joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449c60
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 4], 0
je 0x449c87
push 1
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00449460
mov dword [esp + 4], eax
jmp 0x449ca1
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
jne 0x449d58
mov cl, byte [esp + 0xc]
test cl, cl
js 0x449cc6
mov eax, dword [esp + 0x10]
pop esi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push edi
cmp al, 0xc0
jne 0x449cd6
mov edi, 2
jmp 0x449cf2
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x449ce5
mov edi, 3
jmp 0x449cf2
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x449d44
mov edi, 4
mov eax, dword [esp + 0x14]
push ebx
lea ebx, [edi - 1]
mov byte [eax], cl
inc eax
cmp dword [esi + 4], 0
je 0x449d1e
push ebx
push eax
push esi
call fcn.00449460
mov ecx, eax
xor eax, eax
cmp ecx, ebx
pop ebx
setne al
dec eax
and eax, edi
pop edi
pop esi
pop ecx
ret 8
push 0
lea ecx, [esp + 0x10]
push ecx
push ebx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, ebx
pop ebx
setne al
dec eax
and eax, edi
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8
xor eax, eax
pop esi
pop ecx
ret 8

Function at 0x44b178
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
jne 0x44b189
mov eax, dword [esp + 0xc]
jmp 0x44b26b
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
not ecx
cmp esi, 8
jb 0x44b24a
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4e7168]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4e7168]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4e7168]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4e7168]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4e7168]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4e7168]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4e7168]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4e7168]
sub edi, 1
jne 0x44b1a3
pop edi
test esi, esi
je 0x44b266
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4e7168]
inc edx
sub esi, 1
jne 0x44b24e
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x44b30d
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x5a1a44]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [esi + 0xa4]
cmp eax, dword [esi + 0xac]
je 0x44b335
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [esp + 0x14]
mov eax, dword [esi + 0x90]
push dword [esp + 0x14]
add eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [esp + 0x14]
push eax
push esi
call dword [esi + 4]
pop esi
ret 0x10

Function at 0x44b35b
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0x5a1a44]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi + 0xac]
je 0x44b383
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [ebp + 0x14]
mov eax, dword [esi + 0x90]
push dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [ebp + 8]
push eax
push esi
call dword [esi + 4]
pop esi
pop ebp
ret 0x14

Function at 0x44b3a6
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x5a1a44]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
mov ecx, dword [edx + 0x74]
cmp ecx, 2
je 0x44b3cb
cmp ecx, 3
je 0x44b3cb
cmp ecx, 8
je 0x44b3cb
cmp ecx, 0xc
jne 0x44b3d9
mov eax, dword [esp + 4]
test eax, eax
je 0x44b3d9
mov dword [edx + 0xb8], eax
ret 4

Function at 0x44b3dc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [0x5a1a44]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
mov esi, dword [edx + 0x2c]
mov edi, dword [edx + 0x90]
mov ebx, dword [edx + 0x8c]
test esi, esi
je 0x44b41c
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
add ecx, edi
push 0xff
push ecx
add eax, ebx
push eax
push dword [ebp + 8]
push edx
call esi
jmp 0x44b42f
mov eax, dword [ebp + 0x10]
add eax, edi
push eax
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
push dword [ebp + 8]
push edx
call dword [edx + 0x24]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x44b436
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x5a1a44]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x90]
add ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 0x8c]
add ecx, dword [esp + 0xc]
push ecx
push dword [esp + 0xc]
push eax
call dword [eax + 0x24]
ret 0xc
Function at 0x44b4ef
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0x5a1a44]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
add edx, dword [eax + 0x8c]
add esi, dword [eax + 0x90]
mov ecx, dword [eax + 0x74]
cmp ecx, 2
je 0x44b528
cmp ecx, 3
je 0x44b528
cmp ecx, 8
je 0x44b528
cmp ecx, 0xc
jne 0x44b57b
mov ecx, dword [ebp + 0x10]
push edi
xor edi, edi
inc edi
test ecx, ecx
jns 0x44b53a
neg ecx
mov dword [ebp + 0x10], ecx
jmp 0x44b53f
jne 0x44b53f
mov dword [ebp + 0x10], edi
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jns 0x44b54d
neg ecx
mov dword [ebp + 0x14], ecx
jmp 0x44b552
jne 0x44b552
mov dword [ebp + 0x14], edi
fild dword [ebp + 0x10]
mov dword [eax + 0x118], edx
mov dword [eax + 0x11c], esi
mov dword [eax + 0xb4], 0x44b47a
pop edi
fstp dword [eax + 0x120]
fild dword [ebp + 0x14]
fstp dword [eax + 0x124]
pop esi
pop ebp
ret 0x10

Function at 0x44b59a
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x5a1a44]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, dword [esi + 0xac]
je 0x44b5c0
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [esp + 0x10]
mov eax, dword [esi + 0x90]
add eax, dword [esp + 0x10]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [esp + 0x10]
push eax
push esi
call dword [esi + 0x3c]
pop esi
ret 0x10

Function at 0x44b5fb
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [0x5a1a44]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov ecx, dword [ebx + 0x74]
cmp ecx, 2
je 0x44b628
cmp ecx, 3
je 0x44b628
cmp ecx, 8
je 0x44b628
cmp ecx, 0xc
jne 0x44b6fd
fldz
fld dword [ebp + 8]
fcom st(1)
fnstsw ax
test ah, 5
jp 0x44b63d
fstp st(0)
fstp dword [ebp + 8]
jmp 0x44b64e
fstp st(1)
fld1
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 5
jnp 0x44b638
fstp st(0)
push esi
mov esi, dword [ebx + 0xbc]
push edi
xor edi, edi
jmp 0x44b67a
fld dword [esi + 4]
fld dword [ebp + 8]
fld st(0)
fucom st(2)
fnstsw ax
test ah, 0x44
jnp 0x44b69a
fstp st(1)
fcompp
fnstsw ax
test ah, 5
jnp 0x44b680
mov edi, esi
mov esi, dword [esi]
test esi, esi
jne 0x44b65a
jmp 0x44b6a6
push 0x18
push 0
push dword [0x59cd20]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x44b6a6
mov dword [edx], esi
jmp 0x44b6bf
mov edx, esi
fstp st(2)
fstp st(1)
test edx, edx
jne 0x44b6d0
fstp st(0)
push 0x18
push 0
push dword [0x59cd20]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x44b6fb
and dword [edx], 0
fld dword [ebp + 8]
test edi, edi
je 0x44b6ca
mov dword [edi], edx
jmp 0x44b6d0
mov dword [ebx + 0xbc], edx
mov ecx, dword [ebp + 0xc]
movzx eax, cl
mov dword [edx + 8], eax
mov eax, ecx
sar eax, 8
movzx eax, al
mov dword [edx + 0xc], eax
mov eax, ecx
sar eax, 0x10
movzx eax, al
sar ecx, 0x18
mov dword [edx + 0x10], eax
movzx eax, cl
fstp dword [edx + 4]
mov dword [edx + 0x14], eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x44b917
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x5a1a44]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [esp + 0x14]
mov edi, eax
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov edx, dword [edi + 0x8c]
add esi, edx
mov ecx, dword [edi + 0x90]
add ebx, edx
mov edx, dword [esp + 0x20]
add ebp, ecx
mov eax, dword [edi + 0x74]
add edx, ecx
mov dword [esp + 0x20], edx
cmp eax, 2
je 0x44b96c
cmp eax, 3
je 0x44b96c
cmp eax, 8
je 0x44b96c
cmp eax, 0xc
jne 0x44bae8
mov dword [edi + 0x124], edx
mov eax, ebx
sub edx, ebp
mov dword [edi + 0x118], esi
sub eax, esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
imul edx, edx
imul eax, eax
mov dword [edi + 0x11c], ebp
mov dword [edi + 0x120], ebx
add edx, eax
mov dword [esp + 0x18], edx
fild dword [esp + 0x18]
push edx
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp]
call fcn.0044b580
mov eax, dword [esp + 0x24]
fstp dword [edi + 0x128]
pop ecx
cmp ebp, eax
jne 0x44b9d2
mov eax, 0x44b813
cmp esi, ebx
jle 0x44b9e4
mov eax, 0x44b854
jmp 0x44b9e4
cmp esi, ebx
jne 0x44b9ef
cmp ebp, eax
mov eax, 0x44b895
jle 0x44b9e4
mov eax, 0x44b8d6
mov dword [edi + 0xb4], eax
jmp 0x44bae8
push dword [esp + 0x14]
call fcn.004c4fae
push dword [esp + 0x20]
mov esi, eax
call fcn.004c4fae
xor ebp, ebp
pop ecx
inc ebp
pop ecx
cmp esi, eax
jl 0x44ba21
and dword [edi + 0x130], 0
mov ecx, dword [edi + 0x124]
mov esi, dword [edi + 0x11c]
jmp 0x44ba57
mov eax, dword [edi + 0x11c]
mov esi, dword [edi + 0x118]
mov ecx, dword [edi + 0x120]
mov dword [edi + 0x118], eax
mov eax, dword [edi + 0x124]
mov dword [edi + 0x130], ebp
mov dword [edi + 0x11c], esi
mov dword [edi + 0x124], ecx
mov dword [edi + 0x120], eax
mov ebx, dword [edi + 0x118]
mov edx, dword [edi + 0x120]
cmp ebx, edx
jge 0x44ba70
and dword [edi + 0x12c], 0
jmp 0x44baa0
mov esi, dword [edi + 0x124]
mov eax, ebx
mov ecx, dword [edi + 0x11c]
mov ebx, edx
mov dword [edi + 0x118], edx
mov edx, eax
mov dword [edi + 0x12c], ebp
mov dword [edi + 0x120], eax
mov dword [edi + 0x124], ecx
mov dword [edi + 0x11c], esi
sub ecx, esi
sub edx, ebx
mov dword [esp + 0x20], ecx
fild dword [esp + 0x20]
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
mov dword [esp + 0x20], edx
fild dword [esp + 0x20]
fstp dword [esp + 0x20]
fdiv dword [esp + 0x20]
mov dword [edi + 0xb4], 0x44b71b
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
fst dword [edi + 0x134]
fdivr qword [0x4e7578]
fstp dword [edi + 0x138]
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x44bb28
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x5a1a44]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
add eax, dword [esi + 0x90]
add ebp, dword [esi + 0x8c]
mov dword [esp + 0x18], eax
test edi, edi
jns 0x44bb5e
add ebp, edi
neg edi
mov ebx, dword [esp + 0x20]
test ebx, ebx
jns 0x44bb6e
add eax, ebx
neg ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
add eax, eax
cmp eax, edi
jle 0x44bb83
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
add ecx, ecx
cmp ecx, ebx
jle 0x44bb98
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0xa4]
cmp eax, dword [esi + 0xac]
je 0x44bbb1
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
push edi
push dword [esp + 0x28]
push ebp
push esi
call dword [esi + 8]
pop edi
pop esi
pop ebp
pop ebx
ret 0x18

Function at 0x44bbcb
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x5a1a44]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
add eax, dword [edi + 0x90]
add ebp, dword [edi + 0x8c]
mov dword [esp + 0x18], eax
test esi, esi
jns 0x44bc01
add ebp, esi
neg esi
mov ebx, dword [esp + 0x20]
test ebx, ebx
jns 0x44bc11
add eax, ebx
neg ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
add eax, eax
cmp eax, esi
jle 0x44bc26
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
add ecx, ecx
cmp ecx, ebx
jle 0x44bc3b
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
cmp eax, dword [edi + 0xac]
je 0x44bc52
push eax
push edi
mov dword [edi + 0xac], eax
call dword [edi + 0x40]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
push esi
push dword [esp + 0x28]
push ebp
push edi
call dword [edi + 8]
pop edi
pop esi
pop ebp
pop ebx
ret 0x1c

Function at 0x44bc6c
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, ebx
test esi, esi
je 0x44bcc9
push esi
call dword [esi + 0x58]
mov ecx, dword [esi + 0x80]
mov edi, eax
mov dword [esi + 0x94], ecx
mov ecx, dword [esi + 0x84]
mov dword [esi + 0x98], ecx
test edi, edi
jne 0x44bcc9
mov eax, dword [esi + 0x70]
test eax, eax
je 0x44bca8
push ebx
push esi
call eax
push esi
push ebx
push dword [0x59cd20]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [0x5a1a44]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x5a1a40], ebx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x44c52a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
xor ebp, ebp
push esi
test ebx, ebx
je 0x44c53e
mov esi, ebx
jmp 0x44c550
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
je 0x44c63e
lea eax, [esp + 0x18]
push eax
push 0x18
pop eax
push eax
push dword [esp + 0x68]
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x44c633
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push edi
mov edi, dword [esp + 0x24]
push 0x2c
push 0
push eax
mov dword [esp + 0x20], ebp
call fcn.00436fb0
add esp, 0xc
mov dword [esp + 0x34], 0x28
xor eax, eax
mov dword [esp + 0x38], ebp
inc eax
mov dword [esp + 0x3c], edi
mov word [esp + 0x40], ax
xor ecx, ecx
push 0x18
pop eax
push ecx
push ecx
mov word [esp + 0x4a], ax
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [esp + 0x44]
mov dword [esp + 0x54], ecx
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x44c632
push 0
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x18]
push edi
push 0
push dword [esp + 0x78]
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
imul edi, dword [esp + 0x14]
test edi, edi
jle 0x44c632
mov ebp, dword [esp + 0x10]
push 3
pop ebx
movzx ecx, byte [ebp + 1]
xor edx, edx
movzx eax, byte [ebp + 2]
add eax, ecx
movzx ecx, byte [ebp]
add eax, ecx
div ebx
mov byte [ebp], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 1], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 2], al
mov ebp, dword [esp + 0x10]
add ebp, ebx
mov dword [esp + 0x10], ebp
sub edi, 1
jne 0x44c5f6
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x18]
pop edi
test ebx, ebx
jne 0x44c63e
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x50
ret 8
Function at 0x44e660
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x44e698
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44e693
xor eax, eax
cmp dword [esp + 0xc], esi
pop edi
sete al
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call fcn.00439170
add dword [edi + 8], esi
add esp, 0xc
mov eax, 1
pop edi
pop esi
ret
Function at 0x452288
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x5a13e8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x4522e9
push esi
push dword [0x5a13e4]
push 8
push dword [0x59cd20]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x5a13e8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x5a13e0]
jmp 0x4522d9
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4522d7
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x4522c7
push edi
push 0x452226
call fcn.004ba320
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4

Function at 0x4522f3
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ecx, edi
and ecx, 3
je 0x452309
push 4
pop eax
sub eax, ecx
add edi, eax
mov esi, dword [0x5a13e4]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
jne 0x452342
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push edi
push 8
push dword [0x59cd20]
mov dword [0x5a13e8], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x5a13e8]
call ebx
mov esi, dword [0x5a13e4]
lea eax, [edi + esi]
push eax
push dword [0x5a13e8]
mov dword [0x5a13e4], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x59cd20]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x5a13e8]
call ebx
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test edi, edi
jne 0x452381
test ebx, ebx
je 0x4523a2
push 0x14
push 0x5a13e0
call fcn.00452bb0
pop ecx
pop ecx
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
test edi, edi
je 0x4523a2
lea ecx, [esi + ebp]
push ecx
call edi
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x452d10
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x59c998]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov edi, eax
mov ebp, dword [esp + 0x14]
mov esi, dword [edi + 8]
mov ecx, dword [ebp]
sub esi, ebx
lea eax, [esi + 0xa]
push eax
test ecx, ecx
jne 0x452d49
push ecx
push dword [0x5a1b78]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x452d58
push ecx
push 0
push dword [0x5a1b78]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
shr esi, 1
mov dword [ebp], ecx
mov eax, dword [edi]
push esi
add eax, ebx
push eax
push ecx
call fcn.00453070
mov dword [edi + 8], ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x452e50
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x59c998]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [eax + 8], 2
ret
Function at 0x452f50
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x59c998]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov esi, eax
cmp ebx, 0xffffffff
jne 0x452f6e
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x14]
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
lea ebp, [eax + eax]
add ecx, ebp
lea eax, [edx - 4]
cmp ecx, eax
jl 0x452f92
lea eax, [ecx + 0x4000]
mov dword [esi + 4], eax
add eax, 0xa
jmp 0x452fad
cmp edx, 0x100000
jle 0x452fc0
cmp ecx, 0x100000
jge 0x452fa7
mov ecx, 0x100000
mov dword [esi + 4], ecx
lea eax, [ecx + 0xa]
push eax
push dword [esi]
push 0
push dword [0x5a1b78]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [esi], eax
lea eax, [ebx + ebp]
mov dword [esi + 8], eax
mov eax, dword [esi]
pop edi
pop esi
pop ebp
add eax, ebx
pop ebx
ret 8

Function at 0x453000
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x59c998]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
neg ecx
add ecx, ecx
add dword [eax + 8], ecx
ret 4

Function at 0x453020
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x59c998]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov eax, dword [esp + 4]
mov edx, dword [ecx]
cmp eax, edx
jb 0x453047
mov ecx, dword [ecx + 8]
add ecx, edx
cmp eax, ecx
ja 0x453047
sub eax, edx
inc eax
ret 4
xor eax, eax
ret 4

Function at 0x453050
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x59c998]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
mov eax, dword [esp + 4]
dec eax
add eax, ecx
ret 4

Function at 0x4530b0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x59c998]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
add eax, dword [esp + 4]
ret 4

Function at 0x453240
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x59c998]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
mov dword [eax + 8], ecx
mov eax, dword [eax]
add eax, ecx
ret 4

Function at 0x457370
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x457390
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x457390
mov eax, dword [eax + 0x44]
test eax, eax
je 0x457390
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x469b90
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x469c40
lea eax, [esp + 0x18]
push eax
push ebx
push 2
call fcn.00486960
add esp, 0xc
test eax, eax
jne 0x469c40
lea eax, [esp + 4]
push eax
push ebx
push 0x17
call fcn.00486960
add esp, 0xc
test eax, eax
jne 0x469c40
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x469bd3
sub esi, ecx
push esi
push 0x2e
push ebx
call fcn.00486930
add esp, 0xc
test eax, eax
je 0x469c0b
sub eax, ebx
push eax
push 0x2e
push ebx
call fcn.00486930
mov edi, eax
add esp, 0xc
test edi, edi
je 0x469c0b
inc edi
mov ecx, ebx
sub ecx, edi
add esi, ecx
test edi, edi
jne 0x469c0d
mov edi, ebx
add esi, edi
mov ebx, 0x1505
cmp edi, esi
jae 0x469c36
mov al, byte [edi]
push eax
call fcn.0047a4c0
movsx ecx, al
inc edi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, esi
jb 0x469c18
pop edi
pop esi
movzx eax, bl
pop ebx
add esp, 0x10
ret
xor eax, eax
pop ebx
add esp, 0x10
ret

Function at 0x46a0c0
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x2f0], 2
je fcn.0046a070
mov al, 1
ret