joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f0a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x49f078]
test eax, eax
je 0x41f153
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x41f0cc
cmp dword [eax + 4], 0
mov edi, eax
je 0x41f0cc
add edi, 8
jmp 0x41f14e
mov eax, dword [0x49f078]
test eax, eax
je 0x41f162
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41f14c
mov esi, eax
test eax, eax
jne 0x41f122
movzx eax, byte [0x49fb08]
mov ecx, 0xc
call fcn.004361d0
test eax, eax
je 0x41f17d
mov dword [eax], 0x49f078
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x49f078]
test eax, eax
je 0x41f171
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x41f14e
test ecx, ecx
je 0x41f14e
lock dec dword [ecx]
jne 0x41f14e
call fcn.0041eda0
jmp 0x41f14e
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x49f078
call fcn.00459330
jmp 0x41f0b0
mov ecx, 0x49f078
call fcn.00459330
jmp 0x41f0da
mov ecx, 0x49f078
call fcn.00459330
jmp 0x41f11a
mov ecx, 4
mov edx, 0xc
call fcn.00458570
int3

Function at 0x41f700
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x49f088]
test eax, eax
je 0x41f77f
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x41f71f
cmp byte [eax + 4], 0
mov esi, eax
jne 0x41f774
mov eax, dword [0x49f088]
test eax, eax
je 0x41f78b
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41f779
mov esi, eax
test eax, eax
jne 0x41f76e
movzx eax, byte [0x49fb08]
mov ecx, 8
call fcn.004361d0
test eax, eax
je 0x41f7a3
mov dword [eax], 0x49f088
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x49f088]
test eax, eax
je 0x41f797
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x41f77b
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x49f088
call fcn.00459330
jmp 0x41f70b
mov ecx, 0x49f088
call fcn.00459330
jmp 0x41f729
mov ecx, 0x49f088
call fcn.00459330
jmp 0x41f766
mov ecx, 4
mov edx, 8
call fcn.00458570
int3
Function at 0x41fe70
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x41fec4
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x41fee7
test eax, eax
js 0x41fed3
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x41fedf
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x46fe34
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0041e860
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0041e990
mov ecx, 7
int 0x29
ud2
Function at 0x420650
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x49f068]
test eax, eax
je 0x4206e3
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x420676
cmp dword [eax + 4], 0
je 0x420676
add eax, 8
pop esi
ret
mov eax, dword [0x49f068]
test eax, eax
je 0x4206f2
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4206df
mov esi, eax
test eax, eax
jne 0x4206c8
movzx eax, byte [0x49fb08]
mov ecx, 0x10
call fcn.004361d0
test eax, eax
je 0x42070a
mov dword [eax], 0x49f068
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x49f068]
test eax, eax
je 0x4206fe
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x49f068
call fcn.00459330
jmp 0x42065f
mov ecx, 0x49f068
call fcn.00459330
jmp 0x420680
mov ecx, 0x49f068
call fcn.00459330
jmp 0x4206c0
mov ecx, 4
mov edx, 0x10
call fcn.00458570
int3
Function at 0x426520
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x42656d
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x42657d
mov dword [esi + 4], 0
jmp 0x42658f
cmp eax, 0x103
je 0x4265a7
test eax, eax
js 0x426598
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x426592
mov eax, esp
mov dword [esp + 0x1c], 0x46fe34
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0041e860
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0041e990
mov ecx, 7
int 0x29
ud2

Function at 0x429fe0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x49f098]
test eax, eax
je 0x42a093
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x42a00c
cmp dword [eax + 4], 0
mov edi, eax
je 0x42a00c
add edi, 8
jmp 0x42a08e
mov eax, dword [0x49f098]
test eax, eax
je 0x42a0a2
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x42a08c
mov esi, eax
test eax, eax
jne 0x42a062
movzx eax, byte [0x49fb08]
mov ecx, 0xc
call fcn.004361d0
test eax, eax
je 0x42a0bd
mov dword [eax], 0x49f098
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x49f098]
test eax, eax
je 0x42a0b1
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x42a08e
test ecx, ecx
je 0x42a08e
lock dec dword [ecx]
jne 0x42a08e
call fcn.0042a0d0
jmp 0x42a08e
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x49f098
call fcn.00459330
jmp 0x429ff0
mov ecx, 0x49f098
call fcn.00459330
jmp 0x42a01a
mov ecx, 0x49f098
call fcn.00459330
jmp 0x42a05a
mov ecx, 4
mov edx, 0xc
call fcn.00458570
int3

Function at 0x42b880
Capabilities:
Create process on windows
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54c
call fcn.0042b891
Function at 0x431a60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.00420cf0
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp edx, 0x80000000
jne 0x431a9e
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], 0x80000000
jmp 0x431ac0
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.00431990
mov ebx, dword [esp]
cmp ebx, 0x80000000
jne 0x431ad5
mov ecx, esp
call fcn.00420ea0
mov dword [esi], 0x80000000
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [esp + 4]
mov ebp, dword [esp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x431af3
mov dword [esi], ebx
mov dword [esi + 4], edi
mov dword [esi + 8], ebp
jmp 0x431acd
test ebx, ebx
mov dword [esi], 0x80000000
je 0x431acd
mov ecx, edi
mov edx, 2
call fcn.004070e0
jmp 0x431acd
Function at 0x433d90
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1038
call fcn.0044a0b0
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x449bc0
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], edx
lea esi, [ebp - 0x1044]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x1000
push 0
push esi
call fcn.0044b1d0
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push 0x42b320
push eax
push 0x1000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x433ee4
mov ebx, dword [sym.imp.KERNEL32.dll_SleepEx]
mov dword [ebp - 0x20], edi
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x433e1a
cmp dword [ebp - 0x2c], 0
jne 0x433ef5
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x433ef5
cmp esi, 0x1000
ja 0x433f31
xor edi, edi
nop dword [eax]
mov eax, esi
sub eax, edi
jb 0x433f17
xorps xmm0, xmm0
lea edx, [ebp - 0x30]
lea ecx, [ebp + edi - 0x1044]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], edx
push 0x42b320
lea edx, [ebp - 0x44]
push edx
push eax
push ecx
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
je 0x433eec
nop dword [eax]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x433e90
cmp dword [ebp - 0x2c], 0
jne 0x433ef2
add edi, dword [ebp - 0x28]
cmp edi, esi
jne 0x433e50
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
push 0x42b320
lea eax, [ebp - 0x44]
push eax
push 0x1000
lea eax, [ebp - 0x1044]
push eax
mov edi, dword [ebp - 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x433e1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x433ef5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push dword [ebp - 0x24]
call esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1038
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, edi
mov edx, esi
push 0x4700e0
call fcn.00458980
add esp, 4
jmp 0x433f4c
mov dword [ebp - 0x10], 0
mov ecx, esi
mov edx, 0x1000
push 0x4700e0
call fcn.00458760
add esp, 4
ud2
Function at 0x434020
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x449be0
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x43409e
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esi + 8]
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], 0x47020c
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x30]
mov edx, 0x47023c
mov dword [esi + 0x2c], fcn.004258c0
mov dword [esi + 0x3c], 1
call fcn.00458670
ud2

Function at 0x435ef0
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx], 0
mov edi, edx
jne 0x435fb6
mov ebx, dword [edi + 0xc]
mov esi, ecx
mov edx, dword [ebx]
test edx, edx
jne 0x435f1d
mov eax, dword [ebx + 8]
xor edx, edx
lea ecx, [eax + 0xf]
cmp ecx, 0xf
jbe 0x435fa1
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x435f8e
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx + 4]
mov dword [esp], 0
mov ebx, esp
push ecx
push ebx
push edx
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x435f54
mov eax, dword [esp]
mov ecx, 2
test eax, eax
jne 0x435f72
jmp 0x435f66
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x435f6d
cmp eax, 0x6d
jne 0x435f83
mov word [esi], 4
jmp 0x435f7c
mov ecx, 1
mov dword [edi], ecx
mov dword [edi + 4], eax
mov word [esi], 0x104
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov dword [esi], 0
mov dword [esi + 4], eax
jmp 0x435f7c
mov ecx, ebx
push 1
call fcn.00459630
add esp, 4
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
jmp 0x435f24
mov edx, eax
mov ecx, ebx
push 0x10
call fcn.00459630
add esp, 4
mov edx, dword [ebx]
jmp 0x435f1d
mov edx, esp
mov ecx, edi
mov dword [esp], 0
call fcn.00459850
int3
Function at 0x438ce0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], esp
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0x449d10
mov ebx, dword [ebp + 8]
mov edi, ecx
lea ecx, [esi + 0x38]
mov eax, dword fs:[0]
mov dword [esi + 0x38], eax
mov dword fs:[0], ecx
lea ecx, [esi + 0x24]
push ebx
call fcn.00420cf0
add esp, 4
mov ecx, dword [esi + 0x24]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
cmp ecx, 0x80000000
je 0x438d60
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
lea edx, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
push 1
call fcn.00426750
add esp, 4
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
cmp eax, 0x80000000
jne 0x438d7d
mov eax, dword [esi + 0x20]
mov dword [edi + 8], eax
mov dword [edi + 4], edx
mov dword [edi], 1
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 4], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], edx
mov edx, dword [ebp + 0xc]
mov dword [esi + 0x14], eax
mov dword [esi + 0x40], 0
lea ecx, [esi + 0x24]
push edi
call fcn.00420cf0
add esp, 4
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
cmp ecx, 0x80000000
je 0x438dd9
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
lea edx, [esi + 8]
push 1
call fcn.00426750
add esp, 4
mov ebx, dword [esi + 0x18]
mov edi, dword [esi + 0x1c]
cmp ebx, 0x80000000
jne 0x438e03
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 4]
mov dword [ecx + 8], eax
mov dword [ecx + 4], edi
mov dword [ecx], 1
cmp dword [esi + 0x14], 0
je 0x438d6c
mov ecx, dword [esi]
mov edx, 2
call fcn.004070e0
jmp 0x438d6c
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push 0
push 0
lea eax, [esi + 8]
push eax
push 0x438eb0
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
je 0x438e46
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
mov ecx, dword [esi + 0xc]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov dword [edx], 0
test ebx, ebx
jne 0x438e60
jmp 0x438de8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 4]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 1
test ebx, ebx
je 0x438de8
mov ecx, edi
mov edx, 2
call fcn.004070e0
jmp 0x438de8
Function at 0x438ed0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x449d20
mov ebx, ecx
mov esi, edx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
test edi, edi
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
je 0x438f2c
js 0x438f98
movzx eax, byte [0x49fb08]
mov ecx, edi
call fcn.004361d0
test eax, eax
jne 0x438f31
mov ecx, 1
mov edx, edi
call fcn.00458570
mov eax, 1
push edi
push esi
mov dword [ebp - 0x20], eax
push eax
call fcn.0044ac50
add esp, 0xc
mov edx, dword [ebx + 0x30]
cmp edx, dword [ebx + 0x28]
jne 0x438f62
lea ecx, [ebx + 0x28]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], ebx
call fcn.00438fc0
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp + 8]
mov edx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x2c]
mov esi, dword [ebp - 0x20]
lea ecx, [edx + edx*4]
inc edx
mov dword [eax + ecx*4], 0
mov dword [eax + ecx*4 + 4], edi
mov dword [eax + ecx*4 + 8], esi
mov dword [eax + ecx*4 + 0xc], edi
mov byte [eax + ecx*4 + 0x10], 0
mov dword [ebx + 0x30], edx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00407240
nop dword [eax]
push ebp
sub esp, 0xc
add ebp, 0xc
cmp dword [ebp + 8], 0
je 0x438fba
mov ecx, dword [ebp - 0x20]
mov edx, 1
call fcn.004070e0
add esp, 0xc
pop ebp
ret
Function at 0x4397b1
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x49f0a8]
mov ebx, ecx
test eax, eax
je 0x4398e5
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x4397f4
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x4397f4
mov edi, eax
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], ebx
add edi, 8
jmp 0x4398af
mov eax, dword [0x49f0a8]
test eax, eax
je 0x4398f4
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x439872
mov edi, eax
test eax, eax
jne 0x43984f
mov al, byte [0x49fb08]
push 0x20
pop ecx
call fcn.004361d0
test eax, eax
je 0x439912
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 0x18], 0x49f0a8
mov edi, eax
mov eax, dword [0x49f0a8]
test eax, eax
je 0x439903
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movaps xmmword [eax], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x439879
movdqa xmm0, xmmword [esp + 0x10]
jmp 0x43988c
xor ecx, ecx
xor eax, eax
inc eax
jmp 0x4398d8
mov esi, ebx
lea ebx, [esp + 0x28]
mov ecx, ebx
call fcn.00434020
movdqu xmm0, xmmword [ebx]
mov ebx, esi
and dword [edi + 4], 0
mov dword [edi], 1
movdqu xmmword [edi + 8], xmm0
movd ecx, xmm0
pshufd xmm0, xmm0, 0x55
add edi, 8
mov dword [esp + 0xc], ebx
movd eax, xmm0
mov ebx, ecx
mov edx, dword [edi + 8]
mov esi, dword [edi + 0xc]
add ebx, 1
mov dword [edi], ebx
mov ebx, eax
adc ebx, 0
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0xc]
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], eax
xor eax, eax
xor ecx, ecx
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], esi
mov dword [ebx], eax
mov dword [ebx + 4], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x49f0a8
call fcn.00459330
jmp 0x4397cd
mov ecx, 0x49f0a8
call fcn.00459330
jmp 0x439802
mov ecx, 0x49f0a8
call fcn.00459330
jmp 0x439847
push 8
pop ecx
push 0x20
pop edx
call fcn.00458570
Function at 0x44854b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
lea eax, [ebp - 0x18]
mov dword [ebp - 0x2c], ecx
mov edi, dword [ebp + 8]
mov esi, edx
mov edx, dword [ebp + 0x10]
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x449f70
mov dword [ebp - 0x20], esi
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
cmp dword [edi + 8], 0
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
je 0x4485b5
mov eax, dword [edi + 0xc]
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
and dword [ebp - 0x10], 0
push eax
call fcn.0044872a
pop ecx
mov dword [ebp - 0x24], eax
mov eax, edx
mov esi, dword [ebp - 0x20]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
jmp 0x4485be
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0x18]
and dword [ebp - 0x10], 0
sub edx, ecx
mov ecx, esi
mov dword [ebp - 0x28], eax
add edx, eax
call fcn.00441737
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.00441750
pop eax
push 0x23
pop edx
mov ecx, dword [ebp - 0x20]
call fcn.00410ceb
lea esi, [ebp - 0x34]
mov ecx, esi
call fcn.004423fc
mov edx, dword [esi]
mov ecx, dword [ebp - 0x20]
push dword [esi + 4]
call fcn.0044873b
pop eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 8]
movsd xmm0, qword [edx]
mov edx, dword [ebp + 8]
movsd qword [ecx + 0x10], xmm0
movsd xmm0, qword [edx + 0x3c]
mov dword [ecx + 0x18], eax
mov bl, byte [edx + 0x44]
mov edi, dword [edx]
mov esi, dword [edx + 4]
movsd qword [ecx + 0x3c], xmm0
movsd xmm0, qword [edx + 0x34]
mov byte [ecx + 0x44], bl
movsd qword [ecx + 0x34], xmm0
mov dword [ecx], edi
mov dword [ecx + 4], esi
mov edi, dword [ebp - 0x28]
mov esi, dword [edx + 0x1c]
mov dword [ecx + 8], 1
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x1c], esi
mov edi, dword [edx + 0x20]
mov esi, dword [edx + 0x24]
mov dword [ecx + 0x20], edi
mov dword [ecx + 0x24], esi
mov edi, dword [edx + 0x28]
mov esi, dword [edx + 0x2c]
mov edx, dword [edx + 0x30]
mov dword [ecx + 0x28], edi
mov dword [ecx + 0x2c], esi
mov dword [ecx + 0x30], edx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x44a7de
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44a81d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44a81d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44a81d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44a81d
cmp dword [ecx + 0x74], 0xe
jbe 0x44a81d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret