joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ed7d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0xff
push dword [ebp + 0xc]
lea esi, [edi + 0x108]
push esi
call dword [sym.imp.kernel32.dll_lstrcpynA]
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
je 0x40ef6e
push esi
call main
pop ecx
test eax, eax
je 0x40ef6e
lea eax, [ebp + 0xc]
push eax
push 1
xor ebx, ebx
push ebx
push 0x4301f4
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ef6e
mov esi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x988]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x43021c
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x400
call esi
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x588]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x43022c
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x400
call esi
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x208]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x430240
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x100
call esi
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x1408]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x430254
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x104
call esi
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x1008]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x430264
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x400
call esi
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0xd88]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x430270
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x100
call esi
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0xe88]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x430280
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x100
call esi
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x80
push eax
lea eax, [edi + 0xf88]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x43028c
push dword [ebp + 0xc]
call esi
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x1560]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x430298
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x80
call esi
test eax, eax
jne 0x40ef1e
cmp dword [ebp + 8], 3
jb 0x40ef1e
mov dword [edi + 0x15e0], 1
mov dword [ebp + 8], 0x50
cmp dword [edi + 0x15e0], ebx
je 0x40ef57
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x1510]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x4302a4
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x40ef51
cmp dword [ebp + 8], 0x28
je 0x40ef57
mov dword [edi + 0x15e0], ebx
push dword [ebp + 0xc]
mov dword [edi + 0x150c], 1
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
jmp 0x40ef73
mov eax, 0x80004005
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40f046
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x2001f
xor ebx, ebx
push ebx
push 0x430304
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
je 0x40f075
mov eax, 0x80004005
jmp 0x40f247
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi + 0x108]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40f085
sub eax, ecx
push eax
push esi
mov esi, dword [sym.imp.advapi32.dll_RegSetValueExA]
push 1
push ebx
push 0x43032c
push dword [ebp - 4]
call esi
lea ecx, [edi + 0x988]
mov eax, ecx
lea edx, [eax + 1]
mov dword [ebp + 8], edx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40f0b1
sub eax, dword [ebp + 8]
push eax
push ecx
push 1
push ebx
push 0x43033c
push dword [ebp - 4]
call esi
lea ecx, [edi + 0x588]
mov eax, ecx
lea edx, [eax + 1]
mov dword [ebp + 8], edx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40f0d8
sub eax, dword [ebp + 8]
push eax
push ecx
push 1
push ebx
push 0x43034c
push dword [ebp - 4]
call esi
lea ecx, [edi + 0x208]
mov eax, ecx
lea edx, [eax + 1]
mov dword [ebp + 8], edx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40f0ff
sub eax, dword [ebp + 8]
push eax
push ecx
push 1
push ebx
push 0x430360
push dword [ebp - 4]
call esi
lea eax, [edi + 0x1408]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
jle 0x40f150
lea eax, [edi + 0x1408]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40f132
sub eax, ecx
push eax
lea eax, [edi + 0x1408]
push eax
push 1
push ebx
push 0x430374
push dword [ebp - 4]
call esi
lea eax, [edi + 0x1008]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
jle 0x40f188
lea eax, [edi + 0x1008]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40f16a
sub eax, ecx
push eax
lea eax, [edi + 0x1008]
push eax
push 1
push ebx
push 0x430384
push dword [ebp - 4]
call esi
lea eax, [edi + 0xd88]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
jle 0x40f1c0
lea eax, [edi + 0xd88]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40f1a2
sub eax, ecx
push eax
lea eax, [edi + 0xd88]
push eax
push 1
push ebx
push 0x430390
push dword [ebp - 4]
call esi
lea eax, [edi + 0xf88]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
jle 0x40f1f8
lea eax, [edi + 0xf88]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40f1da
sub eax, ecx
push eax
lea eax, [edi + 0xf88]
push eax
push 1
push ebx
push 0x4303a0
push dword [ebp - 4]
call esi
lea eax, [edi + 0xe88]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
jle 0x40f230
lea eax, [edi + 0xe88]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40f212
sub eax, ecx
push eax
lea eax, [edi + 0xe88]
push eax
push 1
push ebx
push 0x4303ac
push dword [ebp - 4]
call esi
push dword [ebp - 4]
mov ecx, edi
call main
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
pop ebx
leave
ret 4
Function at 0x40feb9
Capabilities:
Check os version

Disassembly:
push 0xa4
push 0x437020
call fcn.00413470
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xb4], 0x94
push 0x90
push esi
lea eax, [ebp - 0xb0]
push eax
call fcn.00412420
add esp, 0xc
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xa4], 2
jne 0x40ff43
cmp dword [ebp - 0xb0], 5
jb 0x40ff43
mov dword [ebp - 4], esi
push 0x431b4c
call main
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x40ff3a
push 0x431b58
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x40ff3a
mov dword [ebp - 0x20], 1
or dword [ebp - 4], 0xffffffff
call fcn.0040ff4e
mov eax, dword [ebp - 0x20]
call fcn.004134ab
ret
Function at 0x4111d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
mov esi, dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 0xc]
push eax
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
push edi
push 0x431bfc
push 0x80000002
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], 0x200
call esi
test eax, eax
jne 0x411235
lea eax, [ebp - 8]
push eax
push str.EnableJavaUpdate
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
call main
add esp, 0xc
test eax, eax
je 0x411227
cmp dword [ebp - 8], ebx
je 0x41122a
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x411243
push str.ISAUDisabled__:_Error_opening_HKLM_Policy_key_for_reading
call main
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], edi
jne 0x4112d5
call fcn.00410107
test eax, eax
jne 0x4112d2
call main
test eax, eax
je 0x4112d2
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
push 0x431c74
push 0x80000001
call esi
test eax, eax
jne 0x4112d5
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push edi
push 0x431c9c
push dword [ebp - 0xc]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp esi, edi
jne 0x4112d5
mov dword [ebp - 8], edi
call fcn.0040feb9
test eax, eax
je 0x4112c7
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x210]
push eax
call fcn.0040ff5d
mov eax, dword [ebp - 8]
add esp, 0x10
jmp 0x4112cd
mov eax, dword [ebp - 0x210]
cmp eax, 0x64
jne 0x4112d5
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x413c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x413c4f
pop dword [ebp - 0x18]
mov eax, 0x9eab2892
sub eax, 0x9e69ec43
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x41e12
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x491d
mov esi, eax
mov edi, 0xbc7fee44
sub edi, 0xbc3be644
add edi, dword [ebp - 0x18]
mov edx, 0x49a486d5
add dword [ebp - 8], 0xd3f0d83a
mov ebx, dword [edi]
sub dword [ebp - 0xc], 0x24e6db00
xor ebx, edx
xor dword [ebp - 0x14], esi
mov dword [esi], ebx
xor dword [ebp - 0x14], 0x7509ccc
add esi, 0x28c73346
sub esi, 0x28c73342
add edi, 0x93f580d7
add edi, 0x6c0a7f2d
loop 0x413c9d
add eax, 0x11747
xor ebx, ebx
add ebx, eax
add eax, 0xc5b9301a
add eax, 0x3a46cfeb
mov ecx, 0x2183ef94
sub ecx, 0x2143ef94
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x4187e4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a210]
jne 0x4187ee
repz ret
jmp fcn.00420617
Function at 0x7813480f
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
xor ebx, ebx
push ebx
push ebx
mov ebp, str.__MSVCRT_HEAP_SELECT
push ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call edi
mov esi, eax
cmp esi, ebx
je 0x78134961
push esi
push ebx
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x7813495f
push esi
push ebx
push ebp
call edi
test eax, eax
mov ebp, dword [sym.imp.kernel32.dll_HeapFree]
jbe 0x78134953
cmp eax, esi
ja 0x78134953
cmp byte [ebx], 0
mov ecx, ebx
je 0x78134889
mov al, byte [ecx]
cmp al, 0x61
jl 0x78134883
cmp al, 0x7a
jg 0x78134883
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x78134875
push 0x16
push ebx
push str.__GLOBAL_HEAP_SELECTED
call fcn.7814f1e9
add esp, 0xc
test eax, eax
jne 0x781348a1
mov edi, ebx
jmp 0x781348fc
push 0x105
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x78134953
push 3
push esi
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
cmp byte [esi], 0
mov ecx, esi
je 0x781348e5
mov al, byte [ecx]
cmp al, 0x61
jl 0x781348df
cmp al, 0x7a
jg 0x781348df
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x781348d1
push esi
push ebx
call sym.MSVCR80.dll_strstr
pop ecx
pop ecx
push esi
push 0
mov edi, eax
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
test edi, edi
je 0x78134953
push 0x2c
push edi
call sym.MSVCR80.dll_strchr
test eax, eax
pop ecx
pop ecx
je 0x78134953
inc eax
cmp byte [eax], 0x20
je 0x7813490e
mov cl, byte [eax]
xor esi, esi
cmp cl, 0x30
jl 0x78134953
cmp cl, 0x39
jg 0x78134934
imul esi, esi, 0xa
movsx ecx, cl
inc eax
lea esi, [esi + ecx - 0x30]
mov cl, byte [eax]
cmp cl, 0x30
jge 0x7813491d
cmp esi, 2
je 0x78134943
cmp esi, 3
je 0x78134943
cmp esi, 1
jne 0x78134953
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
mov eax, esi
jmp 0x781349c1
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
call sym.MSVCR80.dll__get_osplatform
test eax, eax
pop ecx
je 0x7813497d
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.MSVCR80.dll__invoke_watson
add esp, 0x14
lea eax, [esp + 0x14]
push eax
call sym.MSVCR80.dll__get_winmajor
test eax, eax
pop ecx
je 0x78134999
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.MSVCR80.dll__invoke_watson
add esp, 0x14
cmp dword [esp + 0x10], 2
jne 0x781349ac
cmp dword [esp + 0x14], 5
jb 0x781349ac
xor eax, eax
inc eax
jmp 0x781349c1
lea eax, [esp + 0x18]
push eax
call fcn.781347e2
cmp byte [esp + 0x1c], 6
pop ecx
sbb eax, eax
add eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x78138894
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.MSVCR80.dll__invalid_parameter

Function at 0x78139847
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x781c19c8]
jne 0x78139851
repz ret
jmp sym.MSVCR80.dll___report_gsfailure
Function at 0x7814f1e9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x7814f1f8
pop dword [ebp - 0x34]
mov eax, 0xed276913
add eax, 0x8aed88e5
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x42f6b
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x2327a94b
sub ecx, 0x23275ec1
mov ebx, eax
mov edx, 0x46902645
add edx, 0x318c89bb
add edx, dword [ebp - 0x34]
mov edi, 0xba70334b
sub edi, 0x7e389570
xor dword [ebp - 0x18], eax
mov esi, dword [edx]
add esi, edi
xor dword [ebp - 0xc], 0xf9655696
mov dword [ebx], esi
add dword [ebp - 4], 0xe842f7ed
add ebx, 0xc3d8f659
add ebx, 0x3c2709ab
add edx, 0x405322f1
add edx, 0xbfacdd13
loop 0x7814f252
add eax, 0xf6dcbe57
sub eax, 0xf6dba15c
xor ebx, ebx
add ebx, eax
add eax, 0xad4f628
sub eax, 0xad4f623
mov ecx, 0x78130000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x7815472c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154759
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.7814f1e9
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78154735
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154788
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x781547af
test al, 1
je 0x781547af
test byte [esp + 0xc], 2
je 0x781547af
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x7815477f
xor eax, eax
pop esi
ret

Function at 0x78154a51
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154a7e
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.7814f1e9
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154a9c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78154a79
test byte [esp + 0xc], 0x80
je 0x78154aa8
and eax, 0xfffffffe
jmp 0x78154aab
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
je 0x78154a8d
xor eax, eax
pop esi
ret
Function at 0x78155c9d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155cca
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.7814f1e9
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78155ca6
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155cf9
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x78155d20
test al, 1
je 0x78155d20
test byte [esp + 0xc], 2
je 0x78155d20
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x78155cf0
xor eax, eax
pop esi
ret

Function at 0x78155e6a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155e97
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.7814f1e9
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155eb5
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78155e92
test byte [esp + 0xc], 0x80
je 0x78155ec1
and eax, 0xfffffffe
jmp 0x78155ec4
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
je 0x78155ea6
xor eax, eax
pop esi
ret
Function at 0x24804a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x24804a9f
pop dword [ebp - 0x14]
mov eax, 0x25691b75
add eax, 0xff172f2a
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x361b0
push 0
mov eax, 0x18558a36
sub eax, 0xf3d44716
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x4539
xor edx, edx
add edx, eax
mov ebx, 0xb6e82eb1
sub ebx, 0x926570b1
add ebx, dword [ebp - 0x14]
mov esi, 0x3aa1e14e
add dword [ebp - 0x10], 0x4785daef
mov edi, dword [ebx]
xor dword [ebp - 0x10], 0x2b801fcd
add edi, esi
mov dword [ebp - 8], 0x5733d820
mov dword [edx], edi
sub dword [ebp - 4], 0x25202adf
add edx, 4
add ebx, 0x717e73ea
sub ebx, 0x717e73e6
loop 0x24804af4
add eax, 0x107b7
xor ebx, ebx
add ebx, eax
add eax, 0xe595ee90
add eax, 0x1a6a1175
mov ecx, 0x6201beae
sub ecx, 0x3d82beae
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x24804da0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.24805660
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x2480e480], eax
je 0x24804df8
push 0x74
push 1
call fcn.24807430
mov esi, eax
add esp, 8
test esi, esi
je 0x24804df8
mov eax, dword [0x2480e480]
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test eax, eax
je 0x24804df8
push esi
call fcn.24804e30
add esp, 4
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x24804e50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x2480e480]
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x24804ebe
push 0x74
push 1
call fcn.24807430
mov esi, eax
add esp, 8
test esi, esi
je 0x24804eb4
mov ecx, dword [0x2480e480]
push esi
push ecx
call dword [sym.imp.kernel32.dll_TlsSetValue]
test eax, eax
je 0x24804eb4
push esi
call fcn.24804e30
add esp, 4
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push edi
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
push 0x10
call fcn.248041a0
add esp, 4
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
Function at 0x4db140
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x5b6e60
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x6216ec]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, ecx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x34], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x38], esi
cmp dword [ebx + 0x24], eax
je 0x4db1b0
push eax
mov edi, str.Field_does_not_match_message_type.
mov esi, str.SetRepeatedDouble
mov ecx, ebx
call fcn.004d7450
mov esi, dword [esp + 0x3c]
add esp, 4
cmp dword [ebx + 0x1c], 3
je 0x4db1d2
mov ecx, dword [esi + 4]
push ecx
mov edi, str.Field_is_singular__the_method_requires_a_repeated_field.
mov esi, str.SetRepeatedDouble
mov ecx, ebx
call fcn.004d7450
mov esi, dword [esp + 0x3c]
add esp, 4
mov edx, dword [ebx + 0x18]
mov edi, 5
cmp dword [edx*4 + 0x5d40c8], edi
je 0x4db1f4
mov ecx, dword [esi + 4]
push ebx
mov edx, str.SetRepeatedDouble
call fcn.004d75a0
add esp, 4
cmp byte [ebx + 0x20], 0
je 0x4db219
fld qword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx + 0x14]
sub esp, 8
fstp qword [esp]
push eax
push ecx
mov ecx, dword [esi + 0x18]
add ecx, dword [esp + 0x44]
call fcn.004dfaf0
jmp 0x4db236
mov eax, ebx
call fcn.004d73f0
fld qword [ebp + 0x14]
mov edx, dword [esi + 0xc]
mov eax, dword [edx + eax*4]
mov ecx, dword [esp + 0x34]
mov edx, dword [eax + ecx]
mov eax, dword [ebp + 0x10]
fstp qword [edx + eax*8]
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00548a41
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4db260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x5b6e30
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x6216ec]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, ecx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x34], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x38], esi
cmp dword [ebx + 0x24], eax
je 0x4db2d0
push eax
mov edi, str.Field_does_not_match_message_type.
mov esi, str.AddDouble
mov ecx, ebx
call fcn.004d7450
mov esi, dword [esp + 0x3c]
add esp, 4
cmp dword [ebx + 0x1c], 3
je 0x4db2f2
mov ecx, dword [esi + 4]
push ecx
mov edi, str.Field_is_singular__the_method_requires_a_repeated_field.
mov esi, str.AddDouble
mov ecx, ebx
call fcn.004d7450
mov esi, dword [esp + 0x3c]
add esp, 4
mov edx, dword [ebx + 0x18]
mov edi, 5
cmp dword [edx*4 + 0x5d40c8], edi
je 0x4db314
mov ecx, dword [esi + 4]
push ebx
mov edx, str.AddDouble
call fcn.004d75a0
add esp, 4
cmp byte [ebx + 0x20], 0
je 0x4db342
mov eax, dword [ebx + 0x38]
fld qword [ebp + 0x10]
movzx ecx, byte [eax + 0x1c]
movzx edx, byte [ebx + 0x18]
sub esp, 8
fstp qword [esp]
push ebx
push ecx
mov ecx, dword [ebx + 0x14]
push edx
mov edx, dword [esi + 0x18]
add edx, dword [esp + 0x48]
call fcn.004dfc00
jmp 0x4db372
mov eax, ebx
call fcn.004d73f0
mov ecx, dword [esi + 0xc]
mov esi, dword [ecx + eax*4]
add esi, dword [esp + 0x34]
mov eax, dword [esi + 8]
cmp dword [esi + 4], eax
jne 0x4db364
inc eax
push eax
mov eax, esi
call fcn.004dd5e0
mov edx, dword [esi + 4]
fld qword [ebp + 0x10]
mov eax, dword [esi]
fstp qword [eax + edx*8]
inc dword [esi + 4]
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00548a41
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4dee30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4dee57
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004deb69
pop ebx
mov esp, 0x458d8c93
rcl byte [eax - 0x18], 0xc5
cld
invalid