joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa955
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x4c8104]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov al, byte [ecx + 0x21]
mov byte [ecx + 0x21], 0
movups xmmword [ebp - 0x2c], xmm0
mov byte [ebp - 0x2b], al
mov eax, dword [ecx + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ecx + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 0x30]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], eax
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov eax, dword [ecx + 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], eax
call fcn.0041aa80
cmp dword [ebx + 8], 0
je 0x469ea5
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 2
push eax
push eax
call fcn.0046acc0
add esp, 8
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x469ed1
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x469ed1
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x469ed1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea ecx, [ebp - 0x38]
call fcn.0041aa80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049f3c4
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x469f00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa99d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4c8104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov ebx, dword [ebp + 8]
push dword [0x50b8e0]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x469f55
cmp dword [eax], esi
je 0x46a085
mov eax, dword [eax + 8]
test eax, eax
jne 0x469f46
mov esi, dword [edi + 0xc]
mov dword [ebp - 0x34], edi
lea eax, [esi + 0x400]
lock bts dword [eax], 0
setb al
movzx eax, al
test eax, eax
je 0x469f7d
push 0x64
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov esi, eax
mov dword [ebp - 4], 1
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], fcn.0046ab50
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ecx
lea ecx, [esi + 0x30]
mov eax, dword [edi + 0xc]
mov dword [esi + 0x2c], eax
lea eax, [edi + 0x10]
push eax
call fcn.004674d0
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x60], eax
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + 8]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [ebp - 0x28]
push esi
push ebx
call fcn.0042abe0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
test al, al
je 0x46a0ca
mov eax, dword [ebx]
xorps xmm0, xmm0
push dword [0x50b8e0]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x50b8e0]
mov dword [ebp - 0x18], eax
call edi
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx]
mov dword [ebp - 0x20], eax
push 0x50b818
push 0x435e10
push 0x50b820
mov byte [ebp - 4], 3
call fcn.00475b00
add esp, 0xc
test eax, eax
je 0x46a0e8
jmp 0x46a0a2
cmp dword [eax + 4], 0
je 0x469f55
push edi
push edi
mov dword [ebp - 4], 0
call fcn.0046b920
add esp, 8
jmp 0x46a0ca
push 0
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x28]
push esi
push dword [eax + 0x14]
call fcn.0046ab50
add esp, 0x10
lea ecx, [ebp - 0x24]
call fcn.0042ab70
push dword [ebp - 0x14]
push dword [0x50b8e0]
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049f3c4
mov esp, ebp
pop ebp
ret 8
call sub.msvcrt.dll_void___cdecl_terminate_void_
int3
Function at 0x46a510
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aaa40
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4c8104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ecx]
mov edx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x46a6e7
cmp byte [esi + 4], 0
je 0x46a5e4
mov eax, dword [edx]
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x28], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x24], eax
mov dword [edx], 0
mov dword [edx + 4], 0
mov eax, dword [edx + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [edx + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x18], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
push eax
call fcn.0046b770
add esp, 8
mov dword [ebp - 4], 2
mov esi, dword [ebp - 0x24]
test esi, esi
je 0x46a6ca
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x46a6ca
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x46a6ca
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
jmp 0x46a6ca
mov eax, dword [esi]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [edx]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x60], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x5c], eax
mov dword [edx], 0
mov dword [edx + 4], 0
mov eax, dword [edx + 8]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x58], eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x54], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x50], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], 3
push dword [0x50b870]
mov dword [ebp - 0x1c], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46a64d
mov ecx, dword [eax + 4]
jmp 0x46a64f
xor ecx, ecx
push dword [ebp - 0x30]
mov edx, 0x20
call fcn.0046b150
mov ecx, dword [ebp - 0x34]
add esp, 4
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [eax], 0x46b2a0
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x38]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x40]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 0x44]
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp - 0x48]
mov dword [eax + 0x18], ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
call fcn.0046ae80
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 5
push eax
mov ecx, esi
call dword [ebp - 0x30]
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x46a6ca
push 0
push eax
mov eax, dword [eax]
call eax
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049f3c4
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x1c]
call fcn.0042afa0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.0042aff0
int3
Function at 0x46a700
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aaa90
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4c8104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ecx]
mov edx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x46a8c4
cmp byte [esi + 4], 0
je 0x46a7d0
mov eax, dword [edx]
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x24], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x20], eax
mov dword [edx], 0
mov dword [edx + 4], 0
mov eax, dword [edx + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 1
push eax
push eax
call fcn.0046b790
add esp, 8
mov dword [ebp - 4], 2
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x46a8a7
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x46a8a7
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x46a8a7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
jmp 0x46a8a7
mov eax, dword [esi]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [edx]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x54], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x50], eax
mov dword [edx], 0
mov dword [edx + 4], 0
mov eax, dword [edx + 8]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x4c], eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x48], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 3
push dword [0x50b870]
mov dword [ebp - 0x1c], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46a830
mov ecx, dword [eax + 4]
jmp 0x46a832
xor ecx, ecx
push dword [ebp - 0x2c]
mov edx, 0x1c
call fcn.0046b150
mov ecx, dword [ebp - 0x30]
add esp, 4
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [eax], 0x46b1b0
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x34]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x38]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 0x40]
mov dword [eax + 0x14], ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], eax
call fcn.0046adc0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 5
push eax
mov ecx, esi
call dword [ebp - 0x2c]
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x46a8a7
push 0
push eax
mov eax, dword [eax]
call eax
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049f3c4
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x1c]
call fcn.0042afa0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.0042aff0
int3
Function at 0x46adc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3a50
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4c8104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x46ae24
mov dword [ebp - 4], 0
mov esi, dword [esi + 8]
test esi, esi
je 0x46ae1d
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x46ae1d
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x46ae1d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x46ae63
push dword [0x50b870]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46ae52
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x46ae52
cmp dword [ecx + 8], 0
jne 0x46ae52
mov al, byte [esi + 0x1c]
mov byte [esi], al
mov dword [ecx + 8], esi
jmp 0x46ae5c
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46ae80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3a50
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4c8104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x46aee4
mov dword [ebp - 4], 0
mov esi, dword [esi + 8]
test esi, esi
je 0x46aedd
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x46aedd
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x46aedd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x46af23
push dword [0x50b870]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46af12
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x46af12
cmp dword [ecx + 8], 0
jne 0x46af12
mov al, byte [esi + 0x20]
mov byte [esi], al
mov dword [ecx + 8], esi
jmp 0x46af1c
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e000
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [eax + 0x14], 0x10
mov esi, eax
mov dword [ebp - 8], eax
jb 0x46e01c
mov esi, dword [eax]
mov dword [ebp - 8], esi
mov edi, dword [eax + 0x10]
xor edx, edx
mov eax, edi
xor ebx, ebx
shr eax, 2
mov dword [ebp - 0xc], eax
lea ecx, [eax - 1]
lea ecx, [esi + ecx*4]
mov dword [ebp - 0x14], ecx
mov ecx, dword [esi + eax*4 - 4]
mov eax, 0x34
div dword [ebp - 0xc]
mov dword [ebp - 4], ecx
add eax, 6
je 0x46e111
mov edx, dword [ebp - 0xc]
dec edx
mov dword [ebp - 0x10], edx
sub ebx, 0x61c88647
dec eax
mov dword [ebp - 0xc], ebx
shr ebx, 2
mov dword [ebp - 0x18], eax
and ebx, 3
xor eax, eax
test edx, edx
je 0x46e0ba
nop dword [eax]
mov esi, dword [esi + eax*4 + 4]
mov edx, esi
shr ecx, 5
shr edx, 3
lea edi, [esi*4]
xor edi, ecx
mov ecx, dword [ebp - 4]
shl ecx, 4
xor edx, ecx
mov ecx, eax
add edi, edx
and ecx, 3
mov edx, dword [ebp + 0xc]
xor ecx, ebx
mov edx, dword [edx + ecx*4]
xor edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, esi
mov esi, dword [ebp - 8]
add edx, ecx
xor edi, edx
add dword [esi + eax*4], edi
mov ecx, dword [esi + eax*4]
inc eax
mov dword [ebp - 4], ecx
cmp eax, dword [ebp - 0x10]
jb 0x46e070
mov esi, dword [esi]
and eax, 3
shr ecx, 5
mov edx, esi
xor eax, ebx
shr edx, 3
mov ebx, dword [ebp - 0xc]
lea edi, [esi*4]
xor edi, ecx
mov ecx, dword [ebp - 4]
shl ecx, 4
xor edx, ecx
mov ecx, dword [ebp + 0xc]
add edi, edx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ecx + eax*4]
mov eax, ebx
xor ecx, dword [ebp - 4]
xor eax, esi
mov esi, dword [ebp - 8]
add ecx, eax
mov eax, dword [ebp - 0x14]
xor edi, ecx
add dword [eax], edi
mov ecx, dword [eax]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
test eax, eax
jne 0x46e053
mov edi, dword [ebp + 8]
mov edi, dword [edi + 0x10]
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ecx + 0x14]
mov eax, ebx
mov edx, dword [ecx + 0x10]
sub eax, edx
cmp edi, eax
ja 0x46e14c
lea eax, [edi + edx]
mov dword [ecx + 0x10], eax
cmp ebx, 0x10
jb 0x46e12f
mov ecx, dword [ecx]
push edi
push dword [ebp - 8]
lea esi, [ecx + edx]
push esi
call sub.msvcrt.dll_memmove
add esp, 0xc
mov byte [esi + edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
push esi
mov byte [ebp + 0xc], 0
push dword [ebp + 0xc]
push edi
call fcn.004342a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46e170
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
mov dword [ebp - 8], eax
cmp dword [eax + 0x14], 0x10
jb 0x46e189
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
push ebx
push esi
push edi
mov edi, dword [eax + 0x10]
xor edx, edx
mov ebx, edi
mov esi, dword [ecx]
shr ebx, 2
mov eax, 0x34
div ebx
mov dword [ebp - 0x10], ebx
mov ebx, 0xb54cda56
imul eax, eax, 0x61c88647
mov dword [ebp - 4], esi
sub ebx, eax
mov dword [ebp - 0xc], ebx
je 0x46e282
mov eax, dword [ebp - 0x10]
mov edx, dword [ecx]
lea esi, [eax - 1]
dec eax
mov dword [ebp - 0x14], esi
lea eax, [ecx + eax*4]
mov dword [ebp - 0x10], eax
nop dword [eax]
shr ebx, 2
mov eax, esi
and ebx, 3
test eax, eax
je 0x46e228
nop dword [eax]
mov esi, dword [ecx + eax*4 - 4]
lea edi, [edx*4]
mov ecx, esi
shr edx, 3
shr ecx, 5
xor edi, ecx
mov ecx, esi
shl ecx, 4
xor edx, ecx
mov ecx, eax
add edi, edx
and ecx, 3
mov edx, dword [ebp + 0xc]
xor ecx, ebx
mov edx, dword [edx + ecx*4]
mov ecx, dword [ebp - 0xc]
xor edx, esi
xor ecx, dword [ebp - 4]
add edx, ecx
mov ecx, dword [ebp - 8]
xor edi, edx
sub dword [ecx + eax*4], edi
mov edx, dword [ecx + eax*4]
mov dword [ebp - 4], edx
sub eax, 1
jne 0x46e1e0
mov ecx, dword [ebp - 0x10]
lea edi, [edx*4]
shr edx, 3
and eax, 3
xor eax, ebx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ecx]
mov ecx, esi
shr ecx, 5
xor edi, ecx
mov ecx, esi
shl ecx, 4
xor edx, ecx
mov ecx, dword [ebp + 0xc]
add edi, edx
mov ecx, dword [ecx + eax*4]
mov eax, ebx
xor eax, dword [ebp - 4]
xor ecx, esi
mov esi, dword [ebp - 0x14]
add ecx, eax
xor edi, ecx
mov ecx, dword [ebp - 8]
sub dword [ecx], edi
add ebx, 0x61c88647
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], ebx
jne 0x46e1d0
mov edi, dword [ebp + 8]
mov edi, dword [edi + 0x10]
mov edx, dword [ebp + 0x10]
mov ebx, dword [edx + 0x14]
mov eax, ebx
mov esi, dword [edx + 0x10]
sub eax, esi
cmp edi, eax
ja 0x46e2ba
lea eax, [edi + esi]
mov dword [edx + 0x10], eax
cmp ebx, 0x10
jb 0x46e2a0
mov edx, dword [edx]
push edi
add esi, edx
push ecx
push esi
call sub.msvcrt.dll_memmove
add esp, 0xc
mov byte [esi + edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
push ecx
mov byte [ebp + 0xc], 0
mov ecx, edx
push dword [ebp + 0xc]
push edi
call fcn.004342a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46e6f7
Capabilities:
Check os version

Disassembly:
mov eax, dword fs:[0x18]
sub esp, 0x74
mov eax, dword [eax + 0x30]
cmp dword [eax + 0xa4], 6
jae 0x46e8dd
cmp dword [0x4cad20], 0
jne 0x46e8d6
push ebx
push ebp
push edi
push fcn.0046eb7b
mov edx, str.NtOpenKeyedEvent
mov ecx, 0x4c8010
call fcn.0046eaee
mov ebx, eax
test ebx, ebx
jne 0x46e749
push eax
push eax
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
push 0x5c
pop edx
push 0x4b
pop eax
push 0x65
pop ecx
push 0x72
mov word [esp + 0x36], ax
pop eax
push 0x6e
mov word [esp + 0x3a], ax
pop eax
push 0x6c
mov word [esp + 0x3c], ax
pop eax
push 0x4f
pop edi
push 0x62
mov word [esp + 0x40], ax
pop eax
push 0x6a
mov word [esp + 0x44], ax
pop eax
push 0x63
mov word [esp + 0x46], ax
mov word [esp + 0x38], cx
mov word [esp + 0x3e], cx
mov word [esp + 0x48], cx
pop ecx
push 0x74
pop ebp
push 0x73
pop eax
push 0x43
mov word [esp + 0x4e], ax
pop eax
push 0x72
mov word [esp + 0x52], ax
mov word [esp + 0x34], dx
mov word [esp + 0x50], dx
pop edx
push 0x69
pop eax
push 0x53
mov word [esp + 0x56], ax
pop eax
push 0x65
mov word [esp + 0x5a], ax
pop eax
push 0x75
mov word [esp + 0x5c], ax
pop eax
push 0x66
mov word [esp + 0x62], ax
pop eax
push 0x4d
mov word [esp + 0x68], ax
pop eax
push 0x65
mov word [esp + 0x4a], cx
mov word [esp + 0x5e], cx
pop ecx
push 0x6d
mov word [esp + 0x6a], ax
pop eax
push 0x6f
mov word [esp + 0x6e], ax
pop eax
push 0x79
mov word [esp + 0x70], ax
pop eax
mov word [esp + 0x3e], di
mov word [esp + 0x48], bp
mov word [esp + 0x50], dx
mov word [esp + 0x54], bp
mov word [esp + 0x5c], di
mov word [esp + 0x60], bp
mov word [esp + 0x62], di
mov word [esp + 0x68], cx
mov word [esp + 0x6e], dx
mov word [esp + 0x70], ax
push 0x45
pop eax
mov word [esp + 0x72], ax
lea edi, [esp + 0x24]
push 0x76
pop eax
mov word [esp + 0x74], ax
push 0x6e
pop eax
mov word [esp + 0x78], ax
xor eax, eax
mov word [esp + 0x7c], ax
push 0x4c
pop eax
mov word [esp + 0x10], ax
mov word [esp + 0x12], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
xor eax, eax
mov word [esp + 0x7a], bp
xor ebp, ebp
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], ebp
stosd dword es:[edi], eax
mov word [esp + 0x76], cx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x2000000
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
jns 0x46e8b7
push ebp
push ebp
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov ecx, dword [esp + 0xc]
mov edx, 0x4cad20
xor eax, eax
lock cmpxchg dword [edx], ecx
pop edi
pop ebp
pop ebx
test eax, eax
je 0x46e8d6
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4cad20]
jmp 0x46e8df
xor eax, eax
add esp, 0x74
ret
Function at 0x4748a0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004748b0

Function at 0x474b30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x474b3c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.00474b50

Function at 0x477a10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call sub.msvcrt.dll__beginthreadex
mov dword [esi], eax
add esp, 0x18
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
pop esi
pop ebp
ret