joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445f80
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, ecx
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov ebp, edx
add ebp, esi
adc edi, 0
xor eax, eax
mov ecx, 0x11000
cmp ecx, ebp
sbb eax, edi
jl 0x445fb1
cmp dword [ebx + 0xc], 0
je 0x446005
mov ecx, dword [ebx + 0x10]
jmp 0x446052
cmp dword [ebx + 0x18], esi
mov ebp, esi
mov esi, dword [esp + 0x18]
jae 0x445fda
mov edi, edx
push ebp
push dword [ebx + 0x14]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
test eax, eax
je 0x446066
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], ebp
mov edx, edi
push 0
push esi
push edx
push dword [ebx]
call fcn.0045ae00
add esp, 0x10
xor esi, esi
test edx, edx
js 0x446068
push ebp
push dword [ebx + 0x14]
push dword [ebx]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
cmp eax, ebp
jne 0x446068
mov esi, dword [ebx + 0x14]
jmp 0x446068
mov dword [esp], edx
push 0x11000
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov dword [ebx + 0xc], eax
xor esi, esi
test eax, eax
je 0x446068
push 0
push 0
push 0
push dword [ebx]
call fcn.0042b3a0
add esp, 0x10
test edx, edx
js 0x446068
push 0x11000
push dword [ebx + 0xc]
push dword [ebx]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
mov edx, dword [esp + 0xc]
add esp, 0xc
xor ecx, ecx
test eax, eax
cmovns ecx, eax
mov dword [ebx + 0x10], ecx
xor esi, esi
cmp ecx, ebp
mov eax, 0
sbb eax, edi
jl 0x446068
mov esi, dword [ebx + 0xc]
add esi, edx
jmp 0x446068
xor esi, esi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x449630
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x44966d
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
xor ebp, ebp
nop word cs:[eax + eax]
mov eax, esi
sub eax, ebp
push eax
push edi
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
test eax, eax
js 0x449671
je 0x44967f
add edi, eax
add ebp, eax
cmp ebp, esi
jb 0x449650
xor eax, eax
jmp 0x449684
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, eax
xor eax, eax
sub eax, dword [ecx]
jmp 0x449684
mov eax, 0xffffffea
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x44a400
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
not eax
test ebx, ebx
je 0x44a47e
mov ecx, dword [esp + 0x14]
test bl, 1
jne 0x44a423
mov edx, ebx
cmp ebx, 1
jne 0x44a440
jmp 0x44a47e
lea edx, [ebx - 1]
movzx esi, byte [ecx]
add ecx, 1
movzx edi, al
xor edi, esi
shr eax, 8
xor eax, dword [edi*4 + 0x4a7de8]
cmp ebx, 1
je 0x44a47e
xor esi, esi
nop word cs:[eax + eax]
nop dword [eax]
movzx edi, byte [ecx + esi]
movzx ebx, al
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x4a7de8]
movzx edi, byte [ecx + esi + 1]
movzx ebx, al
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x4a7de8]
add esi, 2
cmp edx, esi
jne 0x44a450
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x45ac90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
xorps xmm0, xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
lea eax, [esp + 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat32i64]
add esp, 8
test eax, eax
jne 0x45ace1
movzx eax, word [esp + 0x16]
and eax, 0xf000
cmp eax, 0x8000
jne 0x45ace1
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
jmp 0x45adf2
xor ecx, ecx
mov edx, 0x400
xor edi, edi
xor ebx, ebx
nop dword [eax]
mov dword [esp], ebx
mov esi, edi
mov ebx, ecx
mov edi, edx
mov byte [esp + 0x10], 0
push 0
push ecx
push edx
push dword [ebp + 8]
call fcn.0045ae00
add esp, 0x10
test edx, edx
js 0x45ad30
push 1
lea eax, [esp + 0x14]
push eax
push dword [ebp + 8]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
mov ecx, ebx
shld ecx, edi, 1
lea edx, [edi + edi]
test eax, eax
jg 0x45acf0
mov dword [esp + 4], edi
mov edx, edi
add edx, 0xffffffff
mov edi, ebx
adc ebx, 0xffffffff
mov eax, esi
cmp esi, edx
mov edx, dword [esp]
mov esi, edx
sbb esi, ebx
jge 0x45adec
mov ecx, dword [esp + 4]
jmp 0x45ada6
push 1
lea eax, [esp + 0x14]
push eax
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
xor ecx, ecx
test eax, eax
setg cl
mov edx, dword [esp]
mov edi, dword [esp + 8]
test ecx, ecx
cmove edi, ebx
mov ecx, dword [esp + 4]
cmove ecx, esi
cmovne edx, ebx
mov eax, dword [esp + 0xc]
cmovne eax, esi
mov esi, ecx
add esi, 0xffffffff
mov ebx, edi
adc ebx, 0xffffffff
cmp eax, esi
mov esi, edx
sbb esi, ebx
jge 0x45adec
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
add eax, ecx
mov dword [esp], edx
mov ebx, edx
mov dword [esp + 8], edi
adc ebx, edi
mov esi, ebx
shr esi, 0x1f
add esi, eax
adc ebx, 0
shrd esi, ebx, 1
sar ebx, 1
mov byte [esp + 0x10], 0
push 0
push ebx
push esi
mov edi, dword [ebp + 8]
push edi
call fcn.0045ae00
add esp, 0x10
test edx, edx
jns 0x45ad60
xor ecx, ecx
jmp 0x45ad77
add eax, 1
adc edx, 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45b0c0
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov al, byte [0x4b83e8]
test al, al
je 0x45b1c4
push dword [0x4b83e4]
push dword [0x4b83e0]
push esi
push edi
call fcn.004399e0
add esp, 0x10
mov dword [esp + 0xc], eax
sub edi, eax
sbb esi, 0
mov eax, dword [ebp + 0x1c]
and eax, 2
add eax, 2
push 0
push 0
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
je 0x45b172
mov ebx, eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0xc]
add eax, ecx
mov ecx, dword [ebp + 0x1c]
test cl, 2
mov ecx, 4
mov edx, 0xf001f
cmove edx, ecx
push eax
push edi
push esi
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x45b1ac
mov esi, eax
push 0x10
call fcn.0044a4c0
add esp, 4
mov dword [eax], esi
mov ecx, dword [ebp + 0x18]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
jmp 0x45b1bc
cmp dword [ebp + 0x18], 0
jne 0x45b1b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ee
jne 0x45b1b3
push 0x10
call fcn.0044a4c0
add esp, 4
mov dword [eax], 0x4a95e2
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
jmp 0x45b169
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov dword [eax], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4b83e8
call fcn.004604f0
add esp, 4
test eax, eax
je 0x45b0e2
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x2c]
mov dword [0x4b83e0], eax
mov dword [0x4b83e4], 0
push 0x4b83e8
call fcn.00460660
add esp, 4
jmp 0x45b0e2
Function at 0x464ec9
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
lea ebx, [ecx + 0x54]
mov eax, dword [ecx + 0x64]
mov dword [esp], eax
xor edi, edi
mov dword [esp + 4], ebx
nop dword [eax + eax]
cmp dword [esi + 0x58], 0
jne 0x464ead
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x464e46
cmp eax, 0xfffffffb
jne 0x464f06
cmp dword [esi + 0x34], 0
jne 0x464f13
mov dword [esp + 8], edi
mov edi, dword [esi + 0x18]
mov ebx, dword [esi + 0x20]
xor ebp, ebp
nop dword [eax]
mov eax, edi
sub eax, ebp
cmp eax, 0x40000000
mov ecx, 0x40000000
cmovae eax, ecx
lea ecx, [ebx + ebp]
push eax
push ecx
push dword [esi + 0x10]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
test eax, eax
jle 0x464e8d
add ebp, eax
cmp ebp, edi
jb 0x464e60
jmp 0x464e9a
js 0x464f45
mov dword [esi + 0x34], 1
add dword [esi + 0x58], ebp
mov eax, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov edi, dword [esp + 8]
mov ebx, dword [esp + 4]
je 0x464f13
push 0
push ebx
call fcn.0046f300
add esp, 8
mov edi, eax
add eax, 4
cmp eax, 6
ja case.0x464ec2.1
jmp dword [eax*4 + 0x4aaa88]
mov eax, dword [esi + 0x64]
test eax, eax
je 0x464f26
cmp edi, 1
jne 0x464e30
jmp 0x464f26
push str.internal_error:_inflate_stream_corrupt
push 0xfffffffffffffffe
jmp 0x464efd
push str.out_of_memory
push 0xfffffffffffffffc
jmp 0x464efd
mov eax, dword [esi + 0x6c]
test eax, eax
mov ecx, str.compressed_data_error
cmovne ecx, eax
push ecx
push 0xfffffffffffffffd
push esi
call fcn.0045b990
add esp, 0xc
mov eax, 0xffffffff
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push str.unexpected_end_of_file
push 0xfffffffffffffffb
push esi
call fcn.0045b990
add esp, 0xc
mov eax, dword [esi + 0x64]
mov ecx, dword [esp]
sub ecx, eax
mov dword [esi], ecx
mov eax, dword [esi + 0x60]
sub eax, ecx
mov dword [esi + 4], eax
xor eax, eax
cmp edi, 1
jne 0x464f0b
mov dword [esi + 0x2c], 0
jmp 0x464f0b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_strerror
add esp, 4
push eax
push 0xffffffffffffffff
jmp 0x464efd
Function at 0x465da3
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
jne 0x465db6
jmp 0x465eea
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004839c0
cmp eax, 1
jne 0x465ee2
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea edx, [ebp - 0x4f]
mov ebx, 0x43
mov eax, 0
mov ecx, edx
and ecx, 1
test ecx, ecx
je 0x465e2e
mov byte [edx], al
add edx, 1
sub ebx, 1
mov ecx, edx
and ecx, 2
test ecx, ecx
je 0x465e40
mov word [edx], ax
add edx, 2
sub ebx, 2
mov ecx, ebx
shr ecx, 2
mov edi, edx
rep stosd dword es:[edi], eax
mov edx, edi
mov ecx, ebx
and ecx, 2
test ecx, ecx
je 0x465e5a
mov word [edx], ax
add edx, 2
and ebx, 1
mov ecx, ebx
test ecx, ecx
je 0x465e68
mov byte [edx], al
add edx, 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x465e98
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x465eaf
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x465e94
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x465ecd
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x466e76
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x466ceb
mov dword [esp], 0x4b8734
call fcn.0046643d
mov eax, dword [0x4b6e9c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x466ebd
mov eax, dword [ebp - 0x20]
jmp 0x467008
call fcn.00465cac
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x466ed4
cmp dword [ebp - 0x20], 0
jne 0x466ede
mov eax, 0
jmp 0x467008
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00465da3
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x466fb0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x4b6e9c]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x467005
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4670cc
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.00466e76
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.00466d0e
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x467125
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_longjmp
mov eax, dword [0x4b6e9c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x46724f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x4671b7
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x467174
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00465bc0
mov dword [ebp - 0x10], 0
mov eax, dword [0x4b6e9c]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x46724f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4671e7
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x46724f
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00465bc0
mov dword [ebp - 0x10], 0
mov eax, dword [0x4b6e9c]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax
Function at 0x47a500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
sub ecx, eax
je 0x47a5e3
cmp byte [eax], 0x64
jne 0x47a5e3
cmp ecx, 1
je 0x47a5e3
movsx ecx, byte [eax + 1]
cmp ecx, 0x58
je 0x47a5f1
cmp ecx, 0x78
je 0x47a6a4
cmp ecx, 0x69
jne 0x47a5e3
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.0047d620
xor edi, edi
test eax, eax
je 0x47a731
mov ebx, eax
mov ecx, esi
call fcn.0047a500
test eax, eax
je 0x47a731
mov ebp, eax
mov edi, dword [esi + 0x116c]
mov ecx, dword [edi + 4]
lea eax, [ecx - 0xfd8]
cmp eax, 0xfffff007
ja 0x47a5ac
push 0x1000
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x47a73b
mov dword [eax], edi
mov dword [eax + 4], 0
mov dword [esi + 0x116c], eax
xor ecx, ecx
mov edi, eax
add ecx, 0x20
mov dword [edi + 4], ecx
mov eax, dword [esi + 0x116c]
mov ecx, dword [eax + 4]
lea edi, [eax + ecx]
add edi, 0xffffffe8
mov dword [eax + ecx - 0x14], 0x1010141
mov dword [eax + ecx - 0x18], 0x4b07b4
mov dword [eax + ecx - 0x10], ebx
mov dword [eax + ecx - 0xc], ebp
mov byte [eax + ecx - 8], 0
jmp 0x47a731
mov ecx, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004773e0
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.004773e0
xor edi, edi
test eax, eax
je 0x47a731
mov ebx, eax
mov ecx, esi
call fcn.004773e0
test eax, eax
je 0x47a731
mov ebp, eax
mov ecx, esi
call fcn.0047a500
test eax, eax
je 0x47a731
mov edi, dword [esi + 0x116c]
mov ecx, dword [edi + 4]
lea edx, [ecx - 0xfd8]
cmp edx, 0xfffff007
ja 0x47a66e
mov dword [esp], eax
push 0x1000
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x47a73b
mov dword [eax], edi
mov dword [eax + 4], 0
mov dword [esi + 0x116c], eax
xor ecx, ecx
mov edi, eax
mov eax, dword [esp]
add ecx, 0x20
mov dword [edi + 4], ecx
mov edx, dword [esi + 0x116c]
mov ecx, dword [edx + 4]
lea edi, [edx + ecx]
add edi, 0xffffffe8
mov dword [edx + ecx - 0x14], 0x1010142
mov dword [edx + ecx - 0x18], 0x4b0820
mov dword [edx + ecx - 0x10], ebx
mov dword [edx + ecx - 0xc], ebp
mov dword [edx + ecx - 8], eax
jmp 0x47a731
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.004773e0
xor edi, edi
test eax, eax
je 0x47a731
mov ebx, eax
mov ecx, esi
call fcn.0047a500
test eax, eax
je 0x47a731
mov ebp, eax
mov edi, dword [esi + 0x116c]
mov ecx, dword [edi + 4]
lea eax, [ecx - 0xfd8]
cmp eax, 0xfffff007
ja 0x47a6ff
push 0x1000
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x47a73b
mov dword [eax], edi
mov dword [eax + 4], 0
mov dword [esi + 0x116c], eax
xor ecx, ecx
mov edi, eax
add ecx, 0x20
mov dword [edi + 4], ecx
mov eax, dword [esi + 0x116c]
mov ecx, dword [eax + 4]
lea edi, [eax + ecx]
add edi, 0xffffffe8
mov dword [eax + ecx - 0x14], 0x1010141
mov dword [eax + ecx - 0x18], 0x4b07b4
mov dword [eax + ecx - 0x10], ebx
mov dword [eax + ecx - 0xc], ebp
mov byte [eax + ecx - 8], 1
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0045d390
Function at 0x483bb8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x4b6ec8
call fcn.004839ca
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xbab1f0ed
jne 0x483be4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jg 0x483c26
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], str._buildbot_src_android_mingw_toolchain_mingw_mingw_w64_v6.x_mingw_w64_libraries_winpthreads_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call fcn.0043b7a0
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
sub edx, 1
mov dword [eax + 4], edx
mov dword [esp], 0x4b6ec8
call fcn.00483a28
mov eax, dword [ebp + 0xc]
leave
ret
Function at 0x414dd6
Capabilities:
Encode data using xor

Disassembly:
xor dword [esi], edx
mov eax, edi
add ecx, ecx
and ecx, edi
add esi, 4
sub edi, 0x75c0e67f
push ecx
mov ecx, dword [esp]
add esp, 4
cmp esi, ebx
jne fcn.00414dd6
add ecx, 0xdd3d79dc
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x41c550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push edi
mov edi, ecx
test edx, edx
je 0x41c571
push esi
mov esi, dword [ebp + 8]
mov ecx, eax
and ecx, 0xf
mov cl, byte [ecx + esi]
xor byte [edi + eax], cl
inc eax
cmp eax, edx
jb 0x41c560
pop esi
pop edi
pop ebp
ret

Function at 0x41c580
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x49f3c0]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ecx
push dword [ebp + 0x10]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
call fcn.0041c550
add esp, 8
mov dword [esp + 0x118], 0
mov dword [esp + 0x11c], 0
xor eax, eax
nop dword [eax]
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x41c5d0
xor edi, edi
xor esi, esi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 0xf
movzx ecx, dl
movzx eax, byte [eax + ebx]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x41c5e0
mov ebx, dword [esp + 0x10]
xor ecx, ecx
xor edi, edi
test ebx, ebx
je 0x41c67c
mov edx, dword [esp + 0x11c]
nop
lea eax, [ecx + 1]
movzx eax, al
lea esi, [esp + 0x18]
add esi, eax
mov dword [esp + 0x118], eax
movzx eax, byte [esi]
add eax, edx
lea edx, [esp + 0x18]
movzx eax, al
add edx, eax
mov dword [esp + 0x11c], eax
mov cl, byte [esi]
movzx eax, byte [edx]
mov byte [esi], al
mov esi, dword [esp + 0x14]
mov byte [edx], cl
mov edx, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
movzx eax, byte [esp + edx + 0x18]
add al, byte [esp + ecx + 0x18]
movzx eax, al
movzx eax, byte [esp + eax + 0x18]
xor byte [esi + edi], al
inc edi
cmp edi, ebx
jb 0x41c620
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004409e0
mov esp, ebp
pop ebp
ret