joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411a60
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [0x497bf8]
push esi
push eax
push ecx
mov dword [esp + 0xc], 0
call fcn.00413b6a
mov esi, eax
test esi, esi
je 0x411ae4
cmp dword [esi + 4], 0
je 0x411ab3
push 1
lea edx, [esp + 8]
push edx
push esi
call fcn.00411d80
test eax, eax
je 0x411aa7
add dword [esi + 0xc], 1
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
mov edx, dword [esi]
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411aef
cmp dword [esp + 8], 0
je 0x411aef
mov eax, dword [esi]
push 1
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4

Function at 0x411b60
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x497bf8]
push eax
push ecx
mov byte [esp + 0xb], 0
call fcn.00413b6a
test eax, eax
je 0x411baa
cmp dword [eax + 4], 0
lea edx, [esp + 3]
je 0x411b97
push 1
push edx
push eax
call fcn.00411d80
movzx eax, byte [esp + 3]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, byte [esp + 3]
pop ecx
ret 4

Function at 0x411bc0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x497bf8]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.00413b6a
test eax, eax
je 0x411c0a
cmp dword [eax + 4], 0
lea edx, [esp]
je 0x411bf7
push 4
push edx
push eax
call fcn.00411d80
mov eax, dword [esp]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret 4

Function at 0x411c20
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x497bf8]
push eax
push ecx
mov byte [esp + 0xb], 0
call fcn.00413b6a
test eax, eax
je 0x411c6a
cmp dword [eax + 4], 0
lea edx, [esp + 3]
je 0x411c57
push 1
push edx
push eax
call fcn.00411d80
movsx eax, byte [esp + 3]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movsx eax, byte [esp + 3]
pop ecx
ret 4
Function at 0x411c80
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x411cb5
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x411d2e
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
sub ecx, 1
je 0x411d1b
sub ecx, 1
je 0x411d06
sub ecx, 2
je 0x411cf3
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.00411670
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x411d5b
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x411d80
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 0
push edi
jne 0x411da1
push esi
call fcn.00411670
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ebx, edi
jl 0x411e1a
mov eax, dword [esi + 0x10]
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
sub ecx, 1
je 0x411e07
sub ecx, 1
je 0x411df2
sub ecx, 2
je 0x411ddf
push edi
push eax
mov eax, dword [esp + 0x1c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov edx, dword [esp + 0x14]
mov dword [edx], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ax, word [eax]
mov ecx, dword [esp + 0x14]
mov word [ecx], ax
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov dl, byte [eax]
mov eax, dword [esp + 0x14]
mov byte [eax], dl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esi + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
sub ecx, ebx
add ecx, dword [esi + 4]
push ebx
push ecx
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
cmp edi, eax
push 0
jl 0x411e63
mov eax, dword [esi]
lea edx, [esp + 0x18]
push edx
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
pop esi
add eax, ebx
pop ebx
ret 0xc
mov edx, dword [esi + 4]
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp edi, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
jle 0x411e86
mov edi, eax
mov ecx, dword [esi + 4]
push edi
push ecx
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
add esp, 0xc
pop ebp
lea eax, [ebx + edi]
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x4121c1
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x497bfc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push eax
call dword [eax + 0x24]
ret 0xc

Function at 0x412f60
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
cmp eax, edi
mov dword [0x4977fc], eax
je 0x412f93
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x497800], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [0x4977f8], 1
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x412fd1
cmp dword [ebp - 0xc], 1
je 0x412fe2
cmp dword [ebp - 0xc], 2
jne 0x412fd1
cmp dword [ebp - 0x18], 5
jb 0x412fe2
jne 0x412fd1
cmp dword [ebp - 0x14], edi
jne 0x412fd1
mov dword [0x4977f8], edi
cmp dword [0x4977f8], edi
je 0x412fe8
call fcn.00412ea7
test eax, eax
jne 0x412fe8
mov dword [0x4977f8], edi
pop edi
add ebp, 0x78
leave
ret
Function at 0x413cc5
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x497804]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x413d26
push esi
push dword [0x49780c]
push 8
push dword [0x496e6c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x497804]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x497808]
jmp 0x413d16
mov eax, dword [esi + 0xc]
test eax, eax
je 0x413d14
mov ecx, dword [esi + 8]
add ecx, edi
push ecx
call eax
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x413d04
push edi
push 0x413c8a
call fcn.0043da0d
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4

Function at 0x413d30
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, ebx
and eax, 3
push esi
push edi
je 0x413d45
push 4
pop ecx
sub ecx, eax
add ebx, ecx
cmp dword [0x49780c], 0
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
jne 0x413d77
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push ebx
push 8
push dword [0x496e6c]
mov dword [0x497804], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x497804]
call esi
mov edi, dword [0x49780c]
add dword [0x49780c], ebx
push dword [0x49780c]
push dword [0x497804]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x496e6c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebx, eax
push ebx
push dword [0x497804]
call esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x413dbd
cmp dword [esp + 0x18], esi
je 0x413de1
push 0x14
push 0x497808
call fcn.00414170
test esi, esi
pop ecx
pop ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
je 0x413de1
add ebx, edi
push ebx
call esi
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x414250
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x486aa0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
sub edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x414296
mov ecx, dword [ebp - 4]
add ecx, 5
push ecx
push 0
mov edx, dword [0x497c84]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x4142b7
mov edx, dword [ebp - 4]
add edx, 5
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x497c84]
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.00414790
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x414340
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x486aa0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret

Function at 0x414400
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edx
mov eax, dword [0x486aa0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
add ecx, dword [edx + 8]
mov dword [ebp - 4], ecx
pop edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x414510
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x486aa0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ebp - 4]
add eax, dword [edx + 8]
mov esp, ebp
pop ebp
ret

Function at 0x414640
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x486aa0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x414664
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
add ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
sub eax, 4
cmp dword [ebp - 8], eax
jl 0x4146b1
mov ecx, dword [ebp - 8]
add ecx, 0x4000
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
add ecx, 5
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x497c84]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x414710
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x486aa0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x41474e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x41474e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x414750
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x42da00
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x42daa1
push ebx
push ebp
push esi
mov esi, dword [ecx]
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov esi, dword [ecx + 4]
xor eax, eax
cmp esi, edx
push edi
jle 0x42da4f
mov edi, dword [ecx]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
shl eax, 8
xor eax, dword [ebx*4 + 0x448590]
add edx, 1
cmp edx, esi
jl 0x42da31
xor edx, edx
mov esi, dword [ecx + 0xc]
cmp esi, edx
jle 0x42da7c
mov edi, dword [ecx + 8]
lea esp, [esp]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
shl eax, 8
xor eax, dword [ebx*4 + 0x448590]
add edx, 1
cmp edx, esi
jl 0x42da60
mov edx, dword [ecx]
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
pop edi
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
pop esi
shr eax, 0x18
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x43da0d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x497858], ebx
mov esi, eax
mov dword [ebp - 0xc], esi
jne 0x43da43
push 0x49783c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x497858], 1
push 0x49783c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x497854]
cmp eax, ebx
mov edi, eax
je 0x43daa7
cmp dword [ebp - 4], ebx
jne 0x43dbe7
xor eax, eax
inc eax
lea ecx, [edi + 0x114]
cmp esi, dword [ecx]
je 0x43da7a
inc eax
add ecx, 4
cmp eax, 0x40
jl 0x43da6b
jmp 0x43da98
push dword [ebp + 0xc]
lea esi, [edi + eax*4 + 0x210]
push dword [ebp + 8]
call fcn.0043d85f
mov esi, dword [ebp - 0xc]
pop ecx
pop ecx
mov dword [ebp - 4], 1
mov edi, dword [edi]
cmp edi, ebx
jne 0x43da59
cmp dword [ebp - 4], ebx
jne 0x43dbe7
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
push ebx
push 0x100000
lea eax, [ebp - 8]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x43dbe7
mov edi, dword [0x497854]
jmp 0x43dae7
cmp dword [edi + 0xc], 0x3f
jl 0x43db81
mov edi, dword [edi]
cmp edi, ebx
jne 0x43dadb
push 0x310
push 8
push dword [0x496e6c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
je 0x43dbde
push ebx
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
cmp eax, ebx
mov dword [edi + 8], eax
je 0x43dbd0
push ebx
push ebx
push edi
push 0x43d8b0
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [edi + 0x114], esi
push 0x1000
lea esi, [edi + 0x214]
push ebx
mov dword [edi + 0x14], eax
mov dword [esi], ebx
mov dword [edi + 0xc], 2
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x43dbc7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043d85f
mov eax, dword [0x497854]
cmp eax, ebx
pop ecx
pop ecx
mov dword [edi + 4], ebx
mov dword [edi], eax
je 0x43db79
mov dword [eax + 4], edi
mov dword [0x497854], edi
jmp 0x43dbe7
mov eax, dword [edi + 0xc]
mov ecx, dword [ebp - 8]
push dword [ebp + 0xc]
mov dword [edi + eax*4 + 0x10], ecx
mov eax, dword [edi + 0xc]
push dword [ebp + 8]
mov dword [edi + eax*4 + 0x110], esi
mov eax, dword [edi + 0xc]
mov dword [edi + eax*4 + 0x210], ebx
mov eax, dword [edi + 0xc]
lea esi, [edi + eax*4 + 0x210]
call fcn.0043d85f
inc dword [edi + 0xc]
pop ecx
pop ecx
push ebx
push 1
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x43dbe7
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
push dword [0x496e6c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x49783c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43ef0c
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x154
push 8
push dword [0x496e6c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x497bfc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x497c00], esi
and dword [esi + 0x88], 0
or dword [esi + 0x8c], 0xffffffff
or dword [esi + 0x90], 0xffffffff
push esi
mov dword [esi + 0x84], 0xffffff
mov dword [esi + 0x6c], 2
mov dword [esi + 0x70], 0x3f
call fcn.004442c1
mov dword [esi + 0x58], 0x43ee8b
mov dword [esi + 0x5c], 0x43eeca
mov dword [esi + 0x10], fcn.0043e059
mov dword [esi + 0x30], 0x43e1d8
mov dword [esi + 0x64], 0x43e2e1
mov dword [esi + 0x60], 0x43e32c
mov dword [esi + 0x34], 0x43ea2a
mov dword [esi + 0x24], 0x43e8c9
mov dword [esi + 0x28], 0x43e8f2
mov dword [esi + 0x2c], 0x43e91d
mov dword [esi + 0x44], 0x43ed1b
mov eax, esi
pop esi
ret 4

Function at 0x43fbfb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x20], 0
push esi
mov esi, dword [ecx + 0xb4]
mov dword [ebp - 4], esi
je 0x43fc6e
mov eax, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
imul eax, dword [ebp + 0x18]
add eax, dword [ebp + 8]
push ebx
lea edx, [eax + edx*4]
push edi
mov eax, dword [ecx + 0xac]
imul eax, dword [ebp + 0x14]
add eax, dword [ecx + 0xa8]
mov edi, edx
add eax, esi
cmp dword [ebp + 0x1c], 0
jle 0x43fc5d
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0x10], ebx
mov bl, byte [edi + 2]
xor byte [eax + 2], bl
mov bl, byte [edi + 1]
xor byte [eax + 1], bl
mov bl, byte [edi]
xor byte [eax], bl
add eax, dword [ebp - 4]
add edi, 4
dec dword [ebp + 0x10]
jne 0x43fc42
dec dword [ebp + 0x20]
inc dword [ebp + 0x14]
add edx, dword [ebp + 0xc]
cmp dword [ebp + 0x20], 0
jne 0x43fc22
pop edi
pop ebx
pop esi
leave
ret 0x1c

Function at 0x4409fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x20], 0
mov edx, dword [ecx + 0xb4]
je 0x440a76
push ebx
imul eax, eax, 3
push esi
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x18]
add edi, dword [ebp + 8]
mov esi, edx
imul esi, dword [ebp + 0x10]
add eax, edi
mov edi, eax
mov dword [ebp + 0x18], eax
mov eax, dword [ecx + 0xac]
imul eax, dword [ebp + 0x14]
add eax, dword [ecx + 0xa8]
add eax, esi
cmp dword [ebp + 0x1c], 0
jle 0x440a5e
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0x10], ebx
mov bl, byte [edi + 2]
xor byte [eax + 2], bl
mov bl, byte [edi + 1]
xor byte [eax + 1], bl
mov bl, byte [edi]
xor byte [eax], bl
add edi, 3
add eax, edx
dec dword [ebp + 0x10]
jne 0x440a44
mov edi, dword [ebp + 0x18]
dec dword [ebp + 0x20]
add edi, dword [ebp + 0xc]
inc dword [ebp + 0x14]
cmp dword [ebp + 0x20], 0
mov dword [ebp + 0x18], edi
jne 0x440a26
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x440ad2
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
imul eax, eax, 3
cmp dword [ebp + 0x1c], 0
mov dword [ebp - 4], eax
je 0x440b62
mov eax, dword [ebp + 0x10]
imul ecx, ecx, 3
imul eax, dword [ebp + 0x18]
add eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, edx
imul esi, esi, 3
add ecx, eax
push edi
mov edi, ecx
mov dword [ebp + 0xc], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xac]
imul ecx, dword [ebp + 0x14]
add ecx, dword [eax + 0xa8]
mov edx, dword [ebp - 4]
add ecx, esi
test edx, edx
jle 0x440b4a
mov eax, 0xff
sub eax, dword [ebp + 0x20]
mov dword [ebp + 0x18], edx
mov dword [ebp - 8], eax
movzx eax, byte [ecx]
movzx edx, byte [edi]
imul eax, dword [ebp - 8]
imul edx, dword [ebp + 0x20]
add eax, edx
cdq
mov ebx, 0xff
idiv ebx
inc edi
mov byte [ecx], al
inc ecx
dec dword [ebp + 0x18]
jne 0x440b29
mov edi, dword [ebp + 0xc]
dec dword [ebp + 0x1c]
add edi, dword [ebp + 0x10]
inc dword [ebp + 0x14]
cmp dword [ebp + 0x1c], 0
mov dword [ebp + 0xc], edi
jne 0x440aff
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x42b3fb
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov al, byte [ecx]
and dword [esp + 0x14], 0
push ebx
push ebp
mov byte [edx], al
lea eax, [edx + 1]
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
lea eax, [ecx + 1]
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.0042b3a4
test eax, eax
je 0x42b554
lea ecx, [esp + 0x18]
call fcn.0042b3a4
lea ecx, [esp + 0x18]
test eax, eax
je 0x42b4c3
call fcn.0042b3a4
test eax, eax
je 0x42b485
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.0042b3a4
lea edi, [eax + edi*2]
dec ebx
jne 0x42b45b
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x42b47c
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x42b47f
mov byte [edx], 0
inc edx
jmp 0x42b566
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x42b4bb
test ecx, ecx
je 0x42b54f
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x42b4ad
jmp 0x42b54b
xor ebp, ebp
inc ebp
jmp 0x42b54f
call fcn.0042b3da
test edi, edi
jne 0x42b4f8
cmp eax, 2
jne 0x42b4f3
lea ecx, [esp + 0x18]
call fcn.0042b3da
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x42b54f
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x42b4e8
jmp 0x42b54b
sub eax, 3
jmp 0x42b4fb
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.0042b3da
mov ecx, eax
cmp esi, 0x7d00
jb 0x42b522
inc ecx
cmp esi, 0x500
jb 0x42b52b
inc ecx
cmp esi, 0x80
jae 0x42b536
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x42b54f
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x42b542
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x42b56c
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x42b42b
sub edx, dword [esp + 0x14]
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42b6f1
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x42b723
mov al, byte [esp + 0x14]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [esp + 0x10]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x42b704
jmp 0x42b727
mov eax, dword [esp + 0x10]
test edi, edi
je 0x42b731
xor byte [esi], al
inc esi
dec edi
jne 0x42b72b
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x40892b
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
add esi, edx
call fcn.00408961
and edx, edx
sub esi, 1
xor dword [eax], edi
or edx, esi
inc esi
inc eax
add edx, 0x5041e96a
sub esi, edx
cmp eax, ebx
jne fcn.0040892b
or esi, edx
sub esi, 0xe80d6478
ret