joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6096b5
mov eax, dword fs:[0]
push eax
mov eax, 0x18
call fcn.005dfa60
push ebx
push esi
push edi
mov eax, dword [0x6a704c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov eax, ecx
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
xor esi, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
jb 0x4521b5
mov ecx, dword [eax]
push 0
push 0
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4521e2
mov dword [ebp - 0x14], eax
add eax, eax
push eax
push 0
call fcn.005e4cb3
mov ebx, eax
add esp, 8
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x14], 0x10
jb 0x4521ed
mov ecx, dword [ecx]
push dword [ebp - 0x14]
push ebx
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x45220b
mov eax, dword [edi]
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x452238
mov dword [ebp - 0x1c], eax
add eax, eax
push eax
push 0
call fcn.005e4cb3
mov esi, eax
add esp, 8
mov dword [ebp - 0x20], esi
cmp dword [edi + 0x14], 0x10
jb 0x452240
mov edi, dword [edi]
push dword [ebp - 0x1c]
push esi
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x452296
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push 0
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x452296
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 0x10]
mov edx, eax
mov ecx, 0x6af32c
call fcn.00451e80
add esp, 4
test esi, esi
je 0x4522a3
push esi
call fcn.005e4cbe
add esp, 4
test ebx, ebx
je 0x4522b0
push ebx
call fcn.005e4cbe
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4523c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa00
call fcn.005dfa60
mov eax, dword [0x6a704c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov ebx, ecx
mov dword [ebp - 0xa00], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x4524ce
lea eax, [ebp - 0xa00]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4524ce
push 0x3e8
lea eax, [ebp - 0x9dc]
push eax
lea eax, [ebp - 0x3ec]
push eax
call fcn.005e91c0
add esp, 0xc
lea eax, [ebp - 0x3ec]
mov ecx, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x452453
test dl, dl
je 0x45244f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x452453
add eax, 2
add ecx, 2
test dl, dl
jne 0x452433
xor eax, eax
jmp 0x452458
sbb eax, eax
or eax, 1
test eax, eax
je 0x4524e8
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0xa00]
push eax
push esi
call edi
test eax, eax
je 0x4524ce
push 0x3e8
lea eax, [ebp - 0x9dc]
push eax
lea eax, [ebp - 0x7d4]
push eax
call fcn.005e91c0
add esp, 0xc
lea ecx, [ebp - 0x7d4]
mov eax, ebx
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4524b7
test dl, dl
je 0x4524b3
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4524b7
add ecx, 2
add eax, 2
test dl, dl
jne 0x452497
xor eax, eax
jmp 0x4524bc
sbb eax, eax
or eax, 1
test eax, eax
je 0x4524e8
lea eax, [ebp - 0xa00]
push eax
push esi
call edi
test eax, eax
jne 0x452474
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005df097
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005df097
mov esp, ebp
pop ebp
ret
Function at 0x452cb0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x34
call fcn.005dfa60
mov eax, dword [0x6a704c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
xor edi, edi
mov dword [ebp - 0x2c], ebx
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x452cdd
mov eax, dword [esi]
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x452d09
mov edi, eax
add eax, eax
push eax
push 0
call fcn.005e4cb3
add esp, 8
mov dword [ebp - 0x2c], eax
mov ebx, eax
cmp dword [esi + 0x14], 0x10
jb 0x452d11
mov esi, dword [esi]
push edi
push ebx
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x30], esi
test esi, esi
je 0x452d4f
push 4
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x452d74
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor bl, bl
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x452d61
push eax
call fcn.005e4cbe
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005df097
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x34]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
push ebx
call esi
push dword [ebp - 0x30]
call esi
test edi, edi
je 0x452d4f
cmp dword [ebp - 0x24], 4
sete bl
jmp 0x452d51
Function at 0x452db0
Capabilities:
Check for time delay via gettickcount
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3c
call fcn.005dfa60
mov eax, dword [0x6a704c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x30], ebx
mov eax, edi
cmp dword [edi + 0x14], 0x10
jb 0x452ddd
mov eax, dword [edi]
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x452e09
mov esi, eax
add eax, eax
push eax
push 0
call fcn.005e4cb3
add esp, 8
mov dword [ebp - 0x30], eax
mov ebx, eax
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x452e13
mov eax, dword [edi]
push esi
push ebx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x452e3f
xor bl, bl
jmp 0x452ef2
push 0x10020
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x452e62
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov bl, 1
jmp 0x452ef2
mov ecx, edi
call fcn.00452cb0
test al, al
je 0x452ed1
mov ecx, dword [ebp - 0x2c]
mov edx, esi
call fcn.00452f20
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x452ed1
cmp dword [ebp - 0x24], 1
je 0x452ed1
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x38]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x452ed1
cmp dword [ebp - 0x24], 1
je 0x452ed1
call ebx
sub eax, dword [ebp - 0x34]
cmp eax, 0xbb8
ja 0x452ed1
cmp dword [ebp - 0x24], 1
jne 0x452e94
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x2c]
call esi
mov ecx, edi
call fcn.00452c00
test al, al
sete bl
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x452f02
push eax
call fcn.005e4cbe
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005df097
mov esp, ebp
pop ebp
ret
Function at 0x452f20
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x6a3d58
push 0x5e1920
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x70
call fcn.005dfa60
mov eax, dword [0x6a704c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, edx
mov eax, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x64], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], 0xbb8
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 1
push esi
mov edi, dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
call edi
test eax, eax
jne 0x4530c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x45308d
push dword [ebp - 0x44]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x54], eax
test eax, eax
je 0x45308d
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push dword [ebp - 0x44]
push eax
push 1
push esi
call edi
test eax, eax
je 0x45307a
xor edi, edi
mov dword [ebp - 0x50], edi
cmp edi, dword [ebp - 0x48]
jae 0x4530b7
lea eax, [edi + edi*8]
mov ecx, dword [ebp - 0x54]
movups xmm1, xmmword [ecx + eax*4]
movups xmm0, xmmword [ecx + eax*4 + 0x10]
movups xmmword [ebp - 0x78], xmm0
mov eax, dword [ecx + eax*4 + 0x20]
mov dword [ebp - 0x68], eax
push 0x24
movd eax, xmm1
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x60], esi
test esi, esi
je 0x45307a
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x45307a
nop dword [eax]
cmp dword [ebp - 0x3c], 1
je 0x453091
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x44]
push eax
push 0x24
lea eax, [ebp - 0x40]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x45307a
cmp dword [ebp - 0x3c], 1
je 0x453091
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x5c]
jbe 0x453040
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x6a704c
call fcn.005e4840
add esp, 0xc
xor al, al
jmp 0x4530c5
mov dword [ebp - 4], 0
call fcn.004530af
inc edi
jmp 0x452fe6
mov dword [ebp - 4], 0xfffffffe
call fcn.004530e1
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005df097
mov esp, ebp
pop ebp
ret
Function at 0x453dc0
Capabilities:
Identify system language via api

Disassembly:
mov eax, dword [0x6a7adc]
cmp eax, 8
jne 0x453e41
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
and eax, 0x1ff
add eax, 0xfffffffe
cmp eax, 0x83
ja case.0x453de6.3
movzx eax, byte [eax + 0x453e64]
jmp dword [eax*4 + 0x453e44]
mov eax, 1
mov dword [0x6a7adc], eax
ret
mov eax, 2
mov dword [0x6a7adc], eax
ret
mov eax, 3
mov dword [0x6a7adc], eax
ret
mov eax, 4
mov dword [0x6a7adc], eax
ret
mov eax, 5
mov dword [0x6a7adc], eax
ret
mov eax, 6
mov dword [0x6a7adc], eax
ret
mov eax, 7
mov dword [0x6a7adc], eax
ret
xor eax, eax
mov dword [0x6a7adc], eax
ret
Function at 0x47a830
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.005dfa60
push ebx
push esi
mov eax, ecx
mov esi, edx
push edi
mov dword [ebp - 4], eax
call fcn.00492e50
push 0x62
push esi
mov edi, eax
mov ebx, 1
call fcn.005e2160
add esp, 8
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x47a8e8
push 0x45
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [edi + 1]
lea ecx, [edi + 2]
call fcn.00489de0
push 0x67ab08
push esi
push 0x67ab0c
push dword [ebp - 4]
push str.fopen_
push 5
call fcn.0048a850
add esp, 0x24
call fcn.005ee911
cmp dword [eax], 2
je 0x47a8be
call fcn.005ee911
cmp dword [eax], 6
je 0x47a8be
lea eax, [edi + 2]
lea ecx, [edi + 0x4e]
jmp 0x47a8c8
mov eax, 0x80
mov ecx, 0x4c
push ecx
mov edx, 0x6d
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_bss_file.c
push eax
lea ecx, [edx - 0x4d]
call fcn.00489de0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x637310
call fcn.0047afa0
add esp, 4
mov esi, eax
push edi
test esi, esi
jne 0x47a90d
call fcn.005ef026
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0x6a
push esi
call fcn.0047b8f0
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47e080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.005dfa60
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], edx
cmp edx, ebx
je 0x47e1b6
mov eax, dword [ebx + 4]
push esi
lea esi, [ecx - 1]
not ecx
shr ecx, 0x1f
shr esi, 0x1f
and esi, ecx
mov ecx, dword [edx + 4]
xor eax, ecx
dec esi
and eax, esi
mov dword [ebp - 0xc], esi
xor ecx, eax
mov dword [edx + 4], ecx
xor dword [ebx + 4], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, ecx
movd xmm0, esi
and eax, esi
pshufd xmm4, xmm0, 0
xor ecx, eax
mov dword [edx + 0xc], ecx
xor dword [ebx + 0xc], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [ebx + 0x10]
xor eax, ecx
and eax, esi
and eax, 4
xor ecx, eax
mov dword [edx + 0x10], ecx
xor dword [ebx + 0x10], eax
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x47e1b5
push edi
cmp ecx, 4
jb 0x47e190
mov esi, dword [edx]
lea edx, [ecx - 1]
mov edi, dword [ebx]
lea edx, [edi + edx*4]
mov dword [ebp + 8], edx
lea edx, [ecx - 1]
lea edx, [esi + edx*4]
mov dword [ebp - 4], edx
cmp edi, edx
mov edx, dword [ebp - 8]
ja 0x47e129
cmp dword [ebp + 8], esi
jae 0x47e190
cmp edi, ebx
ja 0x47e132
cmp dword [ebp + 8], ebx
jae 0x47e190
cmp edi, edx
ja 0x47e13b
cmp dword [ebp + 8], edx
jae 0x47e190
cmp esi, ebx
ja 0x47e144
cmp dword [ebp - 4], ebx
jae 0x47e190
cmp esi, edx
ja 0x47e14d
cmp dword [ebp - 4], edx
jae 0x47e190
mov dword [ebp + 8], ecx
and dword [ebp + 8], 0xfffffffc
movups xmm3, xmmword [edi + eax*4]
movups xmm2, xmmword [esi + eax*4]
movaps xmm1, xmm3
pxor xmm1, xmm2
pand xmm1, xmm4
movaps xmm0, xmm1
pxor xmm1, xmm3
pxor xmm0, xmm2
movups xmmword [esi + eax*4], xmm0
movups xmmword [edi + eax*4], xmm1
add eax, 4
cmp eax, dword [ebp + 8]
jl 0x47e154
mov dword [ebp + 8], eax
cmp eax, ecx
jge 0x47e1b4
nop dword [eax]
mov ecx, dword [edx]
mov edx, dword [ecx + eax*4]
lea esi, [ecx + eax*4]
mov ecx, dword [ebx]
mov edi, dword [ecx + eax*4]
xor edi, edx
and edi, dword [ebp - 0xc]
xor edx, edi
mov dword [esi], edx
mov ecx, dword [ebx]
mov edx, dword [ebp - 8]
xor dword [ecx + eax*4], edi
inc eax
cmp eax, dword [ebp + 0xc]
jl 0x47e190
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x487f80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 4
call fcn.005dfa60
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [esp + 0xc], esi
call fcn.00487f00
test eax, eax
je 0x487fef
cmp eax, 0x6a7bbc
je 0x487fef
call fcn.00487f00
test eax, eax
je 0x487fc9
mov eax, dword [eax + 4]
test eax, eax
je 0x487fc9
push ebx
push esi
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x64
push 0x3ae
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_rand_rand_lib.c
push 0x65
lea ecx, [edx - 0x40]
call fcn.00489de0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x4b8ce0
mov ecx, 0x6af0c8
call fcn.00491bf0
neg eax
sbb eax, eax
test dword [0x6af0cc], eax
je 0x4880a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x6af0bc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x4880d2
push edi
push edi
xor ecx, ecx
call fcn.004929a0
add esp, 8
test eax, eax
je 0x4880a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x6a82c0]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, edi
jne 0x4880b1
push 0xc
mov dword [0x6a7ea4], 0
call fcn.005ee808
mov edi, eax
add esp, 4
test edi, edi
je 0x4880a8
xorps xmm0, xmm0
movq qword [edi], xmm0
push edi
mov dword [edi + 8], 0
push dword [0x6a82c0]
call esi
test eax, eax
jne 0x4880b1
push edi
call fcn.005e4cbe
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x6af0c4]
mov dword [edi + 8], 1
call fcn.004b8bf0
mov edi, eax
push edi
push dword [0x6af0bc]
call esi
test edi, edi
je 0x4880a8
mov edx, dword [esp + 0xc]
mov ecx, edi
push ebx
call fcn.004b8aa0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48a6a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 4
call fcn.005dfa60
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
call ebx
push 0
push 0x40000
xor ecx, ecx
mov dword [esp + 0x14], eax
call fcn.004929a0
add esp, 8
test eax, eax
je 0x48a82b
mov edx, 0x48a670
mov ecx, 0x6ae8e8
call fcn.00491bf0
neg eax
sbb eax, eax
test dword [0x6ae8dc], eax
je 0x48a82b
call ebx
push dword [0x6aecf4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0xffffffff
je 0x48a82b
test edi, edi
jne 0x48a801
push 0xffffffffffffffff
push dword [0x6aecf4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x48a82b
push 0x188
mov dword [0x6a7ea4], edi
call fcn.005ee808
mov edi, eax
add esp, 4
test edi, edi
je 0x48a834
push 0x188
push 0
push edi
call fcn.005e1a80
add esp, 0xc
xor ecx, ecx
push 0
push 0
call fcn.004929a0
add esp, 8
test eax, eax
je 0x48a814
call ebx
push dword [0x6a82c0]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x48a7d9
push 0xc
mov dword [0x6a7ea4], ebx
call fcn.005ee808
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x48a81a
xorps xmm0, xmm0
movq qword [ebx], xmm0
push ebx
mov dword [ebx + 8], 0
push dword [0x6a82c0]
call esi
test eax, eax
jne 0x48a7df
push ebx
call fcn.005e4cbe
add esp, 4
jmp 0x48a81a
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
mov dword [ebx + 4], 1
push dword [0x6aecf4]
call esi
test eax, eax
je 0x48a81a
push 0
push 2
xor ecx, ecx
call fcn.004929a0
add esp, 8
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, edi
call fcn.00489a60
push 0
push dword [0x6aecf4]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push dword [0x6aecf4]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48fc40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x4c
push 0
lea eax, [esi + 0x10]
push eax
call fcn.005e1a80
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
pop ebp
ret
Function at 0x491c50
Capabilities:
Allocate thread local storage
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0xc
call fcn.005dfa60
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebx, eax
mov dword [esp + 0xc], ebx
cmp ebx, 0xffffffff
je 0x491cc3
push 0x18
mov dword [0x6a7ea4], 0
call fcn.005ee808
mov esi, eax
add esp, 4
test esi, esi
je 0x491cb2
xorps xmm0, xmm0
push 0x400
movups xmmword [esi], xmm0
push esi
movq qword [esi + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x491ccc
push esi
call fcn.005e4cbe
add esp, 4
push ebx
mov dword [0x6aee28], 0
call dword [sym.imp.KERNEL32.dll_TlsFree]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x6af038], 0
mov dword [0x6aee28], esi
jne 0x491e19
push 0x30
push 0x6aefd8
push str.OPENSSL_ia32cap
mov dword [0x6af038], 1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x2e
ja 0x491df2
mov si, word [0x6aefd8]
xor ecx, ecx
mov eax, 2
cmp si, 0x7e
cmove ecx, eax
add ecx, 0x6aefd8
call fcn.0049bc00
mov edi, eax
mov ebx, edx
cmp si, 0x7e
jne 0x491d60
push 0x6af600
mov esi, edi
call section..text
not edi
not ebx
and esi, 0x1000000
add esp, 4
and edi, eax
and ebx, edx
or esi, 0
mov si, word [0x6aefd8]
je 0x491d7e
and ebx, 0xedfff7fd
jmp 0x491d7e
cmp si, 0x3a
jne 0x491d7e
push 0x6af600
call section..text
mov si, word [0x6aefd8]
add esp, 4
mov edi, eax
mov ebx, edx
movzx eax, si
mov edx, 0x6aefd8
test ax, ax
je 0x491da1
nop dword [eax + eax]
add edx, 2
cmp ax, 0x3a
je 0x491db7
movzx eax, word [edx]
test ax, ax
jne 0x491d90
mov dword [0x6af608], 0
mov dword [0x6af60c], 0
jmp 0x491e03
movzx esi, word [edx]
xor ecx, ecx
cmp esi, 0x7e
mov eax, 2
cmove ecx, eax
add ecx, edx
call fcn.0049bc00
cmp esi, 0x7e
jne 0x491de5
not eax
not edx
and dword [0x6af608], eax
and dword [0x6af60c], edx
jmp 0x491e03
mov dword [0x6af608], eax
mov dword [0x6af60c], edx
jmp 0x491e03
push 0x6af600
call section..text
add esp, 4
mov edi, eax
mov ebx, edx
or edi, 0x400
mov dword [0x6af604], ebx
mov ebx, dword [esp + 0xc]
mov dword [0x6af600], edi
pop edi
pop esi
mov dword [0x6a82c0], ebx
mov eax, 1
mov dword [0x6aee00], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4923c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
je 0x492490
cmp dword [ebx], 0
je 0x4923d5
call fcn.004c3830
cmp dword [ebx + 4], 0
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
je 0x492423
call ecx
push dword [0x6aecf4]
mov esi, eax
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x492417
push 0
push dword [0x6aecf4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, edi
call fcn.00489a60
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebx + 8], 0
je 0x492485
call ecx
push dword [0x6af0c0]
mov esi, eax
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push dword [0x6af0c0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, edi
call fcn.004b8260
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x6af0bc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push dword [0x6af0bc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, edi
call fcn.004b8260
push ebx
call fcn.005e4cbe
add esp, 4
pop edi
pop esi
pop ebx
ret