joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.004e8a97

Function at 0x4ebd80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.004ebd97

Function at 0x4f0b40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4f0bb3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x4f0b9d
cmp dword [ebp - 0x18], 4
jne 0x4f0b9d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x4f0b9d

Function at 0x4f0bc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push eax
mov eax, dword [ebp + 8]
mov edx, dword [0x646040]
xor edx, ebp
mov dword [ebp - 8], edx
mov edx, 4
lea esi, [ebp + 0xc]
push edx
push esi
push edx
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00567335
mov eax, esi
add esp, 4
pop esi
pop ebp
ret 8
Function at 0x4f0c00
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x646040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, 0x20019
or ecx, dword [ebp + 0xc]
push esi
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4f0c9d
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ecx, dword [esi]
sub esp, 0x30
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x4f0ca5
mov eax, dword [ebp - 0x1c]
sub eax, 1
setb dl
mov dword [esi + 4], eax
mov ecx, dword [esi]
test ecx, ecx
sete dh
or dh, dl
je 0x4f0caf
mov word [esi + 8], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi], 0
jmp 0x4f0c85
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4f0c9d
lea ebx, [esi + 8]
lea edx, [ebp - 0x14]
mov dword [edx], 0x104
xor edx, edx
dec edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
xor edx, edx
push edi
push edx
push edx
push edx
lea edx, [ebp - 0x14]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4f0c85
jmp 0x4f0c8b

Function at 0x4f25d0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xa34], 0x8000
jne 0x4f26bf
movzx eax, word [0x648160]
shl eax, 5
cmp dword [esi + eax + 0x54], 0x200
jne 0x4f26c2
push 0x648120
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4f26c8
cmp byte [0x6571f8], 0
jne 0x4f2652
cmp dword [0x659cdc], 0
jne 0x4f26d7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4f26da
mov dword [0x6571a4], eax
mov dword [0x659ce0], eax
mov dword [0x659cdc], 0x441f00
mov byte [0x6571f8], 1
push 0x648120
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor eax, eax
lock cmpxchg dword [0x6571fc], esi
jne 0x4f26c5
add esi, 0x48
mov dword [0x659ce4], 0x4f26e0
mov eax, 0xffffffb0
jmp 0x4f268f
mov cl, 0x40
jmp 0x4f2683
mov cl, 0x80
mov byte [eax + 0x6571f8], cl
add esi, 0x20
inc eax
je 0x4f26b8
cmp dword [esi], 0
je 0x4f26bb
mov ecx, dword [esi + 0xc]
cmp ecx, 0x81
jb 0x4f2681
cmp ecx, 0x101
jb 0x4f267d
cmp ecx, 0x201
setb cl
shl cl, 4
add cl, 0x10
jmp 0x4f2683
pop esi
pop ebp
ret
xor ecx, ecx
jmp 0x4f2683
int3
int3
int3
mov ecx, 0x648120
call fcn.00520a70
jmp 0x4f2612
int3
int3
Function at 0x4f36a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x4f36b7
test eax, eax
je 0x4f36b7
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
sete al
mov ecx, dword [0x659ce4]
test ecx, ecx
setne dl
and dl, al
cmp dl, 1
je 0x4f370a
cmp dword [0x659cdc], 0
je 0x4f36b1
mov esi, dword [0x659ce0]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x4f3714
test esi, esi
je 0x4f36b1
mov ecx, dword [0x659cdc]
call dword [0x6401dc]
push esi
call ecx
add esp, 4
jmp 0x4f36b1
call dword [0x6401dc]
call ecx
jmp 0x4f36ce
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4f36f2
Function at 0x4ffe00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ecx], 0
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x4ffe29
call fcn.004ffee0
cmp dword [esi], ebx
je 0x4ffe53
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4ffe5f
cmp edi, 2
jb 0x4ffe4a
mov dword [esi], ebx
call fcn.004ffee0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004ffee0
mov eax, dword [esi]
cmp dword [0x657038], 0
mov dword [ebp - 0x18], eax
je 0x4ffe98
mov eax, dword [0x657038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x6401dc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x4ffe3e
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6338bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4ffed4
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x4ffece
call dword [0x6401dc]
call ecx
push 0
push eax
call fcn.0043a140
add esp, 8
jmp 0x4ffe72
push 1
push 0
jmp 0x4ffec4
xor eax, eax
push eax
jmp 0x4ffec3
Function at 0x5273a0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x64b6ec]
mov ecx, dword [0x64984c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x5273e4
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, dword [0x64b6e8]
test ecx, ecx
je 0x527429
call dword [0x6401dc]
push edi
push esi
call ecx
test eax, eax
je 0x52743b
pop esi
pop edi
pop ebp
ret
push 0x64b6ec
call fcn.00565714
add esp, 4
cmp dword [0x64b6ec], 0xffffffff
jne 0x5273c2
push str.bcryptprimitives.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x52743e
push str.ProcessPrng
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x64b6e8], eax
push 0x64b6ec
call fcn.00565763
add esp, 4
jmp 0x5273c2
test edi, edi
je 0x5273e0
push edi
push esi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x5273e0
int3
int3
int3
Function at 0x52e010
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x52e0fa
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x52e085
lea eax, [edi + 1]
cmp eax, 2
jb 0x52e062
mov dword [esi], edi
call fcn.004ffee0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 0
inc eax
cmp eax, 1
jbe 0x52e0fe
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.004ffee0
mov eax, dword [esi]
cmp dword [0x657038], 0
mov dword [ebp - 0x18], eax
je 0x52e0be
mov eax, dword [0x657038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x6401dc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x52e053
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6338bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52e101
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x52e0f4
call dword [0x6401dc]
call ecx
push 0
push eax
call fcn.0043a140
add esp, 8
jmp 0x52e098
push 1
push 0
jmp 0x52e0ea
mov byte [esi + 4], 0
int3
xor eax, eax
push eax
jmp 0x52e0e9

Function at 0x52eca0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052ecb0
Function at 0x531b30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
push 0x14
call fcn.00564055
add esp, 4
mov esi, eax
mov ecx, eax
push 4
call fcn.0052a210
mov edi, dword [esi]
mov edx, dword [esi + 4]
mov eax, edx
sub eax, edi
sar eax, 2
lea ecx, [eax - 1]
cmp ecx, 2
jb 0x531bdf
add eax, 0xfffffffd
movd xmm0, eax
por xmm0, xmmword [0x628540]
subsd xmm0, qword [0x628550]
xor edx, edx
inc edx
movq xmm1, qword [0x628550]
movsd xmm2, qword [0x617998]
nop dword [eax]
mov edi, dword [esi]
mov ebx, dword [esi + 4]
sub ebx, edi
sar ebx, 2
cmp ebx, edx
jbe 0x531cad
movd xmm3, eax
por xmm3, xmm1
subsd xmm3, xmm1
lea ebx, [edx - 1]
movd xmm4, ebx
por xmm4, xmm1
subsd xmm4, xmm1
addsd xmm4, xmm4
addsd xmm4, xmm3
divsd xmm4, xmm0
addsd xmm4, xmm2
cvttsd2si ebx, xmm4
mov dword [edi + edx*4], ebx
dec eax
inc edx
cmp edx, ecx
jne 0x531b90
mov edi, dword [esi]
mov edx, dword [esi + 4]
cmp edx, edi
je 0x531cad
mov dword [edx - 4], 0x7fffffff
mov edi, dword [esi]
mov eax, dword [esi + 4]
mov ebx, eax
sub ebx, edi
je 0x531cbc
js 0x531cc0
mov ecx, ebx
shr ecx, 2
mov edx, edi
and ebx, 3
jne 0x531c7f
sub edi, eax
cmp edi, 0xfffffffc
ja 0x531c72
nop word cs:[eax + eax]
movzx edi, cl
movzx ebx, byte [edx]
xor ebx, edi
shr ecx, 8
xor ecx, dword [ebx*4 + 0x631d30]
movzx edi, cl
movzx ebx, byte [edx + 1]
xor ebx, edi
shr ecx, 8
xor ecx, dword [ebx*4 + 0x631d30]
movzx edi, cl
movzx ebx, byte [edx + 2]
xor ebx, edi
shr ecx, 8
xor ecx, dword [ebx*4 + 0x631d30]
movzx edi, cl
movzx ebx, byte [edx + 3]
xor ebx, edi
shr ecx, 8
xor ecx, dword [ebx*4 + 0x631d30]
add edx, 4
cmp edx, eax
jne 0x531c20
mov dword [esi + 0xc], ecx
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x14], edi
movzx edi, cl
mov dword [ebp - 0x18], edi
movzx edi, byte [edx]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x18]
xor dword [ebp - 0x10], edi
shr ecx, 8
mov edi, dword [ebp - 0x10]
xor ecx, dword [edi*4 + 0x631d30]
mov edi, dword [ebp - 0x14]
inc edx
dec ebx
jne 0x531c82
jmp 0x531c0f
push str....._third_partylibc_srcinclude_vector:1411:_assertion___n___size___failed:_vector___index_out_of_bounds_n
push 0x624e92
call fcn.005912b0
xor ecx, ecx
jmp 0x531c72
int3
Function at 0x535c20
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x64b600]
mov ecx, dword [0x64984c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x535c72
mov eax, dword [0x64b5fc]
mov esi, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x64b600
call fcn.00565714
add esp, 4
cmp dword [0x64b600], 0xffffffff
jne 0x535c53
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.00568ad0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x58
call fcn.00564055
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x64b648]
mov ecx, dword [0x64984c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x535d1b
mov ecx, esi
push ebx
push 0x64b624
push edi
call fcn.0040c080
mov dword [0x64b5fc], esi
push 0x64b600
call fcn.00565763
add esp, 4
jmp 0x535c53
push 0x64b648
call fcn.00565714
add esp, 4
cmp dword [0x64b648], 0xffffffff
jne 0x535cf5
xorps xmm0, xmm0
movups xmmword [0x64b634], xmm0
movups xmmword [0x64b624], xmm0
mov dword [0x64b644], 0
push 0x64b624
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x64b648
call fcn.00565763
add esp, 4
jmp 0x535cf5
Function at 0x536520
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x64b600]
mov ecx, dword [0x64984c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x536571
mov eax, dword [0x64b5fc]
mov esi, dword [eax]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x64b600
call fcn.00565714
add esp, 4
cmp dword [0x64b600], 0xffffffff
jne 0x536553
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.00568ad0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x58
call fcn.00564055
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x64b648]
mov ecx, dword [0x64984c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x53661a
mov ecx, esi
push ebx
push 0x64b624
push edi
call fcn.0040c080
mov dword [0x64b5fc], esi
push 0x64b600
call fcn.00565763
add esp, 4
jmp 0x536553
push 0x64b648
call fcn.00565714
add esp, 4
cmp dword [0x64b648], 0xffffffff
jne 0x5365f4
xorps xmm0, xmm0
movups xmmword [0x64b634], xmm0
movups xmmword [0x64b624], xmm0
mov dword [0x64b644], 0
push 0x64b624
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x64b648
call fcn.00565763
add esp, 4
jmp 0x5365f4
Function at 0x536670
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x4f0380
mov edx, dword fs:[0]
mov dword [ecx], edx
mov dword fs:[0], ecx
mov dword [esi + 0x18], eax
xor ecx, ecx
test eax, eax
sete cl
mov dword [esi + 0x10], ecx
xor eax, eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x1002
mov dword [esi + 0xc], eax
mov dword [esi + 8], 6
xorps xmm0, xmm0
movups xmmword [esi + 0x20], xmm0
movups xmmword [esi + 0x30], xmm0
xorps xmm0, xmm0
movsd qword [esi + 0x40], xmm0
mov eax, dword [0x64ae40]
mov ecx, dword [0x64984c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x53671b
mov eax, dword [0x64ae3c]
mov dword [esi + 0x1c], eax
cmp eax, 0x64ad98
jne 0x5367da
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x64ae40
call fcn.00565714
add esp, 4
cmp dword [0x64ae40], 0xffffffff
jne 0x5366f5
mov eax, dword [0x64ae38]
mov ecx, dword [0x64984c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x536782
mov eax, dword [0x64ae34]
mov dword [0x64ae3c], eax
cmp eax, 0x64ad98
jne 0x5367e3
push fcn.00593de0
call fcn.00565cf5
add esp, 4
push 0x64ae40
call fcn.00565763
add esp, 4
jmp 0x5366f5
push 0x64ae38
call fcn.00565714
add esp, 4
cmp dword [0x64ae38], 0xffffffff
jne 0x53674e
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], 0
mov ecx, 0x64ad98
push 1
call fcn.0040aea0
mov dword [0x64ae34], 0x64ad98
push fcn.00593de0
call fcn.00565cf5
add esp, 4
push 0x64ae38
call fcn.00565763
add esp, 4
mov esi, dword [ebp - 0x20]
jmp 0x53674e
lock inc dword [eax + 4]
jmp 0x536708
lock inc dword [eax + 4]
jmp 0x536763
Function at 0x53ea60
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
je 0x53ea6f
pop ebp
jmp fcn.0053ea90
cmp dword [ebp + 0x10], 0
jne 0x53ea89
xor eax, eax
push eax
push eax
push 0x4f26f0
push 0x6586c8
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
xor eax, eax
pop ebp
ret
Function at 0x53f000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm4
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jae 0x53f122
movq xmm4, qword [0x627ce0]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
pmovzxdq xmm3, qword [0x627d20]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp eax, 0x10
jb 0x53f0b9
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add ecx, 0x10
add eax, 0xfffffff0
cmp eax, 0xf
ja 0x53f092
pmovzxdq xmm1, qword [0x627d20]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm2, xmm2
pxor xmm1, xmm1
pblendw xmm1, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x627cf0], 0
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm1, 3
pclmulqdq xmm0, xmmword [0x627d00], 0x10
pblendw xmm0, xmm2, 0xfc
pclmulqdq xmm0, xmmword [0x627d10], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop ebp
ret
movq xmm4, qword [0x627cc0]
movdqa xmm5, xmmword [0x627cd0]
nop word cs:[eax + eax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm6
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
movdqu xmm6, xmmword [ecx]
pxor xmm0, xmm6
movdqu xmm6, xmmword [ecx + 0x10]
pxor xmm3, xmm6
movdqu xmm6, xmmword [ecx + 0x20]
pxor xmm2, xmm6
movdqu xmm6, xmmword [ecx + 0x30]
pxor xmm1, xmm6
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x53f140
jmp 0x53f034
Function at 0x543660
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x450
mov edi, dword [ebp + 8]
mov eax, dword [0x646040]
xor eax, ebp
mov dword [esp + 0x448], eax
pcmpeqd xmm0, xmm0
mov esi, esp
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x240]
push 0x1f9
push str.file_util_win.cc
push 0x6303e6
push ebx
call fcn.00509c60
add esp, 0x10
xor eax, eax
mov ecx, esi
push eax
push eax
call fcn.00520c00
mov dword [esp + 0x30], 0xa
mov al, byte [0x64b456]
test al, al
jne 0x5437f8
push 0x208
push 0xff
mov esi, ebx
push ebx
call fcn.00568ad0
add esp, 0xc
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x5436f2
mov eax, dword [edi]
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
movzx edx, word [eax + ecx*2]
mov word [esp + ecx*2 + 0x240], dx
test dx, dx
je 0x54371b
inc ecx
cmp ecx, 0x104
jne 0x5436f7
mov word [esp + 0x446], 0
push esi
call fcn.004ffdf0
add esp, 4
lea esi, [esp + 0x38]
push 0x208
push 0xff
push esi
call fcn.00568ad0
add esp, 0xc
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x543745
mov eax, dword [ebx]
xor ecx, ecx
movzx edx, word [eax + ecx*2]
mov word [esp + ecx*2 + 0x38], dx
test dx, dx
je 0x543768
inc ecx
cmp ecx, 0x104
jne 0x543747
mov word [esp + 0x23e], 0
push esi
call fcn.004ffdf0
add esp, 4
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x54377b
mov eax, dword [edi]
cmp byte [ebx + 0xb], 0
mov ecx, ebx
jns 0x543785
mov ecx, dword [ebx]
sub esp, 0x18
movsd xmm0, qword [0x630380]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x5437d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp byte [ebx + 0xb], 0
jns 0x5437b6
mov ebx, dword [ebx]
cmp byte [edi + 0xb], 0
jns 0x5437be
mov edi, dword [edi]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
cmp dword [ebp + 0x10], 0
je 0x5437d9
test eax, eax
jne 0x5437d9
jmp 0x54381e
mov bl, 1
mov ecx, esp
call fcn.00540880
mov ecx, dword [esp + 0x448]
xor ecx, ebp
call fcn.00567335
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, al
lea eax, [esp + 0x38]
mov dword [eax], ebx
lea esi, [esp + 0x34]
mov dword [esi], str.ScopedBlockingCall
lea edx, [esp + 0x30]
push eax
push esi
call fcn.005b7340
add esp, 8
jmp 0x5436d3
push esi
call fcn.00407630
add esp, 4
cmp eax, 0xfffffffc
jne 0x543831
call fcn.005b6d30
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor ebx, ebx
jmp 0x5437d9
Function at 0x545160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [ebp + 8], 0
je 0x545268
mov esi, dword [ecx + 4]
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx + 0x74], 0
je 0x545268
add ecx, esi
xor eax, eax
cmp word [ecx + 0x14], 0x68
jb 0x545260
add ecx, 0x78
je 0x545260
mov ecx, dword [ecx]
test ecx, ecx
je 0x545268
add ecx, esi
je 0x545268
cmp edx, 0xffff
jbe 0x545258
mov eax, dword [ecx + 0x20]
lea edi, [esi + eax]
test eax, eax
cmove edi, eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ecx + 0x18]
lea eax, [edi + eax*4]
lea ecx, [edx + 1]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], esi
jmp 0x545203
xor ecx, ecx
lea ebx, [edi + ebx*2]
movzx edx, cl
mov dword [ebp - 0x24], edx
movzx edx, byte [esi]
cmp dword [ebp - 0x24], edx
lea esi, [ebx + 4]
cmovg edi, esi
cmovs eax, ebx
cmp cl, dl
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
je 0x54523e
cmp edi, eax
je 0x545268
mov ebx, eax
sub ebx, edi
mov ecx, ebx
sar ecx, 2
shr ebx, 0x1f
add ebx, ecx
and ebx, 0xfffffffe
mov ecx, dword [edi + ebx*2]
add esi, ecx
test ecx, ecx
cmove esi, ecx
mov cl, byte [edx]
test cl, cl
je 0x5451df
mov edx, dword [ebp - 0x18]
nop dword [eax + eax]
cmp cl, byte [esi]
jne 0x5451e1
inc esi
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x545230
jmp 0x5451df
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x24]
add esi, eax
test eax, eax
cmove esi, eax
sub ebx, dword [ebp - 0x10]
sar ebx, 1
movzx edx, word [esi + ebx]
add dx, word [ecx + 0x10]
mov eax, dword [ebp + 8]
mov word [eax], dx
mov al, 1
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x545260