joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481250
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
push edi
lea edi, [esi + 0x10]
jne 0x48127b
push dword [esi + 8]
push dword [esi + 4]
push esi
push str.Thread_0x_p_0x_p_0x_x_
push 0x1f
push edi
call fcn.004643e0
add esp, 0x18
mov byte [esi + 0x2f], 0
push edi
push str.WARNING__CThread::Terminate:__s_n
call fcn.004777d0
add esp, 8
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x4812a1
pop edi
xor al, al
pop esi
pop ebp
ret 4
mov eax, dword [esi + 4]
push eax
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [esi + 8], 0
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x4819a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592e30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x218]
call fcn.00481800
mov dword [ebp - 4], 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
cmp eax, ecx
je 0x4819fe
push eax
call fcn.0056b4c4
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x481be0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592e30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x218]
call fcn.00481800
mov dword [ebp - 4], 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
cmp eax, ecx
je 0x481c3e
push eax
call fcn.0056b4c4
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4826f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push ebx
push esi
push edi
push str._noassert
call fcn.00476720
add esp, 4
test al, al
jne 0x4828c3
push str._nocrashdialog
call fcn.00476720
add esp, 4
test al, al
jne 0x4828c3
call fcn.00481680
test al, al
jne 0x48273b
call fcn.004777f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str._debugbreak
call fcn.00476720
add esp, 4
test al, al
je 0x482755
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x64d48c], 0
je 0x4828c3
mov esi, dword [0x6a9f10]
mov dword [ebp - 4], 0x6a9f10
test esi, esi
je 0x482809
jmp 0x482780
mov edi, dword [esi + 0x20c]
lea ebx, [esi + 0x20c]
push esi
push dword [ebp + 8]
call fcn.0057d4e6
add esp, 8
test eax, eax
jne 0x4827fc
mov ecx, dword [esi + 0x200]
mov al, 1
cmp ecx, 0xffffffff
jne 0x4827b7
xor edx, edx
movzx eax, al
cmp dword [esi + 0x204], ecx
cmove eax, edx
mov edx, dword [ebp + 0xc]
cmp edx, ecx
jl 0x4827c6
cmp edx, dword [esi + 0x204]
jle 0x4827ca
test al, al
jne 0x4827fc
mov eax, dword [esi + 0x208]
test eax, eax
jle 0x4828c3
add eax, 0xffffffff
mov dword [esi + 0x208], eax
jne 0x4828c3
mov eax, dword [ebp - 4]
push 0x210
push esi
mov dword [eax], edi
call fcn.0056b425
add esp, 8
jmp 0x4827ff
mov dword [ebp - 4], ebx
mov esi, edi
test edi, edi
jne 0x482780
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [0x6a9f14], ebx
mov dword [0x6a9f18], esi
mov dword [0x6a9f1c], edi
mov byte [0x6a9f0a], 0
mov dword [0x6a9f20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4826b0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x6a9f20]
test eax, eax
jne 0x4828a1
push edi
push esi
push ebx
push str.File:__s_nLine:__d_n_Ts_n_nClick_OK_to_dismiss_or_Cancel_to_disable_assert_dialogs_for_this_process.
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.004643e0
add esp, 0x18
mov byte [ebp - 5], 0
lea eax, [ebp - 0x804]
push 0x2001
push str.Assert_Dialog
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x4828b7
mov al, byte [0x6a9f0a]
pop edi
pop esi
mov byte [0x64d48c], 0
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x482320
push eax
push 0x65
push dword [0x6a9f0c]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov al, byte [0x6a9f0a]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x483950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
call fcn.004837e0
test al, al
je 0x483aec
push ebx
push esi
push edi
call fcn.004837c0
mov esi, eax
mov dword [ebp - 4], ebp
mov dword [ebp - 8], esp
push 0x108
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.0056cde0
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x10c], 3
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xec], 3
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xdc], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0x6aa1b0
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
xor edi, edi
cmp dword [ebp + 0xc], edi
jle 0x483a7a
mov ebx, dword [ebp + 0x10]
lea ebx, [ebx]
push 0
push dword [0x6aa1e8]
lea eax, [ebp - 0x118]
push dword [0x6aa1e4]
push 0
push 0
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x14c
call dword [0x6aa1cc]
test eax, eax
je 0x483a7a
mov eax, dword [ebp - 0xf8]
or eax, dword [ebp - 0xf4]
je 0x483a7a
cmp edi, ebx
jle 0x483a74
mov edx, dword [esi + 0xa0]
cmp edx, 0x14
jge 0x483a74
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x114]
mov dword [esi + edx*8], eax
mov dword [esi + edx*8 + 4], ecx
inc dword [esi + 0xa0]
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x483a10
push 0x6aa1b0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [esi + 0xa0]
xor edi, edi
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
test ebx, ebx
jle 0x483ae9
jmp 0x483ab0
mov edx, dword [esi + 0xa8]
mov ecx, dword [esi + 0xac]
shld ecx, edx, 2
shl edx, 2
mov dword [esi + 0xa8], edx
mov dword [esi + 0xac], ecx
xor edx, dword [esi + edi*8]
mov eax, dword [esi + edi*8 + 4]
inc edi
xor eax, ecx
mov dword [esi + 0xa8], edx
mov dword [esi + 0xac], eax
cmp edi, ebx
jl 0x483ab0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484400
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x592fc3
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword fs:[0x2c]
mov edx, dword [0x6acf18]
push esi
push edi
mov edx, dword [eax + edx*4]
mov edi, ecx
mov eax, dword [0x6aa224]
cmp eax, dword [edx + 4]
jg 0x484564
mov dword [ebp - 0x10], 0x6aa1fc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov esi, 0x6aa1fc
cmp edx, dword [0x6aa1fc]
je 0x484473
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x484473
pause
push edx
mov ecx, esi
call fcn.00480ec0
jmp 0x48447a
lock inc dword [0x6aa200]
push ebx
mov dword [ebp - 4], 2
mov ebx, dword [ebp + 8]
cmp ebx, dword [edi + 0x20]
je 0x484533
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [edi + 0x20], ebx
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
mov dword [ebp + 8], ebx
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004794b0
mov eax, dword [eax + 4]
test eax, eax
je 0x4844f3
cmp eax, dword [edi + 4]
je 0x4844f3
mov eax, dword [eax + 0xc]
mov dword [edi + 0x24], eax
jmp 0x484536
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4844f8
sub esi, ecx
inc esi
push esi
call fcn.0057ac09
push esi
push ebx
push eax
mov dword [edi + 0x24], eax
call fcn.0056d100
mov eax, dword [edi + 0x24]
add esp, 0x10
mov dword [ebp - 0x14], eax
mov ecx, edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00484000
mov esi, 0x6aa1fc
mov eax, dword [edi + 0x24]
mov dword [ebp - 4], 0xffffffff
lock dec dword [0x6aa200]
cmp dword [0x6aa200], 0
pop ebx
jne 0x484552
xor ecx, ecx
xchg dword [esi], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push 0x6aa224
call fcn.0056b84d
add esp, 4
cmp dword [0x6aa224], 0xffffffff
jne 0x48443f
mov dword [ebp - 4], 0
mov ecx, 0x6aa204
mov dword [0x6aa1fc], 0
mov dword [0x6aa200], 0
call fcn.00480ac0
mov byte [ebp - 4], 0
push 0x593850
call fcn.0056b705
mov dword [ebp - 4], 0xffffffff
push 0x6aa224
call fcn.0056b803
add esp, 8
jmp 0x48443f
Function at 0x4845d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592fdd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x14], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x48475f
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.0047eb60
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x48471c
mov edi, edi
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp + 8], eax
cmp ebx, esi
jne 0x4846a1
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x48470f
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x4846d8
mov eax, dword [eax]
cmp eax, ecx
je 0x4846d0
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x48470f
cmp ebx, eax
je 0x4846ec
lea esp, [esp]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x48473d
cmp ebx, eax
jne 0x4846e0
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [ebp - 0x14]
mov ecx, edx
cmp edx, esi
jne 0x484650
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
jmp 0x48470f
push str.invalid_hash_bucket_count
call fcn.0056b358
int3
Function at 0x484770
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592cbd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], ebx
cmp edx, esi
je 0x48491d
mov ecx, dword [ebx + 4]
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [edx + 4]
push edi
mov edi, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 4], 0
mov eax, dword [edx + 4]
mov dword [ebp - 0x24], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
xor ecx, eax
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp + 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
lea ebx, [ebx]
cmp edi, eax
mov eax, edi
mov edi, dword [edi]
push 0x10
push eax
sete bl
mov dword [ebp - 0x2c], edi
call fcn.0056b425
mov edx, dword [ebp - 0x10]
add esp, 8
dec dword [edx + 8]
test bl, bl
jne 0x48485e
mov eax, dword [ebp - 0x20]
cmp edi, esi
jne 0x484820
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jne 0x48490d
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edi
jmp 0x48490d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
cmp eax, dword [ebp + 8]
jne 0x484870
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
jmp 0x484873
mov eax, dword [ebp - 0x24]
mov dword [ecx + 4], eax
cmp edi, esi
je 0x48490d
mov edi, edi
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor ecx, eax
movzx eax, byte [edi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + ecx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], eax
cmp edi, eax
mov eax, edi
mov edi, dword [edi]
push 0x10
push eax
sete bl
mov dword [ebp - 0x2c], edi
call fcn.0056b425
mov eax, dword [ebp - 0x10]
add esp, 8
dec dword [eax + 8]
test bl, bl
jne 0x4848f1
cmp edi, esi
je 0x484908
mov eax, dword [ebp + 0xc]
jmp 0x4848c7
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp edi, esi
je 0x48490d
mov edx, dword [ebp - 0x10]
jmp 0x484880
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
mov dword [eax], edi
mov dword [edi + 4], eax
pop edi
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4866b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x18], 0x20
jb 0x4866cc
xor al, al
mov esp, ebp
pop ebp
ret
push 0x5dee4c
call fcn.00486780
add esp, 4
test eax, eax
jne 0x4866f6
push str.AuthenticAMD
call fcn.00486780
add esp, 4
test eax, eax
jne 0x4866f6
xor cl, cl
mov al, cl
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
setne cl
test eax, eax
je 0x486776
mov eax, dword [ebp - 4]
push edi
cmp dword [ebp - 8], eax
je 0x486741
mov edi, dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push eax
push esi
call edi
test eax, eax
setne cl
test eax, eax
je 0x48673e
push dword [ebp - 8]
push esi
call edi
test eax, eax
setne cl
mov eax, dword [ebp - 4]
test cl, cl
je 0x486775
cmp eax, 1
jbe 0x486775
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov esi, eax
push esi
call edi
test eax, eax
je 0x486773
push eax
push esi
call edi
test eax, eax
pop edi
setne cl
pop esi
mov al, cl
mov esp, ebp
pop ebp
ret
xor cl, cl
pop edi
pop esi
mov al, cl
mov esp, ebp
pop ebp
ret
Function at 0x486d90
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x593151
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, dword [edi]
test ecx, ecx
je 0x486dbe
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi], 0
cmp esi, 4
jne 0x486e1d
call fcn.004864d0
test eax, eax
jne case.0x486e26.2
call fcn.004866b0
test al, al
je case.0x486e26.0
push 0x34
call fcn.0056b3f5
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 3
test eax, eax
je 0x486e67
mov ecx, eax
call fcn.00485650
mov dword [ebp - 4], 0xffffffff
mov dword [edi], eax
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
cmp esi, 3
ja case.0x486e26.0
jmp dword [esi*4 + 0x486fd4]
push 0x1c
call fcn.0056b3f5
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x486e67
mov ecx, eax
call fcn.00485a10
mov dword [ebp - 4], 0xffffffff
mov dword [edi], eax
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [edi], eax
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push 0x14
call fcn.0056b3f5
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
test esi, esi
je 0x486fb7
mov dword [esi], vtable.ICpuTopology.0
mov byte [ebp - 4], 2
mov dword [esi], vtable.GlpiImpl.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.004864d0
test eax, eax
jne 0x486ee5
push str.IsSupported__
push 0x292
push str.c:_buildslave_steam_rel_client_win32_build_src_tier0CPUTopology.cpp
call fcn.00476e80
add esp, 0xc
test al, al
jne 0x486ee5
int3
push ebx
call fcn.004864d0
mov ebx, eax
test ebx, ebx
jne 0x486f0d
push str.pGlpi
push 0x295
push str.c:_buildslave_steam_rel_client_win32_build_src_tier0CPUTopology.cpp
call fcn.00476e80
add esp, 0xc
test al, al
jne 0x486f0d
int3
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0
call ebx
push dword [ebp + 8]
call fcn.0057ac09
add esp, 4
mov dword [esi + 4], eax
lea ecx, [ebp + 8]
push ecx
push eax
call ebx
mov eax, 0xaaaaaaab
mov dword [esi + 0x10], 0
mul dword [ebp + 8]
pop ebx
shr edx, 4
mov dword [esi + 8], edx
test edx, edx
je 0x486f61
mov eax, dword [esi + 4]
add eax, 4
cmp dword [eax], 0
jne 0x486f59
inc dword [esi + 0x10]
add eax, 0x18
sub edx, 1
jne 0x486f51
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
jmp 0x486fb9
push 8
call fcn.0056b3f5
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
mov dword [ebp - 4], 4
test esi, esi
je 0x486fb7
mov dword [esi], vtable.ICpuTopology.0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x58]
push eax
mov dword [esi], vtable.DefaultImpl.0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
mov dword [esi + 4], eax
mov byte [ebp - 4], 4
jmp 0x486fb9
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [edi], esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x486ff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push ebx
push esi
mov esi, ecx
mov cl, byte [ebp + 0xc]
mov byte [esi], al
mov byte [esi + 1], cl
cmp cl, al
jbe 0x48700b
mov byte [esi + 1], al
mov cl, al
xor edx, edx
movzx eax, al
movzx ecx, cl
div ecx
mov dl, 8
mov cl, 0x80
dec al
jmp 0x487020
test al, cl
jne 0x48702a
dec dl
shr cl, 1
jne 0x487020
mov bl, byte [esi + 1]
mov cl, 8
mov byte [esi + 2], dl
dec bl
mov al, 0x80
test bl, al
jne 0x487040
dec cl
shr al, 1
jne 0x487036
mov al, 8
mov byte [esi + 4], cl
sub al, cl
or bl, 0xff
sub al, dl
movzx ecx, cl
mov byte [esi + 6], al
movzx eax, dl
or dl, 0xff
add ecx, eax
shl dl, cl
mov ecx, eax
shl bl, cl
mov al, bl
mov byte [esi + 7], dl
not bl
xor al, dl
mov byte [esi + 3], bl
mov byte [esi + 5], al
pop esi
pop ebx
pop ebp
ret 8

Function at 0x5869e0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00586856

Function at 0x58a227
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00589d7a
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x40ed63
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x40eae0
add edx, ebx
and edx, ebx
call fcn.0040ed9f
or ebx, edx
and edx, ebx
xor dword [ecx], esi
sub ebx, 1
push ebx
pop ebx
add ecx, 1
dec edx
add edx, 0xc54fd319
cmp ecx, eax
jne fcn.0040ed63
and edx, edx
sub ebx, 0x13a00687
ret
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
add ch, ah
and ch, ah
js 0x401e9d
mov esi, dword [ebp + 0xc]
push esi
adc byte [ebp - 0x78], al
push 0x78
push eax
sub ebp, eax
mov dword [eax], ebp
add byte [ebx + 0x158b08db], cl
enter 0x40c0, 0
push eax
push ecx
add edx, 0xffffff8b
bound ebp, qword [esp + edx*8 - 0xadffcc]
adc eax, 0xc584a2a4
mov eax, dword [0x4169ac]
add esp, 0xffffff91
test dword [ebx + 0x74], esi
mov word [eax + 0x68], ss
push esp
ror byte [0x9615ff00], cl
sub dword [eax - 0x75], eax
add esp, 8
push esi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
shr byte [eax + edx*4], cl
nop
nop
nop
nop
nop
lcall 0x83ec, 0x34979090
in al, dx
adc al, 0x29
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi - 0x4d]
mov dword [ebp + 0x2e], eax
call 0xd6c19a
mov dword [0x4a0ba0], eax
mov dword [0x410ba4], edx
mov ebx, eax
mov eax, ecx
adc al, 0x85
inc edi
mov edi, edx
jne 0x401f0d
mov ecx, dword [esi + 4]
mov dword [0xa13b842e], eax
jo 0x401f04
inc ecx
add byte [ebx - 0x7644fc36], cl
dec esi
adc al, 0xeb
mov ecx, edx
add edi, dword [ebx - 0x14ebb177]
sub eax, 0x85388e01
add byte [eax], al
add dword [esi + 0x8538], ecx
mov eax, dword [0x40d028]
movsd dword es:[edi], dword [esi]
adc eax, 0x40d02c
add ecx, eax
mov eax, ecx
cmp dword [eax], ecx
add byte [eax], al
adc eax, edx
cmp edi, eax
salc
pop ecx
in eax, 0
add byte [eax], al
jl 0x401f3a
cmp ebp, ebp
ret
mov edx, dword [esi + 0x18]
mov ebx, dword [0x40d030]
mov eax, dword [esi + 4]
lea ecx, [ebp + 8]
xor ebx, edx
push 0x6de85052
imul eax, dword [eax], 0
test eax, eax
je 0x401f53
cmp eax, 0xb
inc ecx
cmp eax, 0xafd68
shl dword [edi], 1
cmp eax, 0xafcd9
je 0x401efb
cmp eax, 0xafd57
outsd dx, dword [esi]
sbb dword [0x2fdffd44], edi
je 0x401fec
cmp eax, 0x7afc32
mov edx, 0x23b33d0b
or eax, dword [eax]
btc dword [esi - 0x74ff9fda], esp
lcall 0x4102, 0xa01d8b08
rcl byte [eax]
cmp eax, 0x4102a4
add edx, dword [esi]
mov esp, dword [esi]
add byte [ecx + 0x41023288], cl
add byte [ecx + 0x4102a43d], cl
add byte [ebx + 0x4e8bfe56], cl
adc al, 3
sal dh, 1
enter 0xffffffffffffdd89, 0xffffffffffffff87
mov dword [esi + 0x14], ecx
jne 0xff7c1e1f
mov dword [esi - 0x42], 0xed03
call 0x64410f00
pushal
mov al, byte [0x8900410b]
adc eax, 0x410b2d
pop ds
push esi
add al, 0x89
mov edi, 0x840
mov ecx, dword [0x17410ba4]
mov eax, 0xdd01
mov dword [eax + esi*8 + 0x66], ebp
mov dword [ebp - 0xc], eax
mov dword [esi + 0x844], ecx
and eax, 0x4158420d
add byte [ebp + 0x894a45], cl
clc
push eax
push ecx
salc
out 0xfc, al
call fcn.004060c0
pop edi
sbb dh, bh
mov esp, ebp
pop ebp
ret
insb byte es:[edi], dx
invalid