joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d38b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 8], ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x42
push str....._base_files_file_win.cc
push str.Read
push esi
call fcn.005e4620
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.005d6a70
xor ebx, ebx
dec ebx
cmp dword [ebp + 0xc], 0
js 0x5d3982
mov edi, dword [ebp + 0x14]
test edi, edi
js 0x5d3982
mov ebx, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.005fae60
test al, al
jne 0x5d39b9
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push esi
push eax
push edi
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5d39a2
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x5d39b4
lea ecx, [esp + 0x28]
call fcn.005faef0
lea ecx, [esp + 0x30]
call fcn.005d6ae0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x5d3979
int3
lea ecx, [esp + 0x28]
push 0
push edi
push dword [esp + 0x10]
push str.File::Read
call fcn.006c9900
jmp 0x5d3934

Function at 0x5d39e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x5f
push str....._base_files_file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.005e4620
add esp, 0x10
mov ecx, edi
push 0
push ebx
mov ebx, dword [ebp + 0xc]
call fcn.005d6a70
test ebx, ebx
js 0x5d3aa1
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.005fae60
test al, al
jne 0x5d3abd
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push 0
push eax
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5d3aab
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x5d3aa6
lea ecx, [esp + 0x10]
call fcn.005faef0
lea ecx, [esp + 0x20]
call fcn.005d6ae0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
dec ebx
jmp 0x5d3a81
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x5d3a78
lea ecx, [esp + 0x10]
push 0
push ebx
push esi
push str.File::ReadAtCurrentPos
call fcn.006c9900
jmp 0x5d3a55
Function at 0x5d3ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 8], ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
lea ebx, [esp + 0x10]
push 0x7f
push str....._base_files_file_win.cc
push str.Write
push ebx
call fcn.005e4620
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push ebx
call fcn.005d6a70
mov edi, 0xffffffff
cmp dword [ebp + 0xc], 0
js 0x5d3bb0
mov esi, dword [ebp + 0x14]
test esi, esi
js 0x5d3bb0
mov edi, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.005fae60
test al, al
jne 0x5d3bd7
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push ebx
push eax
push esi
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5d3bd0
mov edi, dword [esp + 0xc]
lea ecx, [esp + 0x28]
call fcn.005faef0
lea ecx, [esp + 0x30]
call fcn.005d6ae0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.00650d60
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov edi, 0xffffffff
jmp 0x5d3ba7
lea ecx, [esp + 0x28]
push 0
push esi
push dword [esp + 0x10]
push str.File::Write
call fcn.006c9900
jmp 0x5d3b64
Function at 0x5da6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x5da6d1
mov edx, dword [ebp + 8]
xor ebx, ebx
nop word cs:[eax + eax]
lea esi, [ebx + 1]
movzx eax, byte [edx + ebx]
test al, al
js 0x5da6db
mov ebx, esi
cmp esi, ecx
jb 0x5da6c0
mov al, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
dec edi
mov dword [ebp - 0x10], edi
cmp esi, ecx
je 0x5da764
cmp al, 0xe0
jb 0x5da768
cmp al, 0xef
ja 0x5da773
and eax, 0xf
movzx ebx, byte [eax + str._000000000000]
mov edx, dword [ebp + 8]
movzx edi, byte [edx + esi]
mov dword [ebp - 0x14], edi
shr edi, 5
bt ebx, edi
jae 0x5da73d
mov ebx, dword [ebp - 0x14]
and bl, 0x3f
mov edi, ebx
inc esi
cmp esi, ecx
je 0x5da764
shl eax, 6
mov ebx, edi
movzx ebx, bl
or ebx, eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax + esi]
xor eax, 0x80
cmp al, 0x3f
ja 0x5da73d
shl ebx, 6
or ebx, eax
inc esi
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp - 0x10]
cmp edi, 0xd800
setae al
add edi, 0xffff2000
cmp edi, 0x1dd0
setae ah
test al, ah
jne 0x5da7ab
mov edx, dword [ebp + 8]
jmp 0x5da6cb
mov esi, ecx
jmp 0x5da73d
cmp al, 0xc2
jb 0x5da73d
and eax, 0x1f
mov ebx, eax
jmp 0x5da724
cmp al, 0xf4
ja 0x5da73d
add eax, 0xffffff10
mov edx, dword [ebp + 8]
movzx edi, byte [edx + esi]
mov dword [ebp - 0x14], edi
shr edi, 4
movsx edi, byte [edi + 0x753edb]
bt edi, eax
jae 0x5da73d
add ebx, 2
cmp ebx, ecx
je 0x5da764
mov dl, byte [edx + ebx]
add dl, 0x80
cmp dl, 0x3f
jbe 0x5da7df
mov esi, ebx
jmp 0x5da73d
mov eax, dword [ebp - 0x10]
lea edi, [eax - 0xfdf0]
xor eax, eax
cmp edi, 0x10020f
ja 0x5da6d3
mov edi, dword [ebp - 0x10]
and edi, 0xfffe
cmp edi, 0xfffe
mov edx, dword [ebp + 8]
jne 0x5da6cb
jmp 0x5da6d3
mov edi, edx
shl eax, 6
mov esi, dword [ebp - 0x14]
and esi, 0x3f
or eax, esi
mov esi, ebx
jmp 0x5da715
Function at 0x5e5140
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00606fd0

Function at 0x5e5150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
js 0x5e515f
pop ebp
jmp fcn.00606ef0
call fcn.006a7ec0
xor eax, eax
pop ebp
ret

Function at 0x5e7e40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.005d37c0
mov dword [esi], 0
test eax, eax
je 0x5e7e87
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x5e7eb6
lea eax, [ebx + 1]
cmp eax, 2
jb 0x5e7e7d
mov dword [esi], ebx
call fcn.005e4650
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.005e53b0
lea ecx, [esi + 0x10]
call fcn.005fae90
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005e4650
push dword [esi]
call fcn.005cf200
add esp, 4
mov dword [esi], 0
jmp 0x5e7e6e
Function at 0x5ea370
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ebp + 0xc]
movsx edx, byte [esi + 0xb]
mov eax, esi
test edx, edx
jns 0x5ea38b
mov edx, dword [esi + 4]
mov eax, dword [esi]
test edx, edx
js 0x5ea6ff
sete bl
test eax, eax
setne bh
or bh, bl
je 0x5ea6ff
mov ebx, edx
cmp edx, 4
jb switch.0x005ea3d0
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ebx, ebx, 0x5bd1e995
xor ebx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja case.default.0x5ea3d0
jmp dword [edx*4 + 0x754bc8]
movzx edx, byte [eax + 1]
shl edx, 8
xor ebx, edx
movzx eax, byte [eax]
xor eax, ebx
imul ebx, eax, 0x5bd1e995
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ebx, edx
jmp case.0x5ea3d0.2
Function at 0x5ebe00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [edx + 4]
test eax, eax
je 0x5ebf22
mov ebx, ecx
mov ecx, dword [edx]
xor esi, esi
xor edi, edi
or edi, dword [ecx + esi*4]
inc esi
cmp eax, esi
jne 0x5ebe1c
test edi, edi
je 0x5ebf22
test eax, eax
jle 0x5ebf5e
mov ecx, dword [edx]
test byte [ecx], 1
je 0x5ebf5e
cmp dword [edx + 0xc], 0
jne 0x5ebf91
cmp eax, 0x801
jae 0x5ebf6c
lea esi, [ebx + 0x14]
push edx
push esi
call fcn.00546870
add esp, 8
test eax, eax
je 0x5ebf9f
mov eax, dword [ebx + 0x18]
test eax, eax
mov dword [ebp - 0x10], ebx
jle 0x5ebf3e
mov ecx, dword [esi]
cmp dword [ecx + eax*4 - 4], 0
jne 0x5ebe8f
lea edx, [eax - 1]
cmp eax, 1
mov eax, edx
jg 0x5ebe79
jmp 0x5ebf42
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 0x14]
mov edx, dword [ecx]
cmp eax, 2
jb 0x5ebf57
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x1c], edx
xor edi, edi
xor eax, eax
inc eax
mov edx, 0x40
mov dword [ebp - 0x14], 0
xor ebx, ebx
mov esi, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], edx
and esi, 1
neg esi
mov edx, 0
sbb edx, edx
mov eax, ecx
and eax, edx
and esi, dword [ebp - 0x1c]
mov ecx, eax
xor ecx, edi
and eax, edi
mov edi, esi
xor edi, dword [ebp - 0x18]
and esi, dword [ebp - 0x18]
shrd edi, ecx, 1
shr ecx, 1
add esi, edi
adc ecx, eax
and edx, 0x80000000
shrd dword [ebp - 0x14], ebx, 1
shr ebx, 1
or ebx, edx
mov edx, dword [ebp - 0x24]
mov eax, esi
mov edi, ecx
mov ecx, dword [ebp - 0x20]
dec edx
jne 0x5ebebe
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ebx
xor eax, eax
inc eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xaa
push str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
push 0x69
push 0
push 3
call fcn.006d2a00
add esp, 0x14
xor eax, eax
jmp 0x5ebf1a
jne 0x5ebf53
jmp 0x5ebf49
mov dword [ebx + 0x18], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x20], 0
mov eax, dword [esi]
mov edx, dword [eax]
xor ecx, ecx
jmp 0x5ebea3
push 0xae
push str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
push 0x68
jmp 0x5ebf2e
xor esi, esi
mov edi, 0x800
or esi, dword [ecx + edi*4]
inc edi
cmp eax, edi
jne 0x5ebf73
test esi, esi
je 0x5ebe54
push 0xb6
push str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
push 0x66
jmp 0x5ebf2e
push 0xb2
push str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
push 0x6d
jmp 0x5ebf2e
push 0xbc
push str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
push 0x44
jmp 0x5ebf2e
Function at 0x5ec960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x11c]
test eax, eax
jle 0x5ecb27
mov edx, dword [edx + 0x118]
mov esi, eax
cmp dword [edx + esi*4 - 4], 0
je 0x5ecae9
lea edi, [esi - 1]
shl edi, 5
mov esi, dword [edx + esi*4 - 4]
xor edx, edx
test esi, esi
setne dl
mov dword [ebp - 0x18], edx
mov edx, esi
shr edx, 0x10
cmp esi, 0x10000
cmovb edx, esi
mov ebx, 0
setae bl
shl ebx, 4
mov dword [ebp - 0x14], ebx
mov esi, edx
shr esi, 8
xor ebx, ebx
cmp edx, 0x100
cmovb esi, edx
setae bl
mov dword [ebp - 0x10], ebx
mov edx, esi
shr edx, 4
xor ebx, ebx
cmp esi, 0x10
cmovb edx, esi
setae bl
mov dword [ebp - 0x1c], ebx
mov esi, edx
shr esi, 2
xor ebx, ebx
cmp edx, 4
cmovb esi, edx
setae bl
mov edx, dword [ebp - 0x18]
or edx, edi
add edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
lea edx, [edx + edi*8]
mov edi, dword [ebp - 0x1c]
lea edx, [edx + edi*4]
lea edx, [edx + ebx*2]
cmp esi, 2
sbb edx, 0xffffffff
add edx, 7
shr edx, 3
cmp edx, ecx
jne 0x5ecafe
lea edx, [eax*4]
cmp edx, ecx
jb 0x5ecb22
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
cmp ecx, 4
jb 0x5eca52
mov esi, dword [edi + ecx - 4]
add ecx, 0xfffffffc
bswap esi
mov dword [edx], esi
add edx, 4
dec eax
cmp ecx, 3
ja 0x5eca3e
test ecx, ecx
je 0x5eca73
xor esi, esi
xor edi, edi
mov ebx, edi
shl ebx, 8
mov edi, dword [ebp + 0x10]
movzx edi, byte [edi + esi]
or edi, ebx
inc esi
cmp ecx, esi
jne 0x5eca5a
mov dword [edx], edi
add edx, 4
dec eax
shl eax, 2
test eax, eax
jne 0x5ecb36
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x11c]
mov dword [ebp - 0x10], 0x14b
test ecx, ecx
je 0x5ecb05
mov eax, dword [eax + 0x118]
mov dword [ebp - 0x14], eax
xor edx, edx
xor ebx, ebx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + ebx*4]
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + ebx*4]
mov ecx, esi
xor ecx, edi
mov eax, esi
sub eax, edi
lea edi, [ecx - 1]
xor eax, esi
or eax, ecx
not ecx
and edi, ecx
mov ecx, dword [ebp - 0x18]
xor eax, esi
sar edi, 0x1f
sar eax, 0x1f
or eax, 1
xor edx, eax
and edx, edi
xor edx, eax
inc ebx
cmp ecx, ebx
jne 0x5ecaa2
test edx, edx
jns 0x5ecb05
xor eax, eax
inc eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
lea edi, [esi - 1]
cmp esi, 1
mov esi, edi
jg 0x5ec985
xor edx, edx
jmp 0x5eca1c
mov dword [ebp - 0x10], 0x144
push dword [ebp - 0x10]
push str....._third_party_boringssl_srccrypto_fipsmoduleec_simple.c
push 0x80
push 0
push 0xf
call fcn.006d2a00
add esp, 0x14
xor eax, eax
jmp 0x5ecae1
call fcn.00665b29
je 0x5ecaf7
mov edx, dword [edx + 0x118]
mov esi, eax
jmp 0x5ec990
push eax
push 0
push edx
call fcn.006547d0
add esp, 0xc
jmp 0x5eca7e
Function at 0x5f03d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x5f03e8
cmp dword [ebp + 0x10], 0
jne 0x5f03e4
call fcn.00614230
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.005efe90
Function at 0x5f35e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov edx, dword [eax]
mov dword [esi], edx
mov dword [eax], ecx
mov ebx, dword [eax + 4]
mov dword [eax + 4], ecx
lea edi, [ebx + 1]
cmp edi, 2
jb 0x5f360c
call fcn.005e4650
cmp dword [esi + 4], ebx
je 0x5f3638
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 4]
inc ecx
cmp ecx, 2
jae 0x5f3644
cmp edi, 2
jb 0x5f3631
mov dword [esi + 4], ebx
mov edi, eax
call fcn.005e4650
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.005e4650
push dword [esi + 4]
call fcn.005cf200
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi + 4], 0
jmp 0x5f3620

Function at 0x5f3670
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [esi], ecx
xor ecx, ecx
mov dword [eax], ecx
mov ebx, dword [eax + 4]
mov dword [eax + 4], ecx
lea edi, [ebx + 1]
cmp edi, 2
jb 0x5f3697
call fcn.005e4650
cmp dword [esi + 4], ebx
je 0x5f36c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 4]
inc ecx
cmp ecx, 2
jae 0x5f36cf
cmp edi, 2
jb 0x5f36bc
mov dword [esi + 4], ebx
mov edi, eax
call fcn.005e4650
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.005e4650
push dword [esi + 4]
call fcn.005cf200
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi + 4], 0
jmp 0x5f36ab

Function at 0x5f36f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov dword [ecx], 1
xor eax, eax
mov dword [ecx + 4], eax
mov ebx, dword [ebp + 8]
mov dword [ebp + 8], eax
lea edi, [ebx + 1]
cmp edi, 2
jb 0x5f3717
call fcn.005e4650
lea ecx, [ebp + 8]
cmp dword [esi + 4], ebx
je 0x5f3749
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 4]
inc ecx
cmp ecx, 2
jae 0x5f375d
cmp edi, 2
jb 0x5f373f
mov dword [esi + 4], ebx
mov edi, eax
call fcn.005e4650
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp + 8]
mov eax, dword [ecx]
inc eax
cmp eax, 2
jae 0x5f377c
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.005e4650
push dword [esi + 4]
call fcn.005cf200
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi + 4], 0
jmp 0x5f372e
mov edi, ecx
call fcn.005e4650
push dword [edi]
call fcn.005cf200
add esp, 4
jmp 0x5f3751
Function at 0x5f7280
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x5f72fe
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x5f72e7
lea eax, [edi + 1]
cmp eax, 2
jb 0x5f72cb
mov dword [esi], edi
call fcn.005e4650
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 0
inc eax
cmp eax, 1
jbe 0x5f7302
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.005e4650
push dword [esi]
call fcn.005cf200
add esp, 4
mov dword [esi], 0
jmp 0x5f72bc
mov byte [esi + 4], 0
int3

Function at 0x5fb110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x5fb146
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
nop word [eax + eax]
movzx eax, byte [ecx + esi]
xor al, byte [edx + esi]
or bl, al
inc esi
cmp edi, esi
jne 0x5fb130
movzx eax, bl
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x5fb141
Function at 0x5ffed0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2010
call fcn.00651b20
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x7abe2c]
cmp eax, 0xffffffff
jne 0x5fff1b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
add esp, 0x2010
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
push dword [ebp - 0x2018]
call fcn.00594da0
add esp, 8
jmp 0x5ffef4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x5ffef4
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.00654250
add esp, 0xc
mov ecx, dword [0x7abe2c]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x2018], ecx
push ecx
call fcn.00594da0
add esp, 8
test ebx, ebx
je 0x5fff6a
push ebx
call fcn.0065082c
add esp, 4
mov esi, 0x101
lea edi, [ebp - 0x2010]
mov eax, dword [0x7beb6c]
mov ecx, dword [0x7ad2c4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x6000c1
mov ebx, dword [0x7beb68]
push ebx
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x600123
push 0x1000
push 0x7bdb64
lea eax, [ebp - 0x1810]
push eax
call fcn.00654250
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push 0x800
push 0xff
push edi
call fcn.006547d0
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x1804]
nop word cs:[eax + eax]
mov edx, dword [ecx]
mov dword [ebp + eax*8 - 0x2010], edx
mov word [ebp + eax*8 - 0x200c], ax
inc eax
add ecx, 0x10
cmp eax, 0x100
jne 0x5ffff0
mov ecx, edi
lea edx, [ebp - 0x1810]
push 1
push 0x10
call fcn.00600130
add esp, 8
mov ebx, 4
xor eax, eax
nop word [eax + eax]
movzx edx, word [ebp + ebx - 0x2010]
mov edi, dword [ebp + edx*8 - 0x810]
test edi, edi
jne 0x600068
add ebx, 8
cmp ebx, 0x804
jne 0x600030
dec esi
je 0x60010c
test al, 1
lea edi, [ebp - 0x2010]
jne 0x5fff75
jmp 0x5fff09
mov dword [ebp - 0x2014], eax
mov eax, esi
mov ecx, edx
shl ecx, 4
cmp dword [ebp + ecx - 0x1810], 0
je 0x600116
add ecx, ebp
add ecx, 0xffffe7f0
mov esi, dword [ebp + edx*8 - 0x80c]
cmp esi, dword [ecx + 8]
jne 0x600116
mov ecx, dword [ecx + 4]
test ecx, ecx
mov esi, eax
mov eax, dword [ebp - 0x2014]
je 0x600043
mov dword [ebp + edx*8 - 0x810], 0
call dword [0x7a29f4]
push edi
call ecx
add esp, 4
mov al, 1
jmp 0x600043
push 0x7beb6c
call fcn.00650831
add esp, 4
cmp dword [0x7beb6c], 0xffffffff
jne 0x5fff96
push 4
call fcn.006507be
add esp, 4
mov ebx, eax
mov dword [eax], 0
mov ecx, eax
call fcn.005d0780
mov dword [0x7beb68], ebx
push 0x7beb6c
call fcn.006508ab
add esp, 4
jmp 0x5fff96
call fcn.006a7ec0
jmp 0x5fff09
mov esi, eax
mov eax, dword [ebp - 0x2014]
jmp 0x600043
mov ecx, ebx
call fcn.005d0790
jmp 0x5fffab
Function at 0x601570
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00601a70
add esp, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
call fcn.006029f0
test eax, eax
je 0x60159d
mov ecx, eax
call fcn.00602a00
mov ebx, dword [0x7beb78]
cmp ebx, 1
jbe 0x60175c
push ebx
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x6016de
mov edi, dword [0x7beb80]
xor esi, esi
test edi, edi
je 0x6016af
mov eax, dword [0x7beb78]
cmp eax, 1
mov dword [ebp - 0x10], ebx
jbe 0x60171f
mov esi, dword [edi + 4]
test esi, esi
je 0x6016d7
imul eax, dword [ebp - 0x18], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0xde8f4ca8
imul ecx, dword [ebp - 0x14], 0x5bd1e995
mov edx, ecx
shr edx, 0x18
xor edx, ecx
imul ecx, edx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, ecx
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul ebx, edx, 0x1010101
shr ebx, 0x18
cmp ebx, 1
jbe 0x6016ea
mov edx, ecx
cmp ecx, esi
jb 0x60167b
mov eax, ecx
xor edx, edx
div esi
mov eax, dword [edi]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x6016d7
mov edi, dword [eax]
test edi, edi
je 0x6016d7
cmp ebx, 2
mov dword [ebp - 0x1c], edx
jb 0x601702
mov ebx, dword [ebp - 0x10]
mov eax, dword [edi + 4]
cmp ecx, eax
jne 0x6016c0
mov eax, dword [edi + 8]
xor eax, dword [ebp - 0x18]
mov edx, dword [edi + 0xc]
xor edx, dword [ebp - 0x14]
or edx, eax
jne 0x6016cf
mov esi, dword [edi + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
cmp eax, esi
jb 0x6016ca
xor edx, edx
div esi
mov eax, edx
cmp eax, dword [ebp - 0x1c]
jne 0x6016da
mov edi, dword [edi]
test edi, edi
jne 0x601695
jmp 0x6016da
mov ebx, dword [ebp - 0x10]
xor esi, esi
jmp 0x6016af
mov ecx, ebx
call fcn.005d0790
jmp 0x6015bb
lea edx, [esi - 1]
and edx, ecx
jmp 0x60167b
and eax, esi
cmp eax, edx
jne 0x6016da
mov edi, dword [edi]
test edi, edi
mov edx, dword [ebp - 0x1c]
jne 0x601706
jmp 0x6016da
dec esi
mov ebx, dword [ebp - 0x10]
mov eax, dword [edi + 4]
cmp ecx, eax
jne 0x6016f1
mov eax, dword [edi + 8]
xor eax, dword [ebp - 0x18]
mov edx, dword [edi + 0xc]
xor edx, dword [ebp - 0x14]
or edx, eax
je 0x6016ac
jmp 0x6016f7
push 0x7beb78
call fcn.0053bfb0
add esp, 4
test al, al
je 0x6017a9
xor esi, esi
mov dword [0x7beb7c], esi
mov ebx, 0x7beb78
mov ecx, 0x7beb7c
call fcn.005d0780
push ebx
push esi
push 0x7beb7c
push ebx
call fcn.0053c080
add esp, 0x10
jmp 0x6015dc
push 0x7beb78
call fcn.0053bfb0
add esp, 4
test al, al
je 0x60179e
xor esi, esi
mov dword [0x7beb7c], esi
mov edi, 0x7beb78
mov ebx, 0x7beb7c
mov ecx, 0x7beb7c
call fcn.005d0780
push edi
push esi
push 0x7beb7c
push edi
call fcn.0053c080
add esp, 0x10
jmp 0x6015ac
mov ebx, dword [0x7beb78]
jmp 0x6015ac
mov eax, dword [0x7beb78]
jmp 0x6015dc