joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a010
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffffc
sub esp, 8
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x41a093
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [esi]
lea ecx, [edi + 1]
cmp ecx, 2
jb 0x41a067
mov ecx, dword [ebp + 4]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00419db0
push eax
push dword [esp + 8]
push esi
push edi
call fcn.0043dce0
add esp, 0x10
push dword [esi]
call fcn.0043dc90
mov eax, dword [esp + 4]
add esp, 4
mov dword [esi], 0
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x41a08c
mov dword [esi], ebx
mov edi, dword [ebp + 4]
mov dword [esp], eax
call fcn.00419db0
push eax
push edi
push esi
push ebx
call fcn.0043dcb0
mov eax, dword [esp + 0x10]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x41a7a0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffffc
sub esp, 0x24
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x4f62d0]
mov eax, dword [eax]
xor eax, ebp
mov dword [esp + 0x20], eax
xor eax, eax
cmp dword [esi + 4], 0
setne al
add eax, eax
add eax, 4
mov ebx, ecx
sar ebx, 0x1f
push dword [ebp + 0xc]
push ecx
push ebx
mov dword [esp + 0xc], eax
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
test edi, edi
jne 0x41a80c
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push dword [esp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
test edi, edi
je 0x41a84c
mov esi, dword [ebp + 0x14]
lea eax, [esp + 4]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ecx, dword [esp + 0x10]
sub ecx, edi
add ecx, dword [esp + 8]
test eax, eax
cmove ecx, eax
mov dword [esi], ecx
mov al, 1
mov ecx, dword [esp + 0x20]
xor ecx, ebp
mov edx, dword [0x4f62d0]
mov edx, dword [edx]
cmp edx, ecx
jne 0x41a850
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
xor eax, eax
jmp 0x41a830
call fcn.00468008
int3
Function at 0x420030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x120
mov edi, dword [ebp + 8]
mov edx, dword [0x4f62d0]
mov eax, dword [edx]
xor eax, ebp
mov dword [esp + 0x118], eax
mov ecx, dword [edi + 4]
mov eax, 0xffffffff
test ecx, ecx
je 0x4201c4
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ecx + 4]
test ebx, ebx
je 0x4201c4
mov esi, dword [ebp + 0x10]
cmp ebx, 1
jne 0x4200a5
mov ebx, dword [esp + 0xc]
cmp ebx, esi
jbe 0x4201c4
mov ecx, dword [ecx]
mov cl, byte [ecx]
mov edi, dword [edi]
nop
cmp byte [edi + esi], cl
je 0x4201b4
add esi, 1
cmp ebx, esi
jne 0x420090
jmp 0x4201c4
xorps xmm0, xmm0
movaps xmmword [esp + 0x100], xmm0
movaps xmmword [esp + 0xf0], xmm0
movaps xmmword [esp + 0xe0], xmm0
movaps xmmword [esp + 0xd0], xmm0
movaps xmmword [esp + 0xc0], xmm0
movaps xmmword [esp + 0xb0], xmm0
movaps xmmword [esp + 0xa0], xmm0
movaps xmmword [esp + 0x90], xmm0
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov eax, dword [ecx]
lea edx, [ebx - 1]
mov ecx, ebx
and ecx, 3
xor edi, edi
cmp edx, 3
jb 0x42015e
and ebx, 0xfffffffc
xor edi, edi
nop dword [eax]
movzx edx, byte [eax + edi]
mov byte [esp + edx + 0x10], 1
movzx edx, byte [eax + edi + 1]
mov byte [esp + edx + 0x10], 1
movzx edx, byte [eax + edi + 2]
mov byte [esp + edx + 0x10], 1
movzx edx, byte [eax + edi + 3]
mov byte [esp + edx + 0x10], 1
add edi, 4
cmp ebx, edi
jne 0x420130
test ecx, ecx
je 0x420180
add eax, edi
xor edi, edi
nop word cs:[eax + eax]
movzx edx, byte [eax + edi]
mov byte [esp + edx + 0x10], 1
add edi, 1
cmp ecx, edi
jne 0x420170
mov eax, 0xffffffff
mov edi, dword [esp + 0xc]
cmp edi, esi
jbe 0x4201be
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ecx + esi]
cmp byte [esp + edx + 0x10], 0
jne 0x4201bc
add esi, 1
cmp edi, esi
jne 0x4201a0
jmp 0x4201be
cmp ebx, esi
je 0x4201c4
mov eax, esi
jmp 0x4201c4
mov eax, esi
mov edx, dword [0x4f62d0]
mov ecx, dword [esp + 0x118]
xor ecx, ebp
mov edx, dword [edx]
cmp edx, ecx
jne 0x4201db
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00468008
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffffc
mov edx, dword [ebp + 0xc]
mov esi, dword [ecx + 4]
mov eax, 0xffffffff
cmp esi, edx
jbe 0x420214
mov bl, byte [ebp + 8]
mov ecx, dword [ecx]
nop dword [eax]
cmp byte [ecx + edx], bl
je 0x42020e
add edx, 1
cmp esi, edx
jne 0x420200
jmp 0x420214
cmp esi, edx
je 0x420214
mov eax, edx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret 8
Function at 0x420400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x120
mov edi, dword [ebp + 8]
mov edx, dword [0x4f62d0]
mov eax, dword [edx]
xor eax, ebp
mov dword [esp + 0x118], eax
mov ecx, dword [edi + 4]
mov eax, 0xffffffff
test ecx, ecx
je 0x420590
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ecx + 4]
test ebx, ebx
je 0x420475
mov esi, dword [ebp + 0x10]
cmp ebx, 1
jne 0x42047c
mov ebx, dword [esp + 0xc]
cmp ebx, esi
jbe 0x420590
mov ecx, dword [ecx]
mov cl, byte [ecx]
mov edi, dword [edi]
nop dword [eax + eax]
cmp byte [edi + esi], cl
jne 0x420584
add esi, 1
cmp ebx, esi
jne 0x420460
jmp 0x420590
mov eax, ebx
jmp 0x420590
xorps xmm0, xmm0
movaps xmmword [esp + 0x100], xmm0
movaps xmmword [esp + 0xf0], xmm0
movaps xmmword [esp + 0xe0], xmm0
movaps xmmword [esp + 0xd0], xmm0
movaps xmmword [esp + 0xc0], xmm0
movaps xmmword [esp + 0xb0], xmm0
movaps xmmword [esp + 0xa0], xmm0
movaps xmmword [esp + 0x90], xmm0
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov eax, dword [ecx]
lea edx, [ebx - 1]
mov ecx, ebx
and ecx, 3
xor edi, edi
cmp edx, 3
jb 0x42052e
and ebx, 0xfffffffc
xor edi, edi
movzx edx, byte [eax + edi]
mov byte [esp + edx + 0x10], 1
movzx edx, byte [eax + edi + 1]
mov byte [esp + edx + 0x10], 1
movzx edx, byte [eax + edi + 2]
mov byte [esp + edx + 0x10], 1
movzx edx, byte [eax + edi + 3]
mov byte [esp + edx + 0x10], 1
add edi, 4
cmp ebx, edi
jne 0x420500
test ecx, ecx
je 0x420550
add eax, edi
xor edi, edi
nop word cs:[eax + eax]
movzx edx, byte [eax + edi]
mov byte [esp + edx + 0x10], 1
add edi, 1
cmp ecx, edi
jne 0x420540
mov eax, 0xffffffff
mov edi, dword [esp + 0xc]
cmp edi, esi
jbe 0x42058a
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ecx + esi]
cmp byte [esp + edx + 0x10], 0
je 0x420588
add esi, 1
cmp edi, esi
jne 0x420570
jmp 0x42058a
mov eax, esi
jmp 0x420590
mov eax, esi
mov edx, dword [0x4f62d0]
mov ecx, dword [esp + 0x118]
xor ecx, ebp
mov edx, dword [edx]
cmp edx, ecx
jne 0x4205a7
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00468008
int3
Function at 0x420be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x110
mov edx, dword [ebp + 8]
mov ebx, dword [0x4f62d0]
mov eax, dword [ebx]
xor eax, ebp
mov dword [esp + 0x108], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x420d74
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
add eax, 0xffffffff
cmp eax, ecx
cmovae eax, ecx
mov esi, dword [edi + 4]
test esi, esi
je 0x420d79
cmp esi, 1
jne 0x420c61
mov ecx, dword [edi]
mov cl, byte [ecx]
mov edx, dword [edx]
add eax, 1
nop word cs:[eax + eax]
nop
mov esi, eax
mov ch, byte [edx + eax - 1]
add eax, 0xffffffff
cmp esi, 1
je 0x420c52
cmp ch, cl
je 0x420c40
cmp ch, cl
mov ecx, 0xffffffff
cmove eax, ecx
jmp 0x420d79
xorps xmm0, xmm0
movaps xmmword [esp + 0xf0], xmm0
movaps xmmword [esp + 0xe0], xmm0
movaps xmmword [esp + 0xd0], xmm0
movaps xmmword [esp + 0xc0], xmm0
movaps xmmword [esp + 0xb0], xmm0
movaps xmmword [esp + 0xa0], xmm0
movaps xmmword [esp + 0x90], xmm0
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov edi, dword [edi]
lea edx, [esi - 1]
mov ebx, esi
and ebx, 3
xor ecx, ecx
cmp edx, 3
jb 0x420d1a
and esi, 0xfffffffc
xor ecx, ecx
nop word cs:[eax + eax]
nop dword [eax + eax]
movzx edx, byte [edi + ecx]
mov byte [esp + edx], 1
movzx edx, byte [edi + ecx + 1]
mov byte [esp + edx], 1
movzx edx, byte [edi + ecx + 2]
mov byte [esp + edx], 1
movzx edx, byte [edi + ecx + 3]
mov byte [esp + edx], 1
add ecx, 4
cmp esi, ecx
jne 0x420cf0
test ebx, ebx
je 0x420d3f
add edi, ecx
xor ecx, ecx
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [edi + ecx]
mov byte [esp + edx], 1
add ecx, 1
cmp ebx, ecx
jne 0x420d30
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
movzx edx, byte [ecx + eax]
cmp byte [esp + edx], 0
je 0x420d90
mov ebx, dword [0x4f62d0]
nop word cs:[eax + eax]
nop
test eax, eax
je 0x420d74
movzx edx, byte [ecx + eax - 1]
add eax, 0xffffffff
cmp byte [esp + edx], 0
jne 0x420d60
jmp 0x420d79
mov eax, 0xffffffff
mov ecx, dword [esp + 0x108]
xor ecx, ebp
mov edx, dword [ebx]
cmp edx, ecx
jne 0x420d98
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [0x4f62d0]
jmp 0x420d79
call fcn.00468008
int3
Function at 0x425f30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffffc
sub esp, 0x10
mov eax, dword [0x4f62d0]
mov eax, dword [eax]
xor eax, ebp
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
cmp ecx, esi
jb 0x425f99
mov ebx, dword [ebp + 0x18]
lea eax, [esp + 4]
push esi
push 0
push eax
call fcn.00420e90
add esp, 0xc
mov dword [esp], eax
cmp ebx, 1
je 0x425fb7
test ebx, ebx
jne 0x425f99
cmp edx, esi
jne 0x425f99
push esi
push edi
push dword [esp + 8]
call sub.ntdll.dll_memcmp
add esp, 0xc
test eax, eax
sete cl
jmp 0x425f9b
xor ecx, ecx
mov eax, dword [esp + 0xc]
xor eax, ebp
mov edx, dword [0x4f62d0]
mov edx, dword [edx]
cmp edx, eax
jne 0x426003
mov eax, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
test esi, esi
je 0x425fff
xor edx, edx
nop dword [eax]
movzx eax, byte [edi + edx]
mov ecx, dword [esp]
movzx ecx, byte [ecx + edx]
mov ebx, eax
add bl, 0xbf
mov bh, al
add bh, 0x20
cmp bl, 0x1a
movzx ebx, bh
cmovae ebx, eax
mov eax, ecx
add al, 0xbf
mov ah, cl
add ah, 0x20
cmp al, 0x1a
movzx eax, ah
cmovae eax, ecx
cmp bl, al
sete cl
jne 0x425f9b
add edx, 1
cmp esi, edx
jne 0x425fc0
jmp 0x425f9b
mov cl, 1
jmp 0x425f9b
call fcn.00468008
int3

Function at 0x426100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffffc
sub esp, 0x10
mov eax, dword [0x4f62d0]
mov eax, dword [eax]
xor eax, ebp
mov dword [esp + 0xc], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
sub eax, ebx
jb 0x42616c
mov esi, dword [ebp + 0x18]
lea ecx, [esp + 4]
push ebx
push eax
push ecx
call fcn.00420e90
add esp, 0xc
mov dword [esp], eax
mov eax, esi
mov esi, edx
cmp eax, 1
je 0x42618a
test eax, eax
jne 0x42616c
cmp esi, ebx
jne 0x42616c
push ebx
push edi
push dword [esp + 8]
call sub.ntdll.dll_memcmp
add esp, 0xc
test eax, eax
sete cl
jmp 0x42616e
xor ecx, ecx
mov eax, dword [esp + 0xc]
xor eax, ebp
mov edx, dword [0x4f62d0]
mov edx, dword [edx]
cmp edx, eax
jne 0x4261d3
mov eax, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
test esi, esi
je 0x4261cf
xor ebx, ebx
mov eax, dword [esp]
movzx eax, byte [eax + ebx]
movzx edx, byte [edi + ebx]
mov ecx, eax
add cl, 0xbf
mov ch, al
add ch, 0x20
cmp cl, 0x1a
movzx ecx, ch
cmovae ecx, eax
mov eax, edx
add al, 0xbf
mov ah, dl
add ah, 0x20
cmp al, 0x1a
movzx eax, ah
cmovae eax, edx
cmp cl, al
sete cl
jne 0x42616e
add ebx, 1
cmp esi, ebx
jne 0x426190
jmp 0x42616e
mov cl, 1
jmp 0x42616e
call fcn.00468008
int3
Function at 0x4367d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffffc
sub esp, 0x18
mov esi, edx
mov eax, dword [0x4f62d0]
mov eax, dword [eax]
xor eax, ebp
mov dword [esp + 0x14], eax
test ecx, ecx
mov ebx, 0x100000
cmovne ebx, ecx
push 0xc
call fcn.004c3980
add esp, 4
mov edi, eax
mov dword [eax], esi
cmp dword [ebp + 8], 0
setne byte [eax + 4]
mov eax, dword [ebp + 0xc]
mov dword [edi + 8], eax
push 0
push 0x10000
push edi
push 0x436e90
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test eax, eax
je 0x436838
mov eax, dword [ebp + 8]
test eax, eax
je 0x43686b
mov dword [eax], esi
jmp 0x436872
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x436851
mov ecx, eax
cmp eax, 0x5af
je 0x436851
cmp ecx, 0xe
jne 0x436891
push ebx
call fcn.00414cd0
add esp, 4
mov ebx, dword [0x4f62d0]
push edi
call fcn.004c3b20
add esp, 4
jmp 0x436878
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [0x4f62d0]
test esi, esi
setne al
mov ecx, dword [esp + 0x14]
xor ecx, ebp
mov edx, dword [ebx]
cmp edx, ecx
jne 0x4368fe
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, byte [0x517808]
test al, al
je 0x436903
mov ebx, dword [0x51879c]
mov eax, esp
push ecx
push eax
call fcn.0041c940
add esp, 8
movzx eax, byte [esp]
mov ecx, eax
shr ecx, 1
test al, 1
lea eax, [esp + 1]
cmovne eax, dword [esp + 8]
mov dword [esp + 0xc], eax
cmovne ecx, dword [esp + 4]
mov dword [esp + 0x10], ecx
sub esp, 0xc
movsd xmm0, qword [esp + 0x18]
movsd qword [esp + 4], xmm0
mov dword [esp], ebx
call fcn.004126c0
add esp, 0xc
test byte [esp], 1
je 0x43685a
push dword [esp + 8]
call fcn.004c3b20
jmp 0x436857
call fcn.00468008
push 0x517808
mov ebx, ecx
call fcn.004c3610
mov ecx, ebx
add esp, 4
test eax, eax
je 0x43689a
push 0x20
push str.create_thread_last_error
call fcn.004126b0
add esp, 8
mov dword [0x51879c], eax
push 0x517808
call fcn.004c3768
mov ecx, ebx
add esp, 4
jmp 0x43689a
Function at 0x4384d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffffc
mov eax, 0x1408
call fcn.004c4ae4
mov esi, dword [0x4f62d0]
mov eax, dword [esi]
xor eax, ebp
mov dword [esp + 0x1404], eax
mov eax, dword [0x516024]
cmp eax, 0xffffffff
je 0x438622
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x438622
and ebx, 0xfffffffc
lea eax, [esp + 0xc04]
push 0x800
push ebx
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov ecx, dword [0x516024]
lea eax, [esp + 0xc05]
push eax
mov dword [esp + 4], ecx
push ecx
call fcn.00438cc0
add esp, 8
push ebx
call fcn.004c3b50
add esp, 4
mov al, byte [0x5177b8]
test al, al
je 0x43863e
mov esi, dword [0x518744]
mov ecx, esi
call fcn.0042b8c0
lea eax, [esp + 4]
push 0xc00
push 0x517918
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov esi, 0x100
test al, al
je 0x43860e
nop word cs:[eax + eax]
nop
xor eax, eax
lea edi, [esp + 0xc]
xor ebx, ebx
jmp 0x4385be
add ebx, 1
add edi, 0xc
cmp ebx, 0x100
je 0x438600
mov ecx, dword [esp + ebx*8 + 0xc04]
test ecx, ecx
je 0x4385b0
cmp dword [edi - 8], 0
je 0x4385b0
mov edx, dword [esp + ebx*8 + 0xc08]
cmp edx, dword [edi]
jne 0x4385b0
mov edx, dword [edi - 4]
test edx, edx
je 0x4385b0
mov dword [esp + ebx*8 + 0xc04], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x4385b0
cmp esi, 2
jb 0x43860e
add esi, 0xffffffff
and al, 1
test al, al
jne 0x4385a0
push 2
push dword [esp + 4]
call fcn.00438cc0
add esp, 8
mov esi, dword [0x4f62d0]
mov eax, dword [esp + 0x1404]
xor eax, ebp
mov ecx, dword [esi]
cmp ecx, eax
jne 0x438639
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00468008
push 0x5177b8
call fcn.004c3610
add esp, 4
test eax, eax
je 0x43855e
push 4
call fcn.004c3980
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.0042b880
mov dword [0x518744], esi
push 0x5177b8
call fcn.004c3768
add esp, 4
jmp 0x43855e
Function at 0x4386b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffffc
sub esp, 0xac
mov esi, ecx
mov eax, dword [0x4f62d0]
mov eax, dword [eax]
xor eax, ebp
mov dword [esp + 0xa8], eax
mov eax, dword [0x516024]
cmp eax, 0xffffffff
je 0x4386e6
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x4386eb
call fcn.00438890
mov al, byte [0x5177b8]
test al, al
je 0x43883d
mov edi, dword [0x518744]
mov ecx, edi
call fcn.0042b8c0
mov eax, dword [0x51851c]
add eax, 1
mov ecx, 0x100
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, al
lea ebx, [edx + edx*2]
cmp dword [ebx*4 + 0x517918], 0
je 0x43874d
lea edx, [eax + 1]
movzx edx, dl
lea ebx, [edx + edx*2]
cmp dword [ebx*4 + 0x517918], 0
je 0x43874d
add eax, 2
add ecx, 0xfffffffe
jne 0x438720
jmp 0x43877d
lea eax, [ebx*4 + 0x517918]
mov dword [eax], 1
lea eax, [edx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x51791c], ecx
mov dword [0x51851c], edx
mov dword [esi], edx
mov eax, dword [eax + eax*2 + 0x517920]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
mov dword [esp], eax
mov dword [esp + 0xa4], 0xffffffff
cmp eax, 0xffffffff
jne 0x4387d0
lea eax, [esp + 0xa4]
mov ecx, esp
push str.slot____kInvalidSlotValue
push eax
push ecx
call fcn.00413490
add esp, 0xc
test eax, eax
je 0x4387d0
mov edi, esp
mov ecx, edi
push eax
push 0x196
push str._var_tmp_build_firefox_71aaf16cd119_security_sandbox_chromium_base_threading_thread_local_storage.cc
call fcn.00413db0
mov ecx, edi
call fcn.00413f30
mov eax, dword [esi]
mov dword [esp], eax
mov dword [esp + 0xa4], 0x100
cmp eax, 0xff
jle 0x43881e
lea eax, [esp + 0xa4]
mov ecx, esp
push str.slot____kThreadLocalStorageSize
push eax
push ecx
call fcn.00413490
add esp, 0xc
test eax, eax
je 0x43881e
mov esi, esp
mov ecx, esi
push eax
push 0x197
push str._var_tmp_build_firefox_71aaf16cd119_security_sandbox_chromium_base_threading_thread_local_storage.cc
call fcn.00413db0
mov ecx, esi
call fcn.00413f30
mov eax, dword [esp + 0xa8]
xor eax, ebp
mov ecx, dword [0x4f62d0]
mov ecx, dword [ecx]
cmp ecx, eax
jne 0x43887d
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x5177b8
call fcn.004c3610
add esp, 4
test eax, eax
je 0x4386f8
push 4
call fcn.004c3980
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.0042b880
mov dword [0x518744], edi
push 0x5177b8
call fcn.004c3768
add esp, 4
jmp 0x4386f8
call fcn.00468008
int3
Function at 0x43aee0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov ecx, dword [0x4f62d0]
mov eax, dword [ecx]
xor eax, ebp
mov dword [esp + 0x28], eax
movsd xmm1, qword [0x518788]
xorpd xmm0, xmm0
ucomisd xmm1, xmm0
jne 0x43b045
jp 0x43b045
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov al, byte [0x5177e8]
test al, al
je 0x43b06a
mov al, byte [0x5177f0]
test al, al
je 0x43b09e
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
lea esi, [esp + 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub edi, dword [0x518780]
sbb ebx, dword [0x518784]
movd xmm0, ebx
movd xmm1, edi
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x4fa620]
subpd xmm1, xmmword [0x4fa630]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
fild qword [esp + 0x20]
fstp qword [esp + 0x18]
divsd xmm0, qword [esp + 0x18]
xorpd xmm1, xmm1
movsd xmm2, qword [0x4fa640]
ucomisd xmm2, xmm0
ja 0x43b03f
mov eax, dword [esp + 8]
sub eax, dword [0x518778]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x51877c]
movd xmm1, ecx
movd xmm2, eax
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x4fa620]
subpd xmm2, xmmword [0x4fa630]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x518788], xmm1
mov ecx, dword [0x4f62d0]
movsd qword [esp + 0x10], xmm1
fld qword [esp + 0x10]
mov eax, dword [esp + 0x28]
xor eax, ebp
mov ecx, dword [ecx]
cmp ecx, eax
jne 0x43b063
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
fstp st(0)
call fcn.00468008
push 0x5177e8
call fcn.004c3610
add esp, 4
test eax, eax
je 0x43af41
rdtsc
mov dword [0x518778], eax
mov dword [0x51877c], edx
push 0x5177e8
call fcn.004c3768
add esp, 4
jmp 0x43af41
push 0x5177f0
call fcn.004c3610
add esp, 4
test eax, eax
je 0x43af4e
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [0x518784], ecx
mov dword [0x518780], eax
push 0x5177f0
call fcn.004c3768
add esp, 4
jmp 0x43af4e
Function at 0x43cdf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffffc
sub esp, 0x10
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x43cef7
mov ebx, ecx
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx + 0x74], 0
je 0x43cef7
cmp word [eax + edx + 0x14], 0x68
jb 0x43cef7
mov esi, dword [ebx]
mov ecx, ebx
push dword [eax + edx + 0x78]
call dword [esi + 8]
test eax, eax
je 0x43cef7
mov esi, eax
mov eax, dword [ebp + 8]
cmp eax, 0xffff
ja 0x43ce4d
mov word [edi], ax
jmp 0x43cf26
mov eax, dword [ebx]
mov ecx, ebx
push dword [esi + 0x20]
call dword [eax + 8]
mov edx, eax
mov eax, dword [esi + 0x18]
lea ecx, [eax*4]
test ecx, ecx
je 0x43cef7
mov dword [esp + 8], esi
mov dword [esp], ebx
lea esi, [edx + eax*4]
mov eax, dword [ebp + 8]
add eax, 1
mov dword [esp + 0xc], eax
mov dword [esp + 4], edx
mov ebx, edx
nop word cs:[eax + eax]
nop
mov edi, esi
sub edi, ebx
mov eax, edi
sar eax, 2
shr edi, 0x1f
add edi, eax
and edi, 0xfffffffe
mov ecx, dword [esp]
mov eax, dword [ecx]
push dword [ebx + edi*2]
call dword [eax + 8]
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x43ced1
mov edx, dword [esp + 0xc]
nop dword [eax]
cmp cl, byte [eax]
jne 0x43ced3
add eax, 1
movzx ecx, byte [edx]
add edx, 1
test cl, cl
jne 0x43cec0
xor ecx, ecx
lea edi, [ebx + edi*2]
movzx ecx, cl
movzx eax, byte [eax]
mov edx, ecx
sub edx, eax
test edx, edx
lea edx, [edi + 4]
cmovg ebx, edx
cmovle esi, edi
cmp ecx, eax
je 0x43cf03
xor eax, eax
cmp ebx, esi
jne 0x43ce90
jmp 0x43cef9
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [esp]
mov eax, dword [ecx]
mov esi, dword [esp + 8]
push dword [esi + 0x24]
call dword [eax + 8]
sub edi, dword [esp + 4]
sar edi, 1
movzx eax, word [eax + edi]
add ax, word [esi + 0x10]
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
mov al, 1
jmp 0x43cef9