joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450ed0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x450fa9
cmp dword [esi], 0
jne 0x450fa9
cmp dword [esi + 0xc], 0
jne 0x450fa9
xor eax, eax
cmp dword [esi + 4], 0
jne 0x450fa9
mov ebx, dword [edi]
cmp eax, ebx
je 0x450f33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x450f79
lea eax, [ebx + 1]
cmp eax, 2
jb 0x450f29
mov dword [esi], ebx
call fcn.0046e410
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x450f66
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x450f90
lea eax, [ebx + 1]
cmp eax, 2
jb 0x450f5c
mov dword [esi + 4], ebx
call fcn.0046e410
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0046e410
push dword [esi]
call fcn.00470b40
add esp, 4
mov dword [esi], 0
jmp 0x450f1a
call fcn.0046e410
push dword [esi + 4]
call fcn.00470b40
add esp, 4
mov dword [esi + 4], 0
jmp 0x450f4c
mov ecx, esi
call fcn.004df4e0
mov eax, dword [esi]
jmp 0x450f04
Function at 0x45a4b0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x45a5a4
mov byte [ebp - 0x11], 0xff
lea edi, [ecx + 0x6d0]
lea esi, [ecx + 8]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x18], 0
mov eax, dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
push esi
call eax
test al, al
jne 0x45a524
jmp 0x45a592
pause
dec eax
jne 0x45a4f6
mov ecx, dword [ebp - 0x18]
add ecx, ebx
add ebx, ebx
cmp ebx, 0x40
mov eax, 0x40
cmovge ebx, eax
mov dword [ebp - 0x18], ecx
cmp ecx, 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
jl 0x45a4ea
mov ecx, esi
call fcn.0045a6c0
mov eax, dword [edi]
mov ebx, dword [eax]
test ebx, ebx
je 0x45a579
mov byte [ebp - 0x11], 0
mov ecx, dword [ebx]
test ecx, ecx
je 0x45a53f
mov edx, ecx
not edx
cmp dword [ebx + 4], edx
jne 0x45a5a7
bswap ecx
mov dword [eax], ecx
inc word [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, ebx
push dword [ebp + 8]
call fcn.0047e2a0
push ebx
push dword [0x526fd0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048a678
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x11]
mov ecx, edi
push eax
push 0x380
push 2
push dword [ebp + 8]
call fcn.00466690
mov ebx, eax
jmp 0x45a547
mov eax, ebx
test ebx, ebx
jg 0x45a4f6
mov ecx, dword [ebp - 0x18]
jmp 0x45a500
int3
call fcn.004b42d0
int3

Function at 0x45a700
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x520014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x45a730
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048a678
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x45a7f0
push 0
push eax
push 0x45a6f0
push 0x528260
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x45a7e6
cmp dword [0x528264], 0
jne 0x45a71c
push dword [0x528268]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45a71c
mov esi, eax
mov eax, 0x52826c
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov ebx, dword [0x528270]
mov edi, dword [0x528274]
mov eax, dword [0x528278]
mov dword [ebp - 0x18], eax
mov eax, dword [0x52827c]
mov dword [ebp - 0x1c], eax
mov eax, 0x52826c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test ebx, ebx
je 0x45a7ae
push dword [esi]
call ebx
add esp, 4
test edi, edi
je 0x45a7ba
push dword [esi + 4]
call edi
add esp, 4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x45a7c9
push dword [esi + 8]
call eax
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x45a7d8
push dword [esi + 0xc]
call eax
add esp, 4
push esi
call fcn.0047ec80
add esp, 4
jmp 0x45a71c
call fcn.0049d800
int3
Function at 0x460c60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x460c77
test eax, eax
je 0x460c77
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
jne 0x460c84
mov eax, dword [0x528348]
test eax, eax
jne 0x460cb8
cmp dword [0x528340], 0
je 0x460c71
mov esi, dword [0x528344]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x460cbc
test esi, esi
je 0x460c71
push esi
call dword [0x528340]
add esp, 4
jmp 0x460c71
call eax
jmp 0x460c84
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x460ca8
Function at 0x469e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm4
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x469f6e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movdqa xmm6, xmm0
movdqa xmm4, xmmword [0x506f60]
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x506f70]
pclmulqdq xmm0, xmm5, 0x11
movdqa xmm7, xmm0
pxor xmm7, xmm6
movdqa xmm0, xmm3
movdqa xmm4, xmmword [0x506f60]
pclmulqdq xmm0, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
movdqa xmm6, xmm3
pxor xmm6, xmm0
movdqa xmm0, xmm2
pclmulqdq xmm0, xmm4, 0
movdqa xmm3, xmm4
pclmulqdq xmm2, xmm5, 0x11
movdqa xmm4, xmm2
pxor xmm4, xmm0
movdqa xmm0, xmm1
pclmulqdq xmm0, xmm3, 0
pclmulqdq xmm1, xmm5, 0x11
movdqa xmm5, xmm1
pxor xmm5, xmm0
movdqu xmm0, xmmword [ecx]
pxor xmm0, xmm7
movdqu xmm3, xmmword [ecx + 0x10]
pxor xmm3, xmm6
movdqu xmm2, xmmword [ecx + 0x20]
pxor xmm2, xmm4
movdqu xmm1, xmmword [ecx + 0x30]
pxor xmm1, xmm5
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x469ec0
movdqa xmm4, xmmword [0x506f80]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x506f90]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp eax, 0x10
jb 0x469ff2
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add ecx, 0x10
add eax, 0xfffffff0
cmp eax, 0xf
ja 0x469fcb
movdqa xmm1, xmmword [0x506f90]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm2, xmmword [0x506fa0], 0
pxor xmm2, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm2, 3
pclmulqdq xmm0, xmmword [0x506fb0], 0x10
pblendw xmm0, xmm1, 0xfc
pclmulqdq xmm0, xmmword [0x506fc0], 0
pxor xmm0, xmm2
pextrd eax, xmm0, 1
pop ebp
ret
Function at 0x46d4a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x46d4d7
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jae 0x46d4de
lea eax, [ebx + 1]
cmp eax, 2
jb 0x46d4d0
mov dword [esi], ebx
call fcn.0046e410
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0046e410
push dword [esi]
call fcn.00470b40
add esp, 4
mov dword [esi], 0
jmp 0x46d4c1
Function at 0x470090
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.0048a990
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x521ba8]
cmp eax, 0xffffffff
je 0x4700c2
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
jne 0x4700d7
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048a678
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, 0xfffffffc
mov esi, 0x800
lea edi, [ebp - 0x810]
push esi
push 0xff
push edi
call fcn.0048d770
add esp, 0xc
push esi
push ebx
push edi
call fcn.0048cc70
add esp, 0xc
mov ecx, dword [0x521ba8]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.0044eb30
add esp, 8
test ebx, ebx
je 0x470128
push ebx
call fcn.004899bc
add esp, 4
mov eax, dword [0x5259b4]
mov ecx, dword [0x5231ac]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4701f8
mov esi, dword [0x5259b0]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x47023d
lea eax, [ebp - 0x1410]
push 0xc00
push 0x524db0
push eax
call fcn.0048cc70
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ebx, 0x100
test al, 1
je 0x4701e3
xor esi, esi
lea edi, [ebp - 0x1408]
xor eax, eax
mov ecx, dword [ebp + esi*8 - 0x810]
test ecx, ecx
jne 0x4701ac
inc esi
add edi, 0xc
cmp esi, 0x100
jne 0x470193
jmp 0x4701d9
cmp dword [edi - 8], 0
je 0x47019e
mov edx, dword [ebp + esi*8 - 0x80c]
cmp edx, dword [edi]
jne 0x47019e
mov edx, dword [edi - 4]
test edx, edx
je 0x47019e
mov dword [ebp + esi*8 - 0x810], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x47019e
lea ecx, [ebx - 1]
cmp ebx, 2
mov ebx, ecx
jae 0x470185
push 2
push dword [ebp - 0x1414]
call fcn.0044eb30
add esp, 8
jmp 0x4700c2
push 0x5259b4
call fcn.004899f7
add esp, 4
cmp dword [0x5259b4], 0xffffffff
jne 0x470149
push 4
call fcn.00489952
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.00470620
mov dword [0x5259b0], esi
push 0x5259b4
call fcn.00489a6d
add esp, 4
jmp 0x470149
mov ecx, esi
call fcn.00470630
jmp 0x47015e
Function at 0x470440
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 8], ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x68], eax
xor ebx, ebx
dec ebx
lea edi, [esp + 0x30]
mov dword [edi + 0x34], ebx
mov dword [edi + 0x30], ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x3e
push str..._.._base_files_file_win.cc
push str.Read
push esi
call fcn.0046e3e0
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.004735a0
cmp dword [ebp + 0x14], 0
js 0x47050b
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.00473210
test al, al
jne 0x47053d
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ebx
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push esi
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47052b
mov ebx, dword [esp + 0xc]
lea ecx, [esp + 0x28]
call fcn.00473230
lea ecx, [esp + 0x30]
call fcn.004735e0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0048a678
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x470502
lea ecx, [esp + 0x28]
push 0
push dword [ebp + 0x14]
push dword [esp + 0x10]
push str.File::Read
call fcn.004d96b0
jmp 0x4704c2

Function at 0x470560
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x47059b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4705b2
lea eax, [ebx + 1]
cmp eax, 2
jb 0x470594
mov dword [esi], ebx
call fcn.0046e410
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x4705c9
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0046e410
push dword [esi]
call fcn.00470b40
add esp, 4
mov dword [esi], 0
jmp 0x470585
int3
Function at 0x470680
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x4706fe
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4706e7
lea eax, [edi + 1]
cmp eax, 2
jb 0x4706cb
mov dword [esi], edi
call fcn.0046e410
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 1
inc eax
cmp eax, 1
jbe 0x470702
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.0046e410
push dword [esi]
call fcn.00470b40
add esp, 4
mov dword [esi], 0
jmp 0x4706bc
mov byte [esi + 4], 1
int3
Function at 0x471af0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004717d0

Function at 0x475df0
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x475e05
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, edx
cmp edx, 4
jae 0x475e46
cmp edx, 1
jne 0x475e36
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
cmp edx, 2
jne 0x475e6e
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
jmp 0x475e11
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
jbe 0x475e0c
jmp 0x475e46
cmp edx, 3
jne 0x475e1c
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
jmp 0x475e3b
Function at 0x47d9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
movzx eax, byte [ecx + 0x27]
test al, al
js 0x47da34
test eax, eax
jne 0x47da29
cmp dword [esi + 0x28], 0
jne 0x47da29
mov byte [esi + 0x2c], 0
mov eax, dword [esi + 8]
mov dword [esi + 4], eax
cmp eax, dword [esi + 0xc]
je 0x47da1c
lea edi, [esi + 0x10]
mov ebx, 0x80001b
lea ecx, [eax + 1]
mov dword [esi + 8], ecx
movsx eax, byte [eax]
mov ecx, edi
push 0
push eax
call fcn.0046c090
cmp eax, 0xffffffff
jne 0x47da11
cmp dword [esi + 0x30], 1
jne 0x47da4c
jmp 0x47da39
mov eax, dword [esi + 8]
mov dword [esi + 4], eax
cmp eax, dword [esi + 0xc]
jne 0x47d9f1
mov byte [esi + 0x2c], 1
xor ebx, ebx
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004ebac0
mov eax, dword [esi + 0x20]
jmp 0x47d9d0
mov eax, dword [esi + 4]
mov al, byte [eax]
add al, 0xf7
cmp al, 0x17
ja 0x47da4c
movzx eax, al
bt ebx, eax
jb 0x47da11
mov eax, dword [esi + 8]
mov bl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, dword [esi + 0xc]
je 0x47da22
movsx eax, byte [eax]
mov ecx, edi
push 0
push eax
call fcn.0046c090
cmp eax, 0xffffffff
jne 0x47da22
cmp dword [esi + 0x30], 1
je 0x47da88
mov eax, dword [esi + 8]
add eax, 1
mov dword [esi + 8], eax
jmp 0x47da60
mov eax, dword [esi + 8]
mov cl, byte [eax]
add cl, 0xf7
cmp cl, 0x17
ja 0x47da80
movzx ecx, cl
mov edx, 0x80001b
bt edx, ecx
jae 0x47da80
jmp 0x47da22
Function at 0x4817a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x528310]
mov ecx, dword [0x5231ac]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4817cb
mov ecx, 0x528308
pop ebp
jmp fcn.00470250
push 0x528310
call fcn.004899f7
add esp, 4
cmp dword [0x528310], 0xffffffff
jne 0x4817c0
xor eax, eax
mov dword [0x52830c], eax
mov dword [0x528308], eax
mov ecx, 0x528308
push eax
call fcn.004434e0
push 0x528310
call fcn.00489a6d
add esp, 4
jmp 0x4817c0

Function at 0x4823b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x4823ea
mov edx, dword [ebp + 0xc]
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, al
movzx ebx, byte [edx + esi]
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x5187a0]
add esi, 1
cmp ecx, esi
jne 0x4823d0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4abcd7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004abf20

Function at 0x4ae6e0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ae6eb
Function at 0x4b77c0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov esi, ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x212]
push 0x202
push 0xff
push ebx
call fcn.0048d770
add esp, 0xc
lea eax, [ebp - 0x218]
mov dword [eax], 0x101
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test eax, eax
je 0x4b781f
mov ecx, esi
push str.UICreated_
call fcn.00437400
mov ecx, esi
push ebx
call fcn.0043f8c0
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048a678
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4b7960
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x188
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x180], eax
lea esi, [esp + 0x70]
push 0x110
push 0
push esi
call fcn.0048d770
add esp, 0xc
mov dword [esi - 4], 0x114
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4b79c7
cmp dword [esp + 0x70], 5
seta bl
mov ecx, dword [esp + 0x180]
xor ecx, ebp
call fcn.0048a678
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 4]
push eax
push edi
call fcn.004b86f0
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push edi
push 0x2e
push str.IsVistaOrGreater
push 1
call fcn.004b84f0
lea ecx, [esp + 0x4c]
push 0x507508
push str.Cant_get_Windows_version_info
call fcn.004b45d0
mov ecx, esi
call fcn.004b8530
cmp byte [edi + 0xb], 0
jns 0x4b7a1c
push dword [esp + 4]
call fcn.00489982
add esp, 4
xor ebx, ebx
jmp 0x4b79af

Function at 0x4b84a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.004b8850
mov ecx, eax
call fcn.00470250
test eax, eax
jne 0x4b84d7
call fcn.004b8850
mov esi, eax
push 0xc
call fcn.00489952
add esp, 4
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax], ecx
mov dword [eax + 8], ecx
mov ecx, esi
push eax
call fcn.00470280
call fcn.004b8850
mov ecx, eax
pop esi
pop ebp
jmp fcn.00470250
Function at 0x4b9700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
xor eax, eax
dec eax
mov dword [ecx - 4], eax
mov dword [ecx - 8], eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov ebx, eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.004a1780
add esp, 0x10
cmp eax, esi
jne 0x4b9783
cmp ebx, 1
je 0x4b9725
cmp ebx, 2
mov esi, 0xffffffff
je 0x4b9786
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.004a0816
add esp, 4
neg eax
sbb esi, esi
jmp 0x4b9786
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048a678
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4b97a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x4b97c9
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.004a1780
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
test esi, esi
jle 0x4b97f1
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, byte [eax + edi]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x4b97f3
inc edi
cmp esi, edi
mov eax, ebx
jne 0x4b97d2
mov edi, esi
jmp 0x4b97f3
xor edi, edi
mov eax, edi
add esp, 4
jmp 0x4b97c2
Function at 0x4b9800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp ebx, eax
je 0x4b984d
mov edi, ecx
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x4b9867
xor esi, esi
inc esi
lea eax, [ebp - 0x19]
push dword [edi + 0x20]
push esi
push esi
push eax
call fcn.004a1780
add esp, 0x10
cmp eax, esi
mov esi, 0xffffffff
je 0x4b984f
jmp 0x4b9851
xor ebx, ebx
mov esi, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048a678
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x19]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x4b98ea
mov ebx, eax
cmp eax, 3
je 0x4b98d5
cmp ebx, 1
ja 0x4b98ea
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.004a1780
add esp, 0x10
cmp eax, esi
jne 0x4b98ea
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x4b9872
mov ebx, dword [ebp + 8]
jmp 0x4b984f
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.004a1780
add esp, 0x10
cmp eax, ebx
je 0x4b98cd
xor esi, esi
dec esi
jmp 0x4b9851

Function at 0x4b9930
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x4b9959
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.004a1780
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
test esi, esi
jle 0x4b9982
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x4b9984
inc edi
cmp esi, edi
mov eax, ebx
jne 0x4b9962
mov edi, esi
jmp 0x4b9984
xor edi, edi
mov eax, edi
add esp, 4
jmp 0x4b9952