joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60080b50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x124]
push edi
mov eax, dword [esi + 8]
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov ecx, dword [esi + 0x124]
sub eax, 2
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], ecx
je 0x60080c92
dec eax
je 0x60080b96
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret 0xc
mov ecx, dword [esi + 0x20]
push esi
mov edi, ecx
lea eax, [esp + 0x20]
and ecx, 0x1f
mov ebx, 1
push 1
push eax
shr edi, 5
shl ebx, cl
call fcn.6007f390
test eax, eax
mov ebp, dword [esp + 0x124]
je 0x60080bd4
push esi
push 1
push ebp
call fcn.6007f390
test eax, eax
je 0x60080bd4
mov eax, 1
jmp 0x60080bd6
xor eax, eax
mov ecx, dword [esp + 0x10]
lea edi, [esp + edi*4 + 0x1c]
cmp ecx, 1
mov dword [edi], ebx
je 0x60080c47
dec ecx
mov dword [esp + 0x10], ecx
test eax, eax
je 0x60080c34
lea ecx, [esp + 0x1c]
push esi
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
call fcn.6007f9d0
test eax, eax
je 0x60080c34
push esi
push ebp
push ebp
push ebp
call fcn.6007f9d0
test eax, eax
je 0x60080c34
mov ecx, dword [esp + 0x120]
push esi
push ebp
push ebp
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.6007fa40
test eax, eax
je 0x60080c34
mov eax, 1
jmp 0x60080c36
xor eax, eax
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
xor edx, ebx
dec ecx
mov dword [edi], edx
mov dword [esp + 0x10], ecx
jne 0x60080bea
test eax, eax
je 0x60080b87
lea eax, [esp + 0x1c]
push esi
push eax
push ebp
push ebp
push ebp
call fcn.6007fa40
test eax, eax
je 0x60080b87
mov ecx, dword [esp + 0x120]
push esi
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.6007f450
test eax, eax
je 0x60080b87
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10c
ret 0xc
xor esi, esi
xor edx, edx
test edi, edi
mov edi, dword [esp + 0x124]
je 0x60080ce9
mov ebx, dword [esp + 0x120]
mov eax, edx
shr eax, 5
mov ecx, edx
mov ebx, dword [ebx + eax*4]
and ecx, 0x1f
shr ebx, cl
mov ebp, dword [edi + eax*4]
and ebx, 1
xor esi, ebx
mov ebx, esi
not ebx
and ebx, 1
shl ebx, cl
not ebx
and ebx, ebp
mov ebp, esi
and ebp, 1
shl ebp, cl
or ebx, ebp
inc edx
mov dword [edi + eax*4], ebx
mov eax, dword [esp + 0x10]
cmp edx, eax
jne 0x60080ca1
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [edi + ebx*4 - 4]
xor eax, eax
test esi, esi
sete al
shl edx, cl
shr edx, cl
mov dword [edi + ebx*4 - 4], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc

Function at 0x60081fd0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x18]
sub eax, 0x182
je 0x60082004
sub eax, 0x64
je 0x60082004
sub eax, 0x64
cmp word [esp + 0x20], 6
jb 0x60082004
push 0xc
call fcn.60088990
add esp, 0x24
ret
push 4
call fcn.60088990
add esp, 0x24
ret
Function at 0x60087570
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
sub esp, 0x51c
lea edx, [eax + 0x1f]
push ebx
push ebp
lea ebp, [ecx + 0x1f]
push esi
shr edx, 5
shr ebp, 5
cmp edx, ebp
mov ebx, edx
ja 0x60087595
mov ebx, ebp
mov ecx, dword [esp + 0x53c]
xor esi, esi
xor eax, eax
cmp ecx, esi
setne al
cmp ebx, esi
mov dword [esp + 0xc], eax
je 0x6008779c
cmp ebx, 0x40
ja 0x6008779c
lea eax, [esp + 0x324]
mov ecx, ebx
mov dword [eax - 0x204], esi
mov dword [eax], esi
mov dword [eax - 0x104], esi
mov dword [eax + 0x100], esi
add eax, 4
dec ecx
jne 0x600875c3
mov ecx, dword [esp + 0x120]
mov esi, dword [esp + 0x52c]
xor ecx, 1
push edi
mov dword [esp + 0x124], ecx
mov ecx, edx
lea edi, [esp + 0x224]
push edx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x53c]
lea ecx, [ebp*4]
mov dword [esp + 0x24], ecx
mov eax, ecx
lea edi, [esp + 0x42c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x534]
push ecx
call fcn.600864a0
push ebp
mov edx, dword [esp + 0x53c]
mov dword [esp + 0x328], eax
push edx
call fcn.600864a0
xor edx, edx
mov dword [esp + 0x528], eax
mov eax, edx
mov dword [esp + 0x18], edx
shl eax, 7
add eax, edx
shl eax, 2
mov ecx, eax
neg ecx
mov esi, dword [esp + ecx + 0x528]
test esi, esi
je 0x6008773e
lea esi, [esp + eax + 0x124]
lea ebp, [esp + ecx + 0x328]
mov dword [esp + 0x1c], ebp
mov eax, dword [esi + 0x200]
mov ecx, dword [ebp + 0x200]
cmp eax, ecx
jb 0x60087730
sub eax, ecx
push ebx
mov edi, eax
lea eax, [esp + 0x28]
push eax
lea eax, [ebp + 0x100]
push edi
push eax
call fcn.60086290
lea edx, [esi + 0x100]
lea ecx, [esp + 0x24]
mov eax, edx
mov dword [esp + 0x14], ebx
mov ebp, dword [ecx]
add ecx, 4
xor dword [eax], ebp
mov ebp, dword [esp + 0x14]
add eax, 4
dec ebp
mov dword [esp + 0x14], ebp
jne 0x600876c2
push ebx
push edx
call fcn.600864a0
mov dword [esi + 0x200], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x60087714
mov ebp, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ebx
push ecx
push edi
push ebp
call fcn.60086290
lea ecx, [esp + 0x24]
mov eax, esi
sub ecx, esi
mov edx, ebx
mov edi, dword [ecx + eax]
xor dword [eax], edi
add eax, 4
dec edx
jne 0x60087707
jmp 0x60087718
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi + 0x200]
mov ecx, dword [ebp + 0x200]
cmp eax, ecx
jae 0x6008769b
mov edx, dword [esp + 0x18]
mov eax, 1
sub eax, edx
mov edx, eax
jmp 0x60087654
mov edi, dword [esp + 0x544]
test edi, edi
je 0x6008775b
mov eax, edx
mov ecx, ebx
shl eax, 7
add eax, edx
lea esi, [esp + eax*4 + 0x224]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x6008778a
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x540]
mov eax, edx
shl eax, 7
add eax, edx
mov edx, ecx
shr ecx, 2
lea esi, [esp + eax*4 + 0x124]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x51c
ret 0x18
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x51c
ret 0x18
Function at 0x6008b7fd
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
cmp dword [0x600bfb54], 0
je 0x6008b816
mov eax, dword [0x600bc7e0]
leave
ret
push edi
push esi
push 0x25
xor eax, eax
pop ecx
lea edi, [ebp - 0x94]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x6008b8d8
xor eax, eax
cmp dword [ebp - 0x84], 2
sete al
test eax, eax
mov dword [0x600bc7e0], eax
je 0x6008b8a7
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x6008b8d8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQuerySystemInformation
push edi
call esi
test eax, eax
mov dword [0x600bfb3c], eax
je 0x6008b88b
mov dword [0x600bc7d8], 0x4000
push str.NtOpenFile
push edi
call esi
push str.RtlInitUnicodeString
push edi
mov dword [0x600bfb40], eax
call esi
mov dword [0x600bfb44], eax
jmp 0x6008b8d8
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x6008b8d8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x600a6d30
push edi
call esi
push str.GetMessageTime
push edi
mov dword [0x600bfb48], eax
call esi
mov dword [0x600bfb4c], eax
mov eax, dword [0x600bc7e0]
pop esi
mov dword [0x600bfb54], 1
pop edi
leave
ret

Function at 0x6008d310
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
xor ecx, ecx
xor edx, edx
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov cl, byte [esi + 0x100]
mov dl, byte [esi + 0x101]
test ebp, ebp
je 0x6008d35f
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x6008d334
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc

Function at 0x6008d371
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov eax, 0x3020100
push esi
mov ecx, 0x40
mov esi, dword [esp + 0xc]
push edi
mov edx, esi
push ebp
mov dword [edx], eax
add edx, 4
add eax, 0x4040404
dec ecx
jne 0x6008d385
xor ecx, ecx
xor edi, edi
mov ebp, dword [esp + 0x1c]
mov byte [esi + 0x100], cl
mov byte [esi + 0x101], cl
xor ebx, ebx
xor edx, edx
xor eax, eax
mov dl, byte [edi + esi]
mov al, byte [ebp + ecx]
add bl, al
inc ecx
add bl, dl
inc edi
mov al, byte [ebx + esi]
mov byte [edi + esi - 1], al
cmp dword [esp + 0x18], ecx
mov byte [ebx + esi], dl
jne 0x6008d3cb
xor ecx, ecx
cmp edi, 0x100
jb 0x6008d3a8
pop ebp
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x6008d810
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4
Function at 0x6008f050
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov dword [edi + 4], ebx
call fcn.60090730
push 0x54
push edi
mov dword [esp + 0x18], eax
call fcn.600906c0
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x6008f094
push edi
call fcn.60090740
mov eax, dword [edi]
push edi
mov dword [eax + 0x14], 0x36
mov ecx, dword [edi]
mov dword [ecx + 0x18], ebx
mov edx, dword [edi]
call dword [edx]
add esp, 8
mov dword [esi], fcn.6008f190
mov dword [esi + 4], fcn.6008f2e0
mov dword [esi + 8], fcn.6008f390
mov dword [esi + 0xc], fcn.6008f440
mov dword [esi + 0x10], 0x6008f4f0
mov dword [esi + 0x14], 0x6008f560
mov dword [esi + 0x18], 0x6008f5d0
mov dword [esi + 0x1c], 0x6008f750
mov dword [esi + 0x20], 0x6008f940
mov dword [esi + 0x24], fcn.6008fb30
mov dword [esi + 0x28], 0x6008fc30
mov dword [esi + 0x30], 0xfff0
mov eax, dword [esp + 0xc]
mov ecx, 2
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x40]
mov dword [eax - 8], ebx
mov dword [eax], ebx
sub eax, 4
dec ecx
jne 0x6008f0f6
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call sub.MSVCRT.dll_getenv
add esp, 4
cmp eax, ebx
je 0x6008f186
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
push edx
push str._ld_c
push eax
mov byte [esp + 0x24], 0x78
call sub.MSVCRT.dll_sscanf
add esp, 0x10
test eax, eax
jle 0x6008f186
mov al, byte [esp + 0x14]
cmp al, 0x6d
je 0x6008f14f
cmp al, 0x4d
jne 0x6008f173
mov eax, dword [esp + 0xc]
pop edi
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esi + 0x2c], eax
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esp + 0xc]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x600cbdbf
Capabilities:
Encode data using xor

Disassembly:
mov dword [ecx + 0x10], edi
lea ecx, [ecx]
mov dword [ecx + 0x18], edx
mov dword [ecx + 0x14], eax
jmp 0x600cbdb5
call esi
lea edi, [eax]
mov ch, 0x7c
mov dl, cl
call 0x600cbdbf
and ebx, 0xffffffff
cmc
lea ecx, [esp + 0x20]
jmp 0x600cbc02
and dword [ebp - 0x102], 0
lea edx, [esi - 0x24]
inc dword [ebp - 0x102]
call esi
xor eax, edi
xchg edx, edx
je 0x600cbdbf
jmp 0x600cbe9e
xor edi, eax
rdtsc
ret
Function at 0x600cbe1f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esp, esp
nop
mov esp, esp
ja 0x600cbd8e
xor eax, 0xabe326ee
mov edi, edi
sbb eax, dword [esp + 4]
jmp 0x600cbc66
lea edi, [eax + ebx]
nop
mov bh, bh
cmp ecx, dword [edx + 0x18]
mov edi, edi
wait
je 0x600cbddf
cld
push 0
jmp 0x600cbd8a
pop ecx
lea edi, [edi + ecx*8]
inc ecx
lodsd eax, dword [esi]
jmp 0x600c70b0
and edx, 0x4d063aec
push ebx
lea esi, [esi + ecx*2]
movzx eax, word [esi]
jmp 0x600cbe28
mov eax, ebx
dec ecx
add eax, dword [ebx + 0x3c]
add edx, dword [eax + 0x78]
cld
push 0xffffffffffffffff
add esi, dword [edx + 0x20]
jmp 0x600c70ff
jne 0x600c7103
dec eax
lea esi, [ebx]
lea eax, [edx - 0xc]
lea edi, [ebx]
add esi, dword [edx + 0x24]
add edi, dword [edx + 0x1c]
jmp 0x600c710a
movzx eax, byte [edi]
lea edi, [edi + 1]
sub dword [esp], eax
cmp byte [edi], 1
pop eax
jmp 0x600c7068
pop eax
add bl, 0
imul eax, eax, 0xf
push eax
jmp 0x600cbd2c
ret
mov edx, ebx
mov esi, ebx
jmp 0x600cbc37
mov dh, bl
pop esi
wait
inc edx
add esi, dword [edi + eax*4]
ret 4
Function at 0x4102c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x410310
cmp esi, edi
ja 0x410378
cmp edi, dword [esp + 0x1c]
ja 0x41038b
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x410312
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x410300
jmp 0x41036f
ja 0x410318
cmp eax, edx
mov esi, edi
jne 0x4102d3
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x410350
mov ebp, esi
sub ecx, edx
jns 0x410367
jmp 0x410371
cmp esi, edi
je 0x4103a0
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x410371
xor al, 1
cmp ebp, edi
jne 0x410330
jmp 0x410371
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x44a500
call fcn.00446bd0
add esp, 4
ud2
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x44a500
call fcn.004469c0
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112librarycore_srcio_borrowed_buf.rs_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_alloc_srccollections_btree_navigate.rs
mov edx, 0x2b
push 0x44a4f0
call fcn.00446a30
add esp, 4
ud2
Function at 0x41192e
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, edx
mov edx, dword [esp + 0x18]
mov ebx, ecx
not ebx
cmp edx, 0x40
jb 0x411a55
push 4
pop edi
sub edi, 1
jb 0x41193d
cmp edx, 0xf
jbe 0x411a65
movzx ebp, byte [eax + 0xe]
movzx esi, byte [eax + 0xf]
mov ecx, ebx
mov dword [esp], edx
mov edx, 0xff
shr ecx, 0x18
mov ebp, dword [ebp*4 + 0x44b2f4]
xor ebp, dword [esi*4 + 0x44aef4]
movzx esi, byte [eax + 0xd]
xor ebp, dword [esi*4 + 0x44b6f4]
movzx esi, byte [eax + 0xc]
xor ebp, dword [esi*4 + 0x44baf4]
movzx esi, byte [eax + 0xb]
xor ebp, dword [esi*4 + 0x44bef4]
movzx esi, byte [eax + 0xa]
xor ebp, dword [esi*4 + 0x44c2f4]
movzx esi, byte [eax + 9]
xor ebp, dword [esi*4 + 0x44c6f4]
movzx esi, byte [eax + 8]
xor ebp, dword [esi*4 + 0x44caf4]
movzx esi, byte [eax + 7]
xor ebp, dword [esi*4 + 0x44cef4]
movzx esi, byte [eax + 6]
xor ebp, dword [esi*4 + 0x44d2f4]
movzx esi, byte [eax + 5]
xor ebp, dword [esi*4 + 0x44d6f4]
movzx esi, byte [eax + 4]
xor ebp, dword [esi*4 + 0x44daf4]
movzx esi, byte [eax + 3]
xor ecx, esi
mov esi, ebx
xor ebp, dword [ecx*4 + 0x44def4]
movzx ecx, byte [eax + 2]
shr esi, 0x10
and esi, edx
xor esi, ecx
movzx ecx, byte [eax + 1]
xor ebp, dword [esi*4 + 0x44e2f4]
mov esi, ebx
and ebx, edx
shr esi, 8
and esi, edx
mov edx, dword [esp]
xor esi, ecx
movzx ecx, byte [eax]
xor ebp, dword [esi*4 + 0x44e6f4]
xor ebx, ecx
mov ecx, eax
xor ebp, dword [ebx*4 + 0x44eaf4]
push 0x44aee4
call fcn.00411ebc
pop ecx
mov ebx, ebp
jmp 0x411949
mov cl, byte [eax]
inc eax
dec edx
xor cl, bl
shr ebx, 8
movzx esi, cl
xor ebx, dword [esi*4 + 0x44aef4]
test edx, edx
jne 0x411a42
not ebx
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xf
pop ecx
push 0x44aed4
call fcn.00446950
pop eax
ud2
Function at 0x41dba0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x45d04c]
test eax, eax
je 0x41dc53
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x41dbcc
cmp dword [eax + 4], 0
mov edi, eax
je 0x41dbcc
add edi, 8
jmp 0x41dc4e
mov eax, dword [0x45d04c]
test eax, eax
je 0x41dc62
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x41dc4c
mov esi, eax
test eax, eax
jne 0x41dc22
movzx eax, byte [0x45daa8]
mov ecx, 0xc
call fcn.0040c5b0
test eax, eax
je 0x41dc7d
mov dword [eax], 0x45d04c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45d04c]
test eax, eax
je 0x41dc71
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x41dc4e
test ecx, ecx
je 0x41dc4e
lock dec dword [ecx]
jne 0x41dc4e
call fcn.0041d8a0
jmp 0x41dc4e
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x45d04c
call fcn.004474a0
jmp 0x41dbb0
mov ecx, 0x45d04c
call fcn.004474a0
jmp 0x41dbda
mov ecx, 0x45d04c
call fcn.004474a0
jmp 0x41dc1a
mov ecx, 4
mov edx, 0xc
call fcn.00446790
ud2
Function at 0x41e8d0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x41e924
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x41e947
test eax, eax
js 0x41e933
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x41e93f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x453010
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0041d3b0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0041d4e0
mov ecx, 7
int 0x29
ud2
Function at 0x41ef10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x45d03c]
test eax, eax
je 0x41efa3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x41ef36
cmp dword [eax + 4], 0
je 0x41ef36
add eax, 8
pop esi
ret
mov eax, dword [0x45d03c]
test eax, eax
je 0x41efb2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x41ef9f
mov esi, eax
test eax, eax
jne 0x41ef88
movzx eax, byte [0x45daa8]
mov ecx, 0x10
call fcn.0040c5b0
test eax, eax
je 0x41efca
mov dword [eax], 0x45d03c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45d03c]
test eax, eax
je 0x41efbe
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x45d03c
call fcn.004474a0
jmp 0x41ef1f
mov ecx, 0x45d03c
call fcn.004474a0
jmp 0x41ef40
mov ecx, 0x45d03c
call fcn.004474a0
jmp 0x41ef80
mov ecx, 4
mov edx, 0x10
call fcn.00446790
ud2
Function at 0x420e20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x437710
mov dword [ebp - 0x28], ecx
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x30], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jae 0x420eb0
jmp 0x420e9e
jbe 0x420f3c
cmp esi, 0x201
jae 0x420eb0
mov dword [ebp - 0x2c], 0x200
lea ebx, [ebp - 0x44c]
mov edi, esi
jmp 0x420eeb
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x420edc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
mov edx, edi
push esi
call fcn.00447730
add esp, 4
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x420f0b
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x420f74
cmp esi, edi
jne 0x420e90
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x420faf
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x420e9e
jmp 0x420eb0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
cmp esi, edx
ja 0x420fcf
lea ecx, [ebp - 0x4c]
mov edx, ebx
push esi
call fcn.00421670
add esp, 4
movsd xmm0, qword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
movsd xmm1, qword [ebp - 0x44]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
jmp 0x420f87
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp - 0x28]
mov byte [ecx], 0
mov dword [ecx + 4], eax
mov byte [ecx + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x420f9b
mov ecx, dword [ebp - 0x24]
mov edx, 2
call fcn.0040c5e0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, str.internal_error:_entered_unreachable_code
mov edx, 0x28
push 0x453768
call fcn.00446a30
add esp, 4
jmp 0x420fde
mov ecx, esi
push 0x453758
call fcn.004469c0
add esp, 4
ud2
Function at 0x429200
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x45d06c]
test eax, eax
je 0x4292b3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x42922c
cmp dword [eax + 4], 0
mov edi, eax
je 0x42922c
add edi, 8
jmp 0x4292ae
mov eax, dword [0x45d06c]
test eax, eax
je 0x4292c2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4292ac
mov esi, eax
test eax, eax
jne 0x429282
movzx eax, byte [0x45daa8]
mov ecx, 0xc
call fcn.0040c5b0
test eax, eax
je 0x4292dd
mov dword [eax], 0x45d06c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45d06c]
test eax, eax
je 0x4292d1
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x4292ae
test ecx, ecx
je 0x4292ae
lock dec dword [ecx]
jne 0x4292ae
call fcn.004292f0
jmp 0x4292ae
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x45d06c
call fcn.004474a0
jmp 0x429210
mov ecx, 0x45d06c
call fcn.004474a0
jmp 0x42923a
mov ecx, 0x45d06c
call fcn.004474a0
jmp 0x42927a
mov ecx, 4
mov edx, 0xc
call fcn.00446790
ud2
Function at 0x42fdc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.0041f780
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test edx, edx
je 0x42fe25
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.0042fd00
mov edi, dword [esp]
test edi, edi
je 0x42fe34
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42fe49
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebp
jmp 0x42fe41
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], 0
mov ecx, esp
call fcn.0041f930
mov dword [esi], 0
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
mov dword [esi], 0
je 0x42fe41
mov ecx, edi
mov edx, 2
call fcn.0040c5e0
jmp 0x42fe41