joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45af12
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [0x5a8564]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 6
push str.Chrome
call fcn.0042963a
mov ecx, edi
push 0xd
push str.0.0.0.0_devel
call fcn.0042963a
cmp byte [esi + 0xb], 0
js 0x45af5c
mov word [esi], 0
mov byte [esi + 0xb], 0
jmp 0x45af6a
mov eax, dword [esi]
mov word [eax], 0
mov dword [esi + 4], 0
mov dword [ebp - 0x14], 0
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x45af7b
mov eax, dword [ebx]
lea ecx, [ebp - 0x14]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x45b0cb
mov esi, eax
push eax
call fcn.005327e3
add esp, 4
mov edi, eax
mov eax, dword [ebp - 0x14]
cmp byte [ebx + 0xb], 0
jns 0x45afa5
mov ebx, dword [ebx]
push edi
push esi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x45b0be
lea esi, [ebp - 0x20]
mov ecx, esi
push 0x569a1e
call fcn.00401ce0
mov ecx, edi
mov edx, esi
push dword [ebp + 0x10]
call fcn.0045b10d
add esp, 4
cmp byte [esi + 0xb], 0
jns 0x45afe5
push dword [ebp - 0x20]
call fcn.005327b0
add esp, 4
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
lea ebx, [ebp - 0x2c]
mov ecx, ebx
push 0x569a3c
call fcn.00401ce0
mov ecx, edi
mov edx, ebx
push esi
call fcn.0045b10d
add esp, 4
cmp byte [ebx + 0xb], 0
jns 0x45b01d
push dword [ebp - 0x2c]
call fcn.005327b0
add esp, 4
movzx eax, byte [ebp - 0x15]
test al, al
cmovs eax, dword [ebp - 0x1c]
cmovs esi, dword [ebp - 0x20]
mov ecx, ebx
push eax
push esi
call fcn.00401c90
cmp dword [ebx + 4], 1
jne 0x45b043
mov eax, dword [ebp - 0x2c]
cmp word [eax], 0x31
je 0x45b052
mov ecx, dword [ebp + 0x10]
push 6
push str._devel
call fcn.00429860
lea esi, [ebp - 0x2c]
mov ecx, esi
push 0x569a68
call fcn.00401ce0
mov ecx, edi
mov edx, esi
push dword [ebp + 0xc]
call fcn.0045b10d
add esp, 4
cmp byte [esi + 0xb], 0
jns 0x45b081
push dword [ebp - 0x2c]
call fcn.005327b0
add esp, 4
mov ecx, esi
push str.SpecialBuild
call fcn.00401ce0
mov ecx, edi
mov edx, esi
push dword [ebp + 0x14]
call fcn.0045b10d
add esp, 4
cmp byte [esi + 0xb], 0
jns 0x45b0ad
push dword [ebp - 0x2c]
call fcn.005327b0
add esp, 4
cmp byte [ebp - 0x15], 0
jns 0x45b0be
push dword [ebp - 0x20]
call fcn.005327b0
add esp, 4
test edi, edi
je 0x45b0cb
push edi
call fcn.005327ec
add esp, 4
lea eax, [ebp - 0x20]
push 1
push eax
call fcn.0045b268
add esp, 8
mov esi, dword [ebp + 0x18]
cmp byte [esi + 0xb], 0
jns 0x45b0ec
push dword [esi]
call fcn.005327b0
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esi + 8], eax
movsd xmm0, qword [ebp - 0x20]
movsd qword [esi], xmm0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005327f1
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45b10d
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x22c
mov edi, edx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x5a8564]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
js 0x45b13b
mov word [ecx], 0
mov byte [ecx + 0xb], 0
jmp 0x45b149
mov eax, dword [ecx]
mov word [eax], 0
mov dword [ecx + 4], 0
test ebx, ebx
je 0x45b253
xor ecx, ecx
lea esi, [ebp - 0x228]
mov dword [esi], ecx
lea eax, [ebp - 0x20]
mov dword [eax], ecx
push eax
push esi
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45b253
mov dword [ebp - 0x238], ebx
mov eax, dword [ebp - 0x228]
movzx ecx, word [eax]
mov word [ebp - 0x232], cx
movzx ebx, word [eax + 2]
mov word [ebp - 0x20], cx
mov word [ebp - 0x1e], bx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], bx
movzx eax, word [ebp - 0x232]
mov word [ebp - 0x18], ax
mov bx, 0x4e4
mov word [ebp - 0x16], bx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], bx
mov ebx, 0xfffffffe
push 0x208
push 0xff
push esi
call fcn.00536680
add esp, 0xc
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x45b1e8
mov eax, dword [edi]
movzx ecx, word [ebp + ebx*2 - 0x1c]
movzx edx, word [ebp + ebx*2 - 0x1a]
push eax
push edx
push ecx
push str.StringFileInfo_04hx_04hx_ls
mov eax, 0x104
push eax
push eax
push esi
call fcn.0043ca00
add esp, 0x1c
xor eax, eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x22c]
push eax
push esi
push dword [ebp - 0x238]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45b240
mov eax, dword [ebp - 0x22c]
test eax, eax
jne 0x45b24a
add ebx, 2
cmp ebx, 5
jbe 0x45b1cb
jmp 0x45b253
mov ecx, dword [ebp + 8]
push eax
call fcn.0045b2ac
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005327f1
add esp, 0x22c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45dc10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [ecx + 0x1174]
mov ebx, dword [ecx + 0x1178]
add ebx, eax
mov eax, dword [ecx + 0x116c]
mov ecx, ebx
sub ecx, eax
cmp ecx, 0x40000001
jb 0x45dc46
push dword [ebp + 8]
call fcn.004933a0
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [esp + 0xc]
test eax, eax
mov ecx, 0x40000000
mov edi, 0xaf000000
cmove edi, ecx
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x54], 0x365f776f
mov dword [esp + 0x50], 0x775f7369
lea eax, [esp + 0x50]
push eax
call fcn.00403610
add esp, 4
cmp ebx, edi
jbe 0x45dca6
push ebx
call fcn.004933d0
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x44], 0x657a69
mov dword [esp + 0x40], 0x735f6176
lea eax, [esp + 0x40]
push eax
call fcn.00403610
add esp, 4
mov eax, dword [esi + 0x117c]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x34], 0x20200063
mov dword [esp + 0x30], 0x6f6c6c61
lea eax, [esp + 0x30]
push eax
call fcn.00403610
add esp, 4
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov eax, dword [esi + 0x116c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0x20007469
mov dword [esp + 0x10], 0x6d6d6f63
lea eax, [esp + 0x10]
push eax
call fcn.00403610
add esp, 4
mov esi, dword [ebp + 8]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0x20202000
mov dword [esp + 0x20], 0x657a6973
lea eax, [esp + 0x20]
push eax
call fcn.00403610
add esp, 4
mov ecx, dword [0x5b7db0]
test ecx, ecx
je 0x45dd79
call dword [section..00cfg]
push esi
call ecx
add esp, 4
push esi
call fcn.00460b90
int3
Function at 0x464b20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
je 0x464b2f
pop ebp
jmp fcn.00464600
cmp dword [ebp + 0x10], 0
jne 0x464b3a
call fcn.00495d00
xor eax, eax
pop ebp
ret

Function at 0x464fc0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00464c00
Function at 0x46b6d6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x46b7f3
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx + 0x74], 0
je 0x46b7f3
cmp word [eax + edx + 0x14], 0x68
jb 0x46b7f3
mov eax, dword [eax + edx + 0x78]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
mov esi, ecx
mov edi, dword [eax + 4]
mov ecx, edi
call dword [section..00cfg]
mov dword [ebp - 0x14], esi
mov ecx, esi
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x46b7f3
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
cmp ecx, 0xffff
jbe 0x46b835
mov ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp - 0x14]
mov esi, eax
mov eax, dword [edi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
push dword [ebp - 0x10]
call ebx
mov ecx, eax
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x18]
test eax, eax
je 0x46b7f3
lea edi, [ecx + eax*4]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov edx, ecx
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x2c], edi
sub edi, edx
mov eax, edi
sar eax, 2
shr edi, 0x1f
add edi, eax
and edi, 0xfffffffe
mov dword [ebp - 0x18], edx
mov eax, dword [edx + edi*2]
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push dword [ebp - 0x10]
call ebx
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x46b7c9
mov edx, dword [ebp - 0x28]
cmp cl, byte [eax]
jne 0x46b7cb
inc eax
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x46b7bd
xor ecx, ecx
mov edx, dword [ebp - 0x18]
lea edi, [edx + edi*2]
movzx eax, byte [eax]
cmp cl, al
je 0x46b7ff
movzx ecx, cl
cmp ecx, eax
lea eax, [edi + 4]
cmovg edx, eax
mov eax, dword [ebp - 0x2c]
cmovs eax, edi
mov edi, eax
xor eax, eax
cmp edx, edi
jne 0x46b782
jmp 0x46b7f5
xor eax, eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x14]
mov eax, dword [esi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push dword [ebp - 0x10]
call ebx
sub edi, dword [ebp - 0x24]
sar edi, 1
movzx eax, word [eax + edi]
mov ecx, dword [ebp - 0x1c]
add ax, word [ecx + 0x10]
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x20]
mov word [ebx], ax
mov al, 1
jmp 0x46b7f5
Function at 0x473940
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, ecx
mov eax, dword [0x5a8564]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov edi, esp
push 0x1b
push str....._base_filesmemory_mapped_file_win.cc
push str.MapImageToMemory
push edi
call fcn.00451690
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push edi
call fcn.00440b40
mov ecx, esi
call fcn.0043a420
test al, al
je 0x473a27
mov ecx, esi
call fcn.0043a430
sub esp, 0x18
movdqa xmm0, xmmword [0x56edb0]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
cmp dword [esi + 0x24], eax
je 0x473a1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0x24]
inc eax
cmp eax, 2
jb 0x473a05
call fcn.004516c0
push dword [esi + 0x24]
call fcn.00433080
add esp, 4
mov dword [esi + 0x24], 0
mov eax, edi
inc eax
cmp eax, 2
jb 0x473a15
mov dword [esi + 0x24], edi
call fcn.004516c0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi + 0x24]
lea eax, [edi + 1]
cmp eax, 2
jae 0x473a49
xor ebx, ebx
lea ecx, [esp + 0x10]
call fcn.00440ba0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005327f1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
sub esp, 0x14
movdqa xmm0, xmmword [0x562a10]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov eax, dword [esi + 0x1c]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x5aca20]
bt edx, ecx
jae 0x473a87
push eax
call fcn.004050a4
add esp, 4
lea ebx, [esi + 0x1c]
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x5aca20]
bt ecx, eax
jae 0x473aab
push edi
call fcn.00404fac
add esp, 4
jmp 0x473ab7
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x5b4a20], 1
mov dword [ebx], edi
test edi, edi
je 0x473a27
mov eax, dword [ebx]
mov dword [esp], 0x5677b4
mov dword [esp + 4], eax
mov ecx, esp
call fcn.0046b4b0
mov eax, dword [eax + 0x50]
mov dword [esi + 0x20], eax
mov bl, 1
jmp 0x473a29
Function at 0x475960
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
pop ebp
ret 4
Function at 0x47ac50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov eax, dword [0x5a8564]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp + 0xc], 0
sete al
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
push 0
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], 0
test eax, eax
je 0x47acd8
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x47acb4
call fcn.004516c0
push dword [esi]
call fcn.00433080
add esp, 4
mov dword [esi], 0
lea eax, [edi + 1]
cmp eax, 2
jb 0x47acc3
mov dword [esi], edi
call fcn.004516c0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 0
inc eax
cmp eax, 1
jbe 0x47acdc
jmp 0x47ad0d
mov byte [esi + 4], 0
lea ebx, [ebp - 0x24]
push 0x20
push str....._base_synchronizationwaitable_event_win.cc
push str.WaitableEvent
push ebx
call fcn.00451690
add esp, 0x10
lea edi, [ebp - 0x14]
push ebx
push str.handle_.is_valid__
push edi
call fcn.00458b50
add esp, 0xc
mov ecx, edi
call fcn.00458cb0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005327f1
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x483da0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test bl, bl
mov dword [ebp - 0x14], ecx
lea ecx, [eax + ecx]
lea edx, [esi + ebx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
mov dword [ebp - 0x20], ebx
jb 0x483e0d
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x483de0
cmp edx, 1
jne 0x483e16
jmp 0x483e32
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x483e32
cmp edx, 2
je 0x483e29
cmp edx, 3
jne 0x483e3d
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ecx + 4]
xor ecx, ecx
test ebx, ebx
je 0x483f9e
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, ebx
shr edx, 1
and edx, 0x55555555
mov eax, ebx
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 1
ja 0x483ea6
lea edx, [ebx - 1]
and edx, edi
jmp 0x483eb2
mov edx, edi
cmp edi, ebx
jb 0x483eb2
mov eax, edi
xor edx, edx
div ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x483f9e
mov dword [ebp - 0x18], ebx
mov ebx, dword [eax]
test ebx, ebx
je 0x483f9e
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x14]
cmovns eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x483f05
and eax, dword [ebp - 0x1c]
cmp eax, edx
jne 0x483f9c
mov ebx, dword [ebx]
test ebx, ebx
je 0x483f9c
mov eax, dword [ebx + 4]
cmp edi, eax
jne 0x483f60
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x483f19
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x14]
jne 0x483efb
lea ecx, [ebx + 8]
test al, al
jns 0x483f27
mov ecx, dword [ecx]
js 0x483f7e
cmp dword [ebp - 0x14], 0
je 0x483f98
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [ebx + ecx + 8]
cmp dl, byte [esi + ecx]
jne 0x483efb
inc ecx
cmp eax, ecx
jne 0x483f40
jmp 0x483f98
cmp dword [ebp - 0x24], 1
mov edx, dword [ebp - 0x10]
jbe 0x483ef0
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x483ef3
xor edx, edx
div ecx
mov eax, edx
mov edx, dword [ebp - 0x10]
jmp 0x483ef3
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x483f98
push eax
push esi
push ecx
call fcn.00534a7d
add esp, 0xc
test eax, eax
jne 0x483efb
mov ecx, ebx
jmp 0x483f9e
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x485d70
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test bl, bl
mov dword [ebp - 0x14], ecx
lea ecx, [eax + ecx]
lea edx, [esi + ebx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
mov dword [ebp - 0x20], ebx
jb 0x485ddd
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x485db0
cmp edx, 1
jne 0x485de6
jmp 0x485e02
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x485e02
cmp edx, 2
je 0x485df9
cmp edx, 3
jne 0x485e0d
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ecx + 4]
xor ecx, ecx
test ebx, ebx
je 0x485f6e
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, ebx
shr edx, 1
and edx, 0x55555555
mov eax, ebx
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 1
ja 0x485e76
lea edx, [ebx - 1]
and edx, edi
jmp 0x485e82
mov edx, edi
cmp edi, ebx
jb 0x485e82
mov eax, edi
xor edx, edx
div ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x485f6e
mov dword [ebp - 0x18], ebx
mov ebx, dword [eax]
test ebx, ebx
je 0x485f6e
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x14]
cmovns eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x485ed5
and eax, dword [ebp - 0x1c]
cmp eax, edx
jne 0x485f6c
mov ebx, dword [ebx]
test ebx, ebx
je 0x485f6c
mov eax, dword [ebx + 4]
cmp eax, edi
jne 0x485f30
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x485ee9
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x14]
jne 0x485ecb
lea ecx, [ebx + 8]
test al, al
jns 0x485ef7
mov ecx, dword [ecx]
js 0x485f4e
cmp dword [ebp - 0x14], 0
je 0x485f68
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [ebx + ecx + 8]
cmp dl, byte [esi + ecx]
jne 0x485ecb
inc ecx
cmp eax, ecx
jne 0x485f10
jmp 0x485f68
cmp dword [ebp - 0x24], 1
mov edx, dword [ebp - 0x10]
jbe 0x485ec0
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x485ec3
xor edx, edx
div ecx
mov eax, edx
mov edx, dword [ebp - 0x10]
jmp 0x485ec3
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x485f68
push eax
push esi
push ecx
call fcn.00534a7d
add esp, 0xc
test eax, eax
jne 0x485ecb
mov ecx, ebx
jmp 0x485f6e
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x48bfe0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x48c059
mov ecx, dword [ebp + 0xc]
cmp ebx, 1
jne 0x48bffc
xor esi, esi
jmp 0x48c03e
and ebx, 0xfffffffe
xor esi, esi
nop word cs:[eax + eax]
movzx edi, al
movzx edx, byte [ecx + esi]
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x570174]
movzx edx, al
movzx edi, byte [ecx + esi + 1]
xor edi, edx
shr eax, 8
xor eax, dword [edi*4 + 0x570174]
add esi, 2
cmp ebx, esi
jne 0x48c010
mov edx, dword [ebp + 0x10]
test dl, 1
je 0x48c059
movzx edx, al
movzx ecx, byte [ecx + esi]
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x570174]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x492740
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x5b7d7c
pop ebp
jmp fcn.00404ea0

Function at 0x4927d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x4927e1
test eax, eax
jne 0x492831
test eax, eax
jne 0x4927f7
mov ecx, dword [0x5b7d90]
test ecx, ecx
je 0x4927f7
call dword [section..00cfg]
call ecx
cmp dword [0x5b7d88], 0
je 0x492831
mov esi, dword [0x5b7d8c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x492837
test esi, esi
je 0x492831
mov ecx, dword [0x5b7d88]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
pop esi
pop edi
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x49281f
jmp 0x492831
Function at 0x493800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x5a8564]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x49387c
mov eax, dword [ebp + 8]
cmp dword [0x5b7db4], eax
jg 0x49387c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
mov dword [ebp - 0x1c], esi
add esi, ebx
nop dword [eax]
cmp ebx, esi
jae 0x49386b
mov dword [ebp - 0x18], 0
mov eax, esi
sub eax, ebx
push 0
lea ecx, [ebp - 0x18]
push ecx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49386b
mov eax, dword [ebp - 0x18]
add ebx, eax
test eax, eax
jne 0x493840
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
mov eax, dword [ebp + 0xc]
je 0x49387c
cmp byte [ecx + eax - 1], 0xa
jne 0x493894
cmp dword [ebp + 8], 3
je 0x4938e1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005327f1
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 0x560b27
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
lea ebx, [ebp - 0x14]
nop word cs:[eax + eax]
cmp edi, 0x560b28
jae 0x49387c
mov dword [ebp - 0x14], 0
mov eax, 0x560b28
sub eax, edi
push 0
push ebx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49387c
mov eax, dword [ebp - 0x14]
add edi, eax
test eax, eax
jne 0x4938b0
jmp 0x49387c
int3