joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e496
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x577028]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x42e4f7
push esi
push dword [0x577024]
push 8
push dword [0x575c14]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x577028]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x577020]
jmp 0x42e4e7
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x42e4e5
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x42e4d5
push edi
push 0x42e434
call fcn.00462d47
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4

Function at 0x42e501
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ecx, esi
push edi
and ecx, 3
je 0x42e517
push 4
pop eax
sub eax, ecx
add esi, eax
mov eax, dword [0x577024]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x42e54e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
push 8
push dword [0x575c14]
mov dword [0x577028], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x577028]
call ebx
mov eax, dword [0x577024]
mov edi, eax
add eax, esi
push eax
push dword [0x577028]
mov dword [0x577024], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x575c14]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x577028]
call ebx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test esi, esi
jne 0x42e58e
test ebx, ebx
je 0x42e5af
push 0x14
push 0x577020
call fcn.0042eeb7
pop ecx
pop ecx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
test esi, esi
je 0x42e5af
lea ecx, [edi + ebp]
push ecx
call esi
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x42f030
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x572870]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
sub edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x42f076
mov ecx, dword [ebp - 4]
add ecx, 0xa
push ecx
push 0
mov edx, dword [0x5775e0]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x42f097
mov edx, dword [ebp - 4]
add edx, 0xa
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x5775e0]
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
shr edx, 1
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.0042f730
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x42f160
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x572870]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ebp - 4]
add eax, dword [edx + 8]
mov esp, ebp
pop ebp
ret

Function at 0x42f1c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x572870]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 2
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret

Function at 0x42f3f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x572870]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x42f414
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
lea eax, [ecx + edx*2]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
sub edx, 4
cmp dword [ebp - 8], edx
jl 0x42f464
mov eax, dword [ebp - 8]
add eax, 0x4000
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x5775e0]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x42f4ac
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0x100000
jle 0x42f4ac
cmp dword [ebp - 8], 0x100000
jge 0x42f480
mov dword [ebp - 8], 0x100000
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x5775e0]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*2]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x42f4d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x572870]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
shl ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
sub eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x42f650
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x572870]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x42f68e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x42f68e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x42f690
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x42f700
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x572870]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x42fae0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x572870]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x43a550
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x43a570
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x43a570
mov eax, dword [eax + 0x44]
test eax, eax
je 0x43a570
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x44c800
Capabilities:
Query environment variable

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
mov dword [edi + 4], 0
call fcn.0044e920
push 0x54
push edi
mov dword [esp + 0x14], eax
call fcn.0044e8f0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x44c847
push edi
call fcn.0044e930
mov ecx, dword [edi]
push edi
mov dword [ecx + 0x14], 0x38
mov ecx, dword [edi]
mov dword [ecx + 0x18], esi
mov eax, dword [edi]
mov eax, dword [eax]
call eax
add esp, 8
mov dword [esi], fcn.0044c490
mov dword [esi + 4], fcn.0044c320
mov dword [esi + 8], fcn.0044c3f0
mov dword [esi + 0xc], fcn.0044c270
mov dword [esi + 0x10], 0x44cb60
mov dword [esi + 0x14], 0x44caf0
mov dword [esi + 0x18], 0x44c950
mov dword [esi + 0x1c], 0x44c120
mov dword [esi + 0x20], 0x44bfd0
mov dword [esi + 0x24], 0x44c700
mov dword [esi + 0x28], 0x44cbd0
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 8]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x44c92a
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], 0x78
push ecx
lea ecx, [esp + 0xc]
push ecx
push str._ld_c
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x44c92a
mov al, byte [esp + 0x10]
cmp al, 0x6d
je 0x44c919
cmp al, 0x4d
mov eax, dword [esp + 8]
jne 0x44c921
imul eax, dword [esp + 8], 0x3e8
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ecx
ret
Function at 0x462d47
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x577068], 0
push ebx
push esi
mov esi, 0x577070
jne 0x462d73
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x577088], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x577068], 1
push dword [0x577088]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x462e10
push 0x14
push 8
push dword [0x575c14]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x462e3a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x57706c]
test eax, eax
je 0x462db5
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x57706c], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x462e3f
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x577088]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x575c14]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x462e3a
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x463329
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x184
push 8
push dword [0x575c14]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x5774cc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x5774d0], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.00465f39
mov dword [esi + 0x58], 0x463f3c
mov eax, esi
mov dword [esi + 0x5c], 0x463f88
mov dword [esi + 0x10], fcn.00463add
mov dword [esi + 0x30], 0x4639cf
mov dword [esi + 0x64], 0x464012
mov dword [esi + 0x60], 0x463fca
mov dword [esi + 0x34], 0x46367f
mov dword [esi + 0x24], 0x463656
mov dword [esi + 0x28], 0x46362b
mov dword [esi + 0x2c], 0x46357d
mov dword [esi + 0x44], 0x463d42
pop esi
ret 4
Function at 0x469203
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xd4]
mov dword [esp + 4], eax
test edx, edx
je 0x4692b9
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
neg eax
add ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
push ebp
push edi
lea edi, [ecx + eax*4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xcc]
mov ebp, edi
imul ecx, ebx
add ecx, dword [esi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x469299
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, esi
dec edx
jne 0x469274
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec edx
inc ebx
cmp dword [esi + 0xe8], 0
mov dword [esp + 0x3c], edx
jne 0x4692ae
add edi, dword [esp + 0x14]
jmp 0x4692b2
add edi, dword [esp + 0x24]
test edx, edx
jne 0x469252
pop edi
pop ebp
pop ebx
pop esi
pop ecx
pop ecx
ret 0x24

Function at 0x4695c4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], edx
test ebx, ebx
je 0x46969e
imul eax, dword [esp + 0x1c], 3
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
neg ecx
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
push edi
imul edi, dword [esp + 0x30], 3
mov dword [esp + 0x10], ecx
add eax, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], edi
mov esi, dword [eax + 0xcc]
imul esi, ebp
mov dword [esp + 0x34], edi
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x28]
test edx, edx
jle 0x469674
mov ebp, dword [esp + 0x34]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov edi, edx
movzx eax, byte [esi]
movzx ecx, byte [ebp]
imul ecx, dword [esp + 0x40]
imul eax, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [esi], al
inc esi
dec edi
jne 0x46963c
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x46968b
add edi, ecx
jmp 0x46968f
add edi, dword [esp + 0x24]
mov dword [esp + 0x38], edi
test ebx, ebx
jne 0x469612
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x469cbe
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x469d73
imul eax, dword [esp + 0x20]
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x34]
add eax, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x469d54
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [ecx], al
add ecx, edi
dec esi
jne 0x469d2f
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x3c], esi
jne 0x469d69
add edx, dword [esp + 0x14]
jmp 0x469d6d
add edx, dword [esp + 0x24]
test esi, esi
jne 0x469d0d
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 0x24
Function at 0x10017bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10017bdf
pop dword [ebp - 0x40]
mov eax, 0xea17e6a3
sub eax, 0xda166ac4
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x67f1e85
add dword [ebp - 0x50], 0x47d326c6
mov dword [ebp - 0x4c], 0x2ead2c8
sub dword [ebp - 0x4c], 0xd0b78683
mov dword [ebp - 0x48], 0xa73c475a
add dword [ebp - 0x48], 0xa50ffcd4
mov dword [ebp - 0x44], 0xe7a9043f
add dword [ebp - 0x44], 0x1856fbc1
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x50ee130f
add dword [ebp - 0x50], 0x23845647
mov dword [ebp - 0x4c], 0x84e909fb
add dword [ebp - 0x4c], 0xbc83577a
mov dword [ebp - 0x48], 0x2090a618
sub dword [ebp - 0x48], 0xbd2139ac
mov dword [ebp - 0x44], 0xfb8ae0d3
add dword [ebp - 0x44], 0x4751f2d
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x7a60850f
add eax, 0x95a36b3d
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x4779f
push 0
call eax
mov ecx, 0x4d9c
mov edx, eax
mov ebx, 0x33f7cab3
sub ebx, 0x23f27cb3
add ebx, dword [ebp - 0x40]
mov esi, 0xed526a5
mov dword [ebp - 0x2c], 0x4daf7f5c
mov edi, dword [ebx]
add dword [ebp - 0x18], 0x47315256
add edi, esi
xor dword [ebp - 0x14], edx
mov dword [edx], edi
add edx, 0x3aefcee9
sub edx, 0x3aefcee5
add ebx, 0x4345eae4
add ebx, 0xbcba1520
loop 0x10017cf0
add eax, 0xde250a19
sub eax, 0xde23e0d6
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x100366e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e348
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004e2d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1004e28c]
cmp eax, 0xffffffff
jne 0x10036716
xor ebx, ebx
jmp 0x1003671f
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003675f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003679e
test esi, esi
jne 0x100367a2
push 0x10035270
push 0x1004fad8
call fcn.10017bd0
mov eax, dword [0x1004e28c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003675f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003678c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003678c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100367e4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x100367cd
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x100367a2
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10036730
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10036809
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x10036809
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10017bd0
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100367f0
jmp 0x10036730
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401bd7
pop dword [ebp - 0x24]
mov eax, 0x8bdb9148
add eax, 0x74648a8f
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xae6c58af
sub dword [ebp - 0x34], 0x601a1364
mov dword [ebp - 0x30], 0x6768fc73
sub dword [ebp - 0x30], 0x3535b02e
mov dword [ebp - 0x2c], 0x7e547527
add dword [ebp - 0x2c], 0xcdf7cf07
mov dword [ebp - 0x28], 0xcb177916
add dword [ebp - 0x28], 0x34e886ea
lea eax, [ebp - 0x34]
push eax
mov eax, 0x9f2a07a4
add eax, 0x611668bc
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x3adae57c
sub dword [ebp - 0x34], 0xc6687c26
mov dword [ebp - 0x30], 0x75cb4007
add dword [ebp - 0x30], 0xcba1216e
mov dword [ebp - 0x2c], 0xbf16a78
add dword [ebp - 0x2c], 0x577e01f4
mov dword [ebp - 0x28], 0x9b96f362
sub dword [ebp - 0x28], 0x9b96f362
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x9984845f
sub eax, 0x9944135f
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x35ccf
push 0
call eax
mov ecx, 0xa21efa65
sub ecx, 0xa21eb57e
mov edx, eax
mov ebx, 0x530e0c46
sub ebx, 0x52cd0c46
add ebx, dword [ebp - 0x24]
mov edi, 0x38b3fcb8
sub edi, 0x673a7a86
sub dword [ebp - 0x1c], edx
mov esi, dword [ebx]
sub dword [ebp - 0x18], 0x50bd4d2
sub esi, edi
add dword [ebp - 8], eax
mov dword [edx], esi
xor dword [ebp - 0xc], ecx
add edx, 0x189d1687
add edx, 0xe762e97d
add ebx, 0x49a19789
sub ebx, 0x49a19785
loop 0x401cf9
add eax, 0xf234ad04
sub eax, 0xf233a695
mov ebx, eax
add eax, 0xd22cfb92
add eax, 0x2dd30473
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret