joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412130
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x420b50], 0
jne 0x41213e
call fcn.004120d0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x420b54]
call esi
test eax, eax
jne 0x412161
call fcn.004120d0
push dword [0x420b54]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x412170
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x4121d0
mov ebx, 0x10
test edi, edi
jns 0x4121d9
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x4121a2
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4121f0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x420b50], 0
jne 0x4121fe
call fcn.004120d0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x420b54]
call esi
mov edx, eax
test edx, edx
jne 0x412225
call fcn.004120d0
push dword [0x420b54]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x412258
mov ebx, 0x10
test esi, esi
jns 0x412261
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x412270
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x412e23
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x412f6b
xor ecx, ecx
cmp word [eax], cx
je 0x412f6b
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x412e7c
cmp eax, 3
jne 0x412eb6
cmp word [esp + 0xa], 0x3a
jne 0x412eb6
cmp eax, 2
jne 0x412e9a
lea eax, [esp + 8]
push 0x41d058
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x412f6b
push 0xfffffffffffffffe
pop edi
jmp 0x412f6b
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x412ecb
cmp ax, bx
jne 0x412ed5
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x412ebe
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x412f14
test byte [esp + 0x21c], 0x10
je 0x412efb
push 0xfffffffffffffffe
pop edi
jmp 0x412f0b
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x412f69
cmp word [esp + 0x10], bp
jne 0x412f22
cmp word [esp + 0x12], bp
je 0x412f41
cmp word [esp + 0x10], bx
jne 0x412f30
cmp word [esp + 0x12], bx
je 0x412f41
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x412f69
cmp word [esp + 0x12], ax
jne 0x412f69
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x412f56
test al, 0x10
je 0x412f69
jmp 0x412f66
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x412f69
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x412f7a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x412ff2
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x412fd3
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x412fd0
cmp ecx, 0x5c
je 0x412fd0
cmp ecx, 0x2f
jne 0x412fdd
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x412fbd
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x412ff4
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x413240
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x41327c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x413780
Capabilities:
Read file on windows

Disassembly:
push ecx
push dword [esp + 8]
mov dword [esp + 4], 0
push dword [0x42136c]
call fcn.00419a99
test eax, eax
je 0x4137cc
cmp dword [eax + 4], 0
je 0x4137b6
push 4
lea ecx, [esp + 4]
push ecx
push eax
call fcn.00413b60
mov eax, dword [esp]
pop ecx
ret 4
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
lea ecx, [esp + 0xc]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret 4

Function at 0x413b60
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x413b81
push esi
call fcn.00413240
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x413bf5
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x413be2
dec ecx
je 0x413bcd
sub ecx, 2
je 0x413bba
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x413c3a
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x413c5b
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x413c80
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x4207c0]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x413e04
mov cl, byte [esp + 3]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov esi, edx
mov edi, edi
cmp ebp, 0xffffffff
je 0x413cce
test ebp, ebp
je 0x413d70
dec ebp
cmp dword [ebx + 4], 0
je 0x413ce7
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.00413b60
mov dword [esp + 0x14], eax
jmp 0x413d01
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x13]
cmp eax, 1
jne 0x413d70
test cl, cl
je 0x413d15
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x13]
mov eax, dword [esp + 0x18]
mov edi, esi
mov edx, dword [esp + 0x20]
dec eax
sub edi, edx
cmp edi, eax
jle 0x413d50
mov eax, dword [esp + 0x18]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x4207c0]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x20], edx
lea esi, [edi + edx]
test cl, cl
je 0x413d70
cmp dword [esp + 0x2c], 0
jne 0x413cc0
cmp cl, 0xd
je 0x413d77
cmp cl, 0xa
jne 0x413cc0
dec esi
jmp 0x413de7
cmp dword [esp + 0x2c], 0
jne 0x413de7
cmp cl, 0xa
jne 0x413d7f
dec esi
jmp 0x413de7
cmp cl, 0xd
jne 0x413de7
dec esi
cmp dword [ebx + 4], 0
je 0x413d9e
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.00413b60
mov dword [esp + 0x14], eax
jmp 0x413db4
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x413de7
cmp dword [ebx + 4], 0
je 0x413dc6
inc dword [ebx + 0xc]
jmp 0x413de7
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x20]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x413e10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push 0x1000
push 0
push dword [0x4207c0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 8], ecx
test ecx, ecx
je 0x413fbd
mov ax, word [esp]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x1c], 0x7ff
cmp ebp, 0xffffffff
je 0x413e64
test ebp, ebp
je 0x413f1d
dec ebp
cmp dword [ebx + 4], 0
je 0x413e7d
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00413b60
mov dword [esp + 0x14], eax
jmp 0x413e97
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp eax, 2
mov ax, word [esp + 0x10]
jne 0x413f1d
test ax, ax
je 0x413eb1
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, edi
mov edx, dword [esp + 0x1c]
sub esi, ecx
sar esi, 1
cmp esi, edx
jle 0x413ef8
mov eax, dword [esp + 0x20]
add edx, 0x800
add eax, 0x1000
mov dword [esp + 0x1c], edx
push eax
push ecx
push 8
push dword [0x4207c0]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
mov ax, word [esp + 0x10]
mov dword [esp + 0x18], ecx
lea edi, [ecx + esi*2]
test ax, ax
je 0x413f1d
cmp dword [esp + 0x30], 0
jne 0x413e56
cmp ax, 0xd
je 0x413f24
cmp ax, 0xa
jne 0x413e56
sub edi, 2
jmp 0x413f9c
cmp dword [esp + 0x30], 0
jne 0x413f9c
cmp ax, 0xa
jne 0x413f2f
sub edi, 2
jmp 0x413f9c
cmp ax, 0xd
jne 0x413f9c
sub edi, 2
cmp dword [ebx + 4], 0
je 0x413f51
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00413b60
mov dword [esp + 0x14], eax
jmp 0x413f67
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x10], 0xa
je 0x413f9c
cmp dword [ebx + 4], 0
je 0x413f7b
add dword [ebx + 0xc], 2
jmp 0x413f9c
push 1
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x38]
mov ecx, edi
sub ecx, dword [esp + 0x18]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
xor eax, eax
add esp, 0x18
ret 0x10
Function at 0x413fd0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x4207c0]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x414120
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x41401c
test edi, edi
je 0x41408d
dec edi
push esi
push ebp
call fcn.00414240
mov dword [esp + 0x20], eax
test eax, eax
jne 0x41402f
xor cl, cl
jmp 0x414031
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x414074
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x4207c0]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x41408d
test eax, eax
jne 0x414012
cmp cl, 0xd
je 0x414091
cmp cl, 0xa
jne 0x414012
dec esi
jmp 0x414103
test eax, eax
jne 0x414103
cmp cl, 0xa
jne 0x414099
dec esi
jmp 0x414103
cmp cl, 0xd
jne 0x414103
dec esi
cmp dword [ebp + 4], 0
je 0x4140b8
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.00413b60
mov dword [esp + 0x20], eax
jmp 0x4140cf
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x414103
cmp dword [ebp + 4], 0
je 0x4140e1
inc dword [ebp + 0xc]
jmp 0x414103
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x414240
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x414267
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00413b60
mov dword [esp + 4], eax
jmp 0x414281
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
je 0x41428d
xor eax, eax
pop edi
pop ecx
ret 8
mov cl, byte [esp + 0xc]
test cl, cl
js 0x4142a9
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x4142b9
mov esi, 2
jmp 0x4142d5
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x4142c8
mov esi, 3
jmp 0x4142d5
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x414332
mov esi, 4
mov edx, dword [esp + 0x14]
mov byte [edx], cl
cmp dword [edi + 4], 0
je 0x414304
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push edi
call fcn.00413b60
mov edx, eax
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 8]
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8

Function at 0x4144d6
Capabilities:
Hash data using sha384

Disassembly:
mov eax, dword [esp + 4]
push 0x40
push 0x41d320
and dword [eax + 0x80], 0
and dword [eax + 0x84], 0
mov dword [eax + 0xc8], 0x30
add eax, 0x88
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
ret

Function at 0x4145dc
Capabilities:
Hash data using sha512

Disassembly:
mov eax, dword [esp + 4]
push 0x40
pop ecx
push ecx
and dword [eax + 0x80], 0
and dword [eax + 0x84], 0
mov dword [eax + 0xc8], ecx
add eax, 0x88
push 0x41d2e0
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
ret
Function at 0x417c98
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
push 0x20
pop ecx
push ecx
and dword [eax + 0x40], 0
and dword [eax + 0x44], 0
mov dword [eax + 0x68], ecx
add eax, 0x48
push 0x41d460
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
ret
Function at 0x4194d8
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
mov eax, ebx
push ebp
or eax, edx
push esi
mov esi, dword [esp + 0x18]
or eax, esi
push edi
mov edi, dword [esp + 0x20]
or eax, edi
test al, 3
jne 0x41953f
lea ecx, [esi + edi]
mov eax, ecx
lea edi, [ebx + edx]
sub eax, esi
xor ebx, ebx
add eax, 3
shr eax, 2
cmp ecx, esi
sbb ebp, ebp
not ebp
and ebp, eax
jbe 0x419557
sub edi, esi
mov ecx, dword [esi]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
shl ecx, 8
and edx, 0xff00ff
xor edx, ecx
rol edx, 0x10
inc ebx
mov dword [edi + esi], edx
lea esi, [esi + 4]
cmp ebx, ebp
jb 0x419516
jmp 0x419557
add edi, edx
cmp edx, edi
jae 0x419557
sub esi, edx
mov al, byte [esi + edx]
mov ecx, edx
xor ecx, 3
inc edx
mov byte [ecx + ebx], al
cmp edx, edi
jb 0x419547
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x41955c
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
mov eax, ebx
push ebp
or eax, edx
push esi
mov esi, dword [esp + 0x18]
or eax, esi
push edi
mov edi, dword [esp + 0x20]
or eax, edi
test al, 7
jne 0x4195b7
lea ecx, [esi + edi]
mov eax, ecx
lea edi, [ebx + edx]
sub eax, esi
xor ebx, ebx
add eax, 7
shr eax, 3
cmp ecx, esi
sbb ebp, ebp
not ebp
and ebp, eax
jbe 0x4195cf
sub edi, esi
push dword [esi + 4]
push dword [esi]
call fcn.00419498
inc ebx
mov dword [edi + esi], eax
mov dword [edi + esi + 4], edx
lea esi, [esi + 8]
pop ecx
pop ecx
cmp ebx, ebp
jb 0x41959a
jmp 0x4195cf
add edi, edx
cmp edx, edi
jae 0x4195cf
sub esi, edx
mov al, byte [esi + edx]
mov ecx, edx
xor ecx, 7
inc edx
mov byte [ecx + ebx], al
cmp edx, edi
jb 0x4195bf
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x419928
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x421070]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x419989
push esi
push dword [0x42106c]
push 8
push dword [0x4207c0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x421070]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x421068]
jmp 0x419979
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x419977
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x419967
push edi
push 0x4198c6
call fcn.0041b989
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4
Function at 0x419993
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ecx, esi
push edi
and ecx, 3
je 0x4199a9
push 4
pop eax
sub eax, ecx
add esi, eax
mov eax, dword [0x42106c]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x4199e0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
push 8
push dword [0x4207c0]
mov dword [0x421070], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x421070]
call ebx
mov eax, dword [0x42106c]
mov edi, eax
add eax, esi
push eax
push dword [0x421070]
mov dword [0x42106c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x4207c0]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x421070]
call ebx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test esi, esi
jne 0x419a20
test ebx, ebx
je 0x419a41
push 0x14
push 0x421068
call fcn.0041a1b8
pop ecx
pop ecx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
test esi, esi
je 0x419a41
lea ecx, [edi + ebp]
push ecx
call esi
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x41ab50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x41fe24]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 2
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret

Function at 0x41ac80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x41fe24]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
sub edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x41acc6
mov ecx, dword [ebp - 4]
add ecx, 0xa
push ecx
push 0
mov edx, dword [0x421374]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x41ace7
mov edx, dword [ebp - 4]
add edx, 0xa
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x421374]
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
shr edx, 1
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.0041b060
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov esp, ebp
pop ebp
ret 8

Function at 0x41ad40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x41fe24]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ebp - 4]
add eax, dword [edx + 8]
mov esp, ebp
pop ebp
ret