joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433e60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], esi
mov dword [ebx + 0xc], eax
call fcn.00434013
xor edi, edi
mov dword [ebp - 0x1c], edi
test esi, esi
je 0x433fec
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
add esi, 2
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], esi
cmp byte [edi + eax], 0
jl 0x433fc3
movzx eax, byte [esi - 2]
xor eax, 0x811c9dc5
mov dword [ebp - 8], 0
imul ecx, eax, 0x1000193
movzx eax, byte [esi - 1]
xor ecx, eax
movzx eax, byte [esi]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 1]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 5]
mov esi, dword [ebx]
mov edi, esi
imul ecx, ecx, 0x1000193
shr edi, 5
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0xc], ecx
xor edi, eax
mov dword [ebp - 0x20], eax
shr edi, 7
and edi, ecx
mov edx, dword [esi + edi]
mov ebx, dword [esi + edi + 4]
not edx
not ebx
and edx, 0x1010101
and ebx, 0xff010101
shld ebx, edx, 7
and ebx, dword [esi + edi + 4]
shl edx, 7
and edx, dword [esi + edi]
mov eax, edx
or eax, ebx
je 0x434000
mov dword [ebp - 8], 0
test edx, edx
je 0x433ff5
bsf eax, edx
mov ebx, dword [ebp - 0x20]
sar eax, 3
and bl, 0x7f
add eax, edi
mov edi, dword [ebp - 0x1c]
and eax, dword [ebp - 0xc]
mov byte [esi + eax], bl
lea edx, [eax - 8]
mov esi, dword [ebp - 0x10]
shl eax, 4
mov ecx, dword [esi + 0xc]
and edx, ecx
and ecx, 7
add edx, ecx
mov ecx, dword [esi]
mov byte [edx + ecx + 1], bl
mov ebx, esi
mov esi, dword [ebp - 4]
add eax, dword [ebx + 4]
mov ecx, dword [esi - 2]
mov dword [eax], ecx
mov ecx, dword [esi + 2]
mov dword [eax + 4], ecx
mov ecx, dword [esi + 6]
mov dword [eax + 8], ecx
mov ecx, dword [esi + 0xa]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
inc edi
add esi, 0x10
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], esi
cmp edi, ecx
jne 0x433ea6
cmp byte [0x5a2ee5], 0
jne 0x433fec
test eax, eax
je 0x433fec
push eax
call dword [sym.imp.tbbmalloc.dll_scalable_free]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
bsf eax, ebx
add eax, 0x20
jmp 0x433f71
mov eax, dword [ebp - 8]
add eax, 8
add edi, eax
mov dword [ebp - 8], eax
and edi, dword [ebp - 0xc]
jmp 0x433f30
Function at 0x43c013
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0x20
mov eax, 0x48b5a6
call fcn.0047ebf1
mov edi, ecx
mov esi, dword [ebp + 8]
jmp 0x43c0d1
mov ebx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ecx + esi]
xor eax, ebx
imul ebx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x43c030
push ebx
push esi
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.0043c105
cmp dword [ebp - 0x18], 0
jne 0x43c0ce
cmp dword [edi + 8], 0x71c71c7
je 0x49ee00
lea eax, [edi + 4]
mov dword [ebp - 0x24], eax
and dword [ebp - 4], 0
and dword [ebp - 0x20], 0
push 0x24
pop ecx
call fcn.0043d6d0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], eax
lea ecx, [eax + 8]
mov eax, dword [esi]
mov dword [ecx], eax
xor eax, eax
mov dword [ebp + 8], ecx
add ecx, 4
mov dword [ebp - 0x14], ecx
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
lea eax, [esi + 4]
mov byte [ebp - 4], 1
push eax
call fcn.0043c150
mov ecx, edi
mov dword [ebp - 4], 2
call fcn.0043bf78
test al, al
jne 0x43c0e2
mov ecx, dword [ebp - 0x1c]
push dword [ebp - 0x10]
and dword [ebp - 0x20], 0
push ecx
push ebx
mov ecx, edi
call fcn.0043bfc3
or dword [ebp - 4], 0xffffffff
add esi, 0x1c
cmp esi, dword [ebp + 0xc]
jne 0x43c029
call fcn.0047ebbf
ret 8
mov ecx, edi
call fcn.0046d313
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.0043c105
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
jmp 0x43c0ba
push 0x405abc
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
int3
Function at 0x44e06b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
movzx edx, word [ecx + 0x40]
mov ax, word [ebp + 0xc]
push ebx
push esi
push edi
test dx, dx
je 0x44e08e
cmp dx, ax
jne 0x4aa360
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov edx, 0xa641
cmp ax, dx
je 0x4aa4e4
mov word [ecx + 0x40], ax
mov ecx, 0x3a64
cmp ax, cx
je 0x44e0bf
cmp byte [0x5a2ee5], 0
jne 0x44e087
mov dword [0x5a10f8], 0x2c
jmp 0x44e087
mov byte [0x5a4f22], 1
jmp 0x44e0aa
mov bl, byte [ebp + 0x10]
mov edi, 0x3a64
movzx esi, ax
cmp esi, edi
ja 0x4aa45f
je 0x4aa42d
mov eax, esi
sub eax, 0x14c
je 0x4aa428
sub eax, 0x74
je 0x4aa3db
dec eax
sub eax, 1
je 0x4aa3d1
dec eax
sub eax, 1
je 0x4aa3a2
sub eax, 0xcf8
jne 0x4aa48b
mov ecx, esi
call fcn.004304ff
mov ecx, edx
mov esi, eax
call fcn.004304ff
push eax
push esi
test bl, bl
je 0x4aa4f1
push 0x10b0
push dword [ebp + 8]
call fcn.004fd88b
add esp, 0x10
jmp 0x44e087
mov eax, 0x1c4
jmp 0x4aa4a6
mov eax, 0x1c4
cmp dx, ax
jne 0x4aa3a2
cmp dword [0x5a303c], 6
mov byte [0x5a3010], 1
jne 0x44e087
cmp byte [0x5a2ee5], 0
jne 0x4aa40f
test byte [ecx + 0x150], 0x40
jne 0x44e087
xor eax, eax
mov edx, 0x429d00
push eax
push eax
push eax
push eax
xor cl, cl
call fcn.004708d7
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dx, di
jmp 0x4aa4a9
mov eax, 0x14c
cmp dx, ax
jne 0x4aa3a2
mov eax, dword [ecx + 0x238]
and eax, 0x200
or eax, 0
jne 0x4aa3a2
mov word [ecx + 0x40], di
mov byte [0x5a4f22], 1
jmp 0x44e087
mov eax, esi
sub eax, 0x8664
je 0x4aa484
sub eax, 0x1fdd
je 0x4aa4b4
sub eax, 0xd
je 0x4aa4a1
sub eax, 0x416
jne 0x4aa48b
cmp dx, di
je 0x44e087
mov eax, 0xa64e
jmp 0x4aa4a6
test bl, bl
jne 0x4aa3a2
push esi
push 0x459
push dword [ebp + 8]
call fcn.0047dc0b
mov eax, 0xaa64
cmp dx, ax
jne 0x4aa3a2
jmp 0x44e087
mov eax, 0xaa64
cmp dx, ax
je 0x4aa4c8
mov eax, 0x8664
cmp dx, ax
jne 0x4aa484
mov eax, dword [ecx + 0x238]
and eax, 0x200
or eax, 0
jne 0x4aa3a2
test bl, bl
jne 0x4aa3a2
push 0x570
push dword [ebp + 8]
call fcn.0047dc0b
push 0x458
push dword [ebp + 8]
call fcn.0047dc0b
int3

Function at 0x44e3f2
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
push edi
mov edi, edx
test byte [esi + 0x18], 8
jne 0x44e448
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x4aa55a
test byte [esi + 0x18], 2
mov dword [esi + 0x1c], eax
jne 0x44e44c
mov dword [esi + 0x24], eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
xor dl, dl
mov ecx, esi
call fcn.0044e47f
test al, al
je 0x44e47b
or byte [esi + 0x18], 4
test byte [esi + 0x18], 2
jne 0x44e45f
mov al, 1
pop edi
pop esi
leave
ret
xor eax, eax
jmp 0x44e417
test edi, edi
je 0x44e470
cmp dword [esi + 0x24], 0
jne 0x44e423
cmp edi, eax
jbe 0x44e477
mov dword [esi + 0x24], edi
jmp 0x44e423
mov ecx, esi
call fcn.004300ac
test al, al
je 0x44e442
or byte [esi + 0x18], 0x20
jmp 0x44e442
mov edi, 0x100000
jmp 0x44e450
mov edi, eax
jmp 0x44e45a
xor al, al
jmp 0x44e444
push dword [esi]
push 0x450
push 0
call fcn.0047dc0b
int3
Function at 0x457417
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
cmp dword [0x5a10fc], 0xffffffff
push esi
push edi
jne 0x457430
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [0x5a3e60]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x4af39c
mov esi, dword [0x5a3e64]
lea eax, [esp + 8]
sub esi, dword [0x5a3e60]
xor edi, edi
push edi
push eax
push edi
push esi
push dword [0x5a10fc]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x45749f
cmp esi, dword [esp + 8]
jne 0x45749f
cmp edi, dword [esp + 0xc]
jne 0x45749f
push dword [0x5a10fc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x45749f
push dword [0x5a10fc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x45749f
or dword [0x5a10fc], 0xffffffff
jmp 0x45742a
push dword [0x5a3024]
push 0x451
push edi
call fcn.0047dc0b
push dword [0x5a3024]
push 0x451
push 0
jmp 0x4574ab

Function at 0x457617
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0xc], edi
je 0x457647
test byte [esi + 0x18], 0x20
jne 0x4af3c2
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x457680
test byte [esi + 0x18], 2
jne 0x45764d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push edi
lea eax, [esp + 0xc]
push eax
push edi
push dword [esi + 0x1c]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x457680
cmp dword [esp + 0xc], edi
jne 0x457680
mov eax, dword [esi + 0x1c]
cmp eax, dword [esp + 8]
jne 0x457680
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x457647
push dword [esi]
push 0x451
push edi
call fcn.0047dc0b
push edi
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_FlushViewOfFile]
test eax, eax
jne 0x457634
jmp 0x457680
Function at 0x459f14
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x5a2fb8], 0
mov eax, dword [0x5a1100]
push esi
push edi
mov edi, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
mov dword [0x5a1100], 0x403fc0
jne 0x459f55
push 0x404508
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov dword [0x5a3ebc], eax
pop ecx
test eax, eax
jne 0x4b18a9
cmp dword [ebp + 8], 0
je 0x459f7c
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wdupenv_s]
mov ecx, dword [ebp - 4]
add esp, 0xc
test ecx, ecx
jne 0x4b18d0
and dword [0x5a2ff8], 0
xor esi, esi
inc esi
cmp dword [ebp - 8], esi
jle 0x459fa6
mov ecx, dword [edi + esi*4]
cmp word [ecx], 0x40
je 0x459fe8
push 0
push dword [ebp + 0x10]
xor dl, dl
call fcn.00459ffd
inc esi
cmp esi, dword [ebp - 8]
jl 0x459f8b
cmp dword [ebp + 0xc], 0
je 0x459fcd
push dword [ebp + 0xc]
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push 0
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wdupenv_s]
mov ecx, dword [ebp + 8]
add esp, 0xc
test ecx, ecx
jne 0x4b18f0
mov eax, dword [0x5a4fb4]
test eax, eax
jne 0x4b1904
mov eax, dword [ebp - 0xc]
pop edi
mov dword [0x5a1100], eax
pop esi
leave
ret 0xc
add ecx, 2
xor eax, eax
cmp ax, word [ecx]
je 0x4b18e4
call fcn.0042fda4
jmp 0x459fa0
call fcn.004fd8ba
mov dword [0x5a4fb4], eax
test eax, eax
je 0x459f55
push dword [edi]
push 0x402b54
push eax
call fcn.004fd8fd
add esp, 0xc
jmp 0x459f55
call fcn.00459e1b
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x459f7c
push 0x513
push 0
call fcn.0047dc0b
call fcn.00459e1b
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x459fcd
push 0x402b24
push eax
call fcn.004fd8fd
pop ecx
pop ecx
mov ecx, dword [0x5a4fb4]
call fcn.0042fefa
and dword [0x5a4fb4], 0
jmp 0x459fda
Function at 0x45c06e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [0x5a3534], eax
mov edi, edx
mov dword [0x5a3530], eax
mov edx, 0x5a3530
mov dword [0x5a3538], eax
mov ecx, edi
push dword [esi + 0x8a4]
push dword [ebp + 8]
call fcn.0045b900
mov ebx, dword [esi + 0x14c]
mov edx, edi
shr ebx, 5
mov ecx, esi
push 1
and bl, 1
call fcn.0045c3fd
cmp byte [0x5a2ee5], 0
jne 0x45c0e4
test bl, bl
jne 0x45c0db
cmp byte [0x5a2f00], bl
je 0x45c0db
test byte [esi + 0x14c], 0x20
jne 0x4b2948
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [0x5a4ebd], 0
je 0x45c0c2
jmp 0x4b28f2
cmp byte [0x5a4e20], 0
jne 0x45c0c2
push 0x4271dc
push 0x106a
push edi
call fcn.0052bce6
add esp, 0xc
xor dl, dl
mov cl, 1
call fcn.00457243
xor esi, esi
xor edx, edx
push esi
push esi
push esi
push esi
jmp 0x4b293a
xor esi, esi
xor dl, dl
mov cl, 1
call fcn.00457243
push esi
push esi
push esi
push 1
mov edx, 0x427144
xor cl, cl
call fcn.004708d7
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x5a4ecc], 0
jne 0x4b295a
cmp byte [0x5a2ee4], 0
je 0x4b2925
xor esi, esi
push 0x17bc
push esi
call fcn.004fd507
pop ecx
pop ecx
jmp 0x4b2927
Function at 0x461f76
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5a2f9c]
mov edx, dword [0x5a3e68]
sub eax, edx
push ebx
push esi
push edi
mov edi, dword [0x5a3e64]
mov ebx, ecx
mov esi, edi
sub esi, dword [0x5a3e60]
sub eax, esi
je 0x461ed5
lea ecx, [edx + edi]
call fcn.0046222e
mov edx, dword [0x5a3e68]
lea eax, [edx + esi]
mov ecx, ebx
push eax
mov edx, esi
call fcn.00462145
mov edx, dword [0x5a2f9c]
mov edi, eax
mov eax, dword [0x5a3e60]
mov ebx, dword [eax + 0x1b4]
shr ebx, 6
and bl, 1
sub edx, edi
je 0x461f0f
lea ecx, [eax + edi]
lea eax, [ebp - 4]
push eax
call fcn.0046202c
test al, al
je 0x461f6d
mov eax, edi
sub eax, esi
mov dword [0x5a3e68], eax
call fcn.00461fe4
push dword [0x5a3e60]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x4ba61e
mov ecx, dword [0x5a10fc]
lea eax, [ebp - 4]
push eax
push dword [0x5a3e60]
mov edx, edi
call fcn.00461f96
test al, al
je 0x4ba62d
call 0x461f76
mov eax, dword [0x5a4fac]
sub eax, 1
je 0x461f6d
sub eax, 1
je 0x461f69
pop edi
pop esi
pop ebx
leave
ret
xor dl, dl
jmp 0x461f6f
mov dl, 1
mov cl, bl
call fcn.0052aa89
push esi
push edi
mov edi, dword [0x5a3b28]
xor esi, esi
test edi, edi
jne 0x4ba63c
push 0x5a4c58
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
pop edi
pop esi
ret
mov dword [0x5a4fac], 1
jmp 0x461f50
mov dword [0x5a4fac], 2
jmp 0x461f50
mov eax, dword [0x5a3b24]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x4ba659
inc esi
cmp esi, edi
jb 0x4ba63c
jmp 0x461f88
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x428c50
call fcn.004320dd
pop ecx
pop ecx
xor ecx, ecx
call fcn.0047dc27
int3

Function at 0x461fe4
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x5a1014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x5a4c58
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov esi, dword [0x5a3b28]
xor edi, edi
test esi, esi
jne 0x4ba686
xor edi, edi
test esi, esi
jne 0x4ba6cb
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047a40f
leave
ret
mov eax, dword [0x5a3b24]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x4ba6a3
inc edi
cmp edi, esi
jb 0x4ba686
jmp 0x462014
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x428bc0
jmp 0x4ba6bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x428c08
call fcn.004320dd
pop ecx
pop ecx
xor ecx, ecx
call fcn.0047dc27
push 0x2c8
lea eax, [ebp - 0x2cc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x2d0], 0x10001
lea eax, [ebp - 0x2d0]
push eax
mov eax, dword [0x5a3b24]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x4ba6b1
inc edi
cmp edi, esi
jb 0x4ba6cb
jmp 0x46201e
Function at 0x462445
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x5a2f9c]
push ebx
push esi
add eax, 0x400000
mov byte [ebp - 1], 1
push edi
mov esi, 0x13fffff
mov dword [ebp - 8], eax
mov ebx, 0x80000000
xor edi, edi
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp eax, 0x1c
jne 0x4ba83a
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
test dword [ebp - 0x14], 0x10000
je 0x4ba852
mov eax, ecx
sub eax, ebx
cmp eax, esi
jbe 0x4ba852
mov esi, eax
mov edi, ebx
cmp eax, dword [ebp - 8]
jb 0x4ba852
test edi, edi
je 0x4624ee
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x2c]
lea ecx, [eax + 0x3fffff]
add ecx, edi
dec eax
not eax
and ecx, eax
sub edi, ecx
add esi, edi
cmp esi, 0x1000000
jb 0x4624ee
cmp esi, dword [0x5a2f9c]
jb 0x4624e6
mov eax, ecx
pop edi
pop esi
pop ebx
leave
ret
mov dword [0x5a2f9c], esi
jmp 0x4624df
xor eax, eax
jmp 0x4624e1
cmp byte [ebp - 1], 0
je 0x4624ad
mov ebx, 0x10000
mov byte [ebp - 1], 0
jmp 0x46246b
cmp byte [ebp - 1], 0
jne 0x4ba864
cmp ecx, 0x80000000
jae 0x4624ad
mov ebx, ecx
jmp 0x46246b

Function at 0x46298c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ax, word [esi + 0x50]
add ax, 7
mov word [0x5a10ec], ax
call fcn.00466527
mov ecx, esi
call fcn.00466272
mov ecx, esi
pop esi
jmp fcn.00466aad
Function at 0x4699f6
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push esi
push edi
push 0x78
call dword [sym.imp.tbbmalloc.dll_scalable_malloc]
mov esi, eax
xor edi, edi
pop ecx
test esi, esi
je 0x4c0acd
cmp dword [0x5a2e48], 3
push 0x78
jl 0x4c0ae4
pop edx
mov ecx, esi
call fcn.0045be4b
mov eax, dword [0x5a1ac4]
shl eax, 0x14
push eax
push ecx
mov ecx, esi
call fcn.00469758
push edi
push 4
mov esi, eax
push esi
push 0x46b9da
push edi
push edi
mov dword [esi + 8], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x5c], eax
test eax, eax
je 0x4c0af3
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
mov eax, esi
pop esi
pop ecx
ret
call fcn.004575aa
test al, al
jne 0x4699f9
call fcn.004fd4dc
jmp 0x469a25
push edi
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x469a25
call fcn.004fd4dc
mov eax, dword [esi + 0x5c]
jmp 0x469a57
Function at 0x46d350
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], ebx
inc edi
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x4c25b8
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
mov dword [ebp - 0x14], ecx
lea eax, [edi + edi]
push eax
call fcn.0046d44f
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x46d448
mov ecx, dword [ecx]
mov ebx, 0x811c9dc5
xor edi, edi
movzx edx, byte [edi + eax + 8]
xor edx, ebx
imul ebx, edx, 0x1000193
inc edi
cmp edi, 4
jb 0x46d3bc
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x18]
and edx, ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
mov ebx, dword [ebx]
mov dword [ebp - 0xc], ebx
mov edi, dword [ebx + edx*8]
mov dword [ebp - 0x18], edi
cmp edi, esi
jne 0x46d3f7
mov dword [ebx + edx*8], eax
mov dword [ebx + edx*8 + 4], eax
mov eax, ecx
jmp 0x46d3ab
mov edx, dword [ebx + edx*8 + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
je 0x4c25c3
lea ebx, [edx + 4]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], edx
jne 0x46d43c
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov dword [edx], eax
mov dword [esi], edi
mov edi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edi + edx*8], eax
mov esi, dword [ebp + 8]
jmp 0x46d3f3
mov edx, dword [ebx]
cmp edi, dword [edx + 8]
jne 0x46d407
jmp 0x4c25f5
pop edi
pop esi
pop ebx
leave
ret 4
push 0x405ad8
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x4c25ed
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov ebx, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
jmp 0x46d3ef
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0x18], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x46d437

Function at 0x46e647
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov ecx, 0x811c9dc5
cmp dword [ebp + 8], esi
jbe 0x46e66a
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc esi
cmp esi, dword [ebp + 8]
jb 0x46e658
mov eax, ecx
pop esi
leave
ret 4
Function at 0x470a61
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x64]
mov edi, edx
push 0
push eax
mov ebx, ecx
call sub.VCRUNTIME140.dll_memset
mov edx, dword [ebp + 8]
lea ecx, [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x64], esi
call fcn.00470b16
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x64]
push eax
xor eax, eax
push eax
push eax
push 0x400
push 1
push eax
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x470b0d
or eax, 0xffffffff
mov byte [ebp - 0xc], 1
push eax
push dword [ebp - 0x1c]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x470add
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x18]
call edi
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 4], eax
test esi, esi
je 0x470b04
push esi
call dword [sym.imp.tbbmalloc.dll_scalable_free]
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
or dword [ebx + 4], 0xffffffff
mov byte [ebx], 0
jmp 0x470af8
Function at 0x47171d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
or edx, 0xffffffff
push ebx
push esi
push edi
push 4
mov edi, ecx
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
pop ebx
movzx eax, byte [esi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4120f0]
inc esi
sub ebx, 1
jne 0x471735
mov eax, edx
xor edx, edx
div dword [edi + 0x20]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x47175d
mov dword [eax], edx
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4717ad
mov ebx, dword [eax + 4]
xor esi, esi
test ebx, ebx
je 0x4717ad
mov ecx, dword [eax]
mov edi, dword [edi + 4]
mov dword [ebp + 0x14], ecx
mov eax, dword [ecx + esi*8]
mov edx, dword [ecx + esi*8 + 4]
mov cl, 0x20
call fcn.0047f0a0
mov ecx, eax
mov eax, dword [ebp + 0x14]
mov edx, dword [eax + esi*8]
mov eax, dword [ebp + 8]
cmp dword [edi + ecx*4], eax
jne 0x4717b6
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x47179f
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4717a8
mov dword [eax], edx
xor eax, eax
inc eax
jmp 0x4717af
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14
mov ecx, dword [ebp + 0x14]
inc esi
cmp esi, ebx
jb 0x471778
jmp 0x4717ad