joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4087f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1b89
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x4ec1e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0
lea ecx, [edi + 4]
mov dword [edi], vtable.spdlog::pattern_formatter.0
mov dword [ecx], 0
push 2
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x4d2748
mov byte [ecx], 0
mov byte [ebp - 4], 0
call fcn.0041f130
movups xmm0, xmmword [ebp + 0xc]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
movups xmmword [edi + 0x1c], xmm0
movq xmm0, qword [ebp + 0x1c]
movq qword [edi + 0x2c], xmm0
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 0xf
mov byte [ebp + 0xc], 0
mov dword [edi + 0x34], 0
mov byte [edi + 0x38], 1
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
lea ecx, [edi + 0x74]
mov byte [ebp - 4], 6
call fcn.0041c830
mov byte [ebp - 4], 7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [edi + 0x3c], xmm0
push 0x128
movups xmmword [edi + 0x4c], xmm0
mov dword [edi + 0x5c], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call fcn.0048c9ca
mov ecx, eax
add esp, 4
mov dword [ebp - 0x10], ecx
movq xmm0, qword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
movq qword [ecx + 4], xmm0
mov dword [ecx + 0xc], eax
lea eax, [ecx + 0x28]
mov dword [ecx], vtable.spdlog::details::full_formatter.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x18], vtable.fmt::v9::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x24], 0xfa
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 9
mov eax, dword [edi + 0x6c]
cmp eax, dword [edi + 0x70]
je 0x408959
mov dword [eax], ecx
add dword [edi + 0x6c], 4
jmp 0x408973
lea ecx, [ebp - 0x10]
push ecx
push eax
lea ecx, [edi + 0x68]
call fcn.0041c0c0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x408973
mov eax, dword [ecx]
push 1
call dword [eax]
mov edx, dword [ebp + 0x20]
cmp edx, 0x10
jb 0x4089a3
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x408999
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4089b8
push edx
push ecx
call fcn.0048c9bc
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
call fcn.0049166f
int3
Function at 0x408e90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x10], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x408fdd
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.00405c70
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x408fb0
movzx eax, byte [ecx + 8]
mov edi, dword [ebx + 0x18]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul eax, eax, 0x1000193
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
mov dword [ebp - 4], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 0xc], eax
cmp ebx, esi
jne 0x408f25
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x408f9f
mov eax, dword [eax + 4]
mov bl, byte [ecx + 8]
cmp bl, byte [eax + 8]
mov ebx, dword [ebp - 4]
jne 0x408f62
mov eax, dword [eax]
mov dword [ebp + 8], eax
cmp eax, ecx
je 0x408f5a
mov ebx, dword [ecx + 4]
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], ecx
jmp 0x408f9f
mov edi, eax
cmp ebx, eax
je 0x408f7c
mov eax, dword [eax + 4]
mov edi, eax
mov bl, byte [ecx + 8]
cmp bl, byte [eax + 8]
mov ebx, dword [ebp - 4]
je 0x408fb9
cmp ebx, eax
jne 0x408f68
mov eax, dword [ecx + 4]
mov dword [ebp + 8], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp + 8]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
mov ebx, dword [ebp - 0x10]
mov ecx, edx
cmp edx, esi
jne 0x408ef2
nop dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x408f9f
push str.invalid_hash_bucket_count
call fcn.0048a0a3
int3
Function at 0x41e190
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x14], ebx
mov eax, esi
shl eax, cl
push edi
cmp edx, eax
ja 0x41e320
lea eax, [edx - 1]
or eax, esi
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 4], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.00405c70
mov ecx, dword [ebp - 4]
lea eax, [esi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], esi
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov eax, edi
cmp edi, ecx
je 0x41e2f8
cmp dword [edi + 0x1c], 0x10
lea ebx, [edi + 8]
mov eax, dword [eax]
mov esi, dword [ebx + 0x10]
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
jb 0x41e211
mov edx, dword [ebx]
mov dword [ebp - 0xc], edx
xor edx, edx
mov dword [ebp - 8], 0x811c9dc5
test esi, esi
je 0x41e244
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
movzx esi, byte [edx + ebx]
inc edx
xor esi, ecx
imul ecx, esi, 0x1000193
cmp edx, eax
jb 0x41e227
mov eax, dword [ebp + 8]
lea ebx, [edi + 8]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov esi, dword [edx + 0x18]
and esi, dword [ebp - 8]
mov edx, dword [edx + 0xc]
lea edx, [edx + esi*8]
mov esi, dword [edx]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], esi
cmp esi, ecx
jne 0x41e269
mov dword [edx], edi
mov dword [edx + 4], edi
jmp 0x41e2ee
mov esi, dword [edx + 4]
lea eax, [esi + 8]
push eax
push ebx
call fcn.0041e330
test al, al
jne 0x41e2a3
mov ebx, dword [esi]
mov eax, dword [ebp + 8]
cmp ebx, edi
je 0x41e29b
mov esi, dword [edi + 4]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], edi
jmp 0x41e2eb
mov ebx, esi
cmp dword [ebp - 0xc], esi
je 0x41e2cb
nop word [eax + eax]
mov esi, dword [esi + 4]
mov ebx, esi
lea eax, [ebx + 8]
push eax
lea eax, [edi + 8]
push eax
call fcn.0041e330
test al, al
je 0x41e301
cmp dword [ebp - 0xc], esi
jne 0x41e2b0
mov esi, dword [edi + 4]
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx], edi
mov ecx, dword [ebp - 4]
mov edi, eax
cmp eax, ecx
jne 0x41e1f5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [esi]
mov esi, dword [edi + 4]
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
jmp 0x41e2eb
push str.invalid_hash_bucket_count
call fcn.0048a0a3
int3
Function at 0x428f90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b2f40
mov eax, dword fs:[0]
push eax
mov eax, 0x2010
call fcn.0048dee0
mov eax, dword [0x4ec1e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x201c], ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2010]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
push 0x2000
push 0
push eax
mov dword [ebp - 0x2018], esi
call fcn.0048eda0
add esp, 0xc
mov dword [ebp - 0x2014], 1
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x2018], 0x2000
jb 0x429009
mov edi, dword [edi]
lea eax, [ebp - 0x2018]
push eax
lea eax, [ebp - 0x2010]
push eax
lea eax, [ebp - 0x2014]
push eax
mov eax, dword [ebp - 0x201c]
push 0
push edi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x429080
cmp dword [ebp - 0x2014], 1
jne 0x429080
mov dword [esi], eax
lea ecx, [ebp - 0x2010]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
lea edx, [ecx + 2]
mov word [esi], ax
mov dword [ebp - 4], 0xffffffff
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x429060
sub ecx, edx
lea eax, [ebp - 0x2010]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004040a0
jmp 0x429088
push ebx
mov ecx, esi
call fcn.00404420
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048c98b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42bf60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 8
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], eax
jb 0x42bf7e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x42bfa4
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x42bf90
mov eax, dword [ebp - 8]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.00406250
mov eax, dword [ebp - 8]
test eax, eax
je 0x42bfc4
pop edi
pop esi
add eax, 0x20
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call fcn.0048a0c3
int3

Function at 0x42d480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ecx + 0x5d880c4d]
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx

Function at 0x42d550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0042d19c
push eax
push esi
push dword [ebp + 8]
call fcn.0042d151
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
aam 0x88
pop ebp
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0042d19c
push eax
push esi
push dword [ebp + 8]
call fcn.0042d151
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0042d18c
jbe 0x42d5b5
and byte [edi - 0x836278], al
invalid
Function at 0x42e5e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x42e5e2
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x42e58c
call fcn.0042d18c
in al, 0x1c
and esp, dword [eax]
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0042d18c
out dx, al
test dword [edx + edx*2 - 0x73], edi
test esp, edx
clc
invalid
Function at 0x44f480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
push ebp
movzx ebp, ax
xor eax, eax
push esi
mov esi, ebp
mov dword [esp + 0xc], ebp
push edi
shr esi, 8
xor edi, edi
mov dword [esp + 0x14], esi
cmp dword [esp + 0x24], eax
jbe 0x44f4ff
mov ebp, dword [esp + 0x28]
nop dword [eax]
mov ecx, dword [esp + 0x20]
movzx ebx, word [ecx + edi*2]
mov edx, ebx
movzx ecx, bl
shr edx, 8
add edx, eax
cmp esi, ecx
jb 0x44f4fb
movzx ecx, bl
cmp esi, ecx
jne 0x44f4f2
cmp eax, edx
jge 0x44f4f2
mov ecx, dword [esp + 0x1c]
movzx esi, cl
nop dword [eax + eax]
movzx ecx, byte [eax + ebp]
cmp cx, si
je 0x44f528
inc eax
cmp eax, edx
jl 0x44f4e0
mov esi, dword [esp + 0x14]
inc edi
mov eax, edx
cmp edi, dword [esp + 0x24]
jb 0x44f4b0
mov ebp, dword [esp + 0x10]
mov edi, dword [esp + 0x30]
xor eax, eax
mov bl, 1
test edi, edi
je 0x44f540
mov esi, dword [esp + 0x2c]
nop
movzx ecx, byte [eax + esi]
test cl, cl
jns 0x44f532
movzx edx, byte [eax + esi + 1]
inc eax
and ecx, 0x7f
shl ecx, 8
or edx, ecx
jmp 0x44f534
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
mov edx, ecx
sub ebp, edx
js 0x44f540
inc eax
xor bl, 1
cmp eax, edi
jb 0x44f510
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret
Function at 0x44fdd0
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b703d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4ec1e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.0048c9ca
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 1
test esi, esi
je 0x44fe4f
mov edx, dword [edi]
xor eax, eax
mov ecx, dword [edi + 4]
sub ecx, edx
mov dword [esi], 0
shr ecx, 1
push ecx
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 7
push edx
mov word [esi], ax
call fcn.004040a0
jmp 0x44fe51
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], 0
mov dword [ebx], esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call fcn.0044fb50
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov esi, dword [ebx]
cmp ecx, eax
je 0x44fed6
sub eax, ecx
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x44fe8a
mov ecx, dword [esi]
push 0
push eax
push ecx
call dword [sym.imp.CRYPT32.dll_CryptUnprotectMemory]
test eax, eax
je 0x44feec
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x44fea2
mov eax, dword [esi]
mov edx, dword [edi + 0xc]
mov ecx, dword [esi + 0x10]
lea eax, [eax + edx*2]
sub ecx, edx
je 0x44febe
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x44feb0
mov edx, dword [edi + 0xc]
mov eax, dword [esi + 0x10]
cmp eax, edx
jb 0x44ff0d
mov dword [esi + 0x10], edx
cmp dword [esi + 0x14], 8
jb 0x44fed0
mov esi, dword [esi]
xor eax, eax
mov word [esi + edx*2], ax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0044fd10
add esp, 8
lea eax, [ebp - 0x28]
push 0x4e3400
push eax
call fcn.0048e6f7
call fcn.00406330
int3
Function at 0x465d40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0x270
jne 0x465d90
lea edx, [edi + 8]
mov esi, eax
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x465d52
mov eax, dword [edi]
jmp 0x465e77
cmp eax, 0x4e0
jb 0x465e77
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
push ebp
mov ebp, 0xe3
nop
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x465db0
mov eax, dword [edi + 0xd50]
lea ebx, [edi + 0xd50]
mov ebp, 0x18c
nop word [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x465e00
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
pop ebx
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x46a200
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b913e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4ec1e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
lea eax, [ebx + 0xc]
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
push eax
mov dword [ebx], vtable.Concurrency::streams::details::streambuf_state_manager_unsigned_char_.0
call fcn.0048b189
lea ecx, [ebx + 0x14]
mov al, 1
mov byte [ecx], 0
lea edx, [ebx + 0x15]
mov byte [edx], 0
lea esi, [ebx + 0x16]
lea edi, [ebx + 0x17]
mov byte [esi], 0
mov byte [edi], 0
xchg byte [ecx], al
mov al, 1
xchg byte [edx], al
xor al, al
xchg byte [esi], al
xor al, al
xchg byte [edi], al
mov eax, dword [ebp + 8]
mov dword [ebx], vtable.Concurrency::streams::details::basic_producer_consumer_buffer_unsigned_char_.0
mov dword [ebx + 0x18], 1
mov dword [ebx + 0x1c], eax
mov dword [ebp - 4], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
lea eax, [ebx + 0x38]
mov dword [ebx + 0x28], 0
push 2
push eax
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
call fcn.0048a667
lea esi, [ebx + 0x68]
mov byte [ebp - 4], 2
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.0048c9ca
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
lea esi, [ebx + 0x7c]
mov byte [ebp - 4], 3
push 8
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.0048c9ca
add esp, 0x14
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47a200
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba9b5
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4ec1e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x6c]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x70], ebx
lea eax, [esi + 0x18]
push eax
call fcn.00404420
push 3
push 0x4c4d2c
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 0
call fcn.00405380
cmp dword [esi + 0x44], 8
lea ecx, [esi + 0x30]
jb 0x47a262
mov ecx, dword [esi + 0x30]
push dword [esi + 0x40]
push ecx
lea ecx, [ebp - 0x6c]
call fcn.00405380
mov eax, dword [esi + 0x10]
test eax, eax
je 0x47a2a1
cmp dword [esi + 0x14], 8
mov edi, esi
jb 0x47a27f
mov edi, dword [esi]
cmp eax, 1
jne 0x47a2e8
mov ecx, 0x4d23a0
mov edx, eax
sub edi, ecx
nop dword [eax]
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x47a2e8
add ecx, 2
sub edx, 1
jne 0x47a290
mov eax, dword [esi + 0xa8]
cmp eax, 0x50
je 0x47a391
cmp eax, 0x1bb
je 0x47a391
push 0x3a
lea ecx, [ebp - 0x6c]
call fcn.00459fa0
mov eax, dword [esi + 0xa8]
test eax, eax
jns 0x47a2f7
neg eax
push eax
lea eax, [ebp - 0x12]
push eax
call fcn.0044dbb0
lea ecx, [eax - 2]
mov eax, 0x2d
mov word [ecx], ax
jmp 0x47a303
mov eax, dword [esi + 0xa8]
test eax, eax
jne 0x47a2a7
jmp 0x47a391
push eax
lea eax, [ebp - 0x12]
push eax
call fcn.0044dbb0
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x54], 0
mov word [ebp - 0x54], ax
xor edx, edx
lea eax, [ebp - 0x12]
mov dword [ebp - 0x44], edx
add esp, 8
mov edi, 7
mov dword [ebp - 0x40], edi
cmp ecx, eax
je 0x47a33b
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x54]
call fcn.004040a0
mov edi, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
cmp edi, 8
mov byte [ebp - 4], 1
lea eax, [ebp - 0x54]
cmovae eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x6c]
push edx
push eax
call fcn.00405380
mov edx, dword [ebp - 0x40]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x47a391
mov ecx, dword [ebp - 0x54]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47a387
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a40a
push edx
push ecx
call fcn.0048c9bc
add esp, 8
cmp dword [esi + 0x74], 8
lea eax, [esi + 0x60]
jb 0x47a39d
mov eax, dword [esi + 0x60]
push dword [esi + 0x70]
lea ecx, [ebp - 0x6c]
push eax
call fcn.00405380
lea eax, [ebp - 0x6c]
push eax
push ebx
call fcn.0045e4a0
mov edx, dword [ebp - 0x58]
add esp, 8
cmp edx, 8
jb 0x47a3ec
mov ecx, dword [ebp - 0x6c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47a3e2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a40a
push edx
push ecx
call fcn.0048c9bc
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048c98b
mov esp, ebp
pop ebp
ret
call fcn.0049166f
int3