joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451860
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x451939
cmp dword [esi], 0
jne 0x451939
cmp dword [esi + 0xc], 0
jne 0x451939
xor eax, eax
cmp dword [esi + 4], 0
jne 0x451939
mov ebx, dword [edi]
cmp eax, ebx
je 0x4518c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x451909
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4518b9
mov dword [esi], ebx
call fcn.0046eab0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x4518f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x451920
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4518ec
mov dword [esi + 4], ebx
call fcn.0046eab0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0046eab0
push dword [esi]
call fcn.00471760
add esp, 4
mov dword [esi], 0
jmp 0x4518aa
call fcn.0046eab0
push dword [esi + 4]
call fcn.00471760
add esp, 4
mov dword [esi + 4], 0
jmp 0x4518dc
mov ecx, esi
call fcn.004e0a70
mov eax, dword [esi]
jmp 0x451894
Function at 0x45c7f0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 8]
mov eax, dword [0x521014]
xor eax, ebp
mov dword [ebp - 0x10], eax
test esi, esi
je 0x45c9b4
cmp dword [0x523ce0], 0xe69e32f3
jne 0x45c9b7
mov byte [ebp - 0x11], 0xff
lea ebx, [esi + 0x2b0]
lea ecx, [esi + 0x48]
xor edi, edi
inc edi
mov dword [ebp - 0x18], 0
mov eax, dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov dword [ebp - 0x1c], ecx
push ecx
call eax
test al, al
je 0x45c966
mov eax, dword [ebx]
mov edi, dword [eax]
test edi, edi
je 0x45c90d
mov ecx, esi
mov byte [ebp - 0x11], 0
mov esi, dword [edi]
test esi, esi
je 0x45c95f
mov edx, dword [ecx + 0x2bc]
mov dword [ebp - 0x18], edx
mov ebx, esi
bswap ebx
test ebx, 0x1fc000
je 0x45c9ac
mov edx, ebx
xor edx, edi
cmp edx, 0x1fffff
ja 0x45c9ac
not esi
cmp dword [edi + 4], esi
jne 0x45c9ac
prefetcht0 byte [ebx]
mov dword [eax], ebx
inc word [eax + 0xc]
mov esi, ecx
mov eax, dword [eax + 8]
mov ecx, dword [esi + 0x904]
add ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x908]
mov dword [esi + 0x904], ecx
cmp eax, ecx
cmovae ecx, eax
mov dword [esi + 0x908], ecx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, edi
push esi
call fcn.0047feb0
push edi
push dword [0x529c6c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x5251d0]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x90], edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b980
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x11]
mov ecx, ebx
push eax
push 0x4000
push 0x1c8
push 2
push esi
call fcn.00466800
test eax, eax
je 0x45c9ba
mov edi, eax
mov ecx, eax
and ecx, 0xffe00000
mov edx, eax
shr edx, 9
and edx, 0xfe0
lea eax, [edx + ecx]
movzx ecx, byte [edx + ecx + 0x101e]
and ecx, 0x3f
shl ecx, 5
sub eax, ecx
add eax, 0x1000
jmp 0x45c8a3
xor ebx, ebx
jmp 0x45c89b
mov eax, edi
test edi, edi
jle 0x45c9a4
pause
dec eax
jne 0x45c96c
mov edx, dword [ebp - 0x18]
add edx, edi
mov ecx, dword [ebp - 0x1c]
add edi, edi
cmp edi, 0x40
mov eax, 0x40
cmovge edi, eax
mov dword [ebp - 0x18], edx
cmp edx, 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
jl 0x45c83d
call fcn.0045c9e0
jmp 0x45c848
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
jmp 0x45c979
mov ecx, dword [ebp - 0x18]
call fcn.004b5ad0
int3
int3
xor edi, edi
jmp 0x45c8c6
Function at 0x45ca00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x521014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x45ca30
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b980
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x45cb00
push 0
push eax
push 0x45c9f0
push 0x529ca4
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x45caee
cmp dword [0x529ca8], 0
jne 0x45ca1c
push dword [0x529cac]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45ca1c
mov esi, eax
mov eax, 0x529cb0
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov ebx, dword [0x529cb4]
mov edi, dword [0x529cb8]
mov eax, dword [0x529cbc]
mov dword [ebp - 0x18], eax
mov eax, dword [0x529cc0]
mov dword [ebp - 0x1c], eax
mov eax, 0x529cb0
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test ebx, ebx
jne 0x45cac7
test edi, edi
jne 0x45cad0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x45cada
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x45cae4
push esi
call fcn.004809a0
add esp, 4
jmp 0x45ca1c
push dword [esi]
call ebx
add esp, 4
jmp 0x45caa7
push dword [esi + 4]
call edi
add esp, 4
jmp 0x45caab
push dword [esi + 8]
call eax
add esp, 4
jmp 0x45cab2
push dword [esi + 0xc]
call eax
add esp, 4
jmp 0x45cab9
call fcn.0049f050
int3

Function at 0x463a10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x463a27
test eax, eax
je 0x463a27
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
jne 0x463a34
mov eax, dword [0x52bd88]
test eax, eax
jne 0x463a68
cmp dword [0x52bd80], 0
je 0x463a21
mov esi, dword [0x52bd84]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x463a6c
test esi, esi
je 0x463a21
push esi
call dword [0x52bd80]
add esp, 4
jmp 0x463a21
call eax
jmp 0x463a34
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x463a58
Function at 0x46a8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm4
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x46a99e
nop word cs:[eax + eax]
nop
movdqa xmm6, xmm0
movdqa xmm5, xmmword [0x509ab0]
pclmulqdq xmm6, xmm5, 0
movdqa xmm5, xmmword [0x509ac0]
pclmulqdq xmm0, xmm5, 0x11
movdqa xmm7, xmm0
pxor xmm7, xmm6
movdqa xmm0, xmm3
movdqa xmm4, xmmword [0x509ab0]
pclmulqdq xmm0, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
movdqa xmm6, xmm3
pxor xmm6, xmm0
movdqa xmm0, xmm2
pclmulqdq xmm0, xmm4, 0
movdqa xmm3, xmm4
pclmulqdq xmm2, xmm5, 0x11
movdqa xmm4, xmm2
pxor xmm4, xmm0
movdqa xmm0, xmm1
pclmulqdq xmm0, xmm3, 0
pclmulqdq xmm1, xmm5, 0x11
movdqa xmm5, xmm1
pxor xmm5, xmm0
movdqu xmm0, xmmword [ecx]
pxor xmm0, xmm7
movdqu xmm3, xmmword [ecx + 0x10]
pxor xmm3, xmm6
movdqu xmm2, xmmword [ecx + 0x20]
pxor xmm2, xmm4
movdqu xmm1, xmmword [ecx + 0x30]
pxor xmm1, xmm5
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x46a8f0
movdqa xmm4, xmmword [0x509ad0]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x509ae0]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp eax, 0x10
jb 0x46aa22
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add ecx, 0x10
add eax, 0xfffffff0
cmp eax, 0xf
ja 0x46a9fb
movdqa xmm1, xmmword [0x509ae0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm2, xmm2
pxor xmm1, xmm1
pblendw xmm1, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x509af0], 0
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm1, 3
pclmulqdq xmm0, xmmword [0x509b00], 0x10
pblendw xmm0, xmm2, 0xfc
pclmulqdq xmm0, xmmword [0x509b10], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop ebp
ret
Function at 0x46db00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x46db37
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jae 0x46db3e
lea eax, [ebx + 1]
cmp eax, 2
jb 0x46db30
mov dword [esi], ebx
call fcn.0046eab0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0046eab0
push dword [esi]
call fcn.00471760
add esp, 4
mov dword [esi], 0
jmp 0x46db21

Function at 0x470c70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.0048c1b0
mov eax, dword [0x521014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x522bb8]
cmp eax, 0xffffffff
je 0x470ca2
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
jne 0x470cb7
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b980
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.0048e490
add esp, 0xc
mov ecx, dword [0x522bb8]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.0044f580
add esp, 8
test ebx, ebx
je 0x470cf8
push ebx
call fcn.0048b3ac
add esp, 4
mov eax, dword [0x527abc]
mov ecx, dword [0x5251d0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x470dc8
mov esi, dword [0x527ab8]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x470e0d
lea eax, [ebp - 0x1410]
push 0xc00
push 0x526eb8
push eax
call fcn.0048e490
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ebx, 0x100
test al, 1
je 0x470db3
xor esi, esi
lea edi, [ebp - 0x1408]
xor eax, eax
mov ecx, dword [ebp + esi*8 - 0x810]
test ecx, ecx
jne 0x470d7c
inc esi
add edi, 0xc
cmp esi, 0x100
jne 0x470d63
jmp 0x470da9
cmp dword [edi - 8], 0
je 0x470d6e
mov edx, dword [ebp + esi*8 - 0x80c]
cmp edx, dword [edi]
jne 0x470d6e
mov edx, dword [edi - 4]
test edx, edx
je 0x470d6e
mov dword [ebp + esi*8 - 0x810], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x470d6e
lea ecx, [ebx - 1]
cmp ebx, 2
mov ebx, ecx
jae 0x470d55
push 2
push dword [ebp - 0x1414]
call fcn.0044f580
add esp, 8
jmp 0x470ca2
push 0x527abc
call fcn.0048b3e7
add esp, 4
cmp dword [0x527abc], 0xffffffff
jne 0x470d19
push 4
call fcn.0048b346
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.004711f0
mov dword [0x527ab8], esi
push 0x527abc
call fcn.0048b45d
add esp, 4
jmp 0x470d19
mov ecx, esi
call fcn.00471200
jmp 0x470d2e
Function at 0x471010
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, ecx
mov eax, dword [0x521014]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x3e
push str..._.._base_files_file_win.cc
push str.Read
push ebx
call fcn.0046ea80
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.00474400
cmp dword [ebp + 0x14], 0
js 0x47110a
mov edi, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.00473f40
test al, al
jne 0x47110f
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push ebx
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4710f8
mov ebx, dword [esp + 0xc]
lea ecx, [esp + 0x28]
call fcn.00473f60
lea ecx, [esp + 0x30]
call fcn.00474460
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x4710cf
xor ebx, ebx
dec ebx
jmp 0x4710d8
lea ecx, [esp + 0x28]
push 0
push dword [ebp + 0x14]
push esi
push str.File::Read
call fcn.004db1f0
jmp 0x471090

Function at 0x471130
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x47116b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x471182
lea eax, [ebx + 1]
cmp eax, 2
jb 0x471164
mov dword [esi], ebx
call fcn.0046eab0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x471199
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0046eab0
push dword [esi]
call fcn.00471760
add esp, 4
mov dword [esi], 0
jmp 0x471155
int3

Function at 0x471250
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x4712ce
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4712b7
lea eax, [edi + 1]
cmp eax, 2
jb 0x47129b
mov dword [esi], edi
call fcn.0046eab0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 1
inc eax
cmp eax, 1
jbe 0x4712d2
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.0046eab0
push dword [esi]
call fcn.00471760
add esp, 4
mov dword [esi], 0
jmp 0x47128c
mov byte [esi + 4], 1
int3
Function at 0x472870
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00472540

Function at 0x476cf0
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x476d05
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, edx
cmp edx, 4
jae 0x476d46
cmp edx, 1
jne 0x476d36
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
cmp edx, 2
jne 0x476d6e
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
jmp 0x476d11
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
jbe 0x476d0c
jmp 0x476d46
cmp edx, 3
jne 0x476d1c
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
jmp 0x476d3b
Function at 0x47dbf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
movzx eax, byte [ecx + 0x27]
test al, al
js 0x47dc64
test eax, eax
jne 0x47dc59
cmp dword [esi + 0x28], 0
jne 0x47dc59
mov byte [esi + 0x2c], 0
mov eax, dword [esi + 8]
mov dword [esi + 4], eax
cmp eax, dword [esi + 0xc]
je 0x47dc4c
lea edi, [esi + 0x10]
mov ebx, 0x80001b
lea ecx, [eax + 1]
mov dword [esi + 8], ecx
movsx eax, byte [eax]
mov ecx, edi
push 0
push eax
call fcn.0046c820
cmp eax, 0xffffffff
jne 0x47dc41
cmp dword [esi + 0x30], 1
jne 0x47dc7c
jmp 0x47dc69
mov eax, dword [esi + 8]
mov dword [esi + 4], eax
cmp eax, dword [esi + 0xc]
jne 0x47dc21
mov byte [esi + 0x2c], 1
xor ebx, ebx
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004ecb80
mov eax, dword [esi + 0x20]
jmp 0x47dc00
mov eax, dword [esi + 4]
mov al, byte [eax]
add al, 0xf7
cmp al, 0x17
ja 0x47dc7c
movzx eax, al
bt ebx, eax
jb 0x47dc41
mov eax, dword [esi + 8]
mov bl, 1
nop word cs:[eax + eax]
nop dword [eax + eax]
cmp eax, dword [esi + 0xc]
je 0x47dc52
movsx eax, byte [eax]
mov ecx, edi
push 0
push eax
call fcn.0046c820
cmp eax, 0xffffffff
jne 0x47dc52
mov eax, dword [esi + 8]
cmp dword [esi + 0x30], 1
je 0x47dcb8
add eax, 1
mov dword [esi + 8], eax
jmp 0x47dc90
mov cl, byte [eax]
add cl, 0xf7
cmp cl, 0x17
ja 0x47dcb0
movzx ecx, cl
mov edx, 0x80001b
bt edx, ecx
jae 0x47dcb0
jmp 0x47dc52
Function at 0x4832b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x529d48]
mov ecx, dword [0x5251d0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4832db
mov ecx, 0x529d40
pop ebp
jmp fcn.00470e20
push 0x529d48
call fcn.0048b3e7
add esp, 4
cmp dword [0x529d48], 0xffffffff
jne 0x4832d0
xor eax, eax
mov dword [0x529d44], eax
mov dword [0x529d40], eax
mov ecx, 0x529d40
push eax
call fcn.00443d90
push 0x529d48
call fcn.0048b45d
add esp, 4
jmp 0x4832d0

Function at 0x485d90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x485dca
mov edx, dword [ebp + 0xc]
xor esi, esi
nop word cs:[eax + eax]
nop
movzx edi, al
movzx ebx, byte [edx + esi]
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x5196c4]
add esi, 1
cmp ecx, esi
jne 0x485db0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ad527
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ad770

Function at 0x4aff30
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004aff3b
Function at 0x4b8f50
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov esi, ecx
mov eax, dword [0x521014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x212]
push 0x202
push 0xff
push ebx
call fcn.0048ef90
add esp, 0xc
lea eax, [ebp - 0x218]
mov dword [eax], 0x101
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test eax, eax
je 0x4b8faf
mov ecx, esi
push str.UICreated_
call fcn.00437900
mov ecx, esi
push ebx
call fcn.00440280
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4b90f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x188
mov eax, dword [0x521014]
xor eax, ebp
mov dword [esp + 0x180], eax
lea esi, [esp + 0x70]
push 0x110
push 0
push esi
call fcn.0048ef90
add esp, 0xc
mov dword [esi - 4], 0x114
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4b9157
cmp dword [esp + 0x70], 6
setae bl
mov ecx, dword [esp + 0x180]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 4]
push eax
push edi
call fcn.004b9e70
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push edi
push 0x2e
push str.IsVistaOrGreater
push 1
call fcn.004b9c70
lea ecx, [esp + 0x4c]
push 0x50a078
push str.Cant_get_Windows_version_info
call fcn.004b5d50
mov ecx, esi
call fcn.004b9cb0
cmp byte [edi + 0xb], 0
jns 0x4b91ac
push dword [esp + 4]
call fcn.0048b376
add esp, 4
xor ebx, ebx
jmp 0x4b913f

Function at 0x4b9c20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.004b9fd0
mov ecx, eax
call fcn.00470e20
test eax, eax
jne 0x4b9c57
call fcn.004b9fd0
mov esi, eax
push 0xc
call fcn.0048b346
add esp, 4
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax], ecx
mov dword [eax + 8], ecx
mov ecx, esi
push eax
call fcn.00470e50
call fcn.004b9fd0
mov ecx, eax
pop esi
pop ebp
jmp fcn.00470e20

Function at 0x4ba480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
lea esi, [ebp - 0x18]
mov dword [esi - 4], esp
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x438800
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
call fcn.0049d66a
mov dword [esi + 8], 1
call eax
push 2
call fcn.0048fb9f
add esp, 4
push eax
push 1
push 0x28
push str.terminate_handler_unexpectedly_returned_n
call fcn.004a2fd0
add esp, 0x10
call fcn.0049f050
nop dword [eax + eax]
push ebp
sub esp, 0x10
add ebp, 0xc
call fcn.0048cbd1
nop dword [eax]
push ebp
sub esp, 0x10
add ebp, 0xc
mov dword [ebp - 0x1c], esp
push 2
call fcn.0048fb9f
add esp, 4
push eax
push 1
push 0x32
push str.terminate_handler_unexpectedly_threw_an_exception_n
call fcn.004a2fd0
add esp, 0x10
call fcn.0049f050
int3
Function at 0x4ba4f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
lea esi, [ebp - 0x18]
mov dword [esi - 4], esp
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x438800
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
call fcn.0049d66a
mov dword [esi + 8], 1
call eax
push 2
call fcn.0048fb9f
add esp, 4
push eax
push 1
push 0x28
push str.terminate_handler_unexpectedly_returned_n
call fcn.004a2fd0
add esp, 0x10
call fcn.0049f050
nop dword [eax + eax]
push ebp
sub esp, 0x10
add ebp, 0xc
call fcn.0048cbd1
nop dword [eax]
push ebp
sub esp, 0x10
add ebp, 0xc
mov dword [ebp - 0x1c], esp
push 2
call fcn.0048fb9f
add esp, 4
push eax
push 1
push 0x32
push str.terminate_handler_unexpectedly_threw_an_exception_n
call fcn.004a2fd0
add esp, 0x10
call fcn.0049f050
int3

Function at 0x4bb030
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x521014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
xor eax, eax
dec eax
mov dword [ecx - 4], eax
mov dword [ecx - 8], eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov ebx, eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.004a2fd0
add esp, 0x10
cmp eax, esi
jne 0x4bb0b3
cmp ebx, 1
je 0x4bb055
cmp ebx, 2
mov esi, 0xffffffff
je 0x4bb0b6
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.004a2066
add esp, 4
neg eax
sbb esi, esi
jmp 0x4bb0b6
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b980
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4bb0d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x4bb0f9
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.004a2fd0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
test esi, esi
jle 0x4bb121
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, byte [eax + edi]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x4bb123
inc edi
cmp esi, edi
mov eax, ebx
jne 0x4bb102
mov edi, esi
jmp 0x4bb123
xor edi, edi
mov eax, edi
add esp, 4
jmp 0x4bb0f2