joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4637f0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54a6ee
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x8870bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x886c6c], 0xffffffff
jne 0x46384e
mov esi, 0x88925c
mov ecx, esi
call fcn.0045ff70
cmp dword [0x886c6c], 0xffffffff
jne 0x463844
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x886c6c], eax
and esi, 0xfffffffe
mov ecx, esi
call fcn.004604f0
push dword [0x886c6c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4638ed
cmp byte [ebp + 8], al
je 0x4638ed
push 0x44
call fcn.00520ff7
add esp, 4
mov dword [ebp - 0x1c], eax
push 1
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00464a80
mov ebx, eax
push ebx
push dword [0x886c6c]
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 8
mov dword [ebp - 4], 1
call fcn.00520ff7
add esp, 4
mov dword [ebp - 0x1c], eax
push ebx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00464940
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, ebx
mov dword [ebx + 0x24], eax
mov dword [ebp - 4], 0xffffffff
call fcn.00464f60
mov byte [ebx + 0x42], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x28], eax
mov eax, dword [0x889230]
test eax, eax
jne 0x463901
mov eax, dword [ebx + 0x24]
mov dword [0x889230], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x14], 0xffffffff
call esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call esi
push 2
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x24]
push eax
push dword [ebp - 0x14]
call fcn.00464020
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x480340
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54c1c3
mov eax, dword fs:[0]
push eax
sub esp, 0x98
push ebx
push esi
push edi
mov eax, dword [0x8870bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebp - 0x10]
mov byte [ebp - 0x11], 0
push eax
lea ecx, [ebp - 0x11]
call fcn.004807d0
mov eax, dword [ebp + 0x10]
mov edx, 0x40
test eax, eax
mov dword [ebp - 4], 0
cmovne edx, eax
mov dword [ebp - 0xa0], edx
cmp edx, 0x40
jle 0x4803cb
lea eax, [edx + edx]
push eax
call fcn.00526109
add esp, 4
mov dword [ebp - 0x9c], eax
test eax, eax
jne 0x4803bd
call fcn.00418900
mov eax, dword [ebp - 0x9c]
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0xa4], edx
jmp 0x4803e1
lea eax, [ebp - 0x94]
mov dword [ebp - 0xa4], 0x40
mov dword [ebp - 0x9c], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edx
push eax
push esi
push dword [ebx]
mov byte [ebp - 4], 1
call edi
test eax, eax
jne 0x4804ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x50
jne 0x480438
test eax, eax
jne 0x480438
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [eax]
test eax, eax
je 0x4804de
cmp eax, 0xffffffff
je 0x4804de
mov eax, dword [ebp - 0x10]
mov ecx, 1
lock xadd dword [eax], ecx
jmp 0x4804de
cmp eax, 0x7a
je 0x48044b
mov esi, dword [ebp + 8]
mov dword [esi], 0x6f6ba0
jmp 0x4804de
push 0
push 0
push esi
push dword [ebx]
call edi
mov edx, eax
test edx, edx
jne 0x480489
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
mov ecx, dword [ebp - 0x9c]
mov dword [esi], 0x6f6ba0
cmp ecx, eax
je 0x48047c
push ecx
call fcn.005260ee
add esp, 4
lea ecx, [ebp - 0x10]
call fcn.004011e0
jmp 0x480528
cmp edx, dword [ebp - 0xa4]
mov ecx, edx
cmovl ecx, dword [ebp - 0xa4]
push ecx
push edx
lea ecx, [ebp - 0xa4]
call fcn.00459560
push dword [ebp - 0xa0]
push dword [ebp - 0x9c]
push esi
push dword [ebx]
call edi
test eax, eax
je 0x48045a
mov eax, dword [ebp - 0x9c]
cmp esi, 0x50
jne 0x4804cf
cmp word [eax], 0
je 0x48040c
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push eax
push esi
call fcn.00457730
add esp, 0xc
mov eax, dword [ebp - 0x9c]
lea ecx, [ebp - 0x94]
cmp eax, ecx
je 0x4804f7
push eax
call fcn.005260ee
add esp, 4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
test eax, eax
je 0x480519
cmp eax, 0xffffffff
je 0x480528
mov eax, dword [ebp - 0x10]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
cmp ecx, 1
setne al
test al, al
jne 0x480528
push 4
push 2
push dword [ebp - 0x10]
call fcn.004016c0
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x482300
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x2c
mov eax, dword [0x8870bc]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x4823b1
push 8
lea eax, [esp + 8]
push eax
push 0x1014
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4823a9
mov ax, word [esp + 4]
cmp ax, 0x31
je 0x4823a9
cmp ax, 0x30
jne 0x482361
mov dword [esi + 4], 1
mov eax, 1
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00520afb
add esp, 0x2c
ret
cmp ax, 0x32
je 0x48238d
push 0xb
lea eax, [esp + 0x18]
push eax
push 0x13
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4823a9
movzx ecx, word [esp + 0x14]
movzx eax, word [esp + 4]
add ecx, 2
cmp eax, ecx
jne 0x4823a9
mov dword [esi + 4], 2
mov eax, 2
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00520afb
add esp, 0x2c
ret
mov eax, 3
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x2c]
pop esi
xor ecx, esp
call fcn.00520afb
add esp, 0x2c
ret

Function at 0x4833b0
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x204]
sub esp, 0x204
push 0xffffffffffffffff
push 0x54c659
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x8870bc]
xor eax, ebp
mov dword [ebp + 0x200], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x20c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [esi], 0x6f6ba0
push 0xff
lea eax, [ebp]
mov dword [ebp - 4], 0
push eax
push 0x5a
push dword [ebp + 0x210]
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x483473
push 0xffffffffffffffff
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00457730
mov ecx, dword [esi]
mov edx, eax
add esp, 0xc
mov eax, dword [edx]
mov dword [esi], eax
mov dword [edx], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
test eax, eax
je 0x483464
cmp eax, 0xffffffff
je 0x483473
mov ecx, dword [ebp - 0x10]
or edx, 0xffffffff
lock xadd dword [ecx], edx
cmp edx, 1
setne cl
test cl, cl
jne 0x483473
push 4
push 2
push dword [ebp - 0x10]
call fcn.004016c0
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.00520afb
lea esp, [ebp + 0x204]
pop ebp
ret
Function at 0x483ab0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x20
mov eax, dword [0x8870bc]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, dword [esp + 0x28]
push edi
mov dword [esp + 8], esi
lea edi, [ecx + 8]
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x483b3a
push 0xb
lea eax, [esp + 0x10]
push eax
push 0x13
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x483b3a
push 1
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00457730
mov ecx, dword [edi]
mov edx, eax
add esp, 0xc
mov eax, dword [edx]
mov dword [edi], eax
mov dword [edx], ecx
mov eax, dword [esp + 8]
mov eax, dword [eax]
test eax, eax
je 0x483b2a
cmp eax, 0xffffffff
je 0x483b3a
mov eax, dword [esp + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
cmp ecx, 1
setne al
test al, al
jne 0x483b3a
push 4
push 2
push dword [esp + 0x10]
call fcn.004016c0
add esp, 0xc
push edi
mov ecx, esi
call fcn.0047a8a0
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00520afb
add esp, 0x20
ret 4

Function at 0x48d320
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d0c8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8870bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ecx + 4]
mov ecx, dword [ebx + 0x30]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 8]
je 0x48d3ae
mov edi, dword [ebx + 0x20]
mov dword [ebp - 0x10], edi
inc dword [edi + 8]
mov edx, dword [edi + 8]
mov ecx, dword [ebx + 0x30]
xor esi, esi
mov dword [ebp - 4], 0
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
test eax, eax
jle 0x48d3a8
mov eax, dword [ecx + 8]
add eax, esi
mov ecx, dword [ecx + eax*4 + 0x10]
test ecx, ecx
je 0x48d397
push dword [ebp + 0x10]
mov eax, dword [ecx]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x48d3c4
mov ecx, dword [ebx + 0x30]
inc esi
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
cmp esi, eax
jl 0x48d376
mov edx, dword [edi + 8]
lea eax, [edx - 1]
mov dword [edi + 8], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
dec dword [edi + 8]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48ef80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d4b0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x8870bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x60]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x20], esi
test eax, eax
jne 0x48f0a9
cmp dword [ebx + 0x78], 0xffffffff
jne 0x48f11d
cmp dword [ebx + 0x64], 0xffffffff
je 0x48f104
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
mov esi, dword [ebp + 0xc]
movlpd qword [ebp - 0x1c], xmm0
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
nop dword [eax]
test eax, eax
jg 0x48f002
jl 0x48effe
cmp esi, 0x2000000
jae 0x48f002
mov eax, esi
jmp 0x48f007
mov eax, 0x2000000
push 0
lea ecx, [ebp - 0x18]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [ebx + 0x64]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x10]
test eax, eax
je 0x48f062
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x48f04a
add edi, eax
adc ecx, 0
sub esi, eax
mov eax, dword [ebp - 0x14]
sbb eax, 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
cmp ecx, dword [ebp + 0x10]
jg 0x48f04a
jl 0x48eff0
cmp edi, dword [ebp + 0xc]
jb 0x48eff0
mov eax, edi
mov edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, edi
or eax, ecx
jne 0x48f04a
lea eax, [ebp + 8]
push 0xffffffffffffffff
push eax
call fcn.004481a0
add esp, 8
mov ecx, dword [ebp - 0x20]
push eax
push 1
mov dword [ebp - 4], 1
call fcn.004492c0
lea ecx, [ebp + 8]
call fcn.004011e0
or eax, 0xffffffff
or edx, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push eax
call fcn.0052f5ef
push eax
call fcn.0052f219
add esp, 8
cmp eax, 0xffffffff
je 0x48f11d
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x48f0ce
cmp eax, 3
jne 0x48f11d
push dword [ebx + 0x60]
call fcn.0052cde8
add esp, 4
test eax, eax
je 0x48f11d
lea eax, [ebp + 0x10]
push 0xffffffffffffffff
push eax
call fcn.00448390
add esp, 8
push eax
push 1
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004492c0
lea ecx, [ebp + 0x10]
call fcn.004011e0
or eax, 0xffffffff
or edx, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00451c60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48f3a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d4d8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x8870bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x60], 0
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x20], eax
jne 0x48f4c1
cmp dword [ebx + 0x78], 0xffffffff
jne 0x48f4c1
cmp dword [ebx + 0x64], 0xffffffff
je 0x48f4a8
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
mov esi, dword [ebp + 0xc]
movlpd qword [ebp - 0x1c], xmm0
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
test eax, eax
jg 0x48f41a
jl 0x48f416
cmp esi, 0x2000000
jae 0x48f41a
mov eax, esi
jmp 0x48f41f
mov eax, 0x2000000
push 0
lea ecx, [ebp - 0x18]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [ebx + 0x64]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x10]
test eax, eax
je 0x48f47a
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x48f462
add edi, eax
adc ecx, 0
sub esi, eax
mov eax, dword [ebp - 0x14]
sbb eax, 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
cmp ecx, dword [ebp + 0x10]
jg 0x48f462
jl 0x48f408
cmp edi, dword [ebp + 0xc]
jb 0x48f408
mov eax, edi
mov edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, edi
or eax, ecx
jne 0x48f462
lea eax, [ebp + 8]
push 0xffffffffffffffff
push eax
call fcn.004481a0
add esp, 8
mov ecx, dword [ebp - 0x20]
push eax
push 2
mov dword [ebp - 4], 0
call fcn.004492c0
lea ecx, [ebp + 8]
call fcn.004011e0
or eax, 0xffffffff
or edx, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00452410
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48fab0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d588
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x8870bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 4]
mov edi, dword [eax + 0x64]
cmp edi, 0xffffffff
jne 0x48fbe1
cmp dword [eax + 0x78], edi
jne 0x48fbae
cmp dword [eax + 0x60], 0
jne 0x48fbae
lea ecx, [eax + 0x10]
mov eax, dword [ecx]
cmp dword [eax + 4], 0
jne 0x48fb14
mov eax, dword [ecx + 4]
cmp dword [eax + 4], 0
je 0x48fc76
lea eax, [ebp - 0x14]
push eax
call fcn.00453e50
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.004116f0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004011e0
push ecx
mov eax, esp
lea ecx, [ebp - 0x20]
mov dword [eax], 3
call fcn.00411a60
lea ecx, [ebp - 0x20]
test al, al
je 0x48fba4
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00411df0
mov byte [ebp + 0xf], al
test al, al
jne 0x48fb85
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040df90
push eax
push 0xc
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.004492c0
lea ecx, [ebp - 0x18]
call fcn.004011e0
lea ecx, [ebp - 0x20]
call fcn.004117c0
mov al, byte [ebp + 0xf]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.004117c0
jmp 0x48fc76
cmp edi, 0xffffffff
jne 0x48fbe1
mov ecx, dword [eax + 0x60]
test ecx, ecx
je 0x48fbcb
push ecx
call fcn.0052f5ef
push eax
call fcn.0052f219
add esp, 8
jmp 0x48fbd6
push dword [eax + 0x78]
call fcn.0052f219
add esp, 4
mov edi, eax
cmp edi, 0xffffffff
je 0x48fc76
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x18]
call eax
mov ecx, dword [ebx]
push dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
mov esi, dword [ecx + 0x1c]
mov ecx, ebx
mov dword [ebp - 0x14], edx
call esi
test al, al
je 0x48fc68
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x48fc68
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
mov edi, dword [eax + 0x1c]
cmp ecx, esi
jg 0x48fc45
mov eax, dword [ebp - 0x10]
jl 0x48fc4c
mov edx, dword [ebp + 8]
cmp eax, edx
jae 0x48fc48
push ecx
push eax
mov ecx, ebx
call edi
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 8]
mov eax, edx
mov ecx, esi
push ecx
push eax
mov ecx, ebx
call edi
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebx]
push ecx
push dword [ebp - 0x10]
mov ecx, ebx
call dword [eax + 0x1c]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x498ae0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0x270
jne 0x498b30
lea edx, [edi + 8]
mov esi, eax
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x498af2
mov eax, dword [edi]
jmp 0x498c17
cmp eax, 0x4e0
jb 0x498c17
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
push ebp
mov ebp, 0xe3
nop
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x498b50
mov eax, dword [edi + 0xd50]
lea ebx, [edi + 0xd50]
mov ebp, 0x18c
nop word [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x498ba0
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
pop ebx
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret

Function at 0x498c50
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ecx
push ebp
mov ebp, ecx
cmp dword [ebp], 0
je 0x498cd3
push ebx
push esi
push edi
push ebp
lea ecx, [esp + 0x17]
call fcn.00498a90
mov esi, dword [esp + 0x18]
xor ecx, ecx
mov ebx, dword [esp + 0x1c]
xor edi, edi
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, dword [esp + 0x1c]
cmova ebx, ecx
test ebx, ebx
je 0x498c98
lea ecx, [ebp + 4]
call fcn.00498ae0
inc edi
mov dword [esi], eax
lea esi, [esi + 4]
cmp edi, ebx
jne 0x498c86
cmp byte [esp + 0x13], 0
je 0x498ccb
call fcn.00498fa0
push 0
push 3
mov esi, eax
mov dword [esp + 0x24], 1
push 0
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.004186c0
test al, al
jne 0x498ccb
mov ecx, esi
call fcn.00460570
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8
call fcn.00498fa0
pop ebp
lea ecx, [eax + 8]
add esp, 4
jmp fcn.00498cf0
Function at 0x498cf0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54da80
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x8870bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
sub edi, dword [ebp + 8]
sar edi, 2
mov dword [ebp + 0xc], edi
mov dword [ebp - 0x10], 0x88c8c8
mov edi, dword [ebp - 0x10]
nop
mov esi, dword [0x88c8c8]
mov eax, esi
mov ecx, dword [0x88c8cc]
mov edx, ecx
mov ebx, esi
lock cmpxchg8b qword [edi]
cmp esi, eax
jne 0x498d30
cmp ecx, edx
jne 0x498d30
mov edi, dword [ebp + 0xc]
mov eax, esi
or eax, ecx
jne 0x498d5e
call fcn.0049aae0
mov esi, eax
and esi, 0x1000
or esi, 0
jne 0x498d6d
xor al, al
jmp 0x498d6f
mov al, 1
test al, al
je 0x498d83
push edi
push dword [ebp + 8]
call fcn.0049ad20
add esp, 8
mov ebx, eax
jmp 0x498d85
xor ebx, ebx
cmp ebx, edi
je 0x498dfe
mov esi, edi
sub esi, ebx
shl esi, 2
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 4], 0
lea eax, [eax + ebx*4]
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
xor ecx, ecx
test al, al
cmovne ecx, esi
mov eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
add ebx, eax
cmp ebx, edi
je 0x498dfe
mov eax, dword [ebp + 8]
sub edi, ebx
shl edi, 2
xor ecx, ecx
mov dword [ebp + 0xc], edi
lea esi, [eax + ebx*4]
mov ebx, dword [ebp + 0xc]
lea eax, [edi + esi]
xor edi, edi
lea ebx, [ebx + 3]
shr ebx, 2
cmp esi, eax
cmova ebx, ecx
test ebx, ebx
je 0x498dfe
lea eax, [ebp - 0x10]
push eax
call fcn.0052f798
mov eax, dword [ebp - 0x10]
lea esi, [esi + 4]
inc edi
mov dword [esi - 4], eax
add esp, 4
cmp edi, ebx
jne 0x498de4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x498ec0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub esp, 0x9c4
mov eax, dword [0x8870bc]
xor eax, esp
mov dword [esp + 0x9c0], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x9d8]
mov dword [edi + 4], 0
mov dword [edi], 1
call fcn.00498fa0
mov dword [edi + 0x1388], 0xffffffff
lea esi, [edi + 0xc]
mov dword [edi + 8], 0x1571
mov ecx, 0x1571
mov edx, 1
lea ebx, [eax + 8]
mov eax, ecx
lea esi, [esi + 4]
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
inc edx
mov dword [esi - 4], ecx
cmp edx, 0x270
jl 0x498f12
lea eax, [esp + 0x9d0]
mov dword [edi + 4], 0x270
push eax
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
call fcn.00498cf0
xor edx, edx
lea ebx, [edi + 8]
xor esi, esi
mov eax, dword [esp + esi*4 + 0x10]
lea ebx, [ebx + 4]
mov ecx, eax
mov dword [ebx - 4], eax
or ecx, edx
mov edx, eax
shr edx, 0x1f
test esi, esi
cmovne edx, ecx
inc esi
cmp esi, 0x270
jb 0x498f52
test edx, edx
jne 0x498f7e
mov dword [edi + 8], 0xffffffff
mov ecx, dword [esp + 0x9d0]
mov dword [edi + 4], 0x270
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00520afb
add esp, 0x9c4
ret