joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac870
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dl, byte [0x54cdac]
test dl, 1
jne 0x4ac895
test ecx, ecx
je 0x4ac893
push ecx
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x4ac8a0
pop ebp
ret
call fcn.004d0430
pop ebp
jmp fcn.004a7b20
int3

Function at 0x4b0340
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
test bl, bl
jns 0x4b035c
mov ebx, dword [esi + 4]
mov esi, dword [esi]
mov eax, ebx
mov ecx, esi
mov edx, ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 4
jb 0x4b0397
mov eax, dword [ebp - 0x14]
mov edx, eax
mov ecx, esi
imul ebx, dword [ecx], 0x5bd1e995
mov edi, ebx
shr edi, 0x18
xor edi, ebx
imul edi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x4b0371
cmp edx, 1
je 0x4b03b8
cmp edx, 2
je 0x4b03af
cmp edx, 3
jne 0x4b03c3
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ecx + 4]
xor ecx, ecx
test ebx, ebx
je 0x4b04df
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, ebx
shr edx, 1
and edx, 0x55555555
mov eax, ebx
sub eax, edx
mov edx, 0x33333333
mov ecx, ebx
mov ebx, eax
and ebx, edx
shr eax, 2
and eax, edx
add eax, ebx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x20], eax
cmp eax, 1
ja 0x4b042c
lea edx, [ecx - 1]
and edx, edi
jmp 0x4b0438
mov edx, edi
cmp edi, ecx
jb 0x4b0438
mov eax, edi
xor edx, edx
div ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4b04dd
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], ecx
mov ebx, dword [eax]
test ebx, ebx
mov ecx, 0
je 0x4b04df
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 4]
cmp edi, eax
jne 0x4b049e
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x4b0478
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x14]
jne 0x4b04bb
lea ecx, [ebx + 8]
test al, al
jns 0x4b0486
mov ecx, dword [ecx]
js 0x4b04c3
test eax, eax
je 0x4b04d9
xor ecx, ecx
mov dl, byte [ebx + ecx + 8]
cmp dl, byte [esi + ecx]
jne 0x4b04bb
inc ecx
cmp eax, ecx
jne 0x4b048e
jmp 0x4b04d9
cmp dword [ebp - 0x20], 1
ja 0x4b04a9
and eax, dword [ebp - 0x1c]
jmp 0x4b04b6
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x4b04b6
xor edx, edx
div ecx
mov eax, edx
cmp eax, dword [ebp - 0x10]
jne 0x4b04dd
mov ebx, dword [ebx]
test ebx, ebx
jne 0x4b0464
jmp 0x4b04dd
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4b04d9
push eax
push esi
push ecx
call fcn.004d284d
add esp, 0xc
test eax, eax
jne 0x4b04bb
mov ecx, ebx
jmp 0x4b04df
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4b8230
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov edi, ecx
mov eax, dword [0x538010]
xor eax, ebp
mov dword [esp + 0x68], eax
xor eax, eax
push eax
push eax
push ecx
push 0x4b8320
push eax
push eax
call fcn.004e048e
add esp, 0x18
mov esi, eax
cmp dword [edi], eax
je 0x4b82a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [edi]
inc eax
cmp eax, 2
jb 0x4b8288
call fcn.00489980
push dword [edi]
call fcn.00476780
add esp, 4
mov dword [edi], 0
lea eax, [esi + 1]
cmp eax, 2
jb 0x4b8297
mov dword [edi], esi
call fcn.00489980
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [edi]
inc esi
cmp esi, 1
ja 0x4b82fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.00500050
add esp, 8
lea edi, [esp + 0x10]
mov ecx, edi
push ebx
push 0x71
push str.InitializeThread
push 1
call fcn.0044cb80
lea ecx, [esp + 0x4c]
push 0x52c057
push str.Failed_to_create_thread_for_async_http_requests
call fcn.00415500
mov ecx, edi
call fcn.0044cbc0
cmp byte [ebx + 0xb], 0
jns 0x4b82fb
push dword [esp + 4]
call fcn.004d05a5
add esp, 4
test esi, 0xfffffffe
setne bl
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004d1573
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4b8d30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x4b8d41
test eax, eax
jne 0x4b8d91
test eax, eax
jne 0x4b8d57
mov ecx, dword [0x54ce38]
test ecx, ecx
je 0x4b8d57
call dword [section..00cfg]
call ecx
cmp dword [0x54ce30], 0
je 0x4b8d91
mov esi, dword [0x54ce34]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x4b8d97
test esi, esi
je 0x4b8d91
mov ecx, dword [0x54ce30]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
pop esi
pop edi
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4b8d7b
Function at 0x4bd6b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x538010]
xor eax, ebp
mov dword [esp + 0x18], eax
mov edi, dword [ecx + 0x38]
test edi, edi
jne 0x4bd76a
mov esi, ecx
xor eax, eax
dec eax
lea edi, [esp + 0xc]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], 0x9ffffff
cmp edi, str.discarded
ja 0x4bd6fe
lea eax, [esp + 0x15]
cmp eax, str.discarded
ja 0x4bd781
mov dword [esp + 0x10], 0x65647261
mov dword [esp + 0xc], 0x63736964
mov word [esp + 0x14], 0x64
mov eax, esp
mov ecx, esi
push edi
push eax
call fcn.004bd620
push 0x48
call fcn.004d0575
add esp, 4
mov ebx, eax
mov ecx, eax
mov eax, esp
push eax
push dword [esi + 0x28]
push edi
call fcn.004bd8b0
mov edi, dword [esi + 0x38]
mov dword [esi + 0x38], ebx
test edi, edi
je 0x4bd754
mov ecx, edi
call fcn.004bd990
push edi
call fcn.004d05a5
add esp, 4
cmp byte [esp + 0x17], 0
jns 0x4bd767
push dword [esp + 0xc]
call fcn.004d05a5
add esp, 4
mov edi, dword [esi + 0x38]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.004d1573
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
push str.char_traits::copy_overlapped_range
push str.__s2_____s1____s2_____s1__n
push 0xf1
push str....._buildtools_third_partylibc_trunkinclude__stringchar_traits.h
push str._s:_d:_assertion__s_failed:__s
call fcn.00448430
int3
Function at 0x4c2ce0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x538010]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
jne 0x4c2dfe
lea eax, [ebp - 0x14]
mov dword [eax], 0x4c2e20
push 0
push eax
push 0x4c2ca0
push 0x54ceb0
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x4c2e12
cmp dword [0x54ceb4], 0
jne 0x4c2dfe
push dword [0x54ceb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4c2dfe
mov esi, eax
mov eax, 0x54cebc
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x54cec0]
mov ebx, dword [0x54cec4]
mov eax, dword [0x54cec8]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x54cecc]
mov dword [ebp - 0x20], eax
mov eax, dword [0x54ced0]
mov dword [ebp - 0x24], eax
mov eax, 0x54cebc
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x4c2d9c
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [section..00cfg]
push dword [ebp - 0x18]
call edi
add esp, 4
test ebx, ebx
je 0x4c2db1
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4c2dc7
mov edi, dword [esi + 8]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
je 0x4c2de0
mov edi, dword [esi + 0xc]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
test ebx, ebx
je 0x4c2df5
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
push esi
call fcn.004c9250
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d1573
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
call fcn.004e5af7
int3
Function at 0x4c2e40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x538010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x4c2e20
push 0
push eax
push 0x4c2ca0
push 0x54ceb0
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x4c2f08
mov esi, dword [ebp + 0xc]
cmp dword [0x54ceb4], 0
jne 0x4c2f16
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x54ceb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x4c2ecb
push 0x14
push 1
call fcn.004c92f0
add esp, 8
test eax, eax
je 0x4c2f16
mov edi, eax
push eax
push dword [0x54ceb8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4c2f0d
mov ebx, dword [ebp + 8]
mov esi, 0x54cebc
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x54cec0], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d1573
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004e5af7
push edi
call fcn.004c9250
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x4c2ef4
Function at 0x4c7b60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov edi, ecx
mov eax, dword [0x538010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
push edx
push ecx
push esi
call fcn.004ca3f0
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x4c7b8e
mov esi, dword [ebp - 0x1c]
xor eax, eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
jns 0x4c7bac
push dword [ebp - 0x1c]
call fcn.004d05a5
add esp, 4
cmp dword [ebp + 8], 0
je 0x4c7c4f
test esi, esi
je 0x4c7c4f
lea eax, [esi + esi]
xor ecx, ecx
dec ecx
test esi, esi
cmovns ecx, eax
push ecx
call fcn.004d05d3
add esp, 4
mov ecx, edi
mov edi, eax
mov eax, ebx
lea ebx, [ebp - 0x1c]
push eax
push ecx
push ebx
call fcn.004ca3f0
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x4c7bef
mov ebx, dword [ebp - 0x1c]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x4c7c09
push dword [ebp - 0x1c]
call fcn.004d05a5
add esp, 4
test edi, edi
mov ebx, dword [ebp + 8]
je 0x4c7c68
push edi
call fcn.004ec838
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
push edi
push ecx
call fcn.004ca870
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x4c7c37
push dword [ebx]
call fcn.004d05a5
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebx], xmm0
push edi
call fcn.004d05dc
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d1573
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x4c8090
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movzx eax, cx
shr ecx, 0x10
mov edx, ebx
and edx, 0x1f
mov dword [ebp - 0x10], edx
cmp ebx, 0x20
jb 0x4c81b7
shr ebx, 5
movdqa xmm0, xmmword [0x520b20]
pxor xmm2, xmm2
movdqa xmm3, xmmword [0x520b10]
mov edx, 0xad
cmp ebx, edx
mov esi, 0xad
cmovb esi, ebx
mov edx, eax
imul edx, esi
movd xmm5, edx
movd xmm4, ecx
mov ecx, esi
shl ecx, 5
mov dword [ebp - 0x14], esi
mov edx, esi
pxor xmm6, xmm6
mov esi, edi
nop dword [eax]
movdqu xmm7, xmmword [esi]
movdqa xmm1, xmm7
pmaddubsw xmm7, xmmword [0x520b00]
pmaddwd xmm7, xmm3
paddd xmm7, xmm4
movdqu xmm4, xmmword [esi + 0x10]
paddd xmm5, xmm6
psadbw xmm1, xmm2
paddd xmm1, xmm6
movdqa xmm6, xmm4
psadbw xmm6, xmm2
paddd xmm6, xmm1
pmaddubsw xmm4, xmm0
pmaddwd xmm4, xmm3
paddd xmm4, xmm7
add esi, 0x20
dec edx
jne 0x4c8100
add edi, ecx
mov dword [ebp - 0x18], edi
pslld xmm5, 5
paddd xmm4, xmm5
phaddd xmm6, xmm6
pshufd xmm1, xmm6, 0xff
paddd xmm1, xmm6
movd esi, xmm1
add esi, eax
phaddd xmm4, xmm4
pshufd xmm1, xmm4, 0xff
mov eax, esi
mov ecx, 0x80078071
mul ecx
mov edi, edx
paddd xmm1, xmm4
movd ecx, xmm1
shr edi, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, edi, 0xfff1
mov edi, dword [ebp - 0x18]
sub esi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov eax, esi
sub ebx, dword [ebp - 0x14]
jne 0x4c80d0
jmp 0x4c81b9
mov esi, eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4c81f7
cmp ebx, 0x10
jae 0x4c8206
xor eax, eax
movzx edx, byte [edi + eax]
add esi, edx
add ecx, esi
inc eax
cmp ebx, eax
jne 0x4c81c7
lea eax, [esi - 0xfff1]
cmp esi, 0xfff1
cmovae esi, eax
mov edx, 0x80078071
mov eax, ecx
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
shl ecx, 0x10
or ecx, esi
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [edi]
add esi, eax
add ecx, esi
movzx eax, byte [edi + 1]
add eax, esi
add ecx, eax
movzx edx, byte [edi + 2]
add edx, eax
add ecx, edx
movzx eax, byte [edi + 3]
add eax, edx
add ecx, eax
movzx edx, byte [edi + 4]
add edx, eax
add ecx, edx
movzx eax, byte [edi + 5]
add eax, edx
add ecx, eax
movzx edx, byte [edi + 6]
add edx, eax
add ecx, edx
movzx eax, byte [edi + 7]
add eax, edx
add ecx, eax
movzx edx, byte [edi + 8]
add edx, eax
add ecx, edx
movzx eax, byte [edi + 9]
add eax, edx
add ecx, eax
movzx edx, byte [edi + 0xa]
add edx, eax
add ecx, edx
movzx eax, byte [edi + 0xb]
add eax, edx
add ecx, eax
movzx edx, byte [edi + 0xc]
add edx, eax
add ecx, edx
movzx eax, byte [edi + 0xd]
add eax, edx
add ecx, eax
movzx edx, byte [edi + 0xe]
add edx, eax
add ecx, edx
movzx esi, byte [edi + 0xf]
add esi, edx
add ecx, esi
add ebx, 0xfffffff0
je 0x4c81d4
add edi, 0x10
jmp 0x4c81c5
Function at 0x4c82a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm4
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x4c836e
movdqa xmm4, xmmword [0x520b30]
movdqa xmm5, xmmword [0x520b40]
nop word cs:[eax + eax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm6
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
movdqu xmm6, xmmword [ecx]
pxor xmm0, xmm6
movdqu xmm6, xmmword [ecx + 0x10]
pxor xmm3, xmm6
movdqu xmm6, xmmword [ecx + 0x20]
pxor xmm2, xmm6
movdqu xmm6, xmmword [ecx + 0x30]
pxor xmm1, xmm6
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x4c82f0
movdqa xmm4, xmmword [0x520b50]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x520b60]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp eax, 0x10
jb 0x4c83f2
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add ecx, 0x10
add eax, 0xfffffff0
cmp eax, 0xf
ja 0x4c83cb
movdqa xmm1, xmmword [0x520b60]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm2, xmm2
pxor xmm1, xmm1
pblendw xmm1, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x520b70], 0
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm1, 3
pclmulqdq xmm0, xmmword [0x520b80], 0x10
pblendw xmm0, xmm2, 0xfc
pclmulqdq xmm0, xmmword [0x520b90], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop ebp
ret
Function at 0x4c8a50
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x538010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x53e964]
mov ecx, dword [0x53ca88]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4c8aa1
mov eax, dword [0x53e960]
mov esi, dword [eax]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d1573
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x53e964
call fcn.004d0617
add esp, 4
cmp dword [0x53e964], 0xffffffff
jne 0x4c8a83
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.004d4450
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.004d0575
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x53e994]
mov ecx, dword [0x53ca88]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4c8b4a
mov ecx, esi
push ebx
push 0x53e970
push edi
call fcn.00476180
mov dword [0x53e960], esi
push 0x53e964
call fcn.004d068d
add esp, 4
jmp 0x4c8a83
push 0x53e994
call fcn.004d0617
add esp, 4
cmp dword [0x53e994], 0xffffffff
jne 0x4c8b24
xorps xmm0, xmm0
movups xmmword [0x53e980], xmm0
movups xmmword [0x53e970], xmm0
mov dword [0x53e990], 0
push 0x53e970
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x53e994
call fcn.004d068d
add esp, 4
jmp 0x4c8b24
Function at 0x4c9430
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2010
call fcn.004d1990
mov eax, dword [0x538010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x53b394]
cmp eax, 0xffffffff
jne 0x4c9469
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d1573
add esp, 0x2010
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x4c9454
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.004d3ed0
add esp, 0xc
mov ecx, dword [0x53b394]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x2018], ecx
push ecx
call fcn.004ab610
add esp, 8
test ebx, ebx
je 0x4c94b8
push ebx
call fcn.004d05dc
add esp, 4
mov esi, 0x101
lea edi, [ebp - 0x2010]
mov eax, dword [0x53fa34]
mov ecx, dword [0x53ca88]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4c961f
mov ebx, dword [0x53fa30]
push ebx
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4c9664
push 0x1000
push 0x53ea2c
lea eax, [ebp - 0x1810]
push eax
call fcn.004d3ed0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push 0x800
push 0xff
push edi
call fcn.004d4450
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x1804]
nop word cs:[eax + eax]
mov edx, dword [ecx]
mov dword [ebp + eax*8 - 0x2010], edx
mov word [ebp + eax*8 - 0x200c], ax
inc eax
add ecx, 0x10
cmp eax, 0x100
jne 0x4c9540
mov ecx, edi
lea edx, [ebp - 0x1810]
push 1
push 0x10
call fcn.0047e9f0
add esp, 8
mov ebx, 4
xor eax, eax
nop word [eax + eax]
movzx edx, word [ebp + ebx - 0x2010]
mov edi, dword [ebp + edx*8 - 0x810]
test edi, edi
jne 0x4c95a0
add ebx, 8
cmp ebx, 0x804
jne 0x4c9580
jmp 0x4c95f9
mov dword [ebp - 0x2014], eax
mov ecx, edx
shl ecx, 4
cmp dword [ebp + ecx - 0x1810], 0
je 0x4c9670
mov eax, dword [ebp + edx*8 - 0x80c]
cmp eax, dword [ebp + ecx - 0x1808]
jne 0x4c9670
mov ecx, dword [ebp + ecx - 0x180c]
test ecx, ecx
mov eax, dword [ebp - 0x2014]
je 0x4c9593
mov dword [ebp + edx*8 - 0x810], 0
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov al, 1
jmp 0x4c9593
dec esi
je 0x4c967b
test al, 1
lea edi, [ebp - 0x2010]
jne 0x4c94c3
push 2
push dword [ebp - 0x2018]
call fcn.004ab610
add esp, 8
jmp 0x4c9454
push 0x53fa34
call fcn.004d0617
add esp, 4
cmp dword [0x53fa34], 0xffffffff
jne 0x4c94e4
push 4
call fcn.004d0575
add esp, 4
mov ebx, eax
mov ecx, eax
call fcn.004778c0
mov dword [0x53fa30], ebx
push 0x53fa34
call fcn.004d068d
add esp, 4
jmp 0x4c94e4
mov ecx, ebx
call fcn.004778d0
jmp 0x4c94f9
mov eax, dword [ebp - 0x2014]
jmp 0x4c9593
call fcn.00501860
jmp 0x4c960a
Function at 0x4cdca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [ebp + 8]
mov eax, dword [0x538010]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0x30
ja 0x4cddd9
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [ebp - 0x44], eax
call dword [section..00cfg]
lea eax, [ebp - 0x40]
push esi
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
test ebx, ebx
je 0x4cdd7d
xor eax, eax
nop word cs:[eax + eax]
movzx ecx, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp ebx, eax
jne 0x4cdd70
lea edi, [esi + 0xf4]
mov eax, dword [0x54cea0]
bt eax, 0x19
jae 0x4cdddd
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403380
add esp, 0xc
mov ecx, section..text
mov eax, 0x401b90
test edi, edi
je 0x4cddb0
mov dword [edi], ecx
mov dword [esi + 0xf8], eax
lea eax, [ebp - 0x20]
movups xmm0, xmmword [eax]
mov eax, dword [ebp - 0x44]
movups xmmword [eax], xmm0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d1573
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x4cddc5
bt eax, 9
jae 0x4cddfe
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403ea0
add esp, 0xc
xor eax, eax
mov ecx, 0x403f50
jmp 0x4cddaa
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.005057d0
add esp, 0xc
mov ecx, 0x5056d0
mov eax, 0x505f60
jmp 0x4cddaa
Function at 0x4d0490
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x538010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x4c2e20
push 0
push eax
push 0x4c2ca0
push 0x54ceb0
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x4d0509
xor esi, esi
cmp dword [0x54ceb4], 0
jne 0x4d04f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x54ceb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x4d04f5
mov eax, dword [ebp + 8]
mov esi, dword [edi + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d1573
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004e5af7
int3

Function at 0x4d0c57
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4d0c96
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4d0c96
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4d0c96
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4d0c96
cmp dword [ecx + 0x74], 0xe
jbe 0x4d0c96
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret