joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48edf0
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x624040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
test dword [esi + 0x14], 0x100
lea ebx, [esi + 0x14]
je 0x48ee29
push str.CARES_HOSTS
call fcn.005a62bf
add esp, 4
test eax, eax
jne 0x48eefb
mov byte [ebp - 0x108], 0
call fcn.0048f490
cmp eax, 3
jne 0x48eeb0
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48eecb
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.DatabasePath
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x104
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48eecb
cmp eax, 2
jne 0x48efd3
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x108]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x48eed2
mov eax, dword [str.hosts]
mov dword [ecx], eax
mov ax, word [0x5e8e60]
mov word [ecx + 4], ax
mov al, byte [0x5e8e62]
mov byte [ecx + 6], al
lea eax, [ebp - 0x108]
push edi
push 0x5e8e64
push eax
call fcn.005a07ab
mov edi, eax
add esp, 8
test edi, edi
jne 0x48ef39
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
mov ecx, 1
cmp ecx, eax
sbb eax, eax
and eax, 0xa
add eax, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004830fa
mov esp, ebp
pop ebp
ret
push dword [esi + 0x30]
movzx eax, word [esi + 8]
push ebx
push eax
push dword [esi + 4]
push edi
call fcn.00491ad0
push edi
mov dword [ebp - 0x210], eax
call fcn.0059bf68
mov eax, dword [ebp - 0x210]
add esp, 0x18
cmp eax, 4
jne 0x48ef28
mov edi, dword [esi + 4]
mov edx, str.localhost
mov ecx, edi
nop
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x48ef90
test al, al
je 0x48ef8c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x48ef90
add ecx, 2
add edx, 2
test al, al
jne 0x48ef70
xor eax, eax
jmp 0x48ef95
sbb eax, eax
or eax, 1
test eax, eax
jne 0x48efbc
push dword [esi + 0x30]
movzx eax, word [esi + 8]
push ebx
push eax
push edi
call fcn.00491fe0
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004830fa
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x210]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004830fa
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 4
pop esi
xor ecx, ebp
pop ebx
call fcn.004830fa
mov esp, ebp
pop ebp
ret
Function at 0x48fd90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 2
jne 0x48fda0
lea ecx, [eax + 2]
jmp 0x48fda8
cmp eax, 0x17
jne 0x48fe03
lea ecx, [eax - 7]
push esi
sub eax, 2
je 0x48fdd1
sub eax, 0x15
je 0x48fdc3
push 0x273f
call dword [sym.imp.KERNEL32.dll_SetLastError]
or esi, 0xffffffff
jmp 0x48fde7
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00490300
jmp 0x48fddd
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0048ff80
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x48fdf7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x48fdf7
xor eax, eax
pop esi
pop ebp
ret
sar esi, 0x1f
and esi, 0xfffffffe
lea eax, [esi + 1]
pop esi
pop ebp
ret
push 0x273f
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop ebp
ret

Function at 0x490b10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
cmp dword [ebp + 0x10], edi
jle 0x490b84
push ebx
movzx ebx, cl
push esi
movzx ecx, dl
inc bl
mov dh, bl
movzx ebx, dh
mov dl, byte [ebx + eax]
add cl, dl
movzx esi, cl
mov byte [ebp + 0xb], cl
mov dword [ebp - 4], esi
movzx ecx, byte [esi + eax]
mov byte [ebx + eax], cl
mov byte [esi + eax], dl
movzx ecx, byte [ebx + eax]
mov esi, dword [ebp + 0xc]
add cl, dl
movzx ecx, cl
movzx ecx, byte [ecx + eax]
xor byte [edi + esi], cl
inc edi
mov ecx, dword [ebp - 4]
cmp edi, dword [ebp + 0x10]
jl 0x490b33
mov cl, byte [ebp + 0xb]
pop esi
pop ebx
mov byte [eax + 0x100], dh
mov byte [eax + 0x101], cl
pop edi
mov esp, ebp
pop ebp
ret
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x490fe0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jg 0x491003
push 0x2726
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
push esi
test edi, edi
jle 0x4910ab
mov esi, dword [ebp + 0xc]
add esi, 4
mov edx, esi
mov eax, closesocket
sub eax, ebx
cmp dword [edx], eax
ja 0x491096
add ebx, dword [edx]
inc ecx
add edx, 8
mov dword [ebp + 0x10], ebx
cmp ecx, edi
jl 0x491016
test ebx, ebx
je 0x4910ab
push ebx
call dword [0x624134]
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x491055
push 0xc
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, eax
push dword [esi]
push dword [esi - 4]
push ebx
call fcn.00591d00
add ebx, dword [esi]
lea esi, [esi + 8]
add esp, 0xc
sub edi, 1
jne 0x491057
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp - 4]
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
push edi
mov esi, eax
call dword [0x62413c]
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x2726
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4915e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
movzx ecx, word [ebx]
mov eax, ecx
sub eax, 2
je 0x491604
sub eax, 0x15
je 0x4915fb
xor eax, eax
pop ebx
pop ebp
ret
mov dword [ebp + 0xc], 0x1c
jmp 0x49160b
mov dword [ebp + 0xc], 0x10
push esi
push edi
mov edi, dword [ebp + 8]
push 0x11
push 2
push ecx
push edi
call fcn.0048cdb0
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x491640
call fcn.0059c626
pop edi
pop esi
pop ebx
mov eax, dword [eax]
sub eax, 0x273f
neg eax
sbb eax, eax
pop ebp
ret
push dword [ebp + 0xc]
push ebx
push esi
push edi
call fcn.0048cd10
add esp, 0x10
cmp eax, 0xffffffff
jne 0x491671
call fcn.0059c626
cmp dword [eax], 0x2714
je 0x491640
push esi
push edi
call fcn.0048cce0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
push esi
push edi
test eax, eax
je 0x491695
call fcn.0048cce0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.0048cce0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x49cba0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x624040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
push str.Unspecified_error.
call fcn.00493ed0
add esp, 4
push 0x44
push 0
lea eax, [ebp - 0x268]
push eax
call fcn.00591a40
add esp, 0xc
mov dword [ebp - 0x268], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x224]
push ecx
call fcn.00591a40
add esp, 0xc
mov dx, word [0x5e9728]
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.00591a40
add esp, 0xc
push 0x5ea41c
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.005a714f
add esp, 0xc
push 0
mov ecx, dword [ebp - 0x210]
add ecx, 0x9c
call fcn.004966c0
push eax
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.005a714f
add esp, 0xc
push 0x5ea420
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.005a714f
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.005a714f
add esp, 0xc
push 0x5ea41c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.005a714f
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x268]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x210]
add ecx, 0x9c
call fcn.004974d0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x220], 0
je 0x49cd04
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x220], 0
cmp dword [ebp - 0x214], 0
jne 0x49cd21
push 0x5ea428
call fcn.00493ed0
add esp, 4
mov eax, 1
jmp 0x49cd75
cmp dword [ebp + 0xc], 0
je 0x49cd3c
push 0xffffffffffffffff
mov edx, dword [ebp - 0x210]
mov eax, dword [edx + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0x10], 0
je 0x49cd4f
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x224]
mov dword [ecx], edx
jmp 0x49cd66
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x224], 0
push 0x5e917c
call fcn.00493ed0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004830fa
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a9950
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bfe73
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x624040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
call fcn.004ab1a0
push 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x4a99ae
mov eax, 1
jmp 0x4a99fc
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x228]
call fcn.00495cc0
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x224], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x224]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004a3530
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00495ed0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004830fa
mov esp, ebp
pop ebp
ret
Function at 0x4aa340
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c0028
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x624040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00495d60
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp + 0xc]
call fcn.004974d0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4aa459
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 0
lea ecx, [ebp + 0xc]
call fcn.004974d0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4aa459
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0x5e9748
mov edx, dword [ebp - 0x24]
push edx
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10]
shr ecx, 0x10
and ecx, 0xffff
mov word [ebp - 0x1c], cx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x10]
and eax, 0xffff
mov word [ebp - 0x18], ax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x14]
shr edx, 0x10
and edx, 0xffff
mov word [ebp - 0x14], dx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x14]
and ecx, 0xffff
mov word [ebp - 0x10], cx
movzx edx, word [ebp - 0x10]
push edx
movzx eax, word [ebp - 0x14]
push eax
movzx ecx, word [ebp - 0x18]
push ecx
movzx edx, word [ebp - 0x1c]
push edx
push str._u._u._u._u
lea eax, [ebp - 0x28]
push eax
call fcn.004a3d10
add esp, 0x18
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp + 8]
call fcn.004a2f70
mov eax, dword [ebp - 0x30]
or eax, 1
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00495ed0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00495ed0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4aa4b0
Capabilities:
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c005b
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x624040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00495d60
mov byte [ebp - 4], 1
push 0
push 0x3a
lea ecx, [ebp + 8]
call fcn.004ab1e0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x4aa506
mov eax, dword [ebp - 0x18]
add eax, 2
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x5c
lea ecx, [ebp + 8]
call fcn.004ab1e0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x4aa531
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.004a3530
jmp 0x4aa566
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp + 8]
call fcn.004a4440
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004a3530
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00495ed0
push 0
lea ecx, [ebp - 0x14]
call fcn.004974d0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x4aa5b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4aa5b4
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00495ed0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00495ed0
mov eax, dword [ebp - 0x2c]
jmp 0x4aa630
lea ecx, [ebp - 0x14]
call fcn.004974d0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
and edx, 0x10
jne 0x4aa5f5
mov dword [ebp - 0x34], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00495ed0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00495ed0
mov eax, dword [ebp - 0x34]
jmp 0x4aa630
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4aa5fd
jmp 0x4aa60b
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x4aa50c
mov dword [ebp - 0x38], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00495ed0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00495ed0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4ab360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 0x10], 0
je 0x4ab378
mov dword [ebp - 8], 1
jmp 0x4ab37f
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
xor ecx, ecx
jne 0x4ab385
cmp dword [ebp - 0x14], 0
jne 0x4ab399
push 0x80004005
call fcn.00496610
xor edx, edx
jne 0x4ab369
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4ab4e0
cmp dword [ebp + 8], 0
je 0x4ab4e0
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jbe 0x4ab4cf
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jbe 0x4ab4b5
cmp dword [ebp - 4], 2
jbe 0x4ab406
cmp dword [ebp - 4], 7
je 0x4ab44b
jmp 0x4ab4b5
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x4ab42b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 - 2]
test edx, edx
je 0x4ab446
mov eax, 2
imul ecx, eax, 0
xor edx, edx
mov eax, dword [ebp + 8]
mov word [eax + ecx], dx
mov eax, 0xd
jmp 0x4ab4e3
jmp 0x4ab4cd
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x4ab49b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
cmp eax, 1
jb 0x4ab49b
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shr edx, 1
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
jne 0x4ab49b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
cmp eax, 1
jbe 0x4ab4b3
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shr edx, 1
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 - 4]
test ecx, ecx
je 0x4ab4b3
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 8]
mov word [edx + eax], cx
mov eax, 0xd
jmp 0x4ab4e3
jmp 0x4ab4cd
mov eax, 2
imul ecx, eax, 0
xor edx, edx
mov eax, dword [ebp + 8]
mov word [eax + ecx], dx
mov eax, 0xd
jmp 0x4ab4e3
jmp 0x4ab4e0
mov ecx, 2
imul edx, ecx, 0
xor eax, eax
mov ecx, dword [ebp + 8]
mov word [ecx + edx], ax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ac190
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c0188
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x624040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00495d60
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00495b90
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 8], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4ac450
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor edx, edx
div dword [ecx + 8]
mov eax, dword [ebp + 8]
sub eax, edx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
push 6
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0x18
call fcn.004adc60
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x4af790
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c0250
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x624040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0x28], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [ebp - 4], 0
mov dword [edi + 0xc], eax
call fcn.00522160
mov ecx, eax
call fcn.004b4bc0
mov ecx, dword [edi + 0x28]
mov eax, dword [eax*4 + 0x5ec8b0]
mov dword [ebp + 8], eax
cmp ecx, eax
je 0x4af841
cmp ecx, 9
jne 0x4af820
lea ecx, [edi + 0x10]
call fcn.00407ac0
mov eax, dword [ebp + 8]
mov dword [edi + 0x28], eax
cmp eax, 9
jne 0x4af841
xorps xmm0, xmm0
movups xmmword [edi + 0x10], xmm0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0xf
mov byte [edi + 0x10], 0
mov ecx, dword [ebp + 0xc]
call fcn.00522170
mov ecx, eax
call fcn.004b4bc0
mov eax, dword [eax*4 + 0x5ec8b0]
mov dword [edi + 0x34], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4b0380
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0x18
lea eax, [esp + 8]
push ebx
push esi
push edi
push dword [esp + 0x28]
mov ebx, ecx
lea ecx, [esp + 0x2c]
push eax
call fcn.004b0010
mov esi, eax
mov eax, dword [esi]
test eax, eax
jne 0x4b0408
movzx ecx, byte [esi + 8]
movzx eax, byte [esi + 9]
xor ecx, 0x811c9dc5
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xc]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xd]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xe]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xf]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul edi, ecx, 0x1000193
jmp 0x4b0448
mov esi, dword [esi + 8]
push ebp
push esi
push eax
push 0
lea eax, [esp + 0x1c]
push 0x5f8274
push eax
call fcn.00416480
mov eax, esi
mov ecx, 0xcc9e2d51
mul ecx
mov ebp, ecx
add esp, 0x14
mov esi, eax
mov edi, edx
mov eax, dword [esp + 0x14]
mul ebp
mov ecx, eax
mov eax, dword [esp + 0x10]
mul ebp
pop ebp
add ecx, edx
add esi, eax
adc edi, ecx
xor edi, esi
mov ecx, dword [ebx + 8]
mov eax, 0x9e3779b9
xor ecx, edi
mul ecx
pop edi
mov esi, eax
mov eax, 0x7f4a7c15
mul ecx
mov ecx, dword [ebx + 4]
dec ecx
lea eax, [edx + esi]
pop esi
and eax, ecx
pop ebx
add esp, 0x18
ret 4
Function at 0x4b4850
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
mov ebx, ecx
mov ebp, 0xcc9e2d51
mov eax, dword [edi]
lea ecx, [esp + 0x30]
mov dword [esp + 0x10], eax
lea eax, [edi + 8]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004b0010
mov esi, eax
mov eax, dword [esi]
test eax, eax
jne 0x4b48e8
movzx ecx, byte [esi + 8]
movzx eax, byte [esi + 9]
xor ecx, 0x811c9dc5
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xc]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xd]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xe]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xf]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul ebp, ecx, 0x1000193
jmp 0x4b492b
mov esi, dword [esi + 8]
push esi
push eax
push 0
lea eax, [esp + 0x20]
push 0x5f8274
push eax
call fcn.00416480
or esi, esi
mov ecx, 0xcc9e2d51
mov eax, esi
add esp, 0x14
mul ebp
mov esi, eax
mov ebp, edx
mov eax, dword [esp + 0x18]
mul ecx
mov edx, 0xcc9e2d51
mov ecx, eax
mov eax, dword [esp + 0x14]
mul edx
add ecx, edx
add esi, eax
adc ebp, ecx
xor ebp, esi
mov ecx, dword [ebx + 8]
mov eax, 0x9e3779b9
xor ecx, ebp
mul ecx
mov esi, eax
mov eax, 0x7f4a7c15
mul ecx
mov ecx, dword [ebx + 4]
mov eax, dword [ebx + 0x10]
add esi, edx
dec ecx
and esi, ecx
lea ebp, [esi*4]
mov edx, dword [eax + ebp]
test edx, edx
jne 0x4b496e
mov dword [edi], edx
mov eax, dword [ebx + 0x10]
mov dword [eax + ebp], edi
mov eax, dword [ebx + 0xc]
cmp esi, eax
cmovb eax, esi
mov dword [ebx + 0xc], eax
jmp 0x4b49a4
mov al, dl
not al
test al, 1
je 0x4b4996
mov eax, edx
xor ecx, ecx
nop word [eax + eax]
mov eax, dword [eax]
inc ecx
test eax, eax
jne 0x4b4980
cmp ecx, 8
jae 0x4b4996
mov dword [edi], edx
mov eax, dword [ebx + 0x10]
mov dword [eax + ebp], edi
jmp 0x4b49a4
push edi
push 0x4b2710
push esi
mov ecx, ebx
call fcn.004b5fc0
mov eax, dword [esp + 0x10]
mov ebp, 0xcc9e2d51
mov edi, eax
test eax, eax
jne 0x4b4862
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4