebx, ebx
jne 0x451dba
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049510d
mov esp, ebp
pop ebp
ret 8
test esi, esi
je 0x451e9f
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00494ed4
add esp, 4
mov esi, eax
push ebx
push esi
sub esp, 8
mov edx, esp
mov dword [edx], edi
test edi, edi
je 0x451e01
cmp byte [edi], 0
jne 0x451df5
xor edi, edi
jmp 0x451e01
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x451df8
sub edi, ecx
lea eax, [ebp - 0x1c]
mov dword [edx + 4], edi
push eax
call fcn.0042f020
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x451e18
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [ebp - 8]
cmp eax, 8
jb 0x451e34
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00406780
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040cb10
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0042f190
mov ecx, dword [ebp - 0x38]
add esp, 8
push eax
call fcn.00408b00
mov eax, dword [ebp - 0x20]
cmp eax, 0x10
jb 0x451e6b
inc eax
lea ecx, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
call fcn.00406730
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x34], 0
cmp eax, 8
jb 0x451e92
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00406780
test esi, esi
je 0x451e9f
push esi
call fcn.00494a38
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049510d
mov esp, ebp
pop ebp
ret 8

Function at 0x4520e0
Capabilities:
Enumerate processes

Disassembly:
push esi
push edi
mov esi, ecx
push 0x22c
push 0
lea edi, [esi + 0xc]
push edi
call fcn.00496a10
add esp, 0xc
mov dword [edi], 0x22c
cmp byte [esi + 8], 0
push edi
push dword [esi + 4]
jne 0x452119
mov byte [esi + 8], 1
call sub.KERNEL32.dll_Process32FirstW
neg eax
pop edi
sbb eax, eax
neg eax
pop esi
ret
call sub.KERNEL32.dll_Process32NextW
neg eax
pop edi
sbb eax, eax
neg eax
pop esi
ret
Function at 0x458300
Capabilities:
Encode data using xor

Disassembly:
xchg edx, esi
neg esi
xor ebx, 0x59afe80
and eax, dword [0x4deb80]
sub edx, esi
mov edx, edx
neg esi
shr esi, 0xe
or ebx, 0x14dc7e12
and ebx, 0x761c6fc2
dec ecx
jne 0x4582ec
mov eax, ebp
and ebx, 0x90a47398
add eax, 0x3448a4d4
mov esi, 0x4003aead
inc esi
xchg edx, esi
cmp esi, ebx
je 0x458334
mov ebx, 0x15cf5e80
mov ecx, 0x3d0f6a28
not ebx
test dword [0x4def3e], eax
jge 0x458346
rol eax, 0xf
and eax, 0x74c3de65
and dword [0x4e6675], esi
shl edi, 0x16
shr esi, 2
xchg ebx, esi
rol esi, 1
not esi
add edi, 0x8dccf5bd
mov esi, 0xc5ebf335
add ebx, dword [0x4de4d8]
call fcn.00487c62
mov esi, edx
neg edx
xor esi, ecx
ror edx, 4
dec ecx
jne 0x458339
mov ecx, 0x38d42449
cmp esi, edx
jge 0x45838d
neg ebx
inc eax
not edi
inc ebx
not edi
call fcn.00427701
xor edi, edi
add ebx, 0xb4257069
shl edx, 0xf
dec eax
rol eax, 0x19
dec ecx
jne 0x458387
ror ecx, 0xb
call fcn.004aafe1
sub al, 5
add cl, al
loop 0x4583cb
sub edx, dword [0x4de1ce]
neg edx
sub ebx, esp
mov edi, 0xc9756e46
xor dword [0x4e672b], esi
or esi, dword [0x4e6e60]
and dword [0x4e65e3], ecx
xor eax, 0x3605935e
xor edx, dword [0x4e6bc7]
or dword [0x4e633d], edx
dec edi
add ecx, ebx
call fcn.0047b6ea
and dword [0x4e6478], esi
neg eax
xor dword [0x4e6699], eax
neg edx
call fcn.004064c2
add esi, dword [0x4e69c4]
invalid
and dword [ecx], edx
invalid