joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c769
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [0x4df19c]
mov esi, dword [ebp + 8]
xor eax, ebp
mov dword [esp + 0x38], eax
push 0x4c
call fcn.004955e6
add esp, 4
mov ecx, eax
mov edi, eax
mov dword [esp + 4], eax
call fcn.0042c1b0
mov dword [esi], edi
lea esi, [esp + 0x28]
mov dword [esp + 8], edi
push dword [ebp + 0xc]
push esi
call fcn.0042c9e0
add esp, 8
xor edi, edi
mov ebx, 0x4c5c64
mov eax, dword [ebx + 0xc]
cmp byte [esp + 0x33], 0
mov ecx, esi
jns 0x42c7c7
mov ecx, dword [esp + 0x28]
push eax
push ecx
call fcn.004a7799
add esp, 8
test eax, eax
je 0x42c7e3
inc edi
add ebx, 0x78
cmp edi, 3
jbe 0x42c7b7
mov ebx, 0x4c5c64
mov edi, dword [esp + 4]
cmp byte [esp + 0x33], 0
jns 0x42c7fa
push dword [esp + 0x28]
call fcn.00495666
add esp, 4
xor esi, esi
cmp byte [ebx + 0x68], 0
je 0x42c80f
push dword [ebp + 0xc]
call fcn.0042c95e
add esp, 4
jmp 0x42c811
xor eax, eax
lea edx, [esp + 0x28]
lea ecx, [esp + 0x18]
mov dword [edi + 0x34], ebx
mov byte [edi + 0x48], al
movzx eax, al
lea edi, [esp + 0xc]
mov dword [edx + 4], esi
mov dword [edx], esi
mov dword [edx + 8], esi
mov dword [ecx + 4], esi
mov dword [ecx], esi
mov dword [ecx + 8], esi
push ecx
push edx
push esi
push eax
push ebx
push edi
call fcn.0042c341
add esp, 0x18
mov esi, dword [esp + 8]
lea ebx, [esi + 8]
mov ecx, ebx
push edi
mov edi, dword [esp + 8]
call fcn.0041f652
movzx eax, byte [edi + 0x13]
test al, al
js 0x42c864
mov dword [edi + 0x38], ebx
jmp 0x42c86d
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0xc]
mov dword [edi + 0x38], ecx
cmp byte [esp + 0x17], 0
mov dword [edi + 0x3c], eax
jns 0x42c883
push dword [esp + 0xc]
call fcn.00495666
add esp, 4
lea ebx, [esi + 0x14]
lea eax, [esp + 0x28]
mov ecx, ebx
push eax
call fcn.0041f652
cmp byte [edi + 0x1f], 0
jns 0x42c89a
mov ebx, dword [ebx]
add esi, 0x20
lea eax, [esp + 0x18]
mov dword [edi + 0x40], ebx
mov ecx, esi
push eax
call fcn.0041f652
cmp byte [edi + 0x2b], 0
jns 0x42c8b4
mov esi, dword [esi]
cmp byte [esp + 0x23], 0
mov dword [edi + 0x44], esi
jns 0x42c8ca
push dword [esp + 0x18]
call fcn.00495666
add esp, 4
cmp byte [esp + 0x33], 0
jns 0x42c8dd
push dword [esp + 0x28]
call fcn.00495666
add esp, 4
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.004956a1
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x42c95e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x4df19c]
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edi, [ebp - 0x218]
mov ebx, 0xfffffff4
xor eax, ebp
mov dword [ebp - 0x10], eax
mov word [edi], 0
mov eax, dword [ebx + 0x4c2438]
mov word [ebp - 0x218], 0
push 0x104
push edi
push eax
call esi
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x42c9be
push dword [ebp + 8]
push eax
push edi
call fcn.0042c8f3
add esp, 0xc
test al, al
jne 0x42c9c7
add ebx, 4
jne 0x42c98a
xor ebx, ebx
jmp 0x42c9c9
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004956a1
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42f630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [0x4df19c]
mov edi, dword [ebp + 0xc]
mov esi, ecx
lea ebx, [ebp - 0x2c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x56
push str..._.._base_files_file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.004262e0
add esp, 0x10
lea ecx, [ebp - 0x1c]
push 0
push ebx
call fcn.0042f0b0
test edi, edi
js 0x42f6b1
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
call fcn.0042d600
call fcn.00442080
test al, al
je 0x42f698
mov eax, edi
lea ecx, [ebp - 0x2c]
sar eax, 0x1f
push eax
push edi
push esi
push str.File::ReadAtCurrentPos
call fcn.00442100
lea eax, [ebp - 0x30]
push 0
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42f6b8
mov ebx, dword [ebp - 0x30]
jmp 0x42f6c8
mov ebx, 0xffffffff
jmp 0x42f6d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
lea ecx, [ebp - 0x2c]
call fcn.004420e0
lea ecx, [ebp - 0x1c]
call fcn.0042f1a0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004956a1
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x42f6f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [0x4df19c]
mov edi, dword [ebp + 0xc]
mov esi, ecx
lea ebx, [ebp - 0x2c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x87
push str..._.._base_files_file_win.cc
push str.WriteAtCurrentPos
push ebx
call fcn.004262e0
add esp, 0x10
lea ecx, [ebp - 0x1c]
push 0
push ebx
call fcn.0042f0b0
test edi, edi
js 0x42f77f
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
call fcn.0042d600
call fcn.00442080
test al, al
je 0x42f75b
mov eax, edi
lea ecx, [ebp - 0x2c]
sar eax, 0x1f
push eax
push edi
push esi
push str.File::WriteAtCurrentPos
call fcn.00442100
lea eax, [ebp - 0x30]
push 0
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
lea ecx, [ebp - 0x2c]
sbb esi, esi
or esi, dword [ebp - 0x30]
call fcn.004420e0
jmp 0x42f784
mov esi, 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0042f1a0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004956a1
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x430ec0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x4df19c]
xorpd xmm0, xmm0
xor eax, ebp
mov dword [esp + 0x30], eax
movsd xmm1, qword [0x4e1810]
ucomisd xmm1, xmm0
jne 0x431044
jp 0x431044
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [0x4e16fc]
mov edx, dword fs:[0x2c]
mov eax, dword [0x4e1820]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x431069
mov ecx, dword [0x4e16fc]
mov edx, dword fs:[0x2c]
mov eax, dword [0x4e1830]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4310a2
rdtsc
lea esi, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 8], eax
mov dword [esp + 4], edx
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub edi, dword [0x4e1828]
movsd xmm2, qword [0x4c4ac8]
sbb ebx, dword [0x4e182c]
movd xmm1, edi
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movd xmm0, ebx
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x4c4aa0]
subpd xmm1, xmmword [0x4c4ab0]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
xorpd xmm1, xmm1
divsd xmm0, qword [esp + 0x20]
ucomisd xmm2, xmm0
ja 0x431044
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub eax, dword [0x4e1818]
sbb ecx, dword [0x4e181c]
movd xmm2, eax
movd xmm1, ecx
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x4c4aa0]
subpd xmm2, xmmword [0x4c4ab0]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x4e1810], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.004956a1
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4e1820
call fcn.004956e7
add esp, 4
cmp dword [0x4e1820], 0xffffffff
jne 0x430f32
rdtsc
mov dword [0x4e1818], eax
mov dword [0x4e181c], edx
push 0x4e1820
call fcn.0049575d
add esp, 4
jmp 0x430f32
push 0x4e1830
call fcn.004956e7
add esp, 4
cmp dword [0x4e1830], 0xffffffff
jne 0x430f53
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [0x4e182c], ecx
mov dword [0x4e1828], eax
push 0x4e1830
call fcn.0049575d
add esp, 4
jmp 0x430f53
Function at 0x434700
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov eax, dword [0x4df19c]
xor eax, ebp
mov dword [esp + 0x158], eax
mov ecx, dword [0x4e16fc]
mov edx, dword fs:[0x2c]
mov eax, dword [0x4e1868]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x434755
mov ecx, dword [esp + 0x158]
xor ecx, ebp
call fcn.004956a1
mov eax, 0x4e1864
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4e1868
call fcn.004956e7
add esp, 4
cmp dword [0x4e1868], 0xffffffff
jne 0x43473a
lea eax, [esp + 0x40]
push 0x118
push 0
push eax
call fcn.00499950
add esp, 0xc
lea edi, [esp + 0x3c]
mov dword [esp + 0x3c], 0x11c
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc], 0
cmp eax, 0xa
je 0x4347aa
xor ebx, ebx
cmp eax, 6
jne 0x4347d8
push 0x4c4e74
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetProductInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push dword [esp + 0x50]
push dword [esp + 0x50]
call eax
mov ebx, dword [esp + 0xc]
push 0x50
call fcn.004955e6
add esp, 4
mov ecx, dword [0x4e16fc]
mov edx, dword fs:[0x2c]
mov esi, eax
mov eax, dword [0x4e1890]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x434827
mov ecx, esi
push ebx
push 0x4e186c
push edi
call fcn.004349c0
mov dword [0x4e1864], esi
push 0x4e1868
call fcn.0049575d
add esp, 4
jmp 0x43473a
push 0x4e1890
call fcn.004956e7
add esp, 4
cmp dword [0x4e1890], 0xffffffff
jne 0x434801
xorps xmm0, xmm0
lea eax, [esp + 0x10]
mov dword [esp + 0x30], 0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsd xmm1, qword [esp + 0x20]
mov eax, dword [esp + 0x30]
movsd xmm0, qword [esp + 0x28]
movsd xmm2, qword [esp + 0x10]
movsd qword [0x4e187c], xmm1
movsd xmm1, qword [esp + 0x18]
mov dword [0x4e188c], eax
movsd qword [0x4e1884], xmm0
movsd qword [0x4e186c], xmm2
movsd qword [0x4e1874], xmm1
push 0x4e1890
call fcn.0049575d
add esp, 4
jmp 0x434801
Function at 0x4348c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x4df19c]
xor eax, ebp
mov dword [esp + 0x30], eax
mov ecx, dword [0x4e16fc]
mov edx, dword fs:[0x2c]
mov eax, dword [0x4e1890]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x434934
movzx eax, word [0x4e186c]
cmp eax, 0xc
ja case.0x434900.1
xor esi, esi
jmp dword [eax*4 + 0x4c4f7c]
mov esi, 2
jmp case.0x434900.0
mov esi, 4
jmp case.0x434900.0
mov esi, 1
jmp case.0x434900.0
mov esi, 3
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.004956a1
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x4e1890
call fcn.004956e7
add esp, 4
cmp dword [0x4e1890], 0xffffffff
jne 0x4348f2
xorps xmm0, xmm0
mov eax, esp
mov dword [esp + 0x20], 0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsd xmm1, qword [esp + 0x10]
mov eax, dword [esp + 0x20]
movsd xmm0, qword [esp + 0x18]
movsd xmm2, qword [esp]
movsd qword [0x4e187c], xmm1
movsd xmm1, qword [esp + 8]
mov dword [0x4e188c], eax
movsd qword [0x4e1884], xmm0
movsd qword [0x4e186c], xmm2
movsd qword [0x4e1874], xmm1
push 0x4e1890
call fcn.0049575d
add esp, 4
jmp 0x4348f2
Function at 0x439eb1
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov eax, dword [0x4df19c]
mov edi, ecx
mov ecx, dword [ebp + 8]
mov ebx, edx
xor eax, ebp
mov dword [esp + 0x48], eax
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x439eda
mov eax, dword [ecx + 4]
test eax, eax
je 0x439f03
bt ebx, 8
jae 0x439eed
mov eax, ebx
and eax, 0x200
jne 0x439f03
cmp edi, 2
mov eax, 0x4e1b36
mov ecx, 0x4e1d36
cmove ecx, eax
cmp word [ecx], 0
je 0x439f16
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.004956a1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esi + 0x10], xmm0
movaps xmmword [esi], xmm0
mov dword [esi + 0x20], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [esi], 0
je 0x439f03
cmp byte [0x4e1b34], 0
setne al
bt ebx, 8
jb 0x439f03
shr ebx, 9
and ebx, 1
or bl, al
je 0x439f03
cmp edi, 2
mov eax, 0x4c5f38
mov edx, 0x4c5f4c
cmove edx, eax
mov eax, dword [ebp + 8]
movzx ebx, byte [eax + 0xb]
test bl, bl
jns 0x439f74
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
mov eax, ecx
xor ecx, ecx
xor edi, edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0xc], 0
inc ecx
mov dword [esp + 0x10], ecx
jmp 0x439fff
movzx ecx, word [eax + edi*2]
cmp cx, 0x5c
je 0x439faa
test cx, cx
jne 0x43a034
mov ebx, eax
lea eax, [eax + edi*2]
mov edi, dword [edx + 8]
cmp edi, 1
mov dword [esp + 0xc], edi
je 0x439fd0
cmp dword [esp + 0xc], 2
jne 0x439fdc
mov dword [esp + 8], str.WOW6432Node
mov dword [esp + 4], eax
jmp 0x439fdc
mov dword [esp + 8], str.WOW6432Node_
mov dword [esp + 4], ebx
cmp cx, 0x5c
jne 0x439fed
dec esi
cmp word [eax + 2], 0x5c
lea eax, [eax + 2]
je 0x439fe2
mov ecx, dword [edx + 0x10]
mov ebx, dword [edx + 0xc]
xor edi, edi
mov edx, ebx
mov dword [esp + 0x10], ecx
mov ebx, esi
jmp 0x43a03c
mov dword [esp + 0x1c], edi
mov edi, dword [edx + 4]
mov esi, ebx
sub esi, edi
jb 0x43a034
push edi
push dword [edx]
push eax
mov dword [esp + 0x20], ebx
mov ebx, edx
mov dword [esp + 0x24], eax
call fcn.004a7904
mov edx, ebx
mov ebx, dword [esp + 0x20]
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x18]
je 0x439f97
mov edi, dword [esp + 0x1c]
add edx, 0x14
inc edi
cmp edi, dword [esp + 0x10]
jb 0x439fff
cmp dword [esp + 0xc], 0
je 0x439f03
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
js 0x43a05a
mov eax, ecx
jmp 0x43a05c
mov eax, dword [ecx]
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
push dword [esp + 8]
push edx
call fcn.0041fdc4
jmp 0x439f03
Function at 0x43a840
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.00495a30
mov eax, dword [0x4df19c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4df230]
cmp eax, 0xffffffff
je 0x43a9a0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43a9a0
mov esi, eax
cmp eax, 1
jne 0x43a88b
push 0
push dword [0x4df230]
jmp 0x43a998
lea edi, [ebp - 0x810]
push 0x800
push esi
push edi
call fcn.00498e50
add esp, 0xc
mov eax, dword [0x4df230]
push edi
mov dword [ebp - 0x1414], eax
push eax
call fcn.004662b0
add esp, 8
push esi
call fcn.0049569c
add esp, 4
mov ecx, dword [0x4e16fc]
mov edx, dword fs:[0x2c]
mov eax, dword [0x4e3080]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x43a9b5
mov esi, dword [0x4e307c]
mov ecx, esi
call fcn.0042d610
lea eax, [ebp - 0x1410]
push 0xc00
push 0x4e247c
push eax
call fcn.00498e50
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov esi, 0x100
mov al, 1
nop word cs:[eax + eax]
nop dword [eax]
test al, 1
je 0x43a990
mov ebx, 0xfffff400
xor eax, eax
lea edi, [ebp - 0x810]
nop word cs:[eax + eax]
nop dword [eax + eax]
mov ecx, dword [edi]
test ecx, ecx
je 0x43a980
cmp dword [ebp + ebx - 0x810], 0
je 0x43a980
mov edx, dword [edi + 4]
cmp edx, dword [ebp + ebx - 0x808]
jne 0x43a980
mov edx, dword [ebp + ebx - 0x80c]
test edx, edx
je 0x43a980
mov dword [edi], 0
push ecx
call edx
add esp, 4
mov al, 1
nop word cs:[eax + eax]
nop
add edi, 8
add ebx, 0xc
jne 0x43a940
cmp esi, 2
lea esi, [esi - 1]
jae 0x43a920
push 1
push dword [ebp - 0x1414]
call fcn.004662b0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004956a1
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4e3080
call fcn.004956e7
add esp, 4
cmp dword [0x4e3080], 0xffffffff
jne 0x43a8df
push 4
call fcn.004955e6
add esp, 4
mov ecx, eax
mov esi, eax
call fcn.0042d600
mov dword [0x4e307c], esi
push 0x4e3080
call fcn.0049575d
add esp, 4
jmp 0x43a8df
Function at 0x43aa20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x4df230]
mov esi, ecx
cmp eax, 0xffffffff
je 0x43aa3d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x43aa42
call fcn.0043ab40
mov ecx, dword [0x4e16fc]
mov edx, dword fs:[0x2c]
mov eax, dword [0x4e3080]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x43aaea
mov edi, dword [0x4e307c]
mov ecx, edi
call fcn.0042d610
mov eax, dword [0x4e2478]
xor ecx, ecx
inc eax
nop dword [eax + eax]
lea edx, [eax + ecx]
movzx edx, dl
lea ebx, [edx + edx*2]
cmp dword [ebx*4 + 0x4e247c], 0
je 0x43aa9e
inc ecx
cmp ecx, 0xff
jbe 0x43aa80
jmp 0x43aace
mov ecx, dword [ebp + 8]
lea eax, [ebx*4 + 0x4e247c]
mov dword [0x4e2478], edx
mov dword [eax], 1
lea eax, [edx*4]
mov dword [eax + eax*2 + 0x4e2480], ecx
mov dword [esi], edx
mov eax, dword [eax + eax*2 + 0x4e2484]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x43ab2f
cmp eax, 0x100
jge 0x43ab34
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x4e3080
call fcn.004956e7
add esp, 4
cmp dword [0x4e3080], 0xffffffff
jne 0x43aa63
push 4
call fcn.004955e6
add esp, 4
mov ecx, eax
mov edi, eax
call fcn.0042d600
mov dword [0x4e307c], edi
push 0x4e3080
call fcn.0049575d
add esp, 4
jmp 0x43aa63
int3
int3

Function at 0x43ab40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x808
mov eax, dword [0x4df19c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x4df230]
cmp eax, 0xffffffff
mov dword [ebp - 0x810], eax
jne 0x43abde
lea esi, [ebp - 0x810]
push esi
call fcn.00466280
add esp, 4
test al, al
je 0x43ac56
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x43abb5
push esi
call fcn.00466280
add esp, 4
test al, al
je 0x43ac5b
cmp dword [ebp - 0x810], 0xffffffff
je 0x43ac5b
push 0xffffffffffffffff
call fcn.004662a0
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x4df230], ecx
mov eax, dword [ebp - 0x810]
je 0x43abde
push eax
call fcn.004662a0
add esp, 4
mov eax, dword [0x4df230]
mov dword [ebp - 0x810], eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x43ac51
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.00499950
add esp, 0xc
push edi
push dword [ebp - 0x810]
call fcn.004662b0
add esp, 8
push 0x800
call fcn.00495693
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.00498e50
add esp, 0xc
push esi
push dword [ebp - 0x810]
call fcn.004662b0
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004956a1
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebp
ret
int3
int3
int3
Function at 0x43ea60
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
mov edx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ebp - 0x10], edx
test bl, bl
mov dword [ebp - 0x20], ebx
lea ebx, [esi + ebx]
lea edx, [eax + edx]
cmovs ebx, edx
cmovs esi, eax
sub ebx, esi
cmp ebx, 4
jb 0x43eb51
mov dword [ebp - 0x18], ecx
mov edx, ebx
mov edi, esi
mov ecx, ebx
mov eax, ebx
mov dword [ebp - 0x1c], esi
nop word cs:[eax + eax]
nop dword [eax]
imul esi, dword [edi], 0x5bd1e995
imul eax, eax, 0x5bd1e995
add edx, 0xfffffffc
add edi, 4
mov ebx, esi
shr ebx, 0x18
xor ebx, esi
imul esi, ebx, 0x5bd1e995
xor eax, esi
cmp edx, 3
ja 0x43eab0
mov ebx, ecx
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
add ebx, 0xfffffffc
mov esi, ebx
and esi, 0xfffffffc
lea edx, [edi + esi + 4]
sub ebx, esi
mov esi, edi
cmp ebx, 1
je 0x43eb0f
cmp ebx, 2
je 0x43eb06
cmp ebx, 3
jne 0x43eb1a
movzx edi, byte [edx + 2]
shl edi, 0x10
xor eax, edi
movzx edi, byte [edx + 1]
shl edi, 8
xor eax, edi
movzx edx, byte [edx]
xor edx, eax
imul eax, edx, 0x5bd1e995
mov ebx, dword [ecx + 4]
test ebx, ebx
je 0x43ec35
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
lea eax, [ebx - 1]
test eax, ebx
mov dword [ebp - 0x1c], eax
je 0x43eb5c
cmp edi, ebx
mov edx, edi
jb 0x43eb60
mov eax, edi
xor edx, edx
div ebx
jmp 0x43eb60
mov eax, ebx
mov edx, esi
cmp ebx, 1
jne 0x43eaf3
jmp 0x43eb0f
mov edx, edi
and edx, eax
mov eax, dword [ecx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x43ec35
mov dword [ebp - 0x18], ebx
mov ebx, dword [eax]
mov ecx, 0
test ebx, ebx
je 0x43ec37
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
test cl, cl
cmovns eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 4]
cmp eax, edi
jne 0x43ebf0
movzx eax, byte [ebx + 0x13]
test al, al
mov ecx, eax
jns 0x43eba4
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x43ec0f
lea ecx, [ebx + 8]
test al, al
mov edx, dword [ecx]
cmovs ecx, edx
js 0x43ec1b
cmp dword [ebp - 0x10], 0
je 0x43ec31
cmp byte [esi], dl
jne 0x43ec0f
dec eax
xor ecx, ecx
nop word cs:[eax + eax]
nop dword [eax]
cmp eax, ecx
je 0x43ec31
movzx edx, byte [ebx + ecx + 9]
cmp dl, byte [esi + ecx + 1]
lea ecx, [ecx + 1]
je 0x43ebd0
jmp 0x43ec0f
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
test edx, ecx
je 0x43ec06
cmp eax, ecx
jb 0x43ec08
xor edx, edx
div ecx
mov eax, edx
jmp 0x43ec08
and eax, edx
mov ecx, dword [ebp - 0x14]
cmp eax, ecx
jne 0x43ec35
mov ebx, dword [ebx]
test ebx, ebx
jne 0x43eb90
jmp 0x43ec35
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x43ec31
push eax
push esi
push ecx
call fcn.00497e9d
add esp, 0xc
test eax, eax
jne 0x43ec0f
mov ecx, ebx
jmp 0x43ec37
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8