joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f51a
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [0x540090], 0
push ebx
mov esi, dword [ebp + 8]
jne 0x42f561
call fcn.0042f4ae
cmp dword [0x540090], 0
jne 0x42f55c
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x540080], eax
inc eax
jne 0x42f552
call fcn.0042f4b9
xor eax, eax
jmp 0x42f5e1
mov dword [0x540090], 1
call fcn.0042f4b9
push dword [0x540080]
call sub.KERNEL32.dll_TlsGetValue
test esi, esi
mov ebx, eax
jle 0x42f5a9
test eax, eax
jne 0x42f5df
push 0xc
call fcn.0042e9f0
mov ebx, eax
pop eax
test ebx, ebx
je 0x42f5df
mov eax, dword [0x5287e4]
mov dword [ebx], eax
mov eax, dword [0x5287e8]
mov dword [ebx + 4], eax
mov eax, dword [0x5287ec]
mov dword [ebx + 8], eax
push ebx
push dword [0x540080]
call sub.KERNEL32.dll_TlsSetValue
jmp 0x42f5df
test eax, eax
setne al
shr esi, 0x1f
test eax, esi
je 0x42f5df
push 0xc
push 0x5287e4
push ebx
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x42f5df
push ebx
call fcn.0042ea02
push 0
xor ebx, ebx
push dword [0x540080]
call sub.KERNEL32.dll_TlsSetValue
pop eax
mov eax, ebx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x46cfa5
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x130
mov edi, dword [ebp + 0xc]
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp eax, 0xffffffff
je 0x46d022
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x13c], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x46d01c
cmp dword [ebp - 0x124], edi
jne 0x46d00d
push dword [ebp - 0x134]
push 0
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov ebx, eax
test eax, eax
je 0x46d00d
push 0xffffffffffffffff
push eax
call sub.KERNEL32.dll_TerminateProcess
push ebx
call sub.KERNEL32.dll_CloseHandle
lea eax, [ebp - 0x13c]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
jmp 0x46cfdb
push esi
call sub.KERNEL32.dll_CloseHandle
push 0xffffffffffffffff
push dword [ebp + 8]
call sub.KERNEL32.dll_TerminateProcess
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x46e24d
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa0
lea ebx, [ebp - 0xa4]
push 0x94
push 0x4d2250
push ebx
call fcn.0047d340
add esp, 0xc
cmp dword [0x540360], 0
jne 0x46e2d9
push ebx
call sub.KERNEL32.dll_GetVersionExA
test eax, eax
je 0x46e296
cmp dword [ebp - 0x94], 2
jne 0x46e296
mov dword [0x540320], 1
mov dword [0x540390], 1
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [0x540340], eax
push eax
push 0
push 0x46df15
push 3
call sub.USER32.dll_SetWindowsHookExA
mov dword [0x540330], eax
push 1
call sub.WINMM.DLL_timeBeginPeriod
push 0x46dd9b
call fcn.004012d0
mov dword [0x540360], 1
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x46e2de
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
jmp 0x46e3c1
mov ecx, dword [ebp - 0x20]
sub ecx, 0x100
cmp ecx, 5
ja 0x46e37e
mov eax, 1
shl eax, cl
test al, 0x33
je 0x46e37e
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
jb 0x46e37e
cmp eax, 0x12
jbe 0x46e31c
sub eax, 0x5b
cmp eax, 1
ja 0x46e37e
mov dword [0x540350], 0
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x46e339
or dword [0x540350], 1
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x46e34c
or dword [0x540350], 2
push 0x12
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x46e35f
or dword [0x540350], 4
push 0x5b
call sub.USER32.dll_GetKeyState
test ax, ax
js 0x46e377
push 0x5c
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x46e37e
or dword [0x540350], 8
mov eax, dword [ebp - 0x24]
call fcn.0046ddba
test eax, eax
je 0x46e3b2
push dword [ebp - 0x24]
jmp 0x46e390
push ebx
call sub.USER32.dll_GetParent
mov ebx, eax
test eax, eax
je 0x46e3b2
call fcn.0046ddba
test eax, eax
jne 0x46e38f
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.USER32.dll_IsDialogMessageA
test eax, eax
jne 0x46e3c1
lea ebx, [ebp - 0x24]
push ebx
call sub.USER32.dll_TranslateMessage
push ebx
call sub.USER32.dll_DispatchMessageA
lea eax, [ebp - 0x24]
push 1
push 0
push 0
push 0
push eax
call sub.USER32.dll_PeekMessageA
test eax, eax
jne 0x46e2ea
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x46e3df
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xff
push 0xffffffffffffffff
push 0
push 0
push 0
call sub.USER32.dll_MsgWaitForMultipleObjects
leave
jmp fcn.0046e2de

Function at 0x46e8f7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x540320], 0
mov eax, dword [ebp + 8]
je 0x46e920
push 0xa
push 0
push 0
push eax
call fcn.00471dab
mov dword [esp], eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteW
jmp 0x46e938
push 0xa
push 0
push 0
push eax
call fcn.00471d91
mov dword [esp], eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
cmp eax, 0x20
leave
setg al
movzx eax, al
ret
Function at 0x46f064
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00471d91
mov dword [esp], eax
call sub.WSOCK32.DLL_gethostbyname
mov ecx, eax
xor eax, eax
test ecx, ecx
je 0x46f094
movsx edx, word [ecx + 8]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
movsx edx, word [ecx + 0xa]
mov dword [eax], edx
mov eax, dword [ecx + 0xc]
leave
ret

Function at 0x46f096
Capabilities:
Connect socket

Disassembly:
push ebp
or eax, 0xffffffff
mov ebp, esp
push edi
sub esp, 0x10
cmp dword [ebp + 0x10], 2
jne 0x46f0e4
cld
xor eax, eax
lea edi, [ebp - 0x14]
mov ecx, 4
rep stosd dword es:[edi], eax
movzx eax, word [ebp + 0x18]
mov word [ebp - 0x14], 2
push eax
call sub.WSOCK32.DLL_htons
push dword [ebp + 0x14]
push dword [ebp + 0xc]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
call fcn.0047d340
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [ebp + 8]
call sub.WSOCK32.DLL_connect
mov edi, dword [ebp - 4]
leave
ret

Function at 0x46f482
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.WSOCK32.DLL_WSAStartup
push 0x46f479
call fcn.004012d0
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [0x54f7d0], eax
lea edx, [eax + 0x20]
add eax, 0x40
mov dword [0x54f7f0], edx
mov dword [0x54f7e0], eax
leave
ret

Function at 0x4730b7
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0x54f810
call sub.KERNEL32.dll_InitializeCriticalSection
call sub.KERNEL32.dll_TlsAlloc
push 0xb8
mov dword [0x54ab10], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
mov dword [eax + 4], 0
lea eax, [eax + 8]
push pe_nt_image_headers32
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], eax
call sub.KERNEL32.dll_GetCurrentThreadId
push 2
push 0
mov dword [ebx + 0xb4], eax
lea eax, [ebx + 0xb0]
push 0
push eax
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_GetCurrentThread
push eax
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_DuplicateHandle
add esp, 0x10
test eax, eax
jne 0x473142
push 0xffffffffffffffff
call sub.msvcrt.dll_exit
push ebx
push dword [0x54ab10]
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [0x54aae0]
mov dword [ebx], eax
mov dword [0x54aae0], ebx
mov dword [0x54ab00], ebx
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x473166
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x2d0
lea ebx, [ebp - 0x2d8]
push 0xb8
call sub.msvcrt.dll_malloc
mov esi, eax
mov eax, dword [ebp + 8]
push pe_nt_image_headers32
push 0
mov dword [esi + 4], eax
lea eax, [esi + 8]
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x88], 0
mov dword [esi + 8], eax
lea eax, [esi + 0xb4]
push eax
push 4
push esi
push 0x473020
push 0
push 0
call sub.KERNEL32.dll_CreateThread
push 0x2cc
mov dword [esi + 0xb0], eax
push 0x4d46b0
push ebx
call fcn.0047d340
push ebx
push dword [esi + 0xb0]
call sub.KERNEL32.dll_GetThreadContext
mov eax, dword [ebp - 0x214]
add esp, 0x1c
mov dword [esi + 0x8c], eax
cmp dword [0x54f830], 0
je 0x473205
push 0x54f810
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, 0x54aaf0
mov edx, dword [0x54aaf0]
test edx, edx
je 0x473230
cmp dword [edx + 0x88], 0
je 0x47322a
mov eax, dword [edx]
mov dword [ebx], eax
push edx
call fcn.0047d2f0
pop ecx
jmp 0x47322c
mov ebx, edx
mov edx, dword [ebx]
jmp 0x473210
mov eax, dword [0x54aae0]
mov dword [0x54aae0], esi
mov dword [esi], eax
cmp dword [0x54f830], 0
je 0x473250
push 0x54f810
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, esi
mov dword [0x54f830], 1
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x4732d8
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax + 0xb0]
call sub.KERNEL32.dll_ResumeThread
leave
ret

Function at 0x4732eb
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2d0
call fcn.004732b5
mov esi, dword [0x54aae0]
mov edi, eax
test esi, esi
je 0x4733ab
cmp esi, edi
je 0x4733a4
push dword [esi + 0xb0]
call sub.KERNEL32.dll_SuspendThread
lea ebx, [ebp - 0x2dc]
push 0x2cc
push 0x4d497c
push ebx
call fcn.0047d340
push ebx
push dword [esi + 0xb0]
call sub.KERNEL32.dll_GetThreadContext
mov eax, dword [ebp - 0x240]
mov dword [esi + 0x94], eax
mov eax, dword [ebp - 0x23c]
mov dword [esi + 0x98], eax
mov eax, dword [ebp - 0x238]
mov dword [esi + 0x9c], eax
mov eax, dword [ebp - 0x234]
mov dword [esi + 0xa0], eax
mov eax, dword [ebp - 0x230]
mov dword [esi + 0xa4], eax
mov eax, dword [ebp - 0x22c]
mov dword [esi + 0xa8], eax
mov eax, dword [ebp - 0x228]
mov dword [esi + 0xac], eax
mov eax, dword [ebp - 0x218]
mov dword [esi + 0x90], eax
add esp, 0xc
mov esi, dword [esi]
jmp 0x473304
mov eax, dword [0x54aae0]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4733b8
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
call fcn.004732b5
mov ebx, dword [0x54aae0]
mov esi, eax
test ebx, ebx
je 0x4733e1
cmp ebx, esi
je 0x4733dd
push dword [ebx + 0xb0]
call sub.KERNEL32.dll_ResumeThread
mov ebx, dword [ebx]
jmp 0x4733ca
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x475f90
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x475fc6
mov dword [0x54eb50], eax
mov edx, 0x475f70
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0047ba20
test eax, eax
sete al
movzx eax, al
mov dword [0x4d4c80], eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x4d4c80], eax
leave
ret

Function at 0x4760b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], 0x475350
mov dword [ebp - 0x24], 0x47e5b4
mov dword [ebp - 0x1c], 0x476170
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.0047c540
cmp dword [0x4d4c80], 0
mov dword [ebp - 0x44], 0x54eb60
je 0x476150
jl 0x476190
mov dword [ebp - 0x3c], 1
mov eax, dword [0x54eb50]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x476233
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.0047c620
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x54f530]
mov eax, 0xffffffff
test edx, edx
je 0x4761aa
mov eax, dword [0x4d4c84]
test eax, eax
je 0x4761ea
xor eax, eax
test eax, eax
jne 0x4761e0
mov edi, dword [0x4d4c80]
test edi, edi
js 0x4761e0
mov dword [ebp - 0x44], 0x54eb60
mov ebx, dword [0x4d4c80]
test ebx, ebx
je 0x476150
jmp 0x4760fe
xor esi, esi
mov dword [0x4d4c80], esi
jmp 0x4761b8
mov dword [esp], 0x4d4c88
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.dll_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x476271
mov eax, dword [0x4d4c84]
test eax, eax
jne 0x4761a8
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x4d4c84]
test eax, eax
je 0x47620d
jmp 0x4761a8
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x476265
mov dword [esp + 4], eax
mov eax, dword [0x54eb50]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x47629a
test edx, edx
je 0x476285
mov dword [ebp - 0x3c], 1
call fcn.00475ee0
call fcn.00475f90
mov eax, 1
mov dword [0x4d4c84], eax
jmp 0x4761a8
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x476146
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
jmp 0x476261
Function at 0x47c430
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x54f950]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x47c470
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.0047ba20
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x47c820
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x54f950]
mov edi, dword [ebp + 8]
test eax, eax
je 0x47c8fc
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x47c911
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x47c8d0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x47c868
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x47c878
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x47c8c3
test edx, edx
jne 0x47c8b6
test ecx, ecx
je 0x47c860
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x47c920
cmp eax, 8
je 0x47c860
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x47c852
call fcn.0047baf0
mov eax, dword [0x54f950]
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x47c844
call fcn.0047c490
mov eax, dword [0x54f950]
jmp 0x47c844
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.0047c790
cmp eax, 7
jne 0x47c8bb
mov eax, dword [0x54f950]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x47c973
mov edi, dword [eax + 0x30]
test edi, edi
js 0x47c99e
mov esi, dword [eax + 0x30]
test esi, esi
jne 0x47c97f
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.0047baf0
mov eax, dword [0x54f950]
jmp 0x47c951
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x47c962
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x47c962
call fcn.0047c490
mov eax, dword [0x54f950]
jmp 0x47c958
Function at 0x47cc00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x54f950]
mov edi, dword [ebp + 8]
test eax, eax
je 0x47cc94
mov esi, dword [eax + 0x30]
test esi, esi
js 0x47ccb0
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x47ccd0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x47cc88
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0047c790
cmp eax, 7
jne 0x47cd4f
mov eax, dword [0x54f950]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x47cd26
mov edx, dword [eax + 0x30]
test edx, edx
js 0x47cd40
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x47cd00
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0047c9b0
jmp 0x47cc45
call fcn.0047baf0
mov eax, dword [0x54f950]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x47cc20
lea esi, [esi]
call fcn.0047c490
mov eax, dword [0x54f950]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x47cc2b
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x47cc2e
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x47cc77
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x47cc77
call fcn.0047baf0
mov eax, dword [0x54f950]
mov edx, dword [eax + 0x30]
test edx, edx
jns 0x47cc69
nop
lea esi, [esi]
call fcn.0047c490
mov eax, dword [0x54f950]
jmp 0x47cc69
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x47cd60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x47cdf2
mov eax, dword [0x54f950]
test eax, eax
je 0x47cde6
mov ebx, dword [eax + 0x30]
test ebx, ebx
js 0x47ce61
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x47ce07
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.0047c9b0
cmp eax, 7
jne 0x47ce7f
mov eax, dword [0x54f950]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x47ce52
mov edx, dword [eax + 0x30]
test edx, edx
js 0x47ce70
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x47ce33
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.0047baf0
mov eax, dword [0x54f950]
jmp 0x47cd82
mov dword [esp], edi
call fcn.0047c820
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x47cd97
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x47cdd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x47cdd5
call fcn.0047baf0
mov eax, dword [0x54f950]
jmp 0x47cdc0
call fcn.0047c490
mov eax, dword [0x54f950]
jmp 0x47cd8d
call fcn.0047c490
mov eax, dword [0x54f950]
jmp 0x47cdcb
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x295b44c
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
jne fcn.0294ff41
inc ecx
mov ecx, edi
xor esi, eax
bswap si
test cx, bp
sub ecx, ebx
inc esi
mov esi, esp
stc
test bl, 0xc4
pushfd
push ebp
sub edi, 4
pushfd
push dword [edi]
pop dword [esp + 8]
stc
bt esp, esp
add esp, 8
jl 0x2972d1f
cmp edi, ebx
jmp 0x2970672
ja fcn.0172c67a
sbb al, 9
cmc
mov al, bl
sub ebx, edi
pushfd
ror al, 5
add esp, 4
add ebx, esp
lea edi, [esp + 0x7901aa92]
not al
add al, ah
mov edi, ebx
setp al
dec al
sar al, 5
test di, si
mov al, 0x2e
pushal
cmp cx, cx
cmp cl, al
mov byte [esp], bh
repne scasb al, byte es:[edi]
pushfd
pushfd
lea esp, [esp + 0x28]
jne 0x2957bf3
jne 0x29706b6
jmp [eax - 0x3f]
push 0x1ce7a3c1
mov byte [edi - 1], 0
lahf
mov dword [esp], ebx
push ebx
bswap ax
call fcn.02974ee1
or ch, byte [0x13e0576f]
push 0xa
xchg edx, eax
and esi, dword [edx]
test edx, esp
xlatb
mov byte [0xd2f53e92], al
xchg esi, eax
and byte [esi], bh
jne 0x29706b6
pop edx
pop edx
inc esp
sahf
adc al, 0x26
movntps xmmword [eax - 0x26], xmm2
adc al, 0x5d
xlatb
sbb byte [ebx - 0x1d], 0xcf
imul ecx, edx, 0xffffff85
mov al, 0xe7
cld
sub ah, dh
cli
xor dword [ecx - 0x22aad099], 0xffffffd5
rcr dword gs:[ebp - 0x1e], cl
aas
invalid
test bx, dx
clc
clc
cmp edi, ebx
call fcn.029585c5

Function at 0x2962d39
Capabilities:
Encode data using xor

Disassembly:
push 0x17a92171
neg dl
pushfd
push 0x97a94f3b
rol dl, 1
pushfd
stc
push dword [esp + 4]
add dl, 0x4e
clc
push word [esp + 0x42]
inc edx
popf
call fcn.029783bf
test byte [ecx + 0x153cedd9], dh
push 0x74
cld
cmp eax, 0xe45473c0
adc byte [eax + 0x45746ec8], ch
xor al, 5
clc
mov ebx, 0x783caf88
aam 0xde
pop esp
fdivr st(0)
cmp al, 0xa
ja 0x295aa41
mov bl, 0x68
lodsb al, byte [esi]
in eax, 0x6d
dec eax
or eax, 0x4adb9eaa
pop esi
jmp 0x295aa8e
adc dh, al
mov esp, 0xc92210c7
add eax, 0xce06c833
retf
pushf
pop word [esp + 0x26]
push dword [esp]
rcl dl, cl
setp dl
mov dl, byte [esi]
cmp edi, 0x2afeecb0
xor dl, 0x7b
cmc
neg dl
test cl, 0x9d
cmc
clc
push edx
add dl, 0xe9
stc
jmp 0x295aa24