joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456e40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x693f30]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x70], ecx
mov ecx, dword [ebp + 8]
call fcn.00404d40
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x456e6d
xor al, al
jmp 0x456fc4
mov dword [ebp - 0x14], 0xaac56b
mov eax, 0xcd44
mov word [ebp - 0x10], ax
mov ecx, 0x11d0
mov word [ebp - 0xe], cx
mov byte [ebp - 0xc], 0x8c
mov byte [ebp - 0xb], 0xc2
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0xc0
mov byte [ebp - 8], 0x4f
mov byte [ebp - 7], 0xc2
mov byte [ebp - 6], 0x95
mov byte [ebp - 5], 0xee
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
push 0x34
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.005a49e0
add esp, 0xc
mov dword [ebp - 0x24], 0x10
mov ecx, dword [ebp + 8]
call fcn.00404d40
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x58], 0x34
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 1
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 1
mov byte [ebp - 0x59], 0
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
call dword [sym.imp.WINTRUST.dll_WinVerifyTrust]
test eax, eax
jne 0x456fa3
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.WINTRUST.dll_WTHelperProvDataFromStateData]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x456fa3
push 0
push 0
push 0
mov edx, dword [ebp - 0x64]
push edx
call dword [sym.imp.WINTRUST.dll_WTHelperGetProvSignerFromChain]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x456fa3
push 0
mov eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.WINTRUST.dll_WTHelperGetProvCertFromChain]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x456fa3
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ecx + 4]
push edx
mov ecx, 0x699c50
call fcn.00456dd0
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
je 0x456fa3
mov eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp + 0x18]
call fcn.0040eb90
mov ecx, dword [ebp - 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [ebp - 0x59], 1
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x3c], 2
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
call dword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov al, byte [ebp - 0x59]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a1c7e
mov esp, ebp
pop ebp
ret 0x14
Function at 0x459e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 1
jl 0x459e58
cmp dword [ebp + 0xc], 8
jg 0x459e58
mov byte [ebp - 1], 1
jmp 0x459e5c
mov byte [ebp - 1], 0
push str.bad_pack_level
movzx eax, byte [ebp - 1]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00457840
add esp, 0xc
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af78], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x6af70], 0
jne 0x459ea5
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af78], 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af70], 0x10000
mov eax, 4
imul ecx, eax, 0x7fff
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x4af70], 0
push 0x1fffc
push 0
mov eax, dword [ebp + 8]
add eax, 0x4af70
push eax
call fcn.005a49e0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx*8 + 0x63977a]
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af98], edx
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx*8 + 0x639778]
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af9c], edx
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx*8 + 0x63977c]
mov eax, dword [ebp + 8]
mov dword [eax + 0x6afa0], edx
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx*8 + 0x63977e]
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af94], edx
cmp dword [ebp + 0xc], 2
jg 0x459f3d
mov ecx, dword [ebp + 0x10]
movzx edx, word [ecx]
or edx, 4
mov eax, dword [ebp + 0x10]
mov word [eax], dx
jmp 0x459f52
cmp dword [ebp + 0xc], 8
jl 0x459f52
mov ecx, dword [ebp + 0x10]
movzx edx, word [ecx]
or edx, 2
mov eax, dword [ebp + 0x10]
mov word [eax], dx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af84], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af74], 0
mov dword [ebp - 8], 0x8000
mov eax, dword [ebp - 8]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x1af70
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0xc]
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af90], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x6af90], 0
je 0x459fbd
mov eax, dword [ebp + 8]
cmp dword [eax + 0x6af90], 0xffffffff
jne 0x459fd9
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af8c], 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af90], 0
jmp 0x45a051
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af8c], 0
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x6af90], 0x106
jae 0x45a001
mov edx, dword [ebp + 8]
push edx
call fcn.0045a400
add esp, 4
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af7c], 0
mov dword [ebp - 8], 0
jmp 0x45a020
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 2
jae 0x45a051
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x6af7c]
shl eax, 5
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movzx edx, byte [ecx + 0x1af70]
xor eax, edx
and eax, 0x7fff
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af7c], eax
jmp 0x45a017
mov esp, ebp
pop ebp
ret
Function at 0x45c400
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul ecx, eax, 0
movsx edx, byte [ebp + 0xc]
mov eax, dword [ebp + 8]
xor edx, dword [eax + ecx]
and edx, 0xff
mov ecx, 4
imul eax, ecx, 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax]
shr eax, 8
xor eax, dword [edx*4 + 0x639208]
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + edx], eax
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax]
and edx, 0xff
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
add edx, dword [ecx + eax]
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], edx
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
imul ecx, dword [eax + edx], 0x8088405
add ecx, 1
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], ecx
mov ecx, 4
shl ecx, 1
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov edx, dword [eax + edx]
shr edx, 0x18
mov eax, dword [ebp + 8]
xor edx, dword [eax + ecx]
and edx, 0xff
mov ecx, 4
shl ecx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + ecx]
shr ecx, 8
xor ecx, dword [edx*4 + 0x639208]
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + edx], ecx
pop ebp
ret
Function at 0x45ceb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x693f30]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
movzx edx, byte [ecx + 0x2d]
test edx, edx
je 0x45cfa2
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x3c], 0
je 0x45cf0b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x40]
cmp edx, dword [ebp + 0xc]
jae 0x45cf0b
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.005a245e
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x3c], 0
jne 0x45cf37
mov edx, dword [ebp + 0xc]
shl edx, 1
push edx
call fcn.005a2463
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 0x3c], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x40], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
push ecx
call fcn.005a4460
add esp, 0xc
mov dword [ebp - 0x14], 0
jmp 0x45cf60
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x45cf99
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 0x14]
movzx ecx, byte [edx + eax]
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x30
push edx
call fcn.0045c520
add esp, 8
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp - 0x14]
mov al, byte [ebp - 0xd]
mov byte [ecx + edx], al
jmp 0x45cf57
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x3c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x20], 0
je 0x45cffd
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
add edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
cmp edx, dword [eax + 0x28]
jb 0x45cfca
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x14], 0x30000
xor eax, eax
jmp 0x45d032
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
mov eax, dword [ebp - 0xc]
add edx, dword [eax + 0x24]
push edx
call fcn.005a4460
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
add edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x24], edx
mov eax, dword [ebp + 0xc]
jmp 0x45d032
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 4], 0
je 0x45d026
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
jmp 0x45d032
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x14], 0x1000000
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a1c7e
mov esp, ebp
pop ebp
ret 8
Function at 0x45d690
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x693f30]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x84], 0
je 0x45d75c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x8c]
cmp eax, dword [edx + 0x88]
jb 0x45d6ce
xor eax, eax
jmp 0x45d7cc
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x88]
sub eax, dword [edx + 0x8c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0xc]
jbe 0x45d6f1
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x84]
mov eax, dword [ebp - 0xc]
add edx, dword [eax + 0x8c]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.005a4460
add esp, 0xc
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x8c]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x8c], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x74]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x74], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x78]
push edx
call fcn.0045c210
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x78], eax
mov eax, dword [ebp - 0x10]
jmp 0x45d7cc
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x7c], 0
je 0x45d7c0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x45d78d
xor eax, eax
jmp 0x45d7cc
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x74]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x74], eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x78]
push edx
call fcn.0045c210
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x78], eax
mov eax, dword [ebp - 8]
jmp 0x45d7cc
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x14], 0x1000000
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a1c7e
mov esp, ebp
pop ebp
ret 8
Function at 0x4638d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d9024
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x693f30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.BaseRequestInfo.0
mov word [edi + 8], 0
mov dword [edi + 0xc], 1
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov byte [edi + 0x18], 0
mov dword [ebp - 4], 1
mov dword [edi + 0x30], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0xf
mov byte [edi + 0x30], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0xf
mov byte [edi + 0x48], 0
mov byte [edi + 0x60], 1
mov dword [edi + 0x64], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0xf
mov byte [edi + 0x64], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0xf
mov byte [edi + 0x7c], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa8], 0xf
mov byte [edi + 0x94], 0
mov dword [edi + 0xac], 0
mov dword [edi + 0xbc], 0
mov dword [edi + 0xc0], 0xf
mov byte [edi + 0xac], 0
mov dword [edi + 0xc4], 0
mov dword [edi + 0xd4], 0
mov dword [edi + 0xd8], 0xf
mov byte [edi + 0xc4], 0
lea esi, [edi + 0xdc]
mov byte [ebp - 4], 0xf
push 0x40
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005a2092
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0xe4]
mov byte [ebp - 4], 0x10
push 0x30
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005a2092
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x114], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4683a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
test esi, esi
je 0x46857d
cmp dword [esi + 0x20], 0
je 0x46857d
cmp dword [esi + 0x24], 0
je 0x46857d
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x46857d
cmp dword [eax], esi
jne 0x46857d
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x468404
cmp eax, 0x39
je 0x468404
cmp eax, 0x45
je 0x468404
cmp eax, 0x49
je 0x468404
cmp eax, 0x5b
je 0x468404
cmp eax, 0x67
je 0x468404
cmp eax, 0x71
je 0x468404
cmp eax, 0x29a
jne 0x46857d
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x46843d
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
jne 0x46844d
mov dword [edi + 4], 0x39
xor eax, eax
jmp 0x46846d
test ecx, ecx
mov edx, 0x2a
mov eax, 0x71
cmovne eax, edx
xor edx, edx
push 0
xor ecx, ecx
mov dword [edi + 4], eax
call fcn.0046c670
add esp, 4
mov dword [esi + 0x30], eax
mov ecx, edi
lea eax, [edi + 0x94]
mov dword [edi + 0x28], 0
mov dword [edi + 0xb18], eax
lea eax, [edi + 0x988]
mov dword [edi + 0xb24], eax
lea eax, [edi + 0xa7c]
mov dword [edi + 0xb30], eax
xor eax, eax
mov dword [edi + 0xb20], 0x63a134
mov dword [edi + 0xb2c], 0x63a1fc
mov dword [edi + 0xb38], 0x639fac
mov word [edi + 0x16b8], ax
mov dword [edi + 0x16bc], eax
call fcn.0046ad00
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.005a49e0
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x63b9c2]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x63b9c0]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x63b9c4]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x63b9c6]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
pop ebx
ret
pop esi
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x498ac0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, dword [edx + 0x10]
jb 0x498ad3
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x498af1
nop
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x498ae0
pop edi
mov eax, esi
xor edx, edx
pop esi
pop ebp
ret
Function at 0x4ae5a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5de4ff
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x693f30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov eax, dword [edi + 4]
mov edx, eax
mov ecx, dword [edx + 4]
cmp byte [ecx + 0xd], bl
jne 0x4ae5fe
mov esi, dword [ebp + 8]
cmp dword [ecx + 0x10], esi
jae 0x4ae5ec
mov ecx, dword [ecx + 8]
jmp 0x4ae5f0
mov edx, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], bl
je 0x4ae5e2
cmp edx, eax
je 0x4ae5fe
cmp esi, dword [edx + 0x10]
jae 0x4ae600
mov edx, eax
cmp edx, eax
je 0x4ae79d
lea eax, [ebp + 8]
push eax
lea ecx, [edi + 4]
call fcn.004adaa0
push eax
lea ecx, [ebp - 0x50]
call fcn.004ad9e0
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 4]
call fcn.004add50
mov eax, dword [ebp + 0xc]
cmp eax, 2
jne 0x4ae6ee
push 0x18
call fcn.005a2092
mov esi, eax
add esp, 4
mov dword [ebp - 0x5c], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x4ae6c2
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x30]
call fcn.004ad9e0
mov ebx, 1
mov byte [ebp - 4], 2
push 0x20
mov dword [ebp - 0x58], ebx
call fcn.005a2092
mov edi, eax
add esp, 4
mov dword [ebp - 0x54], edi
mov dword [ebp - 4], 3
test edi, edi
je 0x4ae692
lea eax, [ebp - 0x30]
mov ecx, edi
push eax
call fcn.004ad9e0
jmp 0x4ae694
xor edi, edi
mov byte [ebp - 4], 2
mov dword [esi], edi
mov dword [esi + 0x10], 0x4adbb0
mov dword [esi + 0x14], 0x4adc30
call fcn.00498bb0
add eax, 5
mov dword [esi + 4], 0
mov dword [esi + 8], eax
adc edx, 0
mov dword [esi + 0xc], edx
jmp 0x4ae6c4
xor esi, esi
push esi
mov dword [ebp - 4], 4
call fcn.00497990
mov ecx, eax
call fcn.00499df0
test bl, 1
je 0x4ae795
lea ecx, [ebp - 0x30]
call fcn.004a7220
jmp 0x4ae795
cmp eax, 1
je 0x4ae780
test eax, eax
jne 0x4ae780
mov eax, dword [ebp + 0x10]
cmp eax, 0xcc
je 0x4ae710
cmp eax, 0xc8
jne 0x4ae780
cmp dword [0x696414], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x114]
push eax
push dword [ebp + 8]
push str.INFO:_send_report_success__requestId:__u__retry_count:__u
push str.CmtRequestQueue::sendCallBack
push 0xb8
push str.C:lodi_build537278388workspacepdd_cmt_report_srcCmtRequestQueue.cpp
je 0x4ae74f
call fcn.00484020
add esp, 0x18
lea eax, [ebp - 0x50]
mov ecx, edi
push eax
call fcn.004ae2f0
jmp 0x4ae795
mov ecx, dword [0x6963e8]
test ecx, ecx
je 0x4ae76b
call ecx
add esp, 0x18
lea eax, [ebp - 0x50]
mov ecx, edi
push eax
call fcn.004ae2f0
jmp 0x4ae795
call fcn.00484070
add esp, 0x18
lea eax, [ebp - 0x50]
mov ecx, edi
push eax
call fcn.004ae2f0
jmp 0x4ae795
sub esp, 0x20
lea eax, [ebp - 0x50]
mov ecx, esp
push eax
call fcn.004ad9e0
mov ecx, edi
call fcn.004ae330
lea ecx, [ebp - 0x50]
call fcn.004a7220
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a1c7e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4aeaa0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x693f30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x4c
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x50]
push 0
push eax
mov dword [ebp - 0x64], esi
call fcn.005a49e0
mov ebx, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
test ebx, ebx
je 0x4aebbf
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
lea edx, [eax + ebx*8]
cmp edx, eax
jae 0x4aeb04
inc ecx
mov edi, dword [ebp - 8]
mov eax, ebx
shr eax, 0x1d
add ecx, eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], ecx
test edi, edi
je 0x4aeb7f
cmp ebx, 0x40
jae 0x4aeb42
lea eax, [edi + ebx]
cmp eax, 0x40
jae 0x4aeb42
push ebx
lea eax, [ebp - 0x48]
add eax, edi
push esi
push eax
call fcn.005a4460
mov edi, dword [ebp - 8]
add esp, 0xc
add edi, ebx
mov dword [ebp - 8], edi
jmp 0x4aebc2
mov esi, 0x40
lea eax, [ebp - 0x48]
sub esi, edi
add eax, edi
push esi
push dword [ebp - 0x64]
push eax
call fcn.005a4460
push 1
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004aecd0
add dword [ebp - 0x64], esi
lea eax, [ebp - 0x48]
push 0x44
push 0
push eax
sub ebx, esi
call fcn.005a49e0
mov edi, dword [ebp - 8]
add esp, 0x24
mov esi, ebx
shr esi, 6
test esi, esi
je 0x4aeba7
push esi
push dword [ebp - 0x64]
lea eax, [ebp - 0x60]
push eax
call fcn.004aecd0
mov eax, dword [ebp - 0x64]
add esp, 0xc
mov edi, dword [ebp - 8]
shl esi, 6
add eax, esi
sub ebx, esi
jmp 0x4aebaa
mov eax, dword [ebp - 0x64]
test ebx, ebx
je 0x4aebc2
push ebx
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 8], ebx
push eax
call fcn.005a4460
add esp, 0xc
mov edi, dword [ebp - 8]
mov byte [ebp + edi - 0x48], 0x80
inc edi
cmp edi, 0x38
jbe 0x4aebf6
mov eax, 0x40
sub eax, edi
push eax
lea eax, [ebp - 0x48]
add eax, edi
push 0
push eax
call fcn.005a49e0
push 1
lea eax, [ebp - 0x48]
xor edi, edi
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004aecd0
add esp, 0x18
mov eax, 0x38
sub eax, edi
push eax
lea eax, [ebp - 0x48]
add eax, edi
push 0
push eax
call fcn.005a49e0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x48]
push 1
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004aecd0
push 0x40
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.005a49e0
mov ecx, dword [ebp - 0x68]
add esp, 0x24
mov eax, dword [ebp - 0x60]
mov dword [ecx], eax
mov eax, dword [ebp - 0x5c]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x58]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x54]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005a1c7e
mov esp, ebp
pop ebp
ret
Function at 0x4b2e60
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x693f30]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4b2eb0
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x4b2eaa
shr eax, 8
cmp al, 2
jne 0x4b2eaa
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a1c7e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.005a1c7e
mov esp, ebp
pop ebp
ret
Function at 0x4c0c70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4c0c8e
cmp dword [esi + 0x6c], 0
je 0x4c0c8e
push 2
push 3
push esi
call fcn.004eb000
add esp, 0xc
push dword [ebp + 0xc]
call fcn.004eb330
add esp, 4
test esi, esi
je 0x4c0cae
cmp dword [esi + 0x6c], 0
je 0x4c0cae
push 3
push esi
call fcn.004eb040
add esp, 8
pop esi
pop ebp
ret