joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430940
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x44339c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x4309a1
push esi
push dword [0x443398]
push 8
push dword [0x441c10]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x44339c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x443394]
jmp 0x430991
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x43098f
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x43097f
push edi
push 0x4308de
call fcn.004324d9
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4

Function at 0x4309ab
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ecx, esi
push edi
and ecx, 3
je 0x4309c1
push 4
pop eax
sub eax, ecx
add esi, eax
mov eax, dword [0x443398]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x4309f8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
push 8
push dword [0x441c10]
mov dword [0x44339c], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x44339c]
call ebx
mov eax, dword [0x443398]
mov edi, eax
add eax, esi
push eax
push dword [0x44339c]
mov dword [0x443398], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x441c10]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x44339c]
call ebx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test esi, esi
jne 0x430a38
test ebx, ebx
je 0x430a59
push 0x14
push 0x443394
call fcn.004312c4
pop ecx
pop ecx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
test esi, esi
je 0x430a59
lea ecx, [edi + ebp]
push ecx
call esi
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x431730
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x43f8cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 8]
mov dword [eax + edx*4 + 0xc], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x19c]
add eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x19c], eax
mov esp, ebp
pop ebp
ret

Function at 0x431780
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [0x43f8cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
sub edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x19c], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx*4 + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4317e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x43f8cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
sub edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x19c], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret

Function at 0x431830
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x43f8cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
sub edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x19c], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
add eax, dword [ecx + 8]
mov esp, ebp
pop ebp
ret

Function at 0x431880
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x43f8cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
sub edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x19c], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
add eax, dword [ecx + edx*4 + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x431900
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x43f8cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
sub edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x431946
mov ecx, dword [ebp - 4]
add ecx, 0xa
push ecx
push 0
mov edx, dword [0x443660]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x431967
mov edx, dword [ebp - 4]
add edx, 0xa
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x443660]
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
shr edx, 1
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.004320b0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov esp, ebp
pop ebp
ret 8

Function at 0x431b20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x43f8cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 2
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret
Function at 0x431b90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x43f8cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_wcsncpy
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov dword [edx + 8], eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x431cf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x43f8cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
add edx, dword [ebp + 8]
push edx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x431d70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x43f8cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x431d94
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
lea eax, [ecx + edx*2]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
sub edx, 4
cmp dword [ebp - 8], edx
jl 0x431de4
mov eax, dword [ebp - 8]
add eax, 0x4000
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x443660]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x431e2c
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0x100000
jle 0x431e2c
cmp dword [ebp - 8], 0x100000
jge 0x431e00
mov dword [ebp - 8], 0x100000
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x443660]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*2]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x431e50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x43f8cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
shl ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
sub eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x432000
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x43f8cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x43203e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x43203e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x432040
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x432080
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x43f8cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x4324d9
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4433e8], 0
push ebx
push esi
mov esi, 0x4433f0
jne 0x432505
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x443408], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4433e8], 1
push dword [0x443408]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4325a2
push 0x14
push 8
push dword [0x441c10]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4325cc
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4433ec]
test eax, eax
je 0x432547
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4433ec], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x4325d1
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x443408]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x441c10]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4325cc
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8
Function at 0x12101cc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x12101d6
pushal
call 0x12101dc
pop ebp
sub ebp, 0x10
sub ebp, 0xe101cc
jmp 0x12101f2
mov eax, 0xe101cc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c5
mov edx, 0xccb9e8b2
xor byte [eax], dl
inc eax
dec ecx
jne 0x1210209
jmp 0x121021c
cmp dword [edi + 0x39], edi
cmp ecx, dword [esi + 0x33b2b2b2]
jae 0x1210271
mov dl, 0xb2
mov dl, 0xb1
jg 0x1210237
mov ah, 0xb2
mov dl, 0xb2
or byte [edx + 0x45b2b2b2], bl
push eax
mov cl, 0x7a
cmp dword [ebx], esi
mov esi, 0xb1b2b2b2
jp 0x1210274
xor edi, dword [esi - 0x4e4d4d4e]
ja 0x1210282
salc
xchg esi, eax
dec esi
cmp esi, dword [esi + 0x76dae296]
not dword [eax + 0xebadab2]
or al, 0xb2
mov bl, 0x9e
jbe 0x1210244
nop
mov dl, 0xda
mov edx, 0xb3b20c0e
sahf
xchg esi, eax
fimul dword [ebx + 0x5aa63f60]
mov bh, 0xb2
mov dl, 0xb2
pop ebx
lcall 0x5e39, 0xe7b2b2b2
cmp dword [edi], esi
mov edx, 0x39b2b2b2
daa
mov esi, 0x39b2b2b2
mov dl, 0x39
aas
mov byte [0x73b2b2b2], al
pop ebx
mov al, 0x83
mov al, 0x31
jo 0x1210239
mov dh, 0xfb
sti
mov ebp, 0x4d4d4637
dec ebp
out dx, eax
jo 0x121024b
mov dl, 0x39
xchg esi, eax
mov dh, 0xb2
mov dl, 0xb2
fidiv dword [esi - 9]
nop
mov dl, 0xda
mov edx, 0xb3b20c0e
sahf
xchg esi, eax
aas
salc
xchg esi, eax
dec esi
cmp edi, dword [esi - 0x4d48a56a]
mov dl, 0xb2
pop ebx
loope 0x1210261
mov dl, 0xb2
out 0x3f, eax
ficom word [esi - 0x4138b24e]
dec ebp
invalid
Function at 0x401770
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465987
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x485220]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov eax, dword [0x4865b0]
mov edx, dword [eax + 0xc]
mov ecx, 0x4865b0
mov byte [ebp - 4], 2
call edx
add eax, 0x10
mov dword [esi + 0x40], eax
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 3
mov dword [esi + 0x44], 0xffffffff
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], 0x10400
call fcn.00402650
lea eax, [esi + 0x5c]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
push edi
mov dword [eax + 0x10], ecx
push eax
mov byte [ebp - 4], 4
mov dword [eax + 0x14], ecx
call dword [0x467274]
test eax, eax
jne 0x401848
call dword [0x467134]
cmp eax, edi
jle 0x401840
and eax, 0xffff
or eax, 0x80070000
cmp eax, edi
jge 0x401848
push eax
call fcn.00405730
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x420300
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x463630
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x485220]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
sub ecx, dword [ebx + 4]
sub eax, dword [ebx]
imul eax, eax
imul ecx, ecx
movd xmm2, eax
movd xmm0, ecx
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm0, xmm0
mulss xmm2, dword [0x479728]
mulss xmm0, dword [0x479728]
addss xmm2, xmm0
cvtps2pd xmm0, xmm2
call fcn.00461390
cvtsd2ss xmm0, xmm0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 0
cvttss2si esi, xmm0
call dword [0x467534]
mov dword [esp + 0x24], eax
mov dword [esp + 0x40], 0
lea edx, [esi + esi]
mov eax, dword [ebx + 8]
sub esp, 0x10
mov ecx, dword [ebx + 0xc]
sub eax, edx
sub eax, dword [ebx]
movd xmm0, edx
cvtdq2ps xmm0, xmm0
movd xmm2, eax
lea eax, [esi + esi]
sub ecx, eax
movss dword [esp + 0xc], xmm0
sub ecx, dword [ebx + 4]
cvtdq2ps xmm2, xmm2
movd xmm1, ecx
mulss xmm2, dword [0x47972c]
cvtdq2ps xmm1, xmm1
movss dword [esp + 8], xmm0
mulss xmm1, dword [0x47972c]
movss dword [esp + 4], xmm1
movss dword [esp], xmm2
push dword [esp + 0x30]
call dword [0x4674fc]
mov ecx, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0x28], 0x471650
cmovne ecx, eax
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
mov dword [esp + 0x24], ecx
push eax
push dword [esp + 0x24]
call dword [0x4674f8]
mov esi, dword [esp + 0x10]
mov edi, eax
mov dword [esp + 0x2c], esi
mov byte [esp + 0x40], 1
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [0x4674e8]
test eax, eax
push 0xffffffffffffffff
push esi
cmovne edi, eax
call dword [0x4674f4]
test eax, eax
mov dword [esp + 0x18], 0xffeceff4
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 1
cmovne edi, eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], edi
push eax
call fcn.0041f6a0
push dword [esp + 0x20]
mov edi, dword [ebp + 8]
mov esi, dword [esp + 0x30]
push esi
push dword [edi]
call dword [0x4674dc]
test eax, eax
je 0x4204aa
mov dword [edi + 4], eax
push esi
call dword [0x46754c]
push dword [esp + 0x20]
call dword [0x467530]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42b2b0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463fd7
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x485220]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [edi], 0x473dac
mov dword [edi + 4], 0
mov dword [ebp - 0x134], edi
mov dword [edi + 8], 0
push 0x420590
push 0x420fd0
push 3
push 8
lea eax, [edi + 0x14]
mov dword [ebp - 4], 0
push eax
mov dword [edi + 0xc], 0x471708
mov dword [edi + 0x10], 0
call fcn.004472e5
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0xc], 0x471d2c
mov dword [edi + 0x38], 0
push edi
lea ecx, [edi + 0x3c]
call fcn.00427ee0
lea esi, [edi + 0x64]
mov dword [edi + 0x60], 0
mov dword [esi], 0
mov dword [ebp - 0x130], esi
mov dword [esi + 4], 0
mov byte [ebp - 4], 3
mov dword [esi + 8], 0
push 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
push 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
call fcn.00434890
mov dword [esi + 0x1c], eax
mov dword [edi + 0x8c], 0
push 0x118
lea eax, [ebp - 0x128]
mov byte [ebp - 4], 5
push 0
push eax
mov dword [ebp - 0x12c], 0x11c
call fcn.00448430
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
call dword [0x4671c0]
mov ecx, dword [ebp - 0x128]
movzx eax, word [ebp - 0x18]
shl ecx, 8
add ecx, dword [ebp - 0x124]
shl ecx, 8
add ecx, eax
movzx eax, word [ebp - 0x16]
shl ecx, 8
add ecx, eax
push ecx
push dword [0x489a2c]
lea ecx, [ebp - 0x140]
push 0x472c88
push 2
push 0x1d
push 0x472c40
push 0x472c6c
call fcn.00401100
push eax
call fcn.004012f0
add esp, 0x14
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00445aaa
mov esp, ebp
pop ebp
ret
Function at 0x42f340
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4644b0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x485220]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 0x473df8
lea ecx, [esp + 0x14]
call fcn.004047f0
lea eax, [esp + 0x10]
mov dword [esp + 0x38], 0
push eax
lea ecx, [esp + 0x18]
call fcn.0042eb00
mov byte [esp + 0x38], 2
or edi, 0xffffffff
mov edx, dword [esp + 0x10]
mov eax, edi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f3b4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esp + 0x14]
call fcn.0042ec90
test eax, eax
je 0x42f3ce
lea ecx, [esp + 0x14]
call fcn.0042f250
mov esi, eax
jmp 0x42f3d0
xor esi, esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0041a490
mov edx, dword [esp + 0x18]
mov ecx, edi
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42f3fe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x42f419
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x442100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
xor edi, edi
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x442306
cmp dword [esi + 0x6af90], 3
jb 0x442178
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x4421b5
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x4421b5
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x44219f
mov dword [esi + 0x6afa0], eax
mov edx, ebx
mov ecx, esi
call fcn.00441de0
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, esi
cmp edi, 3
jb 0x442286
mov edx, dword [esi + 0x6af84]
lea eax, [edi - 3]
sub edx, dword [esi + 0x6af88]
push eax
call fcn.004415a0
sub dword [esi + 0x6af90], edi
add esp, 4
mov dword [ebp - 4], eax
cmp edi, dword [esi + 0x6af98]
ja 0x44224d
cmp dword [esi + 0x6af90], 3
jb 0x44224d
dec edi
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [esi + edx + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
dec edi
jne 0x4421f3
mov eax, dword [ebp - 4]
jmp 0x4422a5
add dword [esi + 0x6af84], edi
xor edi, edi
mov eax, dword [esi + 0x6af84]
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 4]
jmp 0x4422ab
mov eax, dword [esi + 0x6af84]
xor edx, edx
movzx eax, byte [eax + esi + 0x1af70]
push eax
call fcn.004415a0
add esp, 4
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x4422e6
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x4422c3
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x4422c5
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.004413f0
mov eax, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x4422f9
mov ecx, esi
call fcn.00441fa0
cmp dword [esi + 0x6af90], 0
jne 0x442123
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x44231a
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x44231c
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push 1
push eax
call fcn.004413f0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret