joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d8a0
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov esi, ecx
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 0xc], eax
lea ebp, [ecx + 0x10]
jmp 0x45d901
mov dword [esp], 0xc
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov eax, esp
push eax
push 0
push 0x1000
push 0x1000
push 0xff
push 8
push 0x40000003
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x45d961
test bl, 1
jne 0x45d930
push ebp
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x45d932
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x45d932
mov edi, eax
cmp eax, 0x217
je 0x45d932
jmp 0x45d9bb
xor ebx, ebx
mov edi, dword [esi + 0xc]
mov eax, dword [esi + 0x28]
mov dword [esp], edi
mov ecx, dword [eax]
mov edx, dword [esp]
push edx
push 0x45da60
push eax
call dword [ecx + 0x10]
add esp, 0xc
test eax, eax
je 0x45d8c0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45d8c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
call fcn.00417110
add esp, 4
push eax
push str.Error_while_listening_to_named_pipe:__s
call fcn.00413aa0
add esp, 8
mov ebx, eax
push dword [esi + 8]
call fcn.00410820
add esp, 4
mov ecx, dword [esi + 0x28]
mov edx, dword [ecx]
push edi
push ebx
push 0
push eax
push 1
push ecx
call dword [edx]
add esp, 0x18
push ebx
call fcn.00414470
add esp, 4
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0046efa0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
cmp edi, 0x3e5
jne 0x45d969
jmp 0x45d9a8

Function at 0x45fce0
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 4], eax
push 0
push 0x102c
push 1
call fcn.004143e0
add esp, 0xc
mov esi, eax
mov dword [eax], 0
lea edi, [eax + 4]
mov dword [eax + 4], ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x10], eax
mov dword [esi + 0x1028], ebx
mov byte [esi + 0x16], 0
mov word [esi + 0x14], 0
mov eax, dword [esp + 0x24]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x1c], eax
cmp dword [0x4c2120], 0xffffffff
jne 0x45fd93
mov dword [0x4c39b8], 0x4c39b8
mov dword [0x4c39bc], 0x4c39b8
push 0x4c39c0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x4c2120], eax
push 0
push 0x460480
push eax
call fcn.004329a0
add esp, 0xc
mov eax, esp
push eax
push 0
push edi
push 0x45fdd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x45fdb3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 0x17], 1
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046efa0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45ffc0
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 4], eax
push 0
push 0x102c
push 1
call fcn.004143e0
add esp, 0xc
mov esi, eax
mov dword [eax], 1
lea edi, [eax + 4]
mov dword [eax + 4], ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], ebx
lea eax, [esi + 0x30]
push eax
call fcn.004123d0
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esp + 0x20]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], esi
mov eax, dword [esp + 0x28]
mov dword [esi + 0x1c], eax
cmp dword [0x4c2120], 0xffffffff
jne 0x460083
mov dword [0x4c39b8], 0x4c39b8
mov dword [0x4c39bc], 0x4c39b8
push 0x4c39c0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x4c2120], eax
push 0
push 0x460480
push eax
call fcn.004329a0
add esp, 0xc
mov eax, esp
push eax
push 0
push edi
push 0x4600c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4600a3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046efa0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x461900
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x54]
imul eax, dword [esp + 0x24], 0x3e8
mov ecx, 0x10624dd3
mul ecx
shr edx, 6
mov dword [esp], edx
mov edi, 1
mov ebx, 1
nop
nop
nop
nop
nop
nop
mov dword [esp + 4], ebx
mov ebx, edi
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov edi, eax
mov ebp, esi
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push ebx
push dword [esp + 0x50]
push dword [esp + 0x50]
call fcn.00460cf0
add esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
mov edi, dword [esp + 4]
add edi, ebx
setb cl
cmp eax, dword [esp]
jae 0x4619a4
test cl, cl
jne 0x4619a4
push 0
mov esi, ebp
push ebp
call fcn.00414680
add esp, 8
jmp 0x461930
mov eax, dword [esp + 0x28]
mov dword [eax], ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4619c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc08
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x4c2010]
xor ecx, ebp
mov dword [esp + 0xc00], ecx
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [eax + ecx*8]
mov ebx, dword [eax + ecx*8 + 4]
xor edi, dword [edx + ecx*8]
xor ebx, dword [edx + ecx*8 + 4]
mov dword [esp + ecx*8 + 0x804], ebx
mov dword [esp + ecx*8 + 0x800], edi
add ecx, 1
cmp ecx, 0x80
jne 0x4619f0
lea eax, [esp + 0x800]
lea edi, [esp + 0x400]
mov ecx, edi
mov edx, 2
push 2
push eax
call fcn.00461c50
add esp, 8
lea eax, [esp + 0x880]
lea ecx, [esp + 0x480]
mov edx, 2
push 2
push eax
call fcn.00461c50
add esp, 8
lea eax, [esp + 0x900]
lea ecx, [esp + 0x500]
mov edx, 2
push 2
push eax
call fcn.00461c50
add esp, 8
lea eax, [esp + 0x980]
lea ecx, [esp + 0x580]
mov edx, 2
push 2
push eax
call fcn.00461c50
add esp, 8
lea eax, [esp + 0xa00]
lea ecx, [esp + 0x600]
mov edx, 2
push 2
push eax
call fcn.00461c50
add esp, 8
lea eax, [esp + 0xa80]
lea ecx, [esp + 0x680]
mov edx, 2
push 2
push eax
call fcn.00461c50
add esp, 8
lea eax, [esp + 0xb00]
lea ecx, [esp + 0x700]
mov edx, 2
push 2
push eax
call fcn.00461c50
add esp, 8
lea eax, [esp + 0xb80]
lea ecx, [esp + 0x780]
mov edx, 2
push 2
push eax
call fcn.00461c50
add esp, 8
mov ebx, esp
mov ecx, ebx
mov edx, 0x10
push 0x10
push edi
call fcn.00461c50
add esp, 8
lea eax, [esp + 0x410]
lea ecx, [esp + 0x10]
mov edx, 0x10
push 0x10
push eax
call fcn.00461c50
add esp, 8
lea eax, [esp + 0x420]
lea ecx, [esp + 0x20]
mov edx, 0x10
push 0x10
push eax
call fcn.00461c50
add esp, 8
lea eax, [esp + 0x430]
lea ecx, [esp + 0x30]
mov edx, 0x10
push 0x10
push eax
call fcn.00461c50
add esp, 8
lea eax, [esp + 0x440]
lea ecx, [esp + 0x40]
mov edx, 0x10
push 0x10
push eax
call fcn.00461c50
add esp, 8
lea eax, [esp + 0x450]
lea ecx, [esp + 0x50]
mov edx, 0x10
push 0x10
push eax
call fcn.00461c50
add esp, 8
lea eax, [esp + 0x460]
lea ecx, [esp + 0x60]
mov edx, 0x10
push 0x10
push eax
call fcn.00461c50
add esp, 8
lea eax, [esp + 0x470]
lea ecx, [esp + 0x70]
mov edx, 0x10
push 0x10
push eax
call fcn.00461c50
add esp, 8
xor eax, eax
nop
nop
nop
nop
mov ecx, dword [esp + eax*8]
mov edx, dword [esp + eax*8 + 4]
xor edx, dword [esp + eax*8 + 0x804]
xor ecx, dword [esp + eax*8 + 0x800]
xor dword [esi + eax*8], ecx
xor dword [esi + eax*8 + 4], edx
add eax, 1
cmp eax, 0x80
jne 0x461be0
push 0x400
lea eax, [esp + 0x804]
push eax
call fcn.00432100
add esp, 8
push 0x400
push edi
call fcn.00432100
add esp, 8
push 0x400
push ebx
call fcn.00432100
add esp, 8
mov ecx, dword [esp + 0xc00]
xor ecx, ebp
call fcn.0046efa0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x462710
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x20]
test edi, edi
je 0x46273a
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
lea esi, [edi - 1]
mov ebx, edi
and ebx, 3
cmp esi, 3
jae 0x462741
xor esi, esi
test ebx, ebx
jne 0x46278e
jmp 0x4627a3
mov eax, 1
jmp 0x4627ad
mov dword [esp], ebx
and edi, 0xfffffffc
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax]
xor bl, byte [ecx]
mov bh, byte [eax + 1]
movzx ebp, bl
xor bh, byte [ecx + 1]
or ebp, esi
mov bl, byte [eax + 2]
xor bl, byte [ecx + 2]
movzx esi, bh
movzx ebx, bl
or ebx, esi
or ebx, ebp
movzx edx, byte [eax + 3]
add eax, 4
xor dl, byte [ecx + 3]
add ecx, 4
movzx esi, dl
or esi, ebx
add edi, 0xfffffffc
jne 0x462750
mov ebx, dword [esp]
test ebx, ebx
je 0x4627a3
xor edi, edi
movzx edx, byte [eax + edi]
xor dl, byte [ecx + edi]
movzx edx, dl
or esi, edx
add edi, 1
cmp ebx, edi
jne 0x462790
mov eax, 0x100
sub eax, esi
shr eax, 8
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46cf80
Capabilities:
Hash data using sha512

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x10]
cmp ebx, 0x41
jb 0x46cfa0
push pe_nt_image_headers32
push str._home_simon_mem_.build_workdirs_bob_0_vdcidh_putty_crypto_blake2.c
push str.hashlen___ssh_blake2b.hlen
call fcn.0047f4a4
add esp, 0xc
push 0
push 0xf0
push 1
call fcn.004143e0
add esp, 0xc
lea edx, [eax + 0xe4]
mov dword [eax + 0xe4], 0x4a1e48
mov dword [eax + 0x40], ebx
lea ecx, [eax + 0xd8]
mov dword [eax + 0xd8], 0x46d260
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], ecx
mov dword [eax + 0xe8], ecx
mov ecx, 0x10
mov edi, eax
mov esi, 0x4a1e78
rep movsd dword es:[edi], dword [esi]
xor ebx, 0xf2bdc908
mov dword [eax], ebx
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
mov dword [eax + 0xcc], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov eax, edx
pop esi
pop edi
pop ebx
ret
Function at 0x46f7fc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x46f83b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46f83b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46f83b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x46f83b
cmp dword [ecx + 0x74], 0xe
jbe 0x46f83b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x483b60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x483b8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x483b8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x483f61
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4a3780
push 0x4a3778
push str.FlsAlloc
push 0x1e
call fcn.004845f4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x483f95
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x483f9b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x483fdf
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4a3790
push 0x4a3788
push str.FlsGetValue
push 0x20
call fcn.004845f4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x484016
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x48b648
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x48b6e5
push ebx
push esi
call fcn.0048b736
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0048b591
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x48b692
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x48b6e4
push edi
push eax
call fcn.00486284
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x48b6b2
call fcn.0048593d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x48b6e3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0048b591
add esp, 0x20
test eax, eax
jne 0x48b6d1
push edi
call fcn.0048593d
jmp 0x48b6d9
push ebx
call fcn.0048593d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x48b6e8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x48b6f9
pop esi
ret
push ebx
push edi
push esi
call fcn.0048b736
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00486284
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x48b721
push ebx
push esi
push edi
call fcn.00471750
add esp, 0xc
push 0
call fcn.0048593d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x48b778
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048b9e1

Function at 0x48bf99
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048bfa4
Function at 0x48c916
Capabilities:
Read file via mapping

Disassembly:
push 0
rol edi, 0x12
sub ebx, esp
neg eax
dec esi
mov dword [0x4c4248], edi
add eax, esp
and dword [0x4c4384], edi
ror esi, 0xc
inc esi
ror edi, 0xe
xor esi, esp
neg ebx
dec esi
add edx, edi
neg eax
neg eax
sub edx, edi
inc esi
neg ebx
xor esi, esp
rol edi, 0xe
dec esi
rol esi, 0xc
mov dword [0x4c47d5], esi
sub eax, esp
mov dword [0x4c424a], ebx
inc esi
neg eax
add ebx, esp
ror edi, 0x12
push 0x22
xor ecx, edx
and dword [0x4c44f7], 0x23b621b
xor ecx, dword [0x4c4af6]
sub esi, 0xe877192
rol eax, 6
not esi
dec eax
xchg esi, edx
ror eax, 9
not eax
xor edx, eax
dec esi
inc esi
xor edx, eax
not eax
rol eax, 9
xchg esi, edx
inc eax
not esi
ror eax, 6
add esi, 0xe877192
or dword [0x4c42f0], 0x1e62c98e
xor ecx, edx
push eax
xor esi, eax
call fcn.004023dc
not eax
xor eax, 0x271bee24
not edi
sub eax, 0x73375f4
rol esi, 0x1d
call fcn.00408217
not edx
sub esi, 0xb9e8796
call fcn.00405a97
rol ebx, 0xd
xchg esi, eax
add ecx, esi
rol esi, 0x1c
sbb al, 0x40

Function at 0x48c9e6
Capabilities:
Read file via mapping

Disassembly:
sbb al, 0x40
add esi, eax
sub esi, eax
dec eax
ror esi, 0x1c
sub ecx, esi
xchg esi, eax
ror ebx, 0xd
call fcn.00402d45
add esi, 0xb9e8796
not edx
call fcn.00403bb9
ror esi, 0x1d
add eax, 0x73375f4
not edi
xor eax, 0x271bee24
not eax
xor esi, eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
rol eax, 6
neg esi
sub eax, 0x35adc9f
xor esi, 0x5cad52
ror ebx, 0x17
xor ecx, edx
and dword [0x4c484c], 0x3a3ba38
sub esi, eax
rol esi, 0x17
sub esi, eax
xor edi, dword [0x4c4ce8]
ror eax, 1
call fcn.00402d45
xchg esi, esi
sub esi, eax
xor esi, eax
neg edi
add esi, ebp
not eax
sub edi, dword [0x4c4a87]
xor dword [0x4c4578], 0x2f680ad2
not eax
sub esi, ebp
neg edi
xor esi, eax
add esi, eax
xchg esi, esi
call fcn.00405b38
rol eax, 1
add esi, eax
ror esi, 0x17
add esi, eax
or dword [0x4c4472], 0x623f1a4
xor ecx, edx
rol ebx, 0x17
xor esi, 0x5cad52
add eax, 0x35adc9f
neg esi
ror eax, 6
mov ecx, ebx
not eax
xchg esi, eax
dec edx
call fcn.00404e75
not eax
inc eax
xchg eax, esi
xor esi, dword [0x4c49ec]
xor ecx, dword [0x4c4c60]
xor dword [0x4c481e], 0x757bde8
ror eax, 8
xor ecx, 0x710ea67
dec esi
or dword [0x4c48ab], ebx
xor edx, eax
xor edx, esp
xor ebx, eax
and dword [0x4c4764], ecx
xor ebx, eax
xor edx, esp
xor edx, eax
mov dword [0x4c42f0], edi
inc esi
xor ecx, 0x710ea67
rol eax, 8
xchg eax, esi
dec eax
not eax
call fcn.00402eee
inc edx
xchg esi, eax
not eax
call fcn.0048cb1d
add byte [eax], al
invalid

Function at 0x48cd9f
Capabilities:
Hash data using murmur3

Disassembly:
inc ebx
dec esp
add byte [ebx + 0x250], bh
rol eax, 0x10
mov dword [0x4c44b2], 0x566a6ed
ror esi, 0xc
xor dword [0x4c436c], esi
mov dword [0x4c4570], ebx
dec esi
mov dword [0x4c4595], ecx
inc esi
xor ecx, edi
neg ebx
add ebx, dword [0x4c4982]
mov dword [0x4c476c], edi
cmp eax, 0x4c476c
xchg edx, esi
rol ecx, 0x11
add esi, eax
mov dword [0x4c4617], ebx
mov dword [0x4c436a], edi
sub esi, eax
ror ecx, 0x11
xchg edx, esi
neg ebx
xor ecx, edi
dec esi
sub dword [0x4c446a], edi
inc esi
mov dword [0x4c4428], ecx
rol esi, 0xc
xor dword [0x4c48a2], 0x27c0b75b
ror eax, 0x10
call fcn.0048ce1c
Function at 0x48cdd6
Capabilities:
Hash data using murmur3

Disassembly:
inc ebx
dec esp
add byte [ebx + 0x250], bh
rol eax, 0x10
mov dword [0x4c44b2], 0x566a6ed
ror esi, 0xc
xor dword [0x4c436c], esi
mov dword [0x4c4570], ebx
dec esi
mov dword [0x4c4595], ecx
inc esi
xor ecx, edi
neg ebx
add ebx, dword [0x4c4982]
mov dword [0x4c476c], edi
cmp eax, 0x4c476c
xchg edx, esi
rol ecx, 0x11
add esi, eax
mov dword [0x4c4617], ebx
mov dword [0x4c436a], edi
sub esi, eax
ror ecx, 0x11
xchg edx, esi
neg ebx
xor ecx, edi
dec esi
sub dword [0x4c446a], edi
inc esi
mov dword [0x4c4428], ecx
rol esi, 0xc
xor dword [0x4c48a2], 0x27c0b75b
ror eax, 0x10
call fcn.0048ce1c
Function at 0x48d88c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048d897
Function at 0x48e8a8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4c3e80]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x48e8e8
cmp byte [ebx], 0xa
jne 0x48e8e8
or byte [eax + edi + 0x28], 4
jmp 0x48e8ed
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x48e9eb
mov al, byte [edx]
cmp al, 0x1a
je 0x48e9cd
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x48e91c
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x48e941
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x48e94b
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x48e8fe
jmp 0x48e9eb
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48e9c8
cmp dword [ebp - 0xc], 0
je 0x48e9c8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4c3e80]
test byte [eax + edi + 0x28], 0x48
je 0x48e9a2
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x48e98d
mov byte [esi], dl
jmp 0x48e99e
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4c3e80]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x48e9eb
cmp byte [ebp - 1], 0xa
jne 0x48e9b1
cmp esi, ebx
jne 0x48e9b1
mov byte [esi], 0xa
jmp 0x48e9ea
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004944a0
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x48e9eb
mov byte [esi], 0xd
jmp 0x48e9ea
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4c3e80]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x48e9e7
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x48e9eb
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x48e9f4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4c3e80]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x48ea37
cmp word [esi], dx
jne 0x48ea37
or byte [edi + eax + 0x28], 4
jmp 0x48ea3c
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x48eb8f
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x48eb6f
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x48ea7e
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x48eab4
cmp eax, edx
jae 0x48eac0
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x48ea56
jmp 0x48eb8f
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48eb6b
cmp dword [ebp - 0x14], 0
je 0x48eb6b
mov eax, dword [ebx*4 + 0x4c3e80]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x48eb43
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x48eb0c
mov word [esi], cx
jmp 0x48eb3f
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4c3e80]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4c3e80]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4c3e80]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x48eb8f
pop ebx
cmp word [ebp - 4], bx
jne 0x48eb54
cmp esi, dword [ebp + 0xc]
jne 0x48eb54
mov word [esi], bx
jmp 0x48eb8c
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004944a0
add esp, 0x10
cmp word [ebp - 4], bx
je 0x48eb8f
push 0xd
jmp 0x48eb88
mov ecx, dword [ebx*4 + 0x4c3e80]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x48eb86
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x48eb8f
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret