joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3a60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov eax, dword [0x5ec348]
mov dword [esp + 0x2c], eax
mov eax, dword [ebx]
test edi, edi
je 0x4a3ba0
cmp eax, 1
je 0x4a3ac5
mov eax, ebx
call fcn.004a2a70
mov esi, eax
lea eax, [eax + 4]
mov dword [esp], eax
mov dword [esp + 0x1c], eax
call fcn.004a2300
mov ebp, dword [ebx]
test ebp, ebp
je 0x4a3ae0
cmp ebp, 1
jne 0x4a3b70
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.004a2630
test esi, esi
je 0x4a3ac5
mov eax, esi
call fcn.004a2d10
xor eax, eax
mov edx, dword [esp + 0x2c]
sub edx, dword [0x5ec348]
jne 0x4a3bea
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x20], 0x4a2dd0
mov dword [esp + 0x24], esi
call fcn.004a3080
mov eax, dword [0x55efc4]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x4a3bd8
mov eax, dword [eax + 0xc]
mov dword [esp + 0x28], eax
lock or dword [esp], 0
call fcn.004a3080
mov eax, dword [0x55efc4]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x4a3bc0
lea ecx, [esp + 0x20]
mov dword [eax + 0xc], ecx
lock or dword [esp], 0
call edi
call fcn.004a3080
mov eax, dword [0x55efc4]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x4a3bb0
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x4a3aae
mov dword [esp], 2
call dword [0x55efb0]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x4a3aae
mov eax, 0x16
jmp 0x4a3ac7
call fcn.004a3140
test eax, eax
jne 0x4a3b56
jmp 0x55686f
call fcn.004a3140
test eax, eax
jne 0x4a3b32
jmp 0x556864
call fcn.004a3140
test eax, eax
jne 0x4a3b0c
jmp 0x55685d
call fcn.00497000
nop
mov eax, dword [pe_dos_header]
ud2
lea eax, [esp + 0x20]
mov dword [0], eax
ud2
mov eax, dword [esp + 0x28]
mov dword [0], eax
ud2

Function at 0x4a3e30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004a3080
mov eax, dword [0x55efc4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4a3ea8
lea ebp, [ebx + 0x38]
xor edi, edi
mov dword [esp], ebp
call fcn.004a2980
mov eax, dword [ebx + 0x28]
cmp dword [esp + 0x30], eax
jae 0x4a3e84
mov eax, dword [ebx + 0x30]
mov edx, dword [esp + 0x30]
cmp byte [eax + edx], 0
je 0x4a3e84
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + edx*4]
mov dword [esp], ebp
call fcn.004a29d0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004a3140
mov ebx, eax
jmp 0x4a3e5b
Function at 0x4a3ec0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call fcn.004a3080
mov eax, dword [0x55efc4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4a3fe0
lea edi, [ebx + 0x38]
mov dword [esp], edi
call fcn.004a2980
cmp esi, dword [ebx + 0x28]
jae 0x4a3f40
mov edx, dword [ebx + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call fcn.004a29d0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [esi + 1]
lea eax, [ebp*4]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x4a3fec
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x4a3fec
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call fcn.004a0ad0
mov eax, dword [ebx + 0x28]
mov edx, dword [esp + 0x18]
mov ecx, ebp
mov dword [esp + 4], 0
sub ecx, eax
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call fcn.004a0ad0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
jmp 0x4a3f08
call fcn.004a3140
mov ebx, eax
jmp 0x4a3ef5
mov dword [esp], edi
call fcn.004a29d0
mov eax, 0xc
jmp 0x4a3f30

Function at 0x4a4070
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.004a3080
mov eax, dword [0x55efc4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4a4098
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.004a3140
test eax, eax
jne 0x4a408d
add esp, 0x1c
ret

Function at 0x4a4100
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.004a3080
mov eax, dword [0x55efc4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4a4128
add eax, 0xc
add esp, 0x1c
ret
call fcn.004a3140
test eax, eax
jne 0x4a411d
jmp 0x4a4120
Function at 0x4a4160
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.004a3270
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x4a4182
call fcn.004a32a0
test byte [ebx + 0x20], 0x30
jne 0x4a419c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x55efc4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x4a41dd
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x4a421d
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x4a41d2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x4a41e6
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.004a3060
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x55efc4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x4a41dd
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x4a4231
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x4a41fe

Function at 0x4a4240
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x5ecd68]
test eax, eax
jne 0x4a4250
xor eax, eax
ret
sub esp, 0x1c
call fcn.004a3080
mov eax, dword [0x55efc4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4a4290
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x4a4280
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x4a4274
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x4a4276
call fcn.004a3140
test eax, eax
jne 0x4a426d
jmp 0x4a4274

Function at 0x4a42a0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.004a3080
mov eax, dword [0x55efc4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4a42e0
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x4a42d0
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call fcn.004a3140
test eax, eax
jne 0x4a42bd
add esp, 0x1c
ret
Function at 0x4a43e0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.004a3080
mov eax, dword [0x55efc4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4a4450
test byte [ebx + 0x20], 0xc
jne 0x4a4410
mov eax, dword [0x5ecd68]
test eax, eax
jne 0x4a4420
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.004a2300
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x4a4442
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x4a4442
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x4a4461
mov dword [esp], esi
call fcn.004a2630
add esp, 0x14
pop ebx
pop esi
ret
call fcn.004a3140
mov ebx, eax
test eax, eax
jne 0x4a4401
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4a4481
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.004a2630
call fcn.004a42f0
nop
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4a4510
mov dword [esp], eax
call fcn.004a1f90
mov edi, eax
mov eax, 0xfffffffe
cmp eax, edi
mov eax, 0
sbb eax, edx
jb 0x4a4550
call fcn.004a3080
mov eax, dword [0x55efc4]
mov esi, edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4a45b0
test edi, edi
je 0x4a452a
call fcn.004a43e0
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4a4588
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.004a20b0
call fcn.004a43e0
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.004a3080
mov eax, dword [0x55efc4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4a45a0
call fcn.004a43e0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.004a43e0
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.004a3080
mov eax, dword [0x55efc4]
mov esi, 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
jne 0x4a44e2
call fcn.004a3140
mov ebx, eax
jmp 0x4a44e2
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x4a44fe
call fcn.004a3140
jmp 0x4a452a
call fcn.004a3140
mov ebx, eax
jmp 0x4a44de

Function at 0x4a8070
Capabilities:
Create directory

Disassembly:
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x10
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x4a80a8
call fcn.00534550
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.msvcrt.dll__errno]
mov edi, dword [eax]
cmp edi, 0x11
je 0x4a80d0
call fcn.00534560
mov dword [ebx], edi
mov dword [ebx + 4], eax
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00508260
cmp al, 2
jne 0x4a80b5
xor eax, eax
jmp 0x4a80c1
Function at 0x505200
Capabilities:
Create directory

Disassembly:
push esi
push ebx
sub esp, 0x54
mov eax, dword [0x5ec348]
mov dword [esp + 0x4c], eax
xor eax, eax
lea eax, [esp + 0x10]
mov ebx, dword [esp + 0x64]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wstat64]
test eax, eax
je 0x505260
call fcn.00534560
mov esi, eax
call dword [sym.imp.msvcrt.dll__errno]
mov edx, 0x80000000
mov eax, dword [eax]
mov dword [ebx + 4], esi
mov dword [ebx], eax
xor eax, eax
mov ecx, dword [esp + 0x4c]
sub ecx, dword [0x5ec348]
jne 0x505284
add esp, 0x54
pop ebx
pop esi
ret
call fcn.00534550
mov dword [ebx], 0
mov dword [ebx + 4], eax
mov eax, 0x3b9aca00
imul dword [esp + 0x38]
add eax, 0x40ae0000
adc edx, 0xa6a8d2b3
jmp 0x50524a
call fcn.00497000
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x3c], 0
mov eax, dword [0x5ec348]
mov dword [ebp - 0x1c], eax
xor eax, eax
call fcn.00534550
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x38], eax
mov eax, ebx
call fcn.004a8070
mov edx, dword [ebp - 0x3c]
test edx, edx
jne 0x5531e4
mov edx, dword [ebp - 0x1c]
sub edx, dword [0x5ec348]
jne 0x5052dd
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00497000
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x505330
call fcn.00534550
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.msvcrt.dll__errno]
mov edi, dword [eax]
cmp edi, 0x11
je 0x505350
call fcn.00534560
mov dword [ebx], edi
mov dword [ebx + 4], eax
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00508260
cmp al, 2
jne 0x50533d
xor eax, eax
jmp 0x505349

Function at 0x507fe0
Capabilities:
Delete directory
Delete file

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp], esi
mov dword [esp + 4], ebx
call fcn.00504c80
test al, al
je 0x50803b
cmp al, 0xff
je 0x508048
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00508260
cmp al, 2
je 0x508060
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
test eax, eax
jne 0x508072
mov eax, dword [ebx]
test eax, eax
jne 0x50803b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.00534550
mov dword [ebx], esi
mov dword [ebx + 4], eax
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.00534550
mov dword [ebx], 0
mov dword [ebx + 4], eax
jmp 0x50803b
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
sub esp, 4
test eax, eax
je 0x508011
call fcn.00534550
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret
Function at 0x5080f0
Capabilities:
Move file

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00508260
cmp al, 0xff
je 0x508158
mov ecx, dword [ebx]
test ecx, ecx
jne 0x50814e
test al, al
jne 0x508170
mov dword [esp + 8], 3
mov eax, dword [esi]
mov dword [esp + 4], eax
mov eax, dword [edi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
sub esp, 0xc
test eax, eax
je 0x5081c0
call fcn.00534550
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call fcn.00534550
mov dword [ebx], 0
mov dword [ebx + 4], eax
jmp 0x50811c
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 0x1c], eax
call fcn.00508260
mov edx, dword [ebx]
test edx, edx
jne 0x50814e
mov ecx, dword [esp + 0x1c]
cmp cl, 2
je 0x5081a8
cmp al, 2
jne 0x50811c
call fcn.00534560
mov dword [ebx], 0x14
mov dword [ebx + 4], eax
jmp 0x50814e
cmp al, 2
je 0x50811c
call fcn.00534560
mov dword [ebx], 0x15
mov dword [ebx + 4], eax
jmp 0x50814e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.msvcrt.dll__errno]
cmp eax, 5
je 0x5081f0
call edi
mov dword [eax], 5
call fcn.00534560
mov esi, eax
call edi
mov eax, dword [eax]
mov dword [ebx + 4], esi
mov dword [ebx], eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call edi
mov dword [eax], 0xd
jmp 0x5081d9
Function at 0x514b10
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
mov esi, dword [sym.imp.msvcrt.dll__read]
mov ebp, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov ecx, ebx
call fcn.00514910
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp], eax
call esi
mov edx, eax
cmp eax, 0xffffffff
je 0x514b50
add esp, 0x2c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov dword [esp + 0x1c], eax
call dword [sym.imp.msvcrt.dll__errno]
mov edx, dword [esp + 0x1c]
cmp dword [eax], 4
je 0x514b27
add esp, 0x2c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x528230
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x5ec348]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx + 4]
test eax, eax
je 0x528268
mov edx, dword [ecx]
mov dword [esp], edx
call eax
mov edx, dword [esp + 0x1c]
sub edx, dword [0x5ec348]
jne 0x5282c8
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [sym.imp.msvcrt.dll__read]
mov ebx, 4
lea esi, [esp + 0x18]
lea esi, cs:[esi]
nop
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call edi
test eax, eax
jle 0x5282a0
add esi, eax
sub ebx, eax
jne 0x528280
mov eax, dword [esp + 0x18]
jmp 0x528250
cmp eax, 0xffffffff
jne 0x5282b0
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x528280
mov eax, dword [esp + 0x1c]
sub eax, dword [0x5ec348]
jne 0x5282c8
mov dword [esp], str.random_device_could_not_be_read
call fcn.00552610
call fcn.00497000
nop
nop
nop
mov eax, dword [esp + 4]
mov dword [ecx], fcn.005284f0
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov eax, dword [eax - 4]
test eax, eax
mov eax, dword [ecx + 4]
jg 0x5282f8
mov dword [eax - 4], 1
ret 4
lock add dword [eax - 4], 1
ret 4

Function at 0x548550
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push edi
push esi
push ebx
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
xor edx, esi
cmp esi, 3
jbe 0x5485e0
lea eax, [esi - 4]
shr eax, 2
lea ebx, [ecx + eax*4 + 4]
imul edi, dword [ecx], 0x5bd1e995
add ecx, 4
imul edx, edx, 0x5bd1e995
mov eax, edi
shr eax, 0x18
xor eax, edi
imul eax, eax, 0x5bd1e995
xor edx, eax
cmp ecx, ebx
jne 0x548570
and esi, 3
cmp esi, 2
je 0x5485c9
cmp esi, 3
je 0x5485c0
cmp esi, 1
je 0x5485d2
mov eax, edx
pop ebx
pop esi
shr eax, 0xd
pop edi
xor edx, eax
imul edx, edx, 0x5bd1e995
mov eax, edx
shr eax, 0xf
xor eax, edx
ret
movzx eax, byte [ebx + 2]
shl eax, 0x10
xor edx, eax
movzx eax, byte [ebx + 1]
shl eax, 8
xor edx, eax
movzx eax, byte [ebx]
xor eax, edx
imul edx, eax, 0x5bd1e995
jmp 0x5485a4
mov ebx, ecx
jmp 0x548595
Function at 0x40afc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push eax
push ecx
push edx
push ebx
push esp
push ebp
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi

Function at 0x40afd0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push edi
xor esi, esi
mov dword [ebp - 0x10], 0xb
mov edi, 3
invalid
invalid
invalid

Function at 0x40b504
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40fd30
call fcn.0040b7c8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x40b564
cmp eax, 0xffffffff
je 0x40b564
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40b55d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40b55d
cmp edx, 0x10000000
jae 0x40b55d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40b55a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40b5d0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40b60e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40b606
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40b610
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40b5f6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40b6e0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40b711
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40b711
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40b711
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40ddf8
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [0x4116f4]
push edi
mov edi, edx
test edi, edi
je 0x40de47
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x40de46
and dword [ebp - 4], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xffff7fff
cmp eax, 2
lea eax, [ebp - 4]
push 0
push eax
jne 0x40de3a
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x40de46
lea eax, [esi + esi]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x40e75f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x411368]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x411930]
jne 0x40e7fb
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 6
push eax
push 1
xor edi, edi
push edi
push 0x406cf0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e7fa
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x406da8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x40e7fa
push 3
push dword [edi*8 + 0x401790]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x40e7ec
inc edi
cmp edi, 0x1c
jb 0x40e7ca
jmp 0x40e7fa
mov ax, word [edi*8 + 0x401794]
mov word [0x411930], ax
pop edi
mov ecx, dword [ebp - 4]
mov ax, word [0x411930]
xor ecx, ebp
call fcn.0040afd0
leave
ret

Function at 0x46d808
Capabilities:
Encode data using xor

Disassembly:
xor al, 0xd8
xor al, 0xa4
jge 0x46d842
xor byte [eax + ebx*2], 0x6a
xor al, 4
out dx, eax
cld
adc ch, byte [esi + 0x34]
push cs
xor al, 0xe
push edx
adc eax, 0x34ef2312
xor byte [esp + esi], 0x6c
mov esp, dword [ebp + esi + 0x3434d534]
ja 0x46d818
xor al, 0x1e
xor al, 0x26
push ebp
xor al, 0xa1
xor al, 0x34
xor ebp, esi
xor al, 0x34
aam 0x4c
add dword [esi], ecx
pop edx
invalid
invalid

Function at 0x46d8a6
Capabilities:
Encode data using xor

Disassembly:
push edi
xor al, 0x97
invalid
jb 0x46d84b
jae 0x46d8cf
cmpsb byte [esi], byte es:[edi]
xor al, 0x6e
xor al, 0x34
xor al, 0x18
xor al, 0x34
jle fcn.0046d8ac
sahf
mov cl, 0x34
xor al, 0xae
ret 0x3461
xor al, 0x34
xor al, 0xa1
mov dword [ebx + edx*2], esi
push ebx
xor al, 0x34
adc al, ch
jbe 0x46d869
invalid
hlt
dec eax
adc esi, dword [esp + esi]
div byte [ecx + ecx*8]
xor al, 0x55
out 0x34, eax
invalid