joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42df60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [0x5df440]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x5df038]
cmp eax, 0xffffffff
je 0x42df8a
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x42df8f
call fcn.0042e110
mov eax, dword [0x5ebd54]
mov ecx, dword [0x5ed6c4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x42e0c9
mov edi, dword [0x5ebd50]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x42e0bd
mov ecx, dword [0x5eb14c]
inc ecx
mov edx, 0x100
nop word cs:[eax + eax]
movzx ebx, cl
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x5eb150], 0
je 0x42e00d
lea eax, [ecx + 1]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x5eb150], 0
je 0x42e00d
add ecx, 2
add edx, 0xfffffffe
jne 0x42dfe0
jmp 0x42e03d
lea ecx, [eax*4 + 0x5eb150]
mov dword [ecx], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x5eb154], ecx
mov dword [0x5eb14c], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x5eb158]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov dword [ebp - 0x14], 0xffffffff
mov esi, dword [esi]
cmp esi, 0x100
jb 0x42e0a9
push 0x100
call fcn.0040f570
add esp, 4
mov edi, eax
push esi
call fcn.0040f570
add esp, 4
lea esi, [ebp - 0x14]
mov ecx, esi
push edi
push eax
push str.slot____kThreadLocalStorageSize
call fcn.0040fa00
cmp dword [ebp - 0x14], 0
je 0x42e0a9
lea edi, [ebp - 0x18]
push esi
push 0x1c7
push str....._base_threading_thread_local_storage.cc
push edi
call fcn.00407c20
add esp, 0x10
mov ecx, edi
call fcn.00407cf0
mov ecx, edi
call fcn.00407d00
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00513cac
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ecx, edi
call fcn.00416e90
jmp 0x42dfc5
push 0x5ebd54
call fcn.00513c48
add esp, 4
cmp dword [0x5ebd54], 0xffffffff
jne 0x42dfb0
push 4
call fcn.00513938
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.00416e80
mov dword [0x5ebd50], edi
push 0x5ebd54
call fcn.00513bf7
add esp, 4
jmp 0x42dfb0
Function at 0x42e110
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x80c
mov eax, dword [0x5df440]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x5df038]
mov dword [ebp - 0x810], eax
cmp eax, 0xffffffff
jne 0x42e1fe
lea edi, [ebp - 0x810]
push edi
call fcn.00441180
add esp, 4
test al, al
jne 0x42e178
lea esi, [ebp - 0x80c]
push str.PlatformThreadLocalStorage::AllocTLS_key_
push 0x101
push str....._base_threading_thread_local_storage.cc
push esi
call fcn.00407bc0
add esp, 0x10
mov ecx, esi
call fcn.00407cf0
mov ecx, esi
call fcn.00407d00
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x42e1d5
push edi
call fcn.00441180
add esp, 4
test al, al
je 0x42e199
cmp dword [ebp - 0x810], 0xffffffff
jne 0x42e1c5
lea esi, [ebp - 0x80c]
push str.PlatformThreadLocalStorage::AllocTLS_key___key___PlatformThreadLocalStorage::TLS_KEY_OUT_OF_INDEXES
push 0x10b
push str....._base_threading_thread_local_storage.cc
push esi
call fcn.00407bc0
add esp, 0x10
mov ecx, esi
call fcn.00407cf0
mov ecx, esi
call fcn.00407d00
push 0xffffffffffffffff
call fcn.004411a0
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x5df038], ecx
mov eax, dword [ebp - 0x810]
je 0x42e1fe
push eax
call fcn.004411a0
add esp, 4
mov eax, dword [0x5df038]
mov dword [ebp - 0x810], eax
mov dword [ebp - 0x80c], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
and esi, 3
je 0x42e270
push 0
call fcn.0040f4a0
add esp, 4
mov edi, eax
push esi
call fcn.0040f4a0
add esp, 4
lea esi, [ebp - 0x80c]
mov ecx, esi
push edi
push eax
push str.GetTlsVectorStateAndValue_key___TlsVectorState::kUninitialized
call fcn.0040fa00
cmp dword [ebp - 0x80c], 0
je 0x42e270
lea edi, [ebp - 0x814]
push esi
push 0x11d
push str....._base_threading_thread_local_storage.cc
push edi
call fcn.00407c20
add esp, 0x10
mov ecx, edi
call fcn.00407cf0
mov ecx, edi
call fcn.00407d00
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.00516ef0
add esp, 0xc
lea eax, [ebp - 0x809]
push eax
push dword [ebp - 0x810]
call fcn.004411b0
add esp, 8
push 0x800
call fcn.005141ef
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.00516970
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x810]
call fcn.004411b0
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00513cac
mov eax, esi
add esp, 0x80c
pop esi
pop edi
pop ebp
ret

Function at 0x430d10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5ebda8]
mov ecx, dword [0x5ed6c4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x430d3b
mov ecx, 0x5ebda0
pop ebp
jmp fcn.0042e2f0
push 0x5ebda8
call fcn.00513c48
add esp, 4
cmp dword [0x5ebda8], 0xffffffff
jne 0x430d30
mov dword [0x5ebda4], 0
mov dword [0x5ebda0], 0
mov ecx, 0x5ebda0
push 0
call fcn.0042e360
push 0x5ebda8
call fcn.00513bf7
add esp, 4
jmp 0x430d30
Function at 0x437f80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x5df440]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov edi, dword [eax]
mov dword [ebp - 0x28], 0
movsd xmm0, qword [0x5874c0]
movsd qword [ebp - 0x18], xmm0
mov byte [ebp - 0x28], 0
push edi
call fcn.0051a200
add esp, 4
mov esi, eax
cmp eax, 0xf
jbe 0x437fdc
sub esp, 0xc
mov al, byte [ebp - 0x2c]
mov byte [esp + 4], al
mov dword [esp + 8], edi
mov dword [esp], esi
lea ecx, [ebp - 0x28]
call fcn.00407350
jmp 0x437ff2
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x28]
push esi
push edi
push eax
call fcn.00516970
add esp, 0xc
mov byte [ebp + esi - 0x28], 0
mov eax, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea esi, [ebp - 0x28]
mov dword [ebp - 0x30], eax
cmovae esi, eax
test ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ecx
je 0x438027
lea edx, [ebx - 1]
mov ecx, ebx
and ecx, 3
cmp edx, 3
jae 0x43802e
mov edx, 0x811c9dc5
xor edi, edi
jmp 0x43807a
mov edx, 0x811c9dc5
jmp 0x4380a1
and ebx, 0xfffffffc
mov edx, 0x811c9dc5
xor edi, edi
nop dword [eax + eax]
movzx eax, byte [esi + edi]
xor eax, edx
imul eax, eax, 0x1000193
movzx edx, byte [esi + edi + 1]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + edi + 2]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + edi + 3]
xor edx, eax
imul edx, edx, 0x1000193
add edi, 4
cmp ebx, edi
jne 0x438040
test ecx, ecx
je 0x4380a1
add edi, esi
xor ebx, ebx
nop word cs:[eax + eax]
movzx eax, byte [edi + ebx]
xor eax, edx
imul edx, eax, 0x1000193
inc ebx
cmp ecx, ebx
jne 0x438090
mov eax, dword [ebp + 8]
and edx, dword [eax + 0x18]
mov ecx, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edx*8 + 4]
mov dword [ebp - 0x34], ecx
cmp edi, ecx
mov ecx, dword [ebp - 0x38]
je 0x438107
add edx, edx
mov ebx, dword [eax + edx*4]
cmp ecx, dword [edi + 0x18]
jne 0x4380f5
nop word cs:[eax + eax]
cmp dword [edi + 0x1c], 0x10
jb 0x4380e0
mov eax, dword [edi + 8]
jmp 0x4380e3
lea eax, [edi + 8]
push ecx
push eax
push esi
call fcn.005152ed
mov ecx, dword [ebp - 0x38]
add esp, 0xc
test eax, eax
je 0x438103
cmp edi, ebx
je 0x438107
mov edi, dword [edi + 4]
cmp ecx, dword [edi + 0x18]
je 0x4380d0
jmp 0x4380f5
test edi, edi
jne 0x43810a
mov edi, dword [ebp - 0x34]
mov edx, dword [ebp - 0x3c]
cmp edx, 0x10
jb 0x438141
lea ecx, [edx + 1]
cmp ecx, 0x1000
jb 0x438134
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, eax
cmp ecx, 0x20
jae 0x43815b
add edx, 0x24
mov ecx, edx
jmp 0x438137
mov eax, dword [ebp - 0x30]
push ecx
push eax
call fcn.00513968
add esp, 8
cmp edi, dword [ebp - 0x34]
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00513cac
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0051a096
Function at 0x43d7d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, dword [0x5df440]
xor eax, ebp
mov dword [esp + 0x48], eax
cmp ebx, 0xffffffff
je 0x43d8f2
mov esi, ecx
mov eax, dword [ecx + 0x20]
cmp dword [eax], 0
je 0x43d81a
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
test ecx, ecx
jle 0x43d81a
dec ecx
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
lea edx, [ecx + 1]
mov dword [eax], edx
mov byte [ecx], bl
jmp 0x43d934
cmp dword [esi + 0x4c], 0
je 0x43d8f6
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0x3c]
cmp dword [eax], ecx
jne 0x43d842
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov edi, dword [esi + 0x38]
test edi, edi
je 0x43d8fd
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov byte [esp + 0x1f], bl
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
lea eax, [esi + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [edi]
mov ecx, dword [eax + 0x1c]
mov dword [esp + 0xc], ecx
call dword [0x581450]
lea eax, [esp + 0x20]
lea edx, [esp + 0x1f]
mov ecx, edi
mov edi, edx
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x44]
push edx
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x30]
push eax
push edi
push dword [esp + 0x28]
call dword [esp + 0x28]
mov ecx, 0xffffffff
cmp eax, 2
jae 0x43d914
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x20]
sub edi, eax
je 0x43d8df
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00523399
mov ecx, 0xffffffff
add esp, 0x10
cmp edi, eax
jne 0x43d932
mov byte [esi + 0x3d], 1
lea eax, [esp + 0x1f]
cmp dword [esp + 0x18], eax
mov eax, 0xffffffff
jmp 0x43d92d
xor ebx, ebx
jmp 0x43d934
mov ebx, 0xffffffff
jmp 0x43d934
movsx eax, bl
push dword [esi + 0x4c]
push eax
call fcn.00523425
add esp, 8
cmp eax, 0xffffffff
cmove ebx, eax
jmp 0x43d934
cmp eax, 3
jne 0x43d932
movsx eax, byte [esp + 0x1f]
push dword [esi + 0x4c]
push eax
call fcn.00523425
add esp, 8
cmp eax, 0xffffffff
cmove ebx, eax
mov ecx, ebx
mov ebx, ecx
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00513cac
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43dd00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
cmp esi, 1
mov eax, ebx
sbb eax, 0
jl 0x43ddc3
mov edx, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 0x38], 0
mov dword [ebp - 0x10], ecx
je 0x43ddcc
mov ecx, esi
mov esi, ebx
mov ebx, edi
jmp 0x43dd82
mov edx, dword [ebp - 0x14]
cmp edx, ecx
mov edi, ecx
cmovb edi, edx
test esi, esi
cmovne edi, ecx
push edi
push eax
push ebx
call fcn.00516970
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add esp, 0xc
add ebx, edi
sub ecx, edi
sbb esi, 0
mov eax, dword [edx + 0x2c]
sub dword [eax], edi
mov eax, dword [edx + 0x1c]
add dword [eax], edi
mov eax, ecx
neg eax
mov eax, 0
sbb eax, esi
jge 0x43de6e
mov dword [ebp - 0x14], ecx
mov eax, dword [edx + 0x1c]
mov eax, dword [eax]
test eax, eax
je 0x43dd97
mov ecx, dword [edx + 0x2c]
mov ecx, dword [ecx]
test ecx, ecx
jg 0x43dd40
mov eax, dword [edx]
mov edi, dword [eax + 0x1c]
mov ecx, edi
call dword [0x581450]
mov ecx, dword [ebp - 0x10]
call edi
cmp eax, 0xffffffff
je 0x43de6b
mov byte [ebx], al
inc ebx
mov ecx, dword [ebp - 0x14]
add ecx, 0xffffffff
adc esi, 0xffffffff
mov edx, dword [ebp - 0x10]
jmp 0x43dd71
xor eax, eax
xor edx, edx
jmp 0x43dea0
mov eax, dword [edx + 0x1c]
mov eax, dword [eax]
test eax, eax
je 0x43ddff
mov ecx, dword [edx + 0x2c]
mov ebx, dword [ecx]
test ebx, ebx
je 0x43ddff
cmp ebx, esi
cmovae ebx, esi
push ebx
push eax
push edi
call fcn.00516970
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov eax, dword [edx + 0x2c]
sub dword [eax], ebx
mov eax, dword [edx + 0x1c]
add dword [eax], ebx
add edi, ebx
sub esi, ebx
cmp dword [edx + 0x4c], 0
je 0x43de93
mov eax, dword [edx + 0xc]
lea ecx, [edx + 0x3c]
cmp dword [eax], ecx
jne 0x43de40
mov ecx, dword [edx + 0x50]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1c]
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x2c]
mov dword [eax], edx
mov edx, dword [ebp - 0x10]
nop word cs:[eax + eax]
cmp esi, 0x1000
jb 0x43de7a
push dword [edx + 0x4c]
push 0xfff
push 1
push edi
call fcn.005226ff
mov edx, dword [ebp - 0x10]
add esp, 0x10
add edi, eax
sub esi, eax
cmp eax, 0xfff
je 0x43de40
jmp 0x43de93
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
sub eax, ecx
mov edx, dword [ebp + 0x10]
sbb edx, esi
jmp 0x43dea0
test esi, esi
je 0x43de91
push dword [edx + 0x4c]
push esi
push 1
push edi
call fcn.005226ff
add esp, 0x10
sub esi, eax
jmp 0x43de93
xor esi, esi
mov ebx, dword [ebp + 0xc]
sub ebx, esi
mov eax, ebx
mov edx, dword [ebp + 0x10]
sbb edx, 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43deb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, ecx
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [edx + 0x38], 0
mov dword [ebp - 0x10], edx
je 0x43df81
cmp ecx, 1
mov eax, edi
sbb eax, 0
mov eax, edi
mov edi, ecx
mov ecx, eax
jl 0x43e018
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
jmp 0x43df39
cmp edi, ecx
mov esi, ecx
cmovb esi, edi
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x18]
test ebx, ebx
cmovne esi, ecx
push esi
push dword [ebp - 0x14]
push eax
call fcn.00516970
mov ecx, ebx
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add esp, 0xc
add ebx, esi
sub edi, esi
sbb ecx, 0
mov eax, dword [edx + 0x30]
sub dword [eax], esi
mov eax, dword [edx + 0x20]
add dword [eax], esi
mov eax, edi
neg eax
mov eax, 0
sbb eax, ecx
jge 0x43e018
mov dword [ebp - 0x18], ecx
mov eax, dword [edx + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x43df4e
mov ecx, dword [edx + 0x30]
mov ecx, dword [ecx]
test ecx, ecx
jg 0x43def0
movzx eax, byte [ebx]
mov dword [ebp - 0x14], eax
mov eax, dword [edx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x581450]
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x14]
call esi
cmp eax, 0xffffffff
je 0x43e015
inc ebx
add edi, 0xffffffff
mov ecx, dword [ebp - 0x18]
adc ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
jmp 0x43df28
mov eax, dword [edx + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x43dfe0
cmp dword [ebp + 0xc], 1
mov ecx, edi
sbb ecx, 0
jl 0x43dfe0
mov ecx, edx
mov edx, ebx
mov ecx, dword [ecx + 0x30]
mov esi, dword [ecx]
test esi, esi
jle 0x43dfe2
mov ebx, dword [ebp + 0xc]
cmp esi, ebx
mov ecx, ebx
cmovb ecx, esi
test edi, edi
cmove esi, ebx
cmove esi, ecx
push esi
mov ebx, edx
push edx
push eax
call fcn.00516970
add esp, 0xc
add ebx, esi
mov edx, ebx
mov eax, edi
mov edi, dword [ebp + 0xc]
sub edi, esi
mov ecx, eax
sbb ecx, 0
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x30]
sub dword [eax], esi
mov eax, dword [ebx + 0x20]
add dword [eax], esi
jmp 0x43dfe9
mov edx, ebx
mov eax, edi
mov edi, dword [ebp + 0xc]
mov ecx, eax
cmp edi, 1
mov eax, ecx
sbb eax, 0
jl 0x43e018
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x4c]
test eax, eax
je 0x43e018
push eax
push edi
push 1
push edx
mov esi, ecx
call fcn.00523399
mov ecx, esi
add esp, 0x10
sub edi, eax
sbb ecx, 0
jmp 0x43e018
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
sub eax, edi
mov edx, dword [ebp + 0x10]
sbb edx, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43e3f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x5df440]
xor eax, ebp
mov dword [esp + 0x38], eax
mov bl, 1
cmp dword [ecx + 0x38], 0
je 0x43e4b7
mov esi, ecx
cmp byte [ecx + 0x3d], 0
je 0x43e4b7
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x581450]
mov ecx, esi
push 0xffffffffffffffff
call edi
cmp eax, 0xffffffff
je 0x43e4b5
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], 0xffffffff
mov ebx, dword [esi + 0x38]
lea eax, [esi + 0x40]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [0x581450]
lea eax, [esp + 0xc]
lea edx, [esp + 0x10]
mov ecx, ebx
mov ebx, edx
push eax
lea eax, [esp + 0x34]
push eax
push edx
push dword [esp + 0x14]
call edi
cmp eax, 3
je 0x43e4cc
cmp eax, 1
je 0x43e491
test eax, eax
jne 0x43e4b5
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 0xc]
sub edi, ebx
je 0x43e4ac
push dword [esi + 0x4c]
push edi
push 1
push ebx
call fcn.00523399
add esp, 0x10
cmp edi, eax
jne 0x43e4b5
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x43e4b7
xor ebx, ebx
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.00513cac
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x3d], 0
mov bl, 1
jmp 0x43e4b7

Function at 0x441310
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5ebe38]
mov ecx, dword [0x5ed6c4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x44133b
mov ecx, 0x5ebe30
pop ebp
jmp fcn.0042e2f0
push 0x5ebe38
call fcn.00513c48
add esp, 4
cmp dword [0x5ebe38], 0xffffffff
jne 0x441330
mov dword [0x5ebe34], 0
mov dword [0x5ebe30], 0
mov ecx, 0x5ebe30
push 0
call fcn.0042e360
push 0x5ebe38
call fcn.00513bf7
add esp, 4
jmp 0x441330

Function at 0x44417e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x20]
mov ebx, dword [ebp + 8]
movups xmm0, xmmword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
xor edx, edx
mov dword [edi], edx
mov ecx, dword [ebx]
sub esp, 0x1c
mov dword [esp + 0x18], eax
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edx
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x4441dd
mov esi, eax
mov ebx, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 3
xor ecx, ecx
push ecx
push ecx
push edi
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [ecx + ecx*4]
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x445d70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x445de9
mov ecx, dword [ebp + 0xc]
cmp ebx, 1
jne 0x445d8c
xor esi, esi
jmp 0x445dce
and ebx, 0xfffffffe
xor esi, esi
nop word cs:[eax + eax]
movzx edi, al
movzx edx, byte [ecx + esi]
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x58aa84]
movzx edx, al
movzx edi, byte [ecx + esi + 1]
xor edi, edx
shr eax, 8
xor eax, dword [edi*4 + 0x58aa84]
add esi, 2
cmp ebx, esi
jne 0x445da0
mov edx, dword [ebp + 0x10]
test dl, 1
je 0x445de9
movzx edx, al
movzx ecx, byte [ecx + esi]
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x58aa84]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4535d9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesAdobeAdobe_AcrobatDCFeatureLockDown
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x453645
lea eax, [ebp - 0x10]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
push esi
push str.bEnableATL7Compat
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45363c
cmp dword [ebp - 8], 4
jne 0x45363c
inc eax
cmp dword [ebp - 0xc], eax
cmove esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x45364a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push esi
push edi
push eax
push 0x20019
xor edi, edi
xor esi, esi
push edi
push str.SoftwareAdobeAdobe_AcrobatDCSecurity
push 0x80000002
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4536b0
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push edi
push 0x5855c8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4536a7
cmp dword [ebp - 4], eax
cmove esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x457dc7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
push esi
movzx eax, ax
mov edx, ecx
push edi
mov edi, eax
mov dword [ebp - 8], eax
shr edi, 8
mov ebx, ecx
cmp dword [ebp + 0x10], ecx
jbe 0x457e26
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + ebx*2]
mov esi, eax
movzx eax, al
shr esi, 8
add esi, edx
cmp edi, eax
jb 0x457e26
jne 0x457e1e
cmp edx, esi
jge 0x457e1e
mov eax, dword [ebp + 8]
movzx eax, al
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
movzx eax, byte [edx + eax]
cmp ax, word [ebp - 4]
je 0x457e4a
inc edx
cmp edx, esi
jl 0x457e0c
inc ebx
mov edx, esi
cmp ebx, dword [ebp + 0x10]
jb 0x457de8
mov bl, 1
cmp dword [ebp + 0x1c], ecx
jbe 0x457e5d
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp - 8]
movzx eax, byte [ecx + esi]
test al, al
jns 0x457e4e
inc ecx
and eax, 0x7f
shl eax, 8
movzx edx, byte [ecx + esi]
or edx, eax
jmp 0x457e50
xor al, al
jmp 0x457e5f
mov edx, eax
sub edi, edx
js 0x457e5d
xor bl, 1
inc ecx
cmp ecx, dword [ebp + 0x1c]
jb 0x457e33
mov al, bl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x458200
Capabilities:
Create thread

Disassembly:
push 0x24
mov eax, 0x56738d
call fcn.00513d1f
mov esi, ecx
call fcn.00453bc4
add esi, 0xfffffffc
cmp dword [eax + 4], 0
mov edi, dword [esi]
ja 0x458265
mov ecx, dword [edi + 8]
call dword [0x581450]
mov ecx, esi
call dword [edi + 8]
call fcn.00471be0
call fcn.004a9a31
test al, al
jne 0x4582d2
cmp dword [0x5ec9c0], 0
je 0x4582d2
xor ecx, ecx
lea eax, [ebp - 0x30]
push eax
push ecx
push esi
push 0x454360
push ecx
push ecx
mov dword [ebp - 0x30], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x4582d2
mov ebx, 0x5853c1
lea ecx, [ebp - 0x28]
push ebx
call fcn.00450b3c
mov ecx, dword [edi + 0x28]
lea eax, [ebp - 0x28]
and dword [ebp - 4], 0
push 1
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [0x581450]
mov ecx, esi
call dword [edi + 0x28]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00455548
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x4582c0
call fcn.004538a1
sub esp, 0x18
mov esi, eax
mov ecx, esp
push ebx
call fcn.00450b3c
push 1
mov ecx, esi
call fcn.004b51a1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], 3
test eax, eax
je 0x4582d2
push eax
call fcn.0045413c
pop ecx
call fcn.00513cce
ret