joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444474
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00474a70
mov eax, dword [0x638048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0045d1e8
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4444b6
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x444612
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00448aa0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x63c848]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.00480f91
mov ecx, dword [esi*4 + 0x63c848]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x44460b
cmp eax, dword [ecx + edi + 0x24]
jne 0x44460b
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44460b
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00480f91
add esp, 0x14
test edx, edx
jl 0x44460b
jg 0x444581
test eax, eax
jb 0x44460b
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x44460b
jl 0x44459b
cmp dword [ebp - 0x1008], eax
ja 0x44460b
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4445b9
test ebx, ebx
je 0x4445f2
cmp ecx, edi
jae 0x4445f2
mov al, byte [ecx]
cmp al, 0xd
jne 0x4445d3
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4445df
cmp byte [ecx + 1], 0xa
jne 0x4445df
inc ecx
jmp 0x4445df
movzx eax, al
movsx eax, byte [eax + 0x638560]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4445b9
cmp edx, ebx
jne 0x4445b9
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x444610
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0045d4e4
leave
ret
Function at 0x445260
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x445294
push esi
call fcn.00445790
add esp, 4
cmp byte [esi + 0x40], 0
je 0x44528b
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
jmp 0x44529b
cmp eax, 0xcb
jne 0x445313
mov eax, dword [esi + 0x1a8]
cmp byte [eax + 0x10], 0
je 0x4452fe
mov eax, dword [esi + 8]
test eax, eax
je 0x4452b6
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a8]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x4452f9
cmp eax, 2
je 0x4452fe
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4452a7
cmp eax, 3
je 0x4452de
cmp eax, 1
jne 0x4452a7
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x4452a7
mov eax, dword [esi + 0x128]
add eax, edi
mov dword [edx + 8], eax
jmp 0x4452a7
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.004453f0
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x445335
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.004453f0
add esp, 4
pop edi
pop esi
ret

Function at 0x4453f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
cmp dword [esi + 0x14], 0xcc
lea ebx, [esi + 0x78]
je 0x44541f
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [ebx], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
je 0x4454a2
jmp 0x445430
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x445476
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x445455
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x19c]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x4454b9
cmp eax, dword [esi + 0x60]
jb 0x445437
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
jne 0x445430
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x445f03
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
xor ebp, ebp
push esi
test ebx, ebx
je 0x445f17
mov esi, ebx
jmp 0x445f29
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
je 0x446017
lea eax, [esp + 0x18]
push eax
push 0x18
pop eax
push eax
push dword [esp + 0x68]
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x44600c
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push edi
mov edi, dword [esp + 0x24]
push 0x2c
push 0
push eax
mov dword [esp + 0x20], ebp
call fcn.004016e0
add esp, 0xc
mov dword [esp + 0x34], 0x28
xor eax, eax
mov dword [esp + 0x38], ebp
inc eax
mov dword [esp + 0x3c], edi
mov word [esp + 0x40], ax
xor ecx, ecx
push 0x18
pop eax
push ecx
push ecx
mov word [esp + 0x4a], ax
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [esp + 0x44]
mov dword [esp + 0x54], ecx
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x44600b
push 0
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x18]
push edi
push 0
push dword [esp + 0x78]
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
imul edi, dword [esp + 0x14]
test edi, edi
jle 0x44600b
mov ebp, dword [esp + 0x10]
push 3
pop ebx
movzx ecx, byte [ebp + 1]
xor edx, edx
movzx eax, byte [ebp + 2]
add eax, ecx
movzx ecx, byte [ebp]
add eax, ecx
div ebx
mov byte [ebp], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 1], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 2], al
mov ebp, dword [esp + 0x10]
add ebp, ebx
mov dword [esp + 0x10], ebp
sub edi, 1
jne 0x445fcf
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x18]
pop edi
test ebx, ebx
jne 0x446017
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x50
ret 8
Function at 0x448d4a
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x448de0
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x448ddd
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x448ddd
lea eax, [esi - 1]
push eax
push dword [0x63bee8]
call fcn.00416135
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x448ddf
mov ecx, dword [edi + 4]
add ecx, 4
pop esi
cmp word [ecx - 2], si
jne 0x448dcd
mov edx, 0xfa01
cmp word [ecx], dx
je 0x448dd8
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x448dbd
jmp 0x448ddd
and dword [esp + 0x10], 0
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x448e86
push eax
call esi
test al, al
jns 0x448e86
push 0x11
call esi
test al, al
js 0x448e86
push 0x10
call esi
test al, al
js 0x448e86
push 0x12
call esi
test al, al
js 0x448e86
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x448e86
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call fcn.0044e518
add esp, 0xc
test eax, eax
je 0x448e5a
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call fcn.0044e518
add esp, 0xc
test eax, eax
jne 0x448e71
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x448ec7
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call fcn.00417a34
pop ecx
pop ecx
test eax, eax
je 0x448ec7
test ebp, ebp
je 0x448eaa
push 0x11
call esi
test al, al
js 0x448ea2
push 0x10
call esi
test al, al
js 0x448ea2
push 0x12
call esi
test al, al
jns 0x448eaa
push 1
push ebp
call fcn.00448feb
test ebx, ebx
je 0x448ebe
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x448ec7
test edi, edi
je 0x448ec7
mov eax, dword [edi + 8]
jmp 0x448ec9
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x44a160
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x50
push ebx
push ebp
push esi
xor esi, esi
add edx, 0x78
push edi
mov ecx, dword [edx - 0x78]
xor ecx, dword [edx - 0x50]
mov eax, dword [edx - 0x74]
xor eax, dword [edx - 0x4c]
xor ecx, dword [edx - 0x28]
xor eax, dword [edx - 0x24]
xor ecx, dword [edx + 0x28]
xor eax, dword [edx + 0x2c]
xor ecx, dword [edx]
lea edx, [edx + 8]
xor eax, dword [edx - 4]
mov dword [esp + esi*8 + 0x10], ecx
mov dword [esp + esi*8 + 0x14], eax
inc esi
cmp esi, 5
jb 0x44a170
mov eax, dword [esp + 0x18]
xor edx, edx
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x34]
shld ecx, eax, 1
mov edi, dword [esp + 0x14]
xor edx, ecx
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
add eax, eax
shr esi, 0x1f
xor edx, ebp
xor esi, eax
mov dword [esp + 0x3c], edx
xor esi, dword [esp + 0x30]
xor edx, edx
mov eax, dword [esp + 0x20]
shld ecx, eax, 1
mov dword [esp + 0x38], esi
mov esi, dword [esp + 0x24]
xor edx, ecx
mov ecx, dword [esp + 0x2c]
add eax, eax
xor edx, edi
shr esi, 0x1f
xor esi, eax
mov dword [esp + 0x44], edx
mov eax, dword [esp + 0x28]
xor edx, edx
shld ecx, eax, 1
xor esi, ebx
xor edx, ecx
mov dword [esp + 0x40], esi
xor edx, dword [esp + 0x1c]
add eax, eax
mov esi, dword [esp + 0x2c]
mov ecx, ebp
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x30]
shld ebp, edx, 1
shr ecx, 0x1f
add edx, edx
shr esi, 0x1f
xor ecx, edx
xor esi, eax
xor ecx, dword [esp + 0x20]
xor eax, eax
xor esi, dword [esp + 0x18]
xor eax, ebp
xor eax, dword [esp + 0x24]
mov edx, dword [esp + 0x64]
mov dword [esp + 0x50], ecx
add edx, 0x50
mov ecx, edi
mov dword [esp + 0x54], eax
shld edi, ebx, 1
shr ecx, 0x1f
xor eax, eax
add ebx, ebx
mov dword [esp + 0x48], esi
xor ecx, ebx
xor eax, edi
xor ecx, dword [esp + 0x28]
xor eax, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], eax
mov eax, dword [esp + ebx*8 + 0x38]
mov ecx, dword [esp + ebx*8 + 0x3c]
xor dword [edx - 0x50], eax
xor dword [edx - 0x4c], ecx
xor dword [edx - 0x28], eax
xor dword [edx - 0x24], ecx
xor dword [edx], eax
lea edx, [edx + 8]
xor dword [edx - 4], ecx
xor dword [edx + 0x20], eax
xor dword [edx + 0x24], ecx
xor dword [edx + 0x48], eax
xor dword [edx + 0x4c], ecx
inc ebx
cmp ebx, 5
jb 0x44a274
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x44a43f
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
add ebp, 0x10
mov dword [esp + 0x10], 5
mov edx, dword [ebp - 8]
mov ecx, edx
mov esi, dword [ebp - 4]
not ecx
and ecx, dword [ebp]
mov eax, esi
mov edi, dword [ebp - 0x10]
not eax
and eax, dword [ebp + 4]
xor ecx, edi
mov ebx, dword [ebp - 0xc]
xor eax, ebx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp]
mov dword [ebp - 0xc], eax
not ecx
and ecx, dword [ebp + 8]
mov eax, dword [ebp + 4]
xor ecx, edx
not eax
mov dword [ebp - 8], ecx
and eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, esi
mov dword [ebp - 4], eax
not ecx
mov eax, dword [ebp + 0xc]
and ecx, dword [ebp + 0x10]
not eax
and eax, dword [ebp + 0x14]
xor dword [ebp], ecx
lea ebp, [ebp + 0x28]
xor dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
not ecx
and ecx, edi
not eax
xor dword [ebp - 0x20], ecx
and eax, ebx
xor dword [ebp - 0x1c], eax
not edi
not ebx
and edi, edx
xor dword [ebp - 0x18], edi
and ebx, esi
xor dword [ebp - 0x14], ebx
sub dword [esp + 0x10], 1
jne 0x44a453
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x44ba77
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x5c], eax
ret
Function at 0x44c7e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x30]
mov ecx, 0x10
cdq
idiv ecx
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
mov esi, dword [esp + 0x34]
mov ebp, edx
mov dword [esp + 0x34], ebp
push edi
mov edi, eax
test ebp, ebp
je 0x44c814
test edi, edi
jne 0x44c813
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
dec edi
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x44]
lea eax, [ecx + 8]
mov dword [esp + 0x3c], eax
test edi, edi
je 0x44c880
mov ebp, ecx
lea esp, [esp]
mov eax, dword [esi]
xor eax, dword [edx]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 4]
xor eax, dword [esi + 4]
mov dword [esp + 0x14], eax
mov eax, dword [edx + 8]
xor eax, dword [esi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0xc]
xor eax, dword [esi + 0xc]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push ebx
push eax
push dword [ebp + 4]
lea eax, [ebp + 8]
push eax
call fcn.0044c130
mov edx, ebx
add esp, 0x10
add esi, 0x10
add ebx, 0x10
sub edi, 1
jne 0x44c830
mov ebp, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
test ebp, ebp
je 0x44c924
mov eax, dword [esi]
xor eax, dword [edx]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 4]
xor eax, dword [esi + 4]
mov dword [esp + 0x14], eax
mov eax, dword [edx + 8]
xor eax, dword [esi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0xc]
xor eax, dword [esi + 0xc]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push eax
push dword [ecx + 4]
lea eax, [ecx + 8]
push eax
call fcn.0044c130
add esp, 0x10
test ebp, ebp
je 0x44c8ec
lea edx, [esp + 0x20]
sub esi, ebx
lea edi, [ebx + 0x10]
mov cl, byte [edx]
lea edx, [edx + 1]
mov al, byte [esi + edi]
lea edi, [edi + 1]
xor al, cl
mov byte [edi - 1], cl
mov byte [edx - 1], al
sub ebp, 1
jne 0x44c8d4
lea eax, [esp + 0x20]
push eax
push eax
mov eax, dword [esp + 0x3c]
push dword [eax + 4]
push dword [esp + 0x48]
call fcn.0044c130
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x30]
mov dword [ebx], eax
add esp, 0x10
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [edx]
pop edi
pop esi
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
pop ebp
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x34]
pop ebx
add esp, 0x20
ret
Function at 0x44c9c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x94
test dword [esp + 0xa0], 0x10000
je 0x44cb52
push ebx
mov ebx, dword [esp + 0x9c]
test ebx, ebx
je 0x44cb51
mov eax, dword [ebx]
cdq
push ebp
mov ebp, dword [ebx + 4]
and edx, 7
push esi
add eax, edx
push edi
mov edi, dword [esp + 0xb4]
sar eax, 3
mov dword [esp + 0x10], eax
test edi, edi
jne 0x44ca0c
mov edi, 0x51bdc0
mov eax, dword [esp + 0xb8]
cmp eax, 0x18
jne 0x44ca30
push edi
call fcn.00419690
mov edi, eax
mov esi, edi
lea eax, [esi + 1]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x44ca25
sub esi, eax
jmp 0x44ca69
cmp eax, 0x19
jne 0x44ca53
mov esi, edi
lea ecx, [esi + 2]
lea ebx, [ebx]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x44ca40
sub esi, ecx
sar esi, 1
add esi, esi
jmp 0x44ca69
push edi
call fcn.00419820
mov edi, eax
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x44ca60
sub esi, ecx
push esi
push edi
cmp esi, ebp
jle 0x44cabc
mov esi, dword [esp + 0xb4]
push ebx
mov eax, dword [esi + 0xc]
call eax
mov eax, dword [esi + 0x10]
push ebx
call eax
mov esi, dword [esp + 0x10]
lea eax, [ebx + 8]
push esi
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004174c0
mov eax, ebp
sub eax, esi
push eax
lea eax, [esp + 0x24]
add eax, esi
push 0
push eax
call fcn.004016e0
mov eax, dword [esp + 0xc4]
add esp, 0x18
mov eax, dword [eax + 8]
push 1
push ebx
call eax
jmp 0x44cadc
lea eax, [esp + 0x1c]
push eax
call fcn.004174c0
mov eax, ebp
sub eax, esi
push eax
lea eax, [esp + 0x24]
add eax, esi
push 0
push eax
call fcn.004016e0
add esp, 0x18
push ebp
lea eax, [esp + 0x18]
push eax
lea esi, [ebx + 0x48]
push esi
call fcn.004174c0
add esp, 0xc
test ebp, ebp
jle 0x44cb11
lea eax, [esp + 0x14]
mov ecx, ebp
jmp 0x44cb00
xor byte [eax], 0x36
lea eax, [eax + 1]
xor byte [esi], 0x5c
lea esi, [esi + 1]
sub ecx, 1
jne 0x44cb00
push ebp
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0xb4]
push ebx
mov eax, dword [eax + 0xc]
call eax
mov eax, dword [esp + 0xb8]
cmp eax, 0x18
jne 0x44cb43
push edi
call fcn.00419720
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret 0x14
cmp eax, 0x19
je 0x44cb4e
push edi
call fcn.00419720
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret 0x14

Function at 0x44e780
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x637328]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
add eax, dword [esp + 4]
ret 4
Function at 0x44e8b0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x63c5ac], 0
push ebx
push esi
mov esi, 0x63c5b4
jne 0x44e8dc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x63c5cc], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x63c5ac], 1
push dword [0x63c5cc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x44e979
push 0x14
push 8
push dword [0x639a98]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x44e9a3
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x63c5b0]
test eax, eax
je 0x44e91e
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x63c5b0], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x44ea26
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x63c5cc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x639a98]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x44e9a3
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x44ea90
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x637328]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
mov dword [eax + 8], ecx
mov eax, dword [eax]
add eax, ecx
ret 4

Function at 0x44fcd9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4f7228
push 0x4f7220
push str.FlsAlloc
push 0x1f
call fcn.0045036d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44fd0d
push dword [ebp + 8]
mov ecx, esi
call dword [0x51e01c]
call esi
jmp 0x44fd13
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x44fd57
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4f7238
push 0x4f7230
push str.FlsGetValue
push 0x21
call fcn.0045036d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44fd8e
push dword [ebp + 8]
mov ecx, esi
call dword [0x51e01c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x44fd96
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4f7240
push 0x4f7238
push str.FlsSetValue
push 0x22
call fcn.0045036d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44fdd0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x51e01c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x460280
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [eax + 0x38]
mov bl, byte [eax + 0x34]
test esi, esi
jle 0x4602bd
mov edx, dword [eax + 0x260]
push edi
movzx edi, bl
nop word [eax + eax]
mov ecx, edx
shl edx, 8
shr ecx, 0x18
xor ecx, edi
xor edx, dword [ecx*4 + 0x639410]
mov dword [eax + 0x260], edx
sub esi, 1
jne 0x4602a0
pop edi
mov ecx, dword [eax + 0x34]
mov byte [ecx + eax + 0x58], 1
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, 1
je 0x46036c
sub ecx, 1
je 0x460350
sub ecx, 1
je 0x460328
mov byte [edx + eax + 0x54], 1
mov edx, dword [eax + 0x24]
mov ecx, dword [eax + 0x44]
mov byte [edx + ecx], bl
mov edx, dword [eax + 0x44]
inc edx
mov dword [eax + 0x44], edx
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov esi, dword [eax + 0x44]
mov dl, byte [eax + 0x38]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
inc dword [eax + 0x44]
pop esi
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
inc edx
mov dword [eax + 0x44], edx
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
inc edx
mov dword [eax + 0x44], edx
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret