joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c7480
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [esp + 0x40]
test edx, edx
je 0x4c76a4
mov eax, dword [esp + 0x40]
movsx edx, byte [eax]
lea ecx, [eax + 1]
mov eax, 0x1505
test dl, dl
je 0x4c74c4
mov ebx, eax
add ecx, 1
shl ebx, 5
add edx, ebx
add eax, edx
movsx edx, byte [ecx - 1]
test dl, dl
jne 0x4c74a6
test eax, eax
mov edx, 1
cmove eax, edx
mov ecx, dword [0x5b25c4]
xor edx, edx
div ecx
test edx, edx
mov edi, edx
je 0x4c7615
lea edx, [edx*8]
add edx, dword [0x5b25cc]
mov eax, dword [edx]
test eax, eax
je 0x4c762f
cmp edi, eax
mov ebx, dword [edx + 4]
jne 0x4c751c
test ebx, ebx
mov eax, str._NULL_
cmovne eax, ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov edx, eax
mov eax, edi
test edx, edx
je 0x4c760d
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], ebx
mov ebx, edi
mov dword [esp + 0xc], str.hash_collision___s_vs__s_
mov dword [esp + 8], str.htab_hash
mov dword [esp + 0x10], eax
mov dword [esp + 4], 4
mov dword [esp], 0
call fcn.004b6600
mov eax, dword [0x5b25c4]
xor edx, edx
mov ebp, eax
lea ecx, [eax - 2]
mov dword [esp + 0x1c], eax
mov eax, edi
div ecx
lea esi, [edx + 1]
mov edx, dword [0x5b25cc]
sub ebp, esi
lea esi, [esi]
mov ecx, ebx
lea eax, [ebx + ebp]
sub ecx, esi
cmp ebx, esi
cmova eax, ecx
cmp eax, edi
mov ebx, eax
je 0x4c7593
lea ecx, [edx + eax*8]
mov eax, dword [ecx]
cmp eax, edi
je 0x4c7670
test eax, eax
jne 0x4c7570
mov ecx, dword [esp + 0x1c]
cmp dword [0x5b25c0], ecx
jae 0x4c763d
mov dword [esp], 0x5b25c8
lea esi, [ebx*8]
call fcn.004bd720
mov ebp, dword [0x5b25cc]
add ebp, esi
mov eax, dword [ebp + 4]
test eax, eax
je 0x4c75d4
mov dword [esp], eax
call fcn.004ebfd0
mov dword [ebp + 4], 0
mov eax, dword [esp + 0x40]
mov dword [ebp], edi
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__strdup]
mov dword [ebp + 4], eax
mov eax, dword [0x5b25cc]
mov eax, dword [eax + esi + 4]
test eax, eax
je 0x4c76ae
mov dword [esp], 0x5b25c8
add dword [0x5b25c0], 1
call fcn.004bd760
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 8
mov edi, 1
add edx, dword [0x5b25cc]
mov eax, dword [edx]
test eax, eax
jne 0x4c74ef
cmp dword [0x5b25c0], ecx
mov ebx, edi
jb 0x4c75a3
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.hash_table_is_full___d_entries_
mov dword [esp + 8], str.htab_hash
mov dword [esp + 4], 1
mov dword [esp], 0
call fcn.004b6600
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ecx + 4]
mov ecx, str._NULL_
mov dword [esp + 0x18], edx
test eax, eax
cmove eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov edx, dword [esp + 0x18]
test eax, eax
jne 0x4c7570
mov eax, ebx
jmp 0x4c760d
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], str.could_not_duplicate_string_for_hash_table
mov dword [esp + 8], str.htab_hash
mov dword [esp + 4], 1
mov dword [esp], 0
call fcn.004b6600
mov dword [esp], 0x5b25c8
call fcn.004bd760
xor eax, eax
jmp 0x4c760d
Function at 0x4c76f0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x5b25e4]
test eax, eax
je 0x4c7793
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5b25e0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x402
mov dword [esp], eax
call dword [0x5b25d0]
sub esp, 0x10
test eax, eax
jne 0x4c7795
mov dword [esp + 0xc], str.could_not_wait_for_timer_thread_to_quit
mov dword [esp + 8], str.windows_destroy_clock
mov dword [esp + 4], 4
mov dword [esp], 0
call fcn.004b6600
mov eax, dword [0x5b25e4]
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
sub esp, 8
mov eax, dword [0x5b25e4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5b25e4], 0
mov dword [0x5b25e0], 0
sub esp, 4
leave
repz ret
mov eax, dword [0x5b25e4]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
jne 0x4c7730
jmp 0x4c776d
Function at 0x4cba4f
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
jne 0x4cba62
jmp 0x4cbb96
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004cb280
cmp eax, 1
jne 0x4cbb8e
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea edx, [ebp - 0x4f]
mov ebx, 0x43
mov eax, 0
mov ecx, edx
and ecx, 1
test ecx, ecx
je 0x4cbada
mov byte [edx], al
add edx, 1
sub ebx, 1
mov ecx, edx
and ecx, 2
test ecx, ecx
je 0x4cbaec
mov word [edx], ax
add edx, 2
sub ebx, 2
mov ecx, ebx
shr ecx, 2
mov edi, edx
rep stosd dword es:[edi], eax
mov edx, edi
mov ecx, ebx
and ecx, 2
test ecx, ecx
je 0x4cbb06
mov word [edx], ax
add edx, 2
and ebx, 1
mov ecx, ebx
test ecx, ecx
je 0x4cbb14
mov byte [edx], al
add edx, 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x4cbb44
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x4cbb5b
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x4cbb40
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x4cbb79
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.msvcrt.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x4ccb08
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x4cc97d
mov dword [esp], 0x5b2618
call fcn.004cc0e3
mov eax, dword [0x55672c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4ccb4f
mov eax, dword [ebp - 0x20]
jmp 0x4ccc9a
call fcn.004cb958
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x4ccb66
cmp dword [ebp - 0x20], 0
jne 0x4ccb70
mov eax, 0
jmp 0x4ccc9a
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004cba4f
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x4ccc42
call sub.msvcrt.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x55672c]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x4ccc97
call sub.msvcrt.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4ccd5e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.004ccb08
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.004cc9a0
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x4ccdb7
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_longjmp
mov eax, dword [0x55672c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4ccee1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x4cce49
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4cce06
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004cb874
mov dword [ebp - 0x10], 0
mov eax, dword [0x55672c]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x4ccee1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4cce79
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x4ccee1
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004cb874
mov dword [ebp - 0x10], 0
mov eax, dword [0x55672c]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__endthreadex]
call eax
Function at 0x4d63a0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.004d6400

Function at 0x4d6400
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x5b29c0]
test eax, eax
jle 0x4d6503
mov edx, dword [0x5b29c4]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x4d6431
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x4d64a6
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x4d6420
mov dword [esp], esi
call fcn.004d6ce0
test eax, eax
mov edi, eax
je 0x4d652a
lea esi, [ebx + ebx*2]
mov ebx, dword [0x5b29c4]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.004d6dd0
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x5b29c4]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4d650a
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x4d64b0
add dword [0x5b29c0], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x4d649f
cmp eax, 0x80
je 0x4d649f
cmp eax, 8
je 0x4d649f
mov eax, dword [ebp - 0x28]
add esi, dword [0x5b29c4]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4d649f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004d63a0
xor ebx, ebx
jmp 0x4d643b
mov eax, dword [0x5b29c4]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004d63a0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004d63a0
lea esi, [esi]

Function at 0x4d6c00
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4d6c38
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x4d6c2e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x4d6c3a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4d6c20
xor eax, eax
pop ebx
pop esi
ret

Function at 0x4d8d90
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
jmp fcn.004d8790
Function at 0x4dd4c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x22c
mov ebx, dword [ebp + 8]
call sub.msvcrt.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x4dd653
cmp word [ebx], 0
je 0x4dd620
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x4dd635
test al, 0x10
je 0x4dd620
lea esi, [ebp - 0x220]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], esi
call sub.msvcrt.dll__wfullpath
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
mov dword [esp], 0x590780
mov edi, eax
call sub.msvcrt.dll_wcslen
mov dword [esp], 0x590784
mov ebx, eax
call sub.msvcrt.dll_wcslen
lea edx, [edi + ebx + 0x21d]
add eax, edx
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
je 0x4dd644
lea edi, [eax + 0x434]
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_wcscpy
cmp word [ebx + 0x434], 0
jne 0x4dd5e0
mov dword [esp], edi
mov dword [esp + 4], 0x590784
call sub.msvcrt.dll_wcscat
xor edx, edx
xor eax, eax
mov word [ebx + 0x222], dx
lea edx, [ebx + 0x224]
mov ecx, 0x82
mov word [ebx + 0x220], ax
mov edi, edx
xor eax, eax
mov dword [ebx + 0x42c], 0xffffffff
mov dword [ebx + 0x430], 0
mov dword [ebx + 0x21c], 0
rep stosd dword es:[edi], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call sub.msvcrt.dll_wcslen
cmp word [ebx + eax*2 + 0x432], 0x2f
je 0x4dd580
mov dword [esp], edi
call sub.msvcrt.dll_wcslen
cmp word [ebx + eax*2 + 0x432], 0x5c
je 0x4dd580
mov dword [esp + 4], 0x590780
mov dword [esp], edi
call sub.msvcrt.dll_wcscat
jmp 0x4dd580
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x4dd5d3
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x4dd5d3
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x4dd5d3
Function at 0x4e5100
Capabilities:
Query environment variable

Disassembly:
push ebp
sub ecx, 1
push edi
mov ebp, edx
push esi
mov esi, 1
push ebx
mov ebx, 0x66666667
sub esp, 0x2c
mov dword [esp + 0x1c], eax
mov eax, ecx
mov edi, dword [esp + 0x40]
sar eax, 0x1f
mov dword [esp + 0x14], eax
mov eax, ecx
imul ebx
mov dword [esp + 0x10], ecx
sar ecx, 0x1f
sar edx, 2
mov ebx, edx
sub ebx, ecx
je 0x4e5153
mov ecx, 0x66666667
mov eax, ebx
add esi, 1
imul ecx
sar ebx, 0x1f
sar edx, 2
sub edx, ebx
mov ebx, edx
jne 0x4e5140
mov eax, dword [edi + 0x28]
cmp eax, 0xffffffff
je 0x4e51c8
mov edx, dword [edi + 8]
cmp eax, esi
cmovge esi, eax
lea eax, [esi + 2]
cmp edx, eax
jg 0x4e51c1
mov dword [edi + 8], 0xffffffff
mov eax, dword [esp + 0x1c]
mov ecx, 1
mov edx, ebp
mov dword [esp], edi
add esi, 1
call fcn.004e4a70
mov eax, dword [edi + 0x28]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 4]
mov edx, eax
and eax, 0x20
or edx, 0x1c0
or eax, 0x45
mov dword [edi + 4], edx
mov edx, edi
call fcn.004e46c0
mov eax, dword [esp + 0x10]
mov ecx, edi
add dword [edi + 8], esi
mov edx, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004e4e40
sub edx, eax
mov dword [edi + 8], edx
jmp 0x4e5171
mov edx, dword [0x5567bc]
cmp edx, 0xffffffff
je 0x4e51f1
test edx, edx
mov eax, 2
jne 0x4e51e9
call fcn.004ec1c0
and eax, 1
neg eax
add eax, 3
mov dword [edi + 0x28], eax
jmp 0x4e515b
mov dword [esp], 0x590ca3
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4e5217
movsx eax, byte [eax]
xor edx, edx
sub eax, 0x30
cmp eax, 2
setbe dl
mov dword [0x5567bc], edx
jmp 0x4e51d3
xor edx, edx
jmp 0x4e520f
Function at 0x4e7340
Capabilities:
Query environment variable

Disassembly:
push ebp
sub ecx, 1
push edi
mov ebp, edx
push esi
mov esi, 1
push ebx
mov ebx, 0x66666667
sub esp, 0x2c
mov dword [esp + 0x1c], eax
mov eax, ecx
mov edi, dword [esp + 0x40]
sar eax, 0x1f
mov dword [esp + 0x14], eax
mov eax, ecx
imul ebx
mov dword [esp + 0x10], ecx
sar ecx, 0x1f
sar edx, 2
mov ebx, edx
sub ebx, ecx
je 0x4e7393
mov ecx, 0x66666667
mov eax, ebx
add esi, 1
imul ecx
sar ebx, 0x1f
sar edx, 2
sub edx, ebx
mov ebx, edx
jne 0x4e7380
mov eax, dword [edi + 0x28]
cmp eax, 0xffffffff
je 0x4e7408
mov edx, dword [edi + 8]
cmp eax, esi
cmovge esi, eax
lea eax, [esi + 2]
cmp edx, eax
jg 0x4e7401
mov dword [edi + 8], 0xffffffff
mov eax, dword [esp + 0x1c]
mov ecx, 1
mov edx, ebp
mov dword [esp], edi
add esi, 1
call fcn.004e6b60
mov eax, dword [edi + 0x28]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 4]
mov edx, eax
and eax, 0x20
or edx, 0x1c0
or eax, 0x45
mov dword [edi + 4], edx
mov edx, edi
call fcn.004e6720
mov eax, dword [esp + 0x10]
mov ecx, edi
add dword [edi + 8], esi
mov edx, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004e7080
sub edx, eax
mov dword [edi + 8], edx
jmp 0x4e73b1
mov edx, dword [0x5567d8]
cmp edx, 0xffffffff
je 0x4e7431
test edx, edx
mov eax, 2
jne 0x4e7429
call fcn.004ec1c0
and eax, 1
neg eax
add eax, 3
mov dword [edi + 0x28], eax
jmp 0x4e739b
mov dword [esp], str.PRINTF_EXPONENT_DIGITS
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4e7457
movsx eax, byte [eax]
xor edx, edx
sub eax, 0x30
cmp eax, 2
setbe dl
mov dword [0x5567d8], edx
jmp 0x4e7413
xor edx, edx
jmp 0x4e744f

Function at 0x522720
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ecx, edi
call fcn.005225a0
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebp, eax
je 0x522760
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x522731
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x548e00
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push edi
push esi
push ebx
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
xor eax, edi
cmp edi, 3
jbe 0x548e8f
lea ecx, [edi - 4]
shr ecx, 2
lea esi, [edx + ecx*4 + 4]
imul ebx, dword [edx], 0x5bd1e995
add edx, 4
mov ecx, ebx
shr ecx, 0x18
xor ecx, ebx
imul ebx, eax, 0x5bd1e995
imul eax, ecx, 0x5bd1e995
xor eax, ebx
cmp edx, esi
jne 0x548e20
and edi, 3
cmp edi, 2
je 0x548e79
cmp edi, 3
je 0x548e70
cmp edi, 1
je 0x548e82
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0x5bd1e995
pop ebx
pop esi
pop edi
mov eax, edx
shr eax, 0xf
xor eax, edx
ret
movzx edx, byte [esi + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [esi + 1]
shl edx, 8
xor eax, edx
movzx edx, byte [esi]
xor edx, eax
imul eax, edx, 0x5bd1e995
jmp 0x548e54
mov esi, edx
jmp 0x548e45