joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425430
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5110be
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x56fcd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0
mov dword [edi], vtable.asio::detail::win_iocp_io_context.0
mov dword [ebp - 4], 0
mov dword [edi + 0x14], 0
lea ebx, [edi + 0x18]
mov dword [edi + 0x1c], 0
mov dword [ebx], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0xffffffff
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
lea ecx, [edi + 0x38]
mov byte [ebp - 4], 3
mov dword [edi + 0x34], 0
call fcn.0043af80
mov esi, eax
call fcn.004436b0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
test esi, esi
jne 0x4255c9
mov dword [edi + 0x50], esi
mov dword [edi + 0x54], esi
mov dword [edi + 0x58], esi
mov ecx, dword [ebp + 0xc]
mov dword [edi + 0x5c], ecx
mov dword [edi + 0x60], esi
or eax, 0xffffffff
mov byte [ebp - 4], 6
test ecx, ecx
cmovns eax, ecx
push eax
push esi
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [edi + 0x14], eax
test eax, eax
jne 0x425532
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004436b0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
test esi, esi
jne 0x4255d7
cmp byte [ebp + 0x10], 0
je 0x4255b3
lock inc dword [ebx]
push 0xc
call fcn.004deddf
mov esi, eax
add esp, 4
mov dword [ebp + 0x10], esi
mov byte [ebp - 4], 7
test esi, esi
je 0x425593
push 0x10
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.004deddf
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x425586
push 0
push eax
mov ecx, esi
mov dword [eax], vtable.asio::detail::win_thread::func_struct_asio::detail::win_iocp_io_context::thread_function_.0
mov dword [eax + 0xc], edi
call fcn.0044ee20
jmp 0x425595
xor eax, eax
mov ecx, esi
push eax
push eax
call fcn.0044ee20
jmp 0x425595
xor esi, esi
mov ebx, dword [edi + 0x60]
test ebx, ebx
je 0x4255b0
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc
push ebx
call fcn.004dee43
add esp, 8
mov dword [edi + 0x60], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.mutex
lea eax, [ebp - 0x18]
push eax
call fcn.0043c050
push str.iocp
lea eax, [ebp - 0x18]
push eax
call fcn.0043c050
int3
Function at 0x42ad70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5114c5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x56fcd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov edx, edi
cmp dword [edi + 0x14], 0x10
jb 0x42ada7
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x42adc5
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x42adb3
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00406bb0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42ae95
cmp dword [ebx + 8], 0x6666666
je 0x42aeac
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.004deddf
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
push edi
lea edi, [ecx + 8]
mov ecx, edi
call fcn.0041f8f0
xorps xmm0, xmm0
movq qword [edi + 0x18], xmm0
mov dword [edi + 0x1c], 0
mov eax, dword [ebx + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x51cf10]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x51cf10]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x42ae86
mov ecx, ebx
call fcn.004363b0
push esi
push edi
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.00406bb0
mov ecx, dword [eax]
jmp 0x42ae89
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push esi
mov ecx, ebx
call fcn.00434fb0
add eax, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.004dc214
int3
Function at 0x433f90
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
mov eax, 0x1fffffff
push ebp
mov ebp, ecx
bsr ecx, eax
push edi
mov edi, 1
mov dword [esp + 0xc], ebp
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x4340bf
lea eax, [edx - 1]
or eax, edi
bsr ecx, eax
push esi
mov esi, dword [ebp + 4]
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebp + 0xc]
lea eax, [edi + edi]
push eax
call fcn.004320e0
lea eax, [edi - 1]
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x43409a
push ebx
nop
mov bl, byte [eax + 8]
mov edi, dword [ebp + 0x18]
mov ecx, dword [ecx]
movzx edx, bl
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
and edi, edx
mov edx, dword [ebp + 0xc]
lea ebp, [edx + edi*8]
mov edi, dword [ebp]
mov dword [esp + 0x1c], ebp
cmp edi, esi
jne 0x434022
mov dword [ebp], eax
mov dword [ebp + 4], eax
jmp 0x43408b
mov edx, dword [ebp + 4]
cmp bl, byte [edx + 8]
jne 0x434059
mov edx, dword [edx]
mov dword [esp + 0x10], edx
cmp edx, eax
je 0x434054
mov ebx, dword [eax + 4]
mov ebp, dword [esp + 0x10]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov ebp, dword [esp + 0x1c]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov dword [ebp + 4], eax
jmp 0x43408b
cmp edi, edx
je 0x43406c
nop dword [eax]
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
je 0x4340a3
cmp edi, edx
jne 0x434060
mov ebp, dword [eax + 4]
mov dword [ebp], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 4], ebp
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebp, dword [esp + 0x14]
mov eax, ecx
cmp ecx, esi
jne 0x433ff0
pop ebx
pop esi
pop edi
pop ebp
add esp, 8
ret 4
mov ebx, dword [eax + 4]
mov ebp, dword [edx]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], ebp
mov edx, dword [ebp + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x43408b
push str.invalid_hash_bucket_count
call fcn.004dc214
int3
Function at 0x4347c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, dword [ecx]
push edi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x43480f
lea edx, [esi + 8]
mov edi, eax
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x4347d2
mov eax, dword [esi]
jmp 0x4348f5
cmp eax, 0x4e0
jb 0x4348f5
push ebx
mov ebx, dword [esi + 0x9c4]
lea edi, [esi + 0x9c4]
push ebp
mov ebp, 0xe3
nop dword [eax]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebp, 1
jne 0x434830
mov ebx, dword [esi + 0xd50]
lea edi, [esi + 0xd50]
mov ebp, 0x18c
nop dword [eax]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebp, 1
jne 0x434880
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
pop ebx
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x438c80
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x24
push esi
push dword [0x57640c]
mov esi, ecx
lea eax, [esi + 0x14]
neg esi
sbb esi, esi
and esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x438d9f
cmp dword [eax], esi
je 0x438cb3
mov eax, dword [eax + 8]
test eax, eax
jne 0x438ca3
pop esi
add esp, 0x24
ret
mov esi, dword [eax + 4]
test esi, esi
je 0x438d9f
mov eax, dword [esi + 0x28]
sub eax, 0
je 0x438d69
sub eax, 1
jne 0x438d9f
mov dword [esi + 0x28], 2
lea eax, [esp + 0xc]
add esi, 0x2c
push esi
push eax
call fcn.004dcb85
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], vtable.asio::multiple_exceptions.0
push eax
lea eax, [esp + 0x2c]
xorps xmm0, xmm0
push eax
movq qword [esp + 0x28], xmm0
call fcn.004dcb85
lea eax, [esp + 0x1c]
push eax
call fcn.004dccad
lea eax, [esp + 0x18]
push eax
call fcn.004dcbc2
push 0x5525d8
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004dcb9c
lea eax, [esp + 0x44]
push eax
call fcn.004dccad
lea eax, [esp + 0x40]
mov dword [esp + 0x3c], vtable.std::exception.0
push eax
call fcn.004e0725
lea eax, [esp + 0x30]
push eax
push esi
call fcn.004dcb75
lea eax, [esp + 0x38]
push eax
call fcn.004dccad
add esp, 0x38
pop esi
add esp, 0x24
ret
lea eax, [esp + 4]
mov dword [esi + 0x28], 1
push eax
call fcn.004dcbc2
lea eax, [esp + 8]
push eax
call fcn.004dcbd1
lea eax, [esp + 0xc]
push eax
lea eax, [esi + 0x2c]
push eax
call fcn.004dcb75
lea eax, [esp + 0x14]
push eax
call fcn.004dccad
add esp, 0x14
pop esi
add esp, 0x24
ret
Function at 0x439ac0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511b2d
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x56fcd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x439af7
mov eax, dword [esi]
lea ecx, [ebp - 0x58]
push ecx
push eax
call fcn.004f360b
add esp, 8
test eax, eax
je 0x439c41
mov edi, dword [esi + 0x10]
test edi, edi
je 0x439c8e
xor edx, edx
nop dword [eax]
mov eax, 0x5183c8
lea ecx, [eax + 1]
mov dword [ebp - 0x5c], ecx
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x439b30
sub eax, dword [ebp - 0x5c]
mov ecx, esi
cmp dword [esi + 0x14], 0x10
jb 0x439b44
mov ecx, dword [esi]
push eax
push 0x5183c8
push edx
push edi
push ecx
call fcn.004083f0
add esp, 0x14
mov dword [ebp - 0x18], 0
cmp eax, 0xffffffff
mov dword [ebp - 0x14], 0
xorps xmm0, xmm0
cmovne edi, eax
mov eax, esi
cmp dword [esi + 0x10], edi
mov ecx, edi
movups xmmword [ebp - 0x28], xmm0
cmovb ecx, dword [esi + 0x10]
cmp dword [esi + 0x14], 0x10
jb 0x439b83
mov eax, dword [esi]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00404250
cmp dword [ebp - 0x18], 2
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 4], 0
jne 0x439bc0
cmp edx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, ecx
cmp byte [eax + 1], 0x3a
jne 0x439bc0
push 0x5c
lea ecx, [ebp - 0x28]
call fcn.00448710
mov edx, dword [ebp - 0x14]
inc edi
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x18], 0
je 0x439bfe
cmp edx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, ecx
lea ecx, [ebp - 0x58]
push ecx
push eax
call fcn.004f360b
add esp, 8
test eax, eax
je 0x439bf8
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004f42c1
add esp, 4
test eax, eax
jne 0x439c5e
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
inc edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x5c], edi
cmp edx, 0x10
jb 0x439c33
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x439c29
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439c92
push edx
push ecx
call fcn.004dee43
add esp, 8
mov edi, dword [esi + 0x10]
mov edx, dword [ebp - 0x5c]
cmp edx, edi
jb 0x439b20
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004df28f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x439c8e
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x439c84
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439c92
push ecx
push edx
call fcn.004dee43
add esp, 8
xor al, al
jmp 0x439c43
call fcn.004eaaef
int3
Function at 0x444600
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x18
push esi
push 0
push 0
lea eax, [esp + 0xf]
mov byte [esp + 0xf], 0
push 0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push eax
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 1
push eax
push dword [ecx + 4]
mov dword [esp + 0x24], 0
call dword [sym.imp.WS2_32.dll_WSASend]
call fcn.004436b0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop esi
cmp eax, 0x40
je 0x444654
cmp eax, 0x4d2
jne 0x444659
call fcn.004436b0
add esp, 0x18
ret

Function at 0x444c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
movzx ebp, ax
xor eax, eax
mov esi, ebp
push edi
shr esi, 8
xor edi, edi
mov dword [esp + 0x10], esi
cmp dword [esp + 0x20], eax
jbe 0x444cc1
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
movzx ecx, word [ecx + edi*2]
mov edx, ecx
movzx ecx, cl
shr edx, 8
add edx, eax
cmp esi, ecx
jb 0x444cc1
jne 0x444cb8
cmp eax, edx
jge 0x444cb8
mov ecx, dword [esp + 0x18]
movzx esi, cl
movzx ecx, byte [eax + ebx]
cmp cx, si
je 0x444ce9
inc eax
cmp eax, edx
jl 0x444ca6
mov esi, dword [esp + 0x10]
inc edi
mov eax, edx
cmp edi, dword [esp + 0x20]
jb 0x444c83
mov edi, dword [esp + 0x2c]
xor eax, eax
mov bl, 1
test edi, edi
je 0x444cff
mov esi, dword [esp + 0x28]
movzx ecx, byte [eax + esi]
test cl, cl
jns 0x444cf1
movzx edx, byte [eax + esi + 1]
inc eax
and ecx, 0x7f
shl ecx, 8
or edx, ecx
jmp 0x444cf3
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
mov edx, ecx
sub ebp, edx
js 0x444cff
inc eax
xor bl, 1
cmp eax, edi
jb 0x444cd1
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret

Function at 0x444d20
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 8]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, 0x576410
lock xadd dword [ecx], eax
mov ecx, dword [esi + 4]
push 0
push ecx
test eax, eax
je 0x444d6e
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
add esp, 8
ret
push fcn.00431ef0
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
add esp, 8
ret
Function at 0x4453d0
Capabilities:
Get file size
Get system information on windows
Read file via mapping

Disassembly:
sub esp, 0x4c
push ebp
mov ebp, dword [esp + 0x54]
push esi
mov esi, dword [esp + 0x64]
push edi
mov edi, ecx
mov dword [esi + 4], 0x56fa24
cmp ebp, 0xffffffff
jne 0x445402
pop edi
mov dword [esi], 9
mov dword [esi + 4], 0x56fa14
pop esi
pop ebp
add esp, 0x4c
ret 0x10
lea eax, [esp + 0xc]
mov dword [esi], 0
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x44542b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
xor ecx, ecx
mov dword [esi + 4], 0x56fa24
jmp 0x44542f
mov ecx, dword [esp + 0xc]
cmp dword [esi], 0
jne 0x44555b
mov edx, dword [esp + 0x60]
push ebx
mov ebx, dword [esp + 0x68]
lea eax, [edx + ebx]
cmp eax, ecx
jbe 0x44545f
pop ebx
pop edi
mov dword [esi], 0x16
mov dword [esi + 4], 0x56fa14
pop esi
pop ebp
add esp, 0x4c
ret 0x10
mov eax, dword fs:[0x2c]
sub ecx, edx
test ebx, ebx
cmove ebx, ecx
mov ecx, dword [0x578e68]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x576448]
cmp eax, dword [ecx + 0x30]
jg 0x445564
mov ecx, dword [esp + 0x64]
xor edx, edx
mov eax, ecx
div dword [0x576444]
push 0
mov eax, edx
mov edx, ecx
sub edx, eax
mov dword [esp + 0x6c], eax
mov eax, ebx
mov dword [esp + 0x70], edx
sub eax, edx
add eax, ecx
mov dword [esp + 0x68], eax
mov eax, ebx
add eax, ecx
mov ecx, 0
push eax
adc ecx, ecx
push ecx
push 2
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x445500
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
xorps xmm0, xmm0
mov dword [esi], eax
movups xmmword [esp + 0x28], xmm0
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x30]
movups xmmword [esp + 0x18], xmm0
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 4], 0x56fa24
jmp 0x44552c
push dword [esp + 0x64]
push dword [esp + 0x70]
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x445520
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4454cd
add eax, dword [esp + 0x68]
mov dword [esp + 0x24], 0
cmp dword [esi], 0
mov dword [esp + 0x6c], eax
jne 0x44555a
mov ecx, edi
call fcn.0044fbc0
mov eax, dword [esp + 0x60]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x6c]
mov dword [edi], eax
mov eax, dword [esp + 0x64]
mov byte [edi + 0x14], 0
mov dword [edi + 4], ebx
mov dword [edi + 8], eax
mov dword [edi + 0x10], ebp
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x4c
ret 0x10
push 0x576448
call fcn.004df13e
add esp, 4
cmp dword [0x576448], 0xffffffff
jne 0x445486
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x54]
push 0x576448
mov dword [0x576444], eax
call fcn.004df0ed
add esp, 4
jmp 0x445486
Function at 0x447e80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x4c
mov eax, dword [0x56fcd4]
xor eax, esp
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x54]
push ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ecx
mov dword [esp + 0x10], ebx
push edi
mov edi, dword [esp + 0x64]
cmp ebx, 0x400
jle 0x447ec2
pop edi
mov eax, 0xc9
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.004df28f
add esp, 0x4c
ret
lea eax, [edi - 4]
cmp eax, 0x20
ja 0x44805e
push ebp
push esi
test edi, edi
jle 0x447f3e
mov eax, dword [esp + 0x60]
xor ebp, ebp
sub eax, ecx
mov esi, ecx
mov dword [esp + 0x10], eax
xor ecx, ecx
test ebx, ebx
jle 0x447f2d
cmp ebx, 0x10
jb 0x447f18
mov edx, dword [esp + 0x14]
lea eax, [ebx + ebp]
mov ebx, dword [esp + 0x60]
dec edx
dec ebx
add edx, eax
add eax, ebx
mov ebx, dword [esp + 0x1c]
cmp esi, eax
mov eax, dword [esp + 0x10]
ja 0x44804c
add eax, esi
cmp edx, eax
jb 0x44804e
lea edx, [ecx + ebp]
add edx, dword [esp + 0x60]
nop
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [esi + ecx], al
inc ecx
cmp ecx, ebx
jl 0x447f20
add ebp, ebx
add esi, ebx
sub edi, 1
jne 0x447ee2
mov edi, dword [esp + 0x6c]
mov ecx, dword [esp + 0x14]
xor edx, edx
mov dword [esp + 0x18], edx
test ebx, ebx
jle 0x448037
mov eax, ebx
imul eax, edi
add eax, ecx
mov dword [esp + 0x24], eax
lea eax, [edi + 1]
imul eax, ebx
add eax, ecx
mov dword [esp + 0x28], eax
lea eax, [edi + 2]
imul eax, ebx
add eax, ecx
mov dword [esp + 0x2c], eax
lea eax, [edi + 3]
imul eax, ebx
add eax, ecx
mov dword [esp + 0x30], eax
nop dword [eax + eax]
xor ecx, ecx
test edi, edi
jle 0x447f9d
add edx, dword [esp + 0x60]
nop word [eax + eax]
mov al, byte [edx]
add edx, ebx
mov byte [esp + ecx + 0x34], al
inc ecx
cmp ecx, edi
jl 0x447f90
xor ecx, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], ecx
mov ebp, 0x518598
xor eax, eax
test edi, edi
jle 0x447fe8
lea esi, [esp + 0x10]
add ecx, esi
mov esi, ebp
mov dword [esp + 0x20], ecx
mov bl, byte [ecx]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, byte [esp + eax + 0x34]
inc eax
shl ecx, 8
xor bl, byte [edx + ecx + section..data]
cmp eax, edi
jl 0x447fc4
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov byte [eax], bl
inc ecx
add ebp, 0x24
mov dword [esp + 0x14], ecx
cmp ebp, 0x518628
jl 0x447fb0
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov byte [ecx + edx], al
mov ecx, dword [esp + 0x28]
mov byte [ecx + edx], ah
mov ecx, dword [esp + 0x2c]
movzx eax, byte [esp + 0x12]
mov byte [ecx + edx], al
mov ecx, dword [esp + 0x30]
movzx eax, byte [esp + 0x13]
mov byte [ecx + edx], al
inc edx
mov dword [esp + 0x18], edx
cmp edx, ebx
jl 0x447f80
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.004df28f
add esp, 0x4c
ret
add eax, esi
push ebx
push eax
push esi
call fcn.004e0ed0
add esp, 0xc
jmp 0x447f2d
mov ecx, dword [esp + 0x50]
mov eax, 0xca
pop edi
pop ebx
xor ecx, esp
call fcn.004df28f
add esp, 0x4c
ret
Function at 0x4492c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5101f0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x56fcd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x44930c
mov eax, dword [eax + 0x20]
mov dword [ebp - 4], 0
test eax, eax
je 0x449305
push 0
push eax
mov eax, dword [eax]
call eax
add esp, 8
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x44934f
push dword [0x57640c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x44933f
mov edx, dword [eax + 4]
test edx, edx
je 0x44933f
xor eax, eax
nop dword [eax]
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x449360
inc eax
cmp eax, 2
jl 0x449330
push esi
call fcn.004eab71
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0x28]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x449348
Function at 0x449f90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513995
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x56fcd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edx, edx
lea eax, [esi + 0x18]
lock xadd dword [eax], edx
test edx, edx
jne 0x449ff2
call fcn.0044ef60
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0x56fa24
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x4c]
call fcn.00425360
push dword [0x57640c]
mov ecx, esi
mov dword [ebp - 4], 0
neg ecx
lea eax, [esi + 0x14]
sbb ecx, ecx
and ecx, eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push dword [0x57640c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push ebx
push eax
push 0xffffffffffffffff
mov ecx, esi
mov byte [ebp - 4], 1
xor edi, edi
call fcn.0043b070
test eax, eax
je 0x44a06d
nop
cmp edi, 0xffffffff
lea eax, [edi + 1]
push ebx
cmove eax, edi
mov ecx, esi
mov edi, eax
lea eax, [ebp - 0x4c]
push eax
push 0xffffffffffffffff
call fcn.0043b070
test eax, eax
jne 0x44a050
push dword [ebp - 0x10]
push dword [0x57640c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor esi, esi
nop
mov eax, dword [ebp + esi*4 - 0x4c]
test eax, eax
je 0x44a091
push eax
call fcn.004eab71
add esp, 4
inc esi
cmp esi, 0xa
jl 0x44a080
lea eax, [ebp - 0x20]
push eax
call fcn.004dccad
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4