joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492590
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x12c
mov esi, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov ecx, dword [0x603024]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor ecx, ecx
dec ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], ecx
test al, al
je 0x49266b
lea ebx, [ebp - 0x120]
xor edi, edi
push 0x110
push edi
push ebx
call fcn.005072d0
add esp, 0xc
mov dword [ebx - 0xc], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x5f2d50]
movups xmmword [esp], xmm0
mov ebx, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call ebx
mov ecx, 3
push ecx
push 1
push edx
push eax
call ebx
mov ecx, 3
push ecx
push 0x20
push edx
push eax
call ebx
lea ecx, [ebp - 0x120]
mov dword [ecx - 8], 6
mov dword [ecx - 4], edi
mov word [ecx + 0x108], 0
lea ecx, [ebp - 0x12c]
push edx
push eax
push 0x23
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov ebx, 0x80003
test eax, eax
je 0x492672
lea edi, [ebp - 0x138]
mov dword [edi], 0xc
push 0
call fcn.004926c0
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 8], 1
jmp 0x492672
xor edi, edi
mov ebx, 3
cmp byte [esi + 0xb], 0
jns 0x49267a
mov esi, dword [esi]
sub esp, 0x20
mov dword [esp + 0x1c], edi
movaps xmm0, xmmword [0x5f2d60]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504b53
mov eax, esi
add esp, 0x12c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x494840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword fs:[0x18]
cmp eax, dword [ecx + 0x24]
sete al
pop ebp
ret

Function at 0x49c1a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x603024]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, SysReAllocString
cmp edx, esi
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49c1f8
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x49c1fd
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00504b53
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
xor esi, esi
dec esi
jmp 0x49c1e6
int3
Function at 0x49c200
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x603024]
xor ecx, ebp
mov esi, SysReAllocString
cmp eax, esi
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push edx
mov edi, ebx
push ebx
call ecx
test eax, eax
je 0x49c278
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x49c265
cmp ebx, 0xffffffff
je 0x49c28a
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504b53
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x49c28d
mov ebx, dword [ebp - 0x14]
jmp 0x49c251
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x49c251
int3
mov edx, dword [ebp + 0xc]
jmp 0x49c227

Function at 0x49c6c0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov esi, dword [ebp + 8]
mov eax, dword [0x603024]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.0049c5d0
add esp, 0x10
or edx, eax
jne 0x49c6f7
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
je 0x49c70d
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00504b53
mov eax, ebx
add esp, 0xac
pop esi
pop ebx
pop ebp
ret
push 2
call fcn.004e0f90
add esp, 4
test al, al
jne 0x49c71f
xor ebx, ebx
jmp 0x49c6f7
call fcn.0055df20
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0xfb
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
call fcn.0055e050
lea eax, [ebp - 0xac]
push 0xc
push 0x5f697a
push eax
call fcn.005364d0
add esp, 0xc
mov ecx, esi
call fcn.0055e0b0
jmp 0x49c71b
Function at 0x4a6b70
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, edx
cmp edx, 4
jb 0x4a6ba8
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x4a6b82
cmp edx, 1
je 0x4a6bc9
cmp edx, 2
je 0x4a6bc0
cmp edx, 3
jne 0x4a6bd4
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 8

Function at 0x4a8d40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [0x619690]
mov ecx, dword [0x6072f0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4a8d96
cmp edi, esi
je 0x4a8d8c
xor eax, eax
dec eax
movzx ecx, byte [edi]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x619290]
inc edi
cmp edi, esi
jne 0x4a8d71
not eax
jmp 0x4a8d8e
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x619690
call fcn.00503a17
add esp, 4
cmp dword [0x619690], 0xffffffff
jne 0x4a8d6a
push 0x400
push 0xff
push 0x619290
call fcn.005072d0
add esp, 0xc
xor eax, eax
mov ecx, eax
shr ecx, 1
mov edx, eax
mov dword [ebp - 0x10], eax
and edx, 1
neg edx
mov ebx, 0xedb88320
and edx, ebx
xor edx, ecx
mov ecx, edx
shr ecx, 1
bt eax, 1
mov ebx, 0
sbb ebx, ebx
mov eax, 0xedb88320
and ebx, eax
xor ebx, ecx
mov ecx, ebx
shr ecx, 1
bt edx, 1
mov edx, 0
sbb edx, edx
and edx, eax
xor edx, ecx
mov ecx, edx
shr ecx, 1
bt ebx, 1
mov ebx, 0
sbb ebx, ebx
and ebx, eax
xor ebx, ecx
mov eax, ebx
shr eax, 1
bt edx, 1
mov ecx, 0
sbb ecx, ecx
mov edx, 0xedb88320
and ecx, edx
xor ecx, eax
mov eax, ecx
shr eax, 1
bt ebx, 1
mov edx, 0
sbb edx, edx
mov ebx, 0xedb88320
and edx, ebx
xor edx, eax
bt ecx, 1
mov ebx, 0
sbb ebx, ebx
mov ecx, 0xedb88320
and ebx, ecx
mov eax, edx
shr eax, 2
shr ebx, 1
xor ebx, eax
bt edx, 1
mov eax, 0
sbb eax, eax
and eax, ecx
xor eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword [ecx*4 + 0x619290], eax
inc ecx
mov eax, ecx
cmp ecx, 0x100
jne 0x4a8dc5
push 0x619690
call fcn.00503a8d
add esp, 4
jmp 0x4a8d6a
Function at 0x4b51b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [0x603024]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
push eax
push eax
push ecx
push 0x4b5220
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x4b51ec
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00504b53
add esp, 8
pop esi
pop ebp
ret
lea esi, [ebp - 0xc]
push 0x1b
push str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
push esi
call fcn.0057c880
add esp, 0xc
mov ecx, esi
call fcn.0057c7c0
push 0xc
push 0x5ed867
push eax
call fcn.005364d0
add esp, 0xc
mov ecx, esi
call fcn.0057c7d0
jmp 0x4b51dc
Function at 0x4d0c60
Capabilities:
Decompress data using quicklz

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [ecx]
mov eax, esi
and eax, 0xf800d000
cmp eax, 0xf0008000
sete al
mov edi, esi
not edi
test edi, 0x3c00000
setne ah
and ah, al
test dl, 1
sete bl
lea edi, [edx + 0x100000]
cmp edi, 0x200000
setb al
and al, bl
and al, ah
cmp al, 1
jne 0x4d0cef
mov edi, edx
shl edi, 6
and edi, 0x4000000
mov ebx, edx
shl ebx, 4
and ebx, 0x3f0000
or ebx, edi
mov edi, edx
shr edi, 5
and edi, 0x2000
or edi, ebx
mov ebx, edx
shr edx, 8
and edx, 0x800
or edx, edi
shr ebx, 1
and ebx, 0x7ff
or edx, ebx
and esi, 0xfbc0d000
or edx, esi
mov dword [ecx], edx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4d0da0
Capabilities:
Decompress data using quicklz

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, ecx
or edx, eax
test dl, 1
jne 0x4d0e4c
sub ecx, eax
lea edx, [ecx - 4]
and edx, 1
lea esi, [edx + ecx]
add esi, 0xffffc
xor eax, eax
cmp esi, 0x1fffff
ja 0x4d0e4e
add ecx, edx
add ecx, 0xfffffffc
mov edx, ecx
and edx, 1
jne 0x4d0e4e
mov edx, dword [ebp + 0x10]
mov esi, dword [edx]
mov edi, esi
and edi, 0xf800d000
cmp edi, 0xf0008000
jne 0x4d0e4e
mov edi, esi
and edi, 0x3c00000
cmp edi, 0x3c00000
je 0x4d0e4e
mov eax, ecx
shl eax, 6
and eax, 0x4000000
mov edi, ecx
shl edi, 4
and edi, 0x3f0000
or edi, eax
mov eax, ecx
shr eax, 5
and eax, 0x2000
or eax, edi
mov edi, ecx
shr ecx, 8
and ecx, 0x800
or ecx, eax
shr edi, 1
and edi, 0x7ff
or ecx, edi
and esi, 0xfbc0d000
or ecx, esi
mov dword [edx], ecx
mov al, 1
jmp 0x4d0e4e
xor eax, eax
pop esi
pop edi
pop ebp
ret

Function at 0x4d5360
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x4d5395
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4d539c
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4d538e
mov dword [esi], ebx
call fcn.004e0f80
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004e0f80
push dword [esi]
call fcn.004e9ae0
add esp, 4
mov dword [esi], 0
jmp 0x4d537f

Function at 0x4d9670
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x4d9685
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, edx
cmp edx, 4
jb 0x4d96b6
nop dword [eax]
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x4d9690
cmp edx, 1
je 0x4d96d9
cmp edx, 3
je 0x4d96c7
cmp edx, 2
je 0x4d96d0
jmp 0x4d96e4
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x4da630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm4
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x4da71e
nop word cs:[eax + eax]
movdqa xmm6, xmm0
movdqa xmm5, xmmword [0x5e2c10]
pclmulqdq xmm6, xmm5, 0
movdqa xmm5, xmmword [0x5e2c20]
pclmulqdq xmm0, xmm5, 0x11
movdqa xmm7, xmm0
pxor xmm7, xmm6
movdqa xmm0, xmm3
movdqa xmm4, xmmword [0x5e2c10]
pclmulqdq xmm0, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
movdqa xmm6, xmm3
pxor xmm6, xmm0
movdqa xmm0, xmm2
pclmulqdq xmm0, xmm4, 0
movdqa xmm3, xmm4
pclmulqdq xmm2, xmm5, 0x11
movdqa xmm4, xmm2
pxor xmm4, xmm0
movdqa xmm0, xmm1
pclmulqdq xmm0, xmm3, 0
pclmulqdq xmm1, xmm5, 0x11
movdqa xmm5, xmm1
pxor xmm5, xmm0
movdqu xmm0, xmmword [ecx]
pxor xmm0, xmm7
movdqu xmm3, xmmword [ecx + 0x10]
pxor xmm3, xmm6
movdqu xmm2, xmmword [ecx + 0x20]
pxor xmm2, xmm4
movdqu xmm1, xmmword [ecx + 0x30]
pxor xmm1, xmm5
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x4da670
movdqa xmm4, xmmword [0x5e2c30]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x5e2c40]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp eax, 0x10
jb 0x4da7a2
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add ecx, 0x10
add eax, 0xfffffff0
cmp eax, 0xf
ja 0x4da77b
movdqa xmm1, xmmword [0x5e2c40]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm2, xmm2
pxor xmm1, xmm1
pblendw xmm1, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x5e2c50], 0
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm1, 3
pclmulqdq xmm0, xmmword [0x5e2c60], 0x10
pblendw xmm0, xmm2, 0xfc
pclmulqdq xmm0, xmmword [0x5e2c70], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop ebp
ret
Function at 0x4e7440
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x140c
call fcn.00504f70
mov eax, dword [0x603024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x605ee4]
cmp eax, 0xffffffff
je 0x4e7472
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
jne 0x4e7487
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504b53
add esp, 0x140c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, ebx
and eax, 0xfffffffc
lea ecx, [ebp - 0x810]
push 0x800
push eax
push ecx
call fcn.00506d50
add esp, 0xc
mov ecx, dword [0x605ee4]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.004875a0
add esp, 8
and ebx, 0xfffffffc
je 0x4e74cb
push ebx
call fcn.005039dc
add esp, 4
mov eax, dword [0x614eb8]
mov ecx, dword [0x6072f0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4e75b3
mov esi, dword [0x614eb4]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4e75f8
lea eax, [ebp - 0x1410]
push 0xc00
push 0x6142b4
push eax
call fcn.00506d50
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ecx, 0x100
lea edx, [ebp - 0x1408]
test al, 1
je 0x4e759e
mov dword [ebp - 0x1418], ecx
xor esi, esi
mov edi, edx
xor eax, eax
jmp 0x4e754c
inc esi
add edi, 0xc
cmp esi, 0x100
je 0x4e7590
mov ebx, dword [ebp + esi*8 - 0x810]
test ebx, ebx
je 0x4e7540
cmp dword [edi - 8], 0
je 0x4e7540
mov ecx, dword [ebp + esi*8 - 0x80c]
cmp ecx, dword [edi]
jne 0x4e7540
mov ecx, dword [edi - 4]
test ecx, ecx
je 0x4e7540
mov dword [ebp + esi*8 - 0x810], 0
call dword [section..00cfg]
push ebx
call ecx
lea edx, [ebp - 0x1408]
add esp, 4
mov al, 1
jmp 0x4e7540
mov esi, dword [ebp - 0x1418]
lea ecx, [esi - 1]
cmp esi, 2
jae 0x4e752e
push 2
push dword [ebp - 0x1414]
call fcn.004875a0
add esp, 8
jmp 0x4e7472
push 0x614eb8
call fcn.00503a17
add esp, 4
cmp dword [0x614eb8], 0xffffffff
jne 0x4e74ec
push 4
call fcn.0050397a
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.004e9a50
mov dword [0x614eb4], esi
push 0x614eb8
call fcn.00503a8d
add esp, 4
jmp 0x4e74ec
mov ecx, esi
call fcn.004e9a60
jmp 0x4e7501
Function at 0x4e9530
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, ecx
mov eax, dword [0x603024]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x3e
push str..._.._base_files_file_win.cc
push str.Read
push ebx
call fcn.004e0f50
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.00404d30
cmp dword [ebp + 0x14], 0
js 0x4e962a
mov edi, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.004f1780
test al, al
jne 0x4e962f
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push ebx
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e9618
mov ebx, dword [esp + 0xc]
lea ecx, [esp + 0x28]
call fcn.004f1820
lea ecx, [esp + 0x30]
call fcn.004e7120
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00504b53
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x4e95ef
xor ebx, ebx
dec ebx
jmp 0x4e95f8
lea ecx, [esp + 0x28]
push 0
push dword [ebp + 0x14]
push esi
push str.File::Read
call fcn.00575970
jmp 0x4e95b0

Function at 0x4e9650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 8], ecx
mov eax, dword [0x603024]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x30]
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0x73
push str..._.._base_files_file_win.cc
push str.Write
push edi
call fcn.004e0f50
add esp, 0x10
xor esi, esi
mov ecx, ebx
push esi
push edi
call fcn.004e70c0
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], esi
call fcn.004f1780
test al, al
jne 0x4e9730
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
lea ebx, [esp + 0xc]
mov dword [ebx], 0xffffffff
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [ebx]
lea ecx, [esp + 0x28]
call fcn.004f1820
lea ecx, [esp + 0x30]
call fcn.004e7120
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00504b53
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov edx, dword [ebp + 0x14]
mov eax, edx
sar eax, 0x1f
lea ecx, [esp + 0x28]
push eax
push edx
push dword [esp + 0x10]
push str.File::Write
call fcn.00575970
jmp 0x4e96c2
Function at 0x4e9760
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x4e979b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4e97b2
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4e9794
mov dword [esi], ebx
call fcn.004e0f80
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x4e97c9
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004e0f80
push dword [esi]
call fcn.004e9ae0
add esp, 4
mov dword [esi], 0
jmp 0x4e9785
int3
Function at 0x4eee10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004eeae0

Function at 0x4f03e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x603024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x618bd4]
mov ecx, dword [0x6072f0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4f0431
mov eax, dword [0x618bd0]
mov esi, dword [eax]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504b53
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x618bd4
call fcn.00503a17
add esp, 4
cmp dword [0x618bd4], 0xffffffff
jne 0x4f0413
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.005072d0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.0050397a
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x618c04]
mov ecx, dword [0x6072f0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4f04da
mov ecx, esi
push ebx
push 0x618be0
push edi
call fcn.00480ad0
mov dword [0x618bd0], esi
push 0x618bd4
call fcn.00503a8d
add esp, 4
jmp 0x4f0413
push 0x618c04
call fcn.00503a17
add esp, 4
cmp dword [0x618c04], 0xffffffff
jne 0x4f04b4
xorps xmm0, xmm0
movups xmmword [0x618bf0], xmm0
movups xmmword [0x618be0], xmm0
mov dword [0x618c00], 0
push 0x618be0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x618c04
call fcn.00503a8d
add esp, 4
jmp 0x4f04b4

Function at 0x4f0560
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x4f05de
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4f05c7
lea eax, [edi + 1]
cmp eax, 2
jb 0x4f05ab
mov dword [esi], edi
call fcn.004e0f80
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 1
inc eax
cmp eax, 1
jbe 0x4f05e2
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.004e0f80
push dword [esi]
call fcn.004e9ae0
add esp, 4
mov dword [esi], 0
jmp 0x4f059c
mov byte [esi + 4], 1
int3

Function at 0x4f2140
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x4f2178
mov edx, dword [ebp + 0xc]
xor esi, esi
nop word cs:[eax + eax]
movzx edi, al
movzx ebx, byte [edx + esi]
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x5ef9a0]
inc esi
cmp ecx, esi
jne 0x4f2160
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4f5670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
movzx eax, byte [ecx + 0x27]
test al, al
js 0x4f572a
test eax, eax
jne 0x4f571f
cmp dword [esi + 0x28], 0
jne 0x4f571f
mov byte [esi + 0x2c], 0
mov eax, dword [esi + 8]
mov dword [esi + 4], eax
cmp eax, dword [esi + 0xc]
je 0x4f5759
lea edi, [esi + 0x10]
lea ecx, [eax + 1]
mov dword [esi + 8], ecx
movsx eax, byte [eax]
mov ecx, edi
push 0
push eax
call fcn.004dd7c0
cmp eax, 0xffffffff
jne 0x4f574a
cmp dword [esi + 0x30], 1
je 0x4f5732
mov eax, dword [esi + 8]
mov bl, 1
cmp eax, dword [esi + 0xc]
je 0x4f575f
nop dword [eax]
movsx eax, byte [eax]
mov ecx, edi
push 0
push eax
call fcn.004dd7c0
cmp eax, 0xffffffff
jne 0x4f575f
mov eax, dword [esi + 8]
cmp dword [esi + 0x30], 1
je 0x4f5706
inc eax
mov dword [esi + 8], eax
cmp eax, dword [esi + 0xc]
jne 0x4f56e0
jmp 0x4f575f
mov cl, byte [eax]
add cl, 0xf7
cmp cl, 0x17
ja 0x4f56fb
movzx ecx, cl
mov edx, 0x80001b
bt edx, ecx
jae 0x4f56fb
jmp 0x4f575f
mov ecx, esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.005800e0
mov eax, dword [esi + 0x20]
jmp 0x4f5684
mov eax, dword [esi + 4]
mov al, byte [eax]
add al, 0xf7
cmp al, 0x17
ja 0x4f56ce
movzx eax, al
mov ecx, 0x80001b
bt ecx, eax
jae 0x4f56ce
mov eax, dword [esi + 8]
mov dword [esi + 4], eax
cmp eax, dword [esi + 0xc]
jne 0x4f56ac
mov byte [esi + 0x2c], 1
xor ebx, ebx
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4febe0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x618f28]
mov ecx, dword [0x6072f0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4fec0b
mov ecx, 0x618f20
pop ebp
jmp fcn.004e7610
push 0x618f28
call fcn.00503a17
add esp, 4
cmp dword [0x618f28], 0xffffffff
jne 0x4fec00
xor eax, eax
mov dword [0x618f24], eax
mov dword [0x618f20], eax
mov ecx, 0x618f20
push eax
call fcn.00462250
push 0x618f28
call fcn.00503a8d
add esp, 4
jmp 0x4fec00