joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442b47
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x44bb79
call fcn.00431c5c
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x58]
mov ebx, dword [esi + 0x5c]
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
call fcn.00448793
cmp dword [esi + 0x54], 0
mov edi, dword [eax + 0xc]
je 0x442b95
call fcn.00448793
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x54]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x442ba6
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x442bb2
or eax, 0xffffffff
jmp 0x442cb5
mov ecx, esi
call fcn.00442689
mov dword [ebp - 0x14], eax
call fcn.00440569
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x14], 0
je 0x442bf5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x442bf5
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x442bf5
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
and dword [ebp - 4], 0
push esi
call fcn.004417bd
push dword [ebp - 0x14]
call fcn.004404c1
push edi
push eax
push ebx
mov ecx, esi
call fcn.0044293a
xor ebx, ebx
cmp eax, ebx
je 0x442c69
test byte [esi + 0x38], 0x10
je 0x442c37
push 4
pop edi
mov ecx, esi
call fcn.00442e4c
test ah, 1
je 0x442c2f
push 5
pop edi
push edi
mov ecx, esi
call fcn.0043ff65
cmp dword [esi + 0x1c], ebx
je 0x442c69
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call fcn.004430b2
jmp 0x442c69
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], ebx
je 0x442c7d
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], ebx
je 0x442c96
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x442c96
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.004426c3
cmp dword [esi + 0x54], ebx
je 0x442cb2
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x40]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x44355d
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x44bbc5
call fcn.00431c5c
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x443577
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4435c3
call fcn.00443920
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004019d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x443f43
Capabilities:
Get disk information

Disassembly:
mov eax, 0x44bd37
call fcn.00431c5c
sub esp, 0x154
mov eax, dword [0x45f540]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor eax, ebp
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x158]
push eax
push edi
mov esi, 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x443f8a
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x443f8e
cmp eax, esi
jb 0x443f95
xor eax, eax
jmp 0x444079
call fcn.00443920
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x154], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x154]
push eax
push edi
call fcn.00443f01
push dword [ebp - 0x154]
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
test eax, eax
jne 0x444066
push eax
push eax
lea ecx, [ebp - 0x15c]
push ecx
lea ecx, [ebp - 0x160]
push ecx
push eax
push eax
push eax
push dword [ebp - 0x154]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x443ff6
xor esi, esi
jmp 0x444069
test byte [ebp - 0x15c], 2
jne 0x444006
push edi
call dword [sym.imp.USER32.dll_CharUpperA]
test byte [ebp - 0x15c], 4
jne 0x444066
lea eax, [ebp - 0x150]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x444066
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x158], 0
je 0x443ff2
cmp dword [ebp - 0x158], edi
jbe 0x443ff2
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, edi
add eax, dword [ebp - 0x158]
cmp eax, esi
jge 0x443ff2
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x158]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x154]
add ecx, 0xfffffff0
call fcn.004019d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043065d
leave
ret 8
Function at 0x444c82
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x128
xor ebx, ebx
push ebx
push esi
mov edi, ecx
call fcn.00432080
add esp, 0xc
push 0x104
push dword [edi + 0xc]
lea eax, [esi + 0x22]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [edi + 4]
cmp eax, dword [0x4506e4]
je 0x444dd0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x444cf2
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
jne 0x444cf9
cmp ebx, ebx
jne 0x444cf9
xor eax, eax
jmp 0x444dd3
mov edi, dword [edi + 0xc]
cmp dword [edi - 0xc], ebx
jne 0x444d06
mov byte [esi + 0x20], bl
jmp 0x444d1a
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
sete cl
dec cl
and ecx, eax
mov byte [esi + 0x20], cl
lea eax, [ebp - 8]
push eax
call fcn.0042fe6a
test eax, eax
je 0x444d41
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.0042ff51
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
jmp 0x444d46
mov dword [esi], ebx
mov dword [esi + 4], ebx
lea eax, [ebp - 0x10]
push eax
call fcn.0042fe6a
test eax, eax
je 0x444d6e
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.0042ff51
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x14], eax
jmp 0x444d78
xor eax, eax
xor ecx, ecx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
lea eax, [ebp - 0x18]
push eax
call fcn.0042fe6a
test eax, eax
je 0x444da0
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.0042ff51
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0xc], eax
jmp 0x444daa
xor eax, eax
xor ecx, ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov eax, dword [esi]
or eax, dword [esi + 4]
jne 0x444dbc
mov eax, dword [esi + 8]
mov dword [esi], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x444dd0
mov eax, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4459ef
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x45f540]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor eax, ebp
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov eax, 0x100
cmp ebx, eax
ja 0x445a42
push eax
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, ebx
jne 0x445a42
push edi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x445a4a
push edi
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043065d
leave
ret 8

Function at 0x446665
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x45f540]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor eax, ebp
mov esi, ecx
cmp dword [esi + 0x50], 0
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
je 0x4466b6
push edi
call fcn.004483ee
mov esi, eax
test esi, esi
je 0x4466da
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
jmp 0x4466da
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0x44db00
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043065d
leave
ret 0xc

Function at 0x446fe2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x45f540]
xor eax, ebp
cmp dword [ebp + 8], 0x800
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [ebp - 0x11c]
jne 0x447015
push 0x44ef04
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x447027
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x44705c
lea eax, [ebp - 0x11c]
push eax
push esi
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.0043139c
add esp, 0x10
cmp eax, 0xffffffff
je 0x44705c
cmp eax, esi
jae 0x44705c
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x44705e
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043065d
leave
ret
Function at 0x447081
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x45f540]
push ebx
push esi
xor eax, ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x44712b
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x38], eax
call esi
mov dword [ebp - 0x34], eax
push 4
xor ebx, ebx
jmp 0x44722d
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x4471db
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocStringLen
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44722e
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4471d0
cmp dword [ebp - 0x24], 1
jne 0x4471d0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x44ef14
push eax
call fcn.00431c27
add esp, 0xc
cmp eax, 1
jne 0x4471d0
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x40], eax
call esi
push 2
mov dword [ebp - 0x3c], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44722e
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x44722e
lea ecx, [ebp - 0x18]
push ecx
push 0x44706b
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x44722e
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x40], eax
call esi
mov dword [ebp - 0x3c], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x40], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x447253
push dword [ebp + edi*4 - 0x40]
mov ecx, dword [ebp - 0x2c]
call fcn.00446fe2
cmp eax, ebx
pop ecx
jne 0x447255
inc edi
cmp edi, esi
jl 0x44723d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043065d
leave
ret 4
Function at 0x447266
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x45e594
je 0x447322
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44730a
mov esi, dword [ebx + 4]
jmp 0x447304
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4472f4
cmp dword [ebp - 0xc], 4
jne 0x4472f4
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x4472ec
or dword [eax + 0x9c], ecx
jmp 0x4472f4
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x4472b8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x44729b
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x447716
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x44b9fe
call fcn.00431c5c
sub esp, 0x124
mov eax, dword [0x45f540]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, ebp
mov dword [ebp - 0x10], esp
lea edx, [ebp - 0x124]
mov dword [ebp - 0x14], eax
mov eax, dword [edi]
push edx
push eax
push ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x447824
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x4477f8
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.004021b0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.00447716
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004019d0
test bl, bl
jne 0x4477f8
or dword [ebp - 4], 0xffffffff
jmp 0x447763
cmp esi, 0x103
je 0x447808
cmp esi, 0x3f2
jne 0x447818
push dword [edi]
push dword [ebp - 0x12c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043065d
leave
ret 8
Function at 0x448a63
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x448a98
cmp edi, dword [esi + 0xc]
jge 0x448a98
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x448a98
cmp edi, dword [eax + 8]
jge 0x448a98
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x448a9a
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x448b9e
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x448bd2
jmp fcn.0043da20
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x448c43
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x448d3c
cmp eax, dword [edi + 0xc]
jge 0x448d3c
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x448c94
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x448d25
cmp dword [ebp + 0xc], ebx
je 0x448d25
jmp 0x448cbe
push 0x10
call fcn.0044892f
cmp eax, ebx
je 0x448caa
mov ecx, eax
call fcn.00448b95
mov esi, eax
jmp 0x448cac
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x448cd5
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x448ce5
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x448cf7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0043da20
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.00432080
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x448d37
cmp ecx, dword [esi + 8]
jge 0x448d37
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x448d3d
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x448dfb
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x448e29
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x448e47
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00448d65
jmp 0x448e47
mov eax, dword [esi + 0x14]
test eax, eax
je 0x448e47
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00448d65
test edi, edi
mov eax, edi
jne 0x448e31
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x5736ec]
test ecx, ecx
je 0x448efa
jmp 0x448dfa
ret 8
Function at 0x427456
Capabilities:
Encode data using xor

Disassembly:
jne 0x4274c7
xchg dword [0x2efa9959], ebp
sub al, byte [edx]
test byte [ecx + 0x62], 0x1d
pushfd
pop ebp
and dl, byte [esi + 0x2f]
dec eax
arpl word [esi], si
sub ebp, esi
aas
inc edx
outsb dx, byte es:[esi]
lahf
stc
ret 0xef0
dec eax
mov eax, 0x185205da
or edi, dword [ebx - 0x7cb5025d]
invalid

Function at 0x42dece
Capabilities:
Encode data using xor

Disassembly:
popfd
shl byte [ebp - 0x7ad25c2e], 1
adc dword [0x78ed2f3a], esi
pop edi
push esp
xchg ebp, eax
cli
mov edx, dword [ebx - 0x191163a9]
sbb dword [ebp - 0x129145be], eax
sub byte [eax - 0x22], dh
mov cl, 0xf0
inc ebp
invalid

Function at 0x454432
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x3c66ddf
mov al, 0xcf
adc eax, 0xcce330b6
inc edi
salc
xor ch, ah
xchg byte [ebp + 0x42], ch
insd dword es:[edi], dx
inc edx
mov dl, bl
pop ds
cmp ebp, dword [esi - 0x70]
xor dword [ebx], edx
xor dword [esi - 0x1d228178], eax
mov cl, 0x9e
push 0xffffffffffffffa6
mov eax, 0xa49e65ff
mov dword [edx - 0x166cdc6e], esi
push 0x8b5f6b31
ja 0x454443
fidiv dword [ebp + 0x3caa979f]
jp 0x454472
mov dh, 0xdb
dec eax
daa
fisttp dword [eax + 0x27]
inc esi
js 0x454442
mov ebp, 0xab38a53e
jl 0x4544fa
fxtract
stosb byte es:[edi], al
test al, 0x39
xor ebx, eax
dec cl
dec edi
retf 0x313b
inc ecx
lea edi, [ecx - 0x1ea2a48b]
mov fs, word [edi - 0x17802a33]
scasd eax, dword es:[edi]
pop ss
pop edx
clc
add eax, 0xc1ab1e7
push edx
sub edi, dword [esi - 0x26]
mov esp, 0x65b8c27
arpl word [eax + 0x24eb99f6], bp
nop
adc al, 0x11
movsd dword es:[edi], dword [esi]
invalid

Function at 0x483780
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffb0
iretd
imul esi, dword [ebx], 0xa223271a
fist dword [ebx]
or dword [edx], 0xab31812
xor ebx, dword [edx]
daa
and esp, dword [edx + 0xa8113db]
adc bl, byte [eax]
mov bl, 0xa
insd dword es:[edi], dx
sbb ecx, dword [ebp - 0xf]
mov eax, 0x39ffcdf3
cmp al, 0xba
jns 0x48373b
mov ch, 0xc1
out 0xed, eax
sub eax, 0xad0c15f2
sub ch, al
jo 0x4836ff
or eax, 0xd018163e
rcr edx, 1
loop 0x4837e9
shl eax, cl
fiadd word [edi - 0x33bb6d63]
and ch, dh
dec ebp
salc
dec ebx
mov bl, 0x8a
xor esp, dword [eax + 0x35]
out 0xf, eax
in eax, dx
xor eax, 0x734963ed
mov esi, dword [ebx - 0x13]
adc ecx, ebp
jp 0x48373a
lodsd eax, dword [esi]
dec ebp
mov al, byte [0x5931a65b]
xchg ecx, eax
aad 0xed
out 0x97, eax
push esp
add esi, edi
mov esi, eax
test al, 0x12
cmp bh, byte [eax + 0x371eae1e]
invalid
push cs
sub dword [edx], edx
pop edi
sub dword [eax], 0xe5b2bfa6
pop edi
sub eax, 0xd6705dc7
pop edi
salc
loope 0x48384b
push ss
mov dh, 0xf4
js 0x48380a
jnp 0x48378c
stc
mov dh, 0x8b
inc ecx
add al, 0x12
dec esp
jp 0x48380a
retf 0xed2e
loopne 0x48388d
adc al, 0x19
leave
js 0x4838a0
xchg edx, eax
jns 0x48389d
invalid
jno 0x483837
xchg edx, eax
add al, 0xf5
inc edi
hlt
jmp 0xd2089727
push 0x42d35e9d
mov esp, 0xae305f43
inc esp
dec ebx
mov eax, 0x70f1ba8d
call 0x45b065f2
out 0x6b, al
jo 0x483887
dec edi
sub eax, 0x6be64568
sbb byte [edx - 0x3b], dh
bound ebx, qword [esi - 0x3e]
invalid