joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a24f0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a2f80

Function at 0x4a2500
Capabilities:
Encrypt data using aes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a31a0
Function at 0x4a4860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x2c]
mov ebx, dword [edi + 0x74]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x6c]
add eax, esi
sub edx, ebx
mov dword [ebp + 8], edx
cmp dword [edi + 0x6c], eax
jb 0x4a48f3
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call sub.msvcrt.dll_memcpy
mov ebx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea edx, [eax + ebx*2]
lea ecx, [ecx]
movzx eax, word [edx - 2]
lea edx, [edx - 2]
mov ecx, eax
sub ecx, esi
cmp eax, esi
sbb eax, eax
not eax
and eax, ecx
mov word [edx], ax
sub ebx, 1
jne 0x4a48b0
mov eax, dword [edi + 0x40]
mov ebx, esi
lea edx, [eax + esi*2]
movzx eax, word [edx - 2]
lea edx, [edx - 2]
mov ecx, eax
sub ecx, esi
cmp eax, esi
sbb eax, eax
not eax
and eax, ecx
mov word [edx], ax
sub ebx, 1
jne 0x4a48d3
mov edx, dword [ebp + 8]
add edx, esi
mov ebx, dword [edi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x4a4a2c
mov ecx, dword [edi + 0x6c]
add ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x38]
mov dword [ebp - 4], ecx
mov ecx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jbe 0x4a491a
mov ecx, edx
mov dword [ebp + 8], edx
test ecx, ecx
jne 0x4a4922
xor eax, eax
jmp 0x4a496e
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x4a493f
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.004a9ee0
jmp 0x4a494f
cmp eax, 2
jne 0x4a4958
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.004a7630
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebx + 0x30], eax
push ecx
push dword [ebx]
push dword [ebp - 4]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 8]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
mov ecx, dword [edi + 0x74]
lea ebx, [ecx + eax]
mov dword [edi + 0x74], ebx
cmp ebx, 3
jb 0x4a4999
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x4a49ad
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4a4870
mov edx, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp edx, ecx
jae 0x4a4a2c
mov esi, dword [edi + 0x6c]
add esi, ebx
cmp edx, esi
jae 0x4a49fb
sub ecx, esi
mov dword [ebp + 8], ecx
cmp ecx, 0x102
jbe 0x4a49d8
mov ecx, 0x102
mov dword [ebp + 8], ecx
mov eax, dword [edi + 0x38]
push ecx
add eax, esi
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x102]
cmp edx, eax
jae 0x4a4a2c
sub esi, edx
sub ecx, edx
add esi, 0x102
cmp esi, ecx
jbe 0x4a4a15
mov esi, ecx
mov eax, dword [edi + 0x38]
push esi
add eax, edx
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a7630
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4a763c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004a7390
Function at 0x4aabd0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
movzx ecx, word [ecx + 6]
lea ecx, [ecx + ecx*4]
lea edi, [eax + ecx*8]
cmp eax, edi
je 0x4aac0e
mov esi, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
cmp esi, edx
jb 0x4aac07
mov ecx, dword [eax + 8]
add ecx, edx
cmp esi, ecx
jb 0x4aac10
add eax, 0x28
cmp eax, edi
jne 0x4aabf7
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x4ab510
Capabilities:
Get process heap force flags

Disassembly:
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx + 0xa4]
shl eax, 0x10
or eax, dword [ecx + 0xa8]
ret
Function at 0x4ac640
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x51ec70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2ec], ebx
push edi
test ebx, ebx
je 0x4ac844
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4ac844
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2e4]
add esp, 0xc
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4ac819
xor edi, edi
mov dword [ebp - 0x2d8], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x1d0]
push eax
push edi
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4ac808
lea eax, [ebp - 0x2e8]
push eax
push 1
push 0
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x2e4]
call esi
test eax, eax
jne 0x4ac7d2
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2e0], 1
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2dc], 0x104
push eax
lea eax, [ebp - 0x2e0]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x2e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4ac7ca
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call sub.msvcrt.dll_memset
push 0x64
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004ac860
add esp, 0x18
test eax, eax
je 0x4ac7ca
cmp byte [ebp - 0x68], 0
je 0x4ac78c
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x4ac7ca
lea ecx, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x4ac7b9
mov al, byte [esi + ecx]
test al, al
je 0x4ac7b9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4ac7a0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x2e8]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x104
push eax
lea eax, [ebp - 0x1d0]
inc edi
push eax
push edi
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4ac6e0
push dword [ebp - 0x2e4]
call ebx
mov ebx, dword [ebp - 0x2ec]
mov edi, dword [ebp + 0xc]
cmp byte [ebp - 0x68], 0
pop esi
je 0x4ac844
lea eax, [ebp - 0x68]
push eax
push edi
push ebx
call fcn.004ad740
xor ecx, ecx
test eax, eax
pop edi
setns cl
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d761c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.004d761c
mov esp, ebp
pop ebp
ret
Function at 0x4acae0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x51ec70]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x524890]
mov byte [ebp - 0x20d], 0x40
push ebx
mov ebx, dword [ebp + 8]
test ecx, ecx
jne 0x4acbcd
push 0x208
push ecx
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0xf5
ja 0x4acbae
push esi
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4acb46
mov eax, dword [0x4f1a34]
mov dword [edi], eax
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4acb62
mov ecx, 6
lea eax, [ebp - 0x20c]
mov esi, str.Netapi32.dll
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
test eax, eax
je 0x4acbae
push str.Netbios
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x524890]
test eax, eax
cmovne ecx, eax
mov dword [0x524890], ecx
jmp 0x4acbb4
mov ecx, dword [0x524890]
test ecx, ecx
jne 0x4acbcd
mov al, byte [ebp - 0x20d]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d761c
mov esp, ebp
pop ebp
ret
push ebx
call ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004d761c
mov esp, ebp
pop ebp
ret

Function at 0x4b0470
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4b0860
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4b0875
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4b0887
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.004b0f00
push 0x517e80
lea eax, [ebp - 0x10]
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x4b56a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x51ec70]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4b579b
mov eax, dword [ebp - 0x114]
sub eax, 5
je 0x4b5722
sub eax, 1
jne 0x4b5716
mov eax, dword [ebp - 0x110]
sub eax, 0
je 0x4b56fe
sub eax, 1
jne 0x4b5716
mov dword [0x524cf4], 4
jmp 0x4b5740
mov dword [0x524cf4], 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d761c
mov esp, ebp
pop ebp
ret
mov dword [0x524cf4], 6
jmp 0x4b5740
mov eax, dword [ebp - 0x110]
sub eax, 0
je 0x4b5791
sub eax, 1
je 0x4b5779
sub eax, 1
je 0x4b5761
cmp dword [0x524cf4], 4
jl 0x4b5708
call fcn.004b0330
cmp dword [0x524cf4], 6
jl 0x4b5708
call fcn.004bfee0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d761c
mov esp, ebp
pop ebp
ret
mov dword [0x524cf4], 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d761c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x524cf4], 1
call fcn.004d761c
mov esp, ebp
pop ebp
ret
mov dword [0x524cf4], 0
lea ecx, [ebp - 0x124]
call fcn.004b0f40
push 0x51810c
lea eax, [ebp - 0x124]
push eax
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x4b7a90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor edx, edx
xor ecx, eax
imul eax, ecx, 0x1000193
div dword [esi]
mov eax, dword [esi + 8]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4b7aeb
mov ecx, dword [edi]
lea esp, [esp]
cmp dword [eax + 4], ecx
je 0x4b7af3
mov eax, dword [eax]
test eax, eax
jne 0x4b7ae0
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4b7aed
mov ecx, dword [eax + 8]
pop edi
mov dword [edx], ecx
pop esi
pop ebp
ret 8
Function at 0x4b8d40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor edx, edx
xor ecx, eax
imul eax, ecx, 0x1000193
div dword [esi]
mov eax, dword [esi + 8]
lea ebx, [edx*4]
mov eax, dword [ebx + eax]
test eax, eax
je 0x4b8d9f
mov ecx, dword [edi]
cmp dword [eax + 4], ecx
je 0x4b8dc7
mov eax, dword [eax]
test eax, eax
jne 0x4b8d94
push 0xc
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
add esp, 4
mov dword [ebp + 8], edx
test edx, edx
je 0x4b8dd0
mov dword [edx], 0
mov eax, dword [edi]
mov dword [edx + 4], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [edx + 8], eax
jmp 0x4b8dd2
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
xor edx, edx
mov ecx, dword [esi + 8]
mov eax, edx
pop edi
mov ecx, dword [ebx + ecx]
mov dword [edx], ecx
mov ecx, dword [esi + 8]
mov dword [ebx + ecx], edx
inc dword [esi + 4]
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4ba9e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6b64
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x51ec70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x54]
mov dword [esi + 0x1c], eax
mov al, byte [ebp + 0xc]
mov dword [esi], vtable.Concurrency::details::ContextBase.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 1
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [esi + 0x4c], al
mov dword [ebp - 4], 0
mov dword [esi + 0x50], 0
call fcn.004adfe0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x6c], 0xffffffff
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
push 0x1c
mov dword [esi + 0x80], 7
mov dword [esi + 0x84], 0
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ecx, dword [esi + 0x80]
shl ecx, 2
push ecx
push 0
push eax
mov dword [esi + 0x88], eax
call sub.msvcrt.dll_memset
push 0x10
mov byte [ebp - 4], 1
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
add esp, 0x14
mov dword [esi + 0x94], eax
mov ecx, dword [esi + 0x1c]
mov byte [ebp - 4], 2
call fcn.004b8230
mov ecx, dword [esi + 0x1c]
mov dword [esi + 8], eax
push eax
mov eax, dword [ecx]
call dword [eax + 4]
push eax
push 4
push 1
mov ecx, esi
call fcn.004bbfd0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4bbdc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
xor eax, eax
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ebx
mov edx, dword [ebx + 0x80]
test edx, edx
jle 0x4bbdf4
mov esi, dword [ebx + 0x88]
mov ecx, esi
cmp dword [ecx], edi
jne 0x4bbec4
inc eax
add ecx, 4
cmp eax, edx
jl 0x4bbde4
xor eax, eax
mov dword [ebp - 8], eax
test eax, eax
je 0x4bbf24
mov esi, dword [eax]
test esi, esi
jne 0x4bbe36
mov edx, dword [ebx + 0x80]
inc edi
mov eax, edi
cmp edi, edx
jge 0x4bbe31
mov esi, dword [ebx + 0x88]
lea ecx, [esi + edi*4]
lea ecx, [ecx]
cmp dword [ecx], 0
jne 0x4bbece
inc eax
add ecx, 4
cmp eax, edx
jl 0x4bbe20
xor esi, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
call fcn.004bd500
test al, al
je 0x4bbf17
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov ecx, eax
mov dword [ebp - 0xc], eax
call fcn.004bd510
mov ebx, eax
movzx ecx, bl
xor ecx, 0x811c9dc5
mov dword [ebp - 8], ebx
movzx eax, byte [ebp - 6]
imul edx, ecx, 0x1000193
movzx ecx, bh
xor edx, ecx
imul ecx, edx, 0x1000193
xor edx, edx
xor ecx, eax
movzx eax, byte [ebp - 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 4]
div dword [ecx + 0x80]
mov eax, dword [ecx + 0x88]
lea eax, [eax + edx*4]
xor edx, edx
mov dword [ebp - 8], eax
mov eax, dword [eax]
test eax, eax
je 0x4bbef7
lea esp, [esp]
mov ecx, dword [eax]
cmp dword [eax + 4], ebx
je 0x4bbed8
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x4bbeb0
mov ebx, dword [ebp - 4]
jmp 0x4bbef9
mov edi, eax
mov eax, dword [esi + eax*4]
jmp 0x4bbdf6
mov esi, dword [esi + eax*4]
mov edi, eax
jmp 0x4bbe33
test edx, edx
jne 0x4bbedf
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 4]
push 0xc
mov dword [edx], ecx
push eax
dec dword [ebx + 0x84]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
jmp 0x4bbef9
mov ebx, ecx
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4bbf17
mov ecx, eax
call fcn.004bc420
push 0x90
push dword [ebp - 0xc]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
mov eax, esi
mov dword [ebp - 8], eax
test esi, esi
jne 0x4bbe01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bf2e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e67b8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x51ec70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x20]
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.004ae440
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 4], 0
mov eax, dword [ebx]
call dword [eax]
mov edx, dword [edi + 0x10]
lea edi, [ebx + 8]
imul ecx, dword [ebx + 0x30], 0x34
imul eax, eax, 0x34
mov edx, dword [edx + eax + 0x30]
dec dword [edx + ecx + 0xc]
add edx, ecx
mov ecx, dword [edi + 0x38]
mov eax, dword [edi + 0x34]
mov dword [ecx + 0x34], eax
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x38]
mov dword [ecx + 0x38], eax
mov eax, dword [edx + 0x10]
cmp edi, eax
jne 0x4bf369
cmp eax, dword [eax + 0x38]
jne 0x4bf363
xor eax, eax
jmp 0x4bf366
mov eax, dword [eax + 0x34]
mov dword [edx + 0x10], eax
cmp byte [ebx + 0x45], 0
jne 0x4bf378
mov eax, dword [ebp - 0x10]
dec dword [eax + 0x9c]
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.004ae6f0
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c06e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6f98
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x51ec70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0x524d30
mov eax, 1
mov esi, 0x524d30
xchg dword [esi], eax
test eax, eax
je 0x4c07e0
xor eax, eax
mov ecx, 0x4b0d40
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
cmp eax, 4
ja case.default.0x4c0739
jmp dword [eax*4 + 0x4c0930]
pause
sub dword [ebp - 0x20], 1
jne case.default.0x4c0739
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
add eax, 3
mov dword [ebp - 0x18], eax
jmp case.default.0x4c0739
sub dword [ebp - 0x1c], 1
jne case.0x4c0739.4
mov dword [ebp - 0x18], 3
call ecx
jmp case.default.0x4c0739
mov dword [ebp - 0x18], 0
call fcn.004ae8a0
test eax, eax
jne 0x4c0785
mov dword [ebp - 0x18], 4
jmp case.default.0x4c0739
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 1
jmp case.default.0x4c0739
mov dword [ebp - 0x18], 0
call fcn.004ae8a0
test eax, eax
jne 0x4c07b1
mov dword [ebp - 0x18], 4
jmp 0x4c07c2
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x20]
call fcn.004ae780
mov eax, 1
xchg dword [esi], eax
test eax, eax
je 0x4c07e0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
jmp 0x4c0730
cmp dword [0x524d68], 0
mov dword [ebp - 4], 0
jne 0x4c0914
push 0x18
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
test edi, edi
je 0x4c08d1
push 0x800
push 0
push str.advapi32.dll
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
jne 0x4c0848
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4c08c5
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4c08c5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegisterTraceGuidsW
push ebx
call esi
push eax
call fcn.004b0940
add esp, 4
mov dword [edi], eax
push str.UnregisterTraceGuids
push ebx
call esi
push eax
call fcn.004b0940
add esp, 4
mov dword [edi + 4], eax
push str.TraceEvent
push ebx
call esi
push eax
call fcn.004b0940
add esp, 4
mov dword [edi + 8], eax
push str.GetTraceLoggerHandle
push ebx
call esi
push eax
call fcn.004b0940
add esp, 4
mov dword [edi + 0xc], eax
push str.GetTraceEnableLevel
push ebx
call esi
push eax
call fcn.004b0940
add esp, 4
mov dword [edi + 0x10], eax
push str.GetTraceEnableFlags
push ebx
call esi
push eax
call fcn.004b0940
add esp, 4
mov dword [edi + 0x14], eax
mov byte [ebp - 4], 0
mov dword [0x524d68], edi
jmp 0x4c08dd
mov dword [0x524d68], 0
xor edi, edi
mov esi, dword [edi]
push 0
call fcn.004b0940
add esp, 4
cmp esi, eax
je 0x4c0914
push esi
call fcn.004b0940
add esp, 4
push 0x524d50
push 0
push 0
push 0x51ed2c
push 7
push 0x505004
push 0
push 0x4c0540
call eax
mov dword [0x524d30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c60a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov dword [edi + 8], eax
mov dword [edi + 0x100], edx
mov eax, dword [edi + 0xc]
xor eax, dword [ecx]
and eax, 0xfffffff
xor dword [edi + 0xc], eax
mov eax, dword [ecx]
xor eax, dword [edi + 0xc]
and eax, 0xfffffff
xor eax, dword [ecx]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 8]
mov dword [edi + 0x14], eax
mov eax, dword [ecx + 4]
mov dword [edi + 0x10], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0x18], eax
lea eax, [ebp - 0xc]
mov dword [edi + 0x110], 0
mov dword [edi + 0x11c], 1
mov ecx, dword [edx + 4]
push eax
call fcn.004b7f50
push dword [edi + 0x20]
lea ebx, [edi + 0x1c]
mov esi, eax
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
mov ecx, dword [esi]
mov dword [ebx], ecx
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov dword [esi], 0
mov dword [esi + 4], 0
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
mov ecx, dword [ebp + 0x10]
add esp, 8
mov eax, dword [ecx]
and eax, 0xfffffff
cmp eax, 3
jne 0x4c61b7
mov ebx, dword [ecx + 8]
xor edx, edx
mov esi, dword [ebp + 8]
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
mov esi, dword [esi + 4]
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
div dword [esi + 0x168]
mov eax, dword [esi + 0x170]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4c61ae
cmp dword [eax + 4], ebx
je 0x4c61db
mov eax, dword [eax]
test eax, eax
jne 0x4c61a3
mov eax, dword [ebp - 4]
mov dword [edi + 0x24], eax
lea ebx, [edi + 0x1c]
push ebx
lea ecx, [edi + 0x38]
call fcn.004c59d0
cmp dword [edi + 0x48], 0
je 0x4c61d2
mov ecx, dword [edi + 0x48]
add ecx, 4
push ebx
call fcn.004c59d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [eax + 8]
jmp 0x4c61b1

Function at 0x4c7c60
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x524d6c], eax
cmp eax, 0xffffffff
je 0x4c7c7a
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4c7c8c
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.004b0f00
push 0x517e80
lea eax, [ebp - 0x10]
push eax
call sub.msvcrt.dll__CxxThrowException
int3