joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409b20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, edx
cmp dword [ebx + 0x18], ecx
ja 0x409b74
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov esi, dword [ebx]
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
mov dword [esp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x409ba3
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x409ba3
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x409be7
cmp esi, eax
jne 0x409b97
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x409bd1
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx + 8]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x409c03
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x409c25
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.00409c40
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x409c0b
mov dword [ecx], edi
jmp 0x409c25
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x409c25
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.00409c90
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40d190
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x49f270]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [0x4a2cf4], 0
push esi
je 0x40d1c0
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00467f35
mov esp, ebp
pop ebp
ret
push 0x18
call fcn.00467030
add esp, 4
test eax, eax
je 0x40d1dd
push ecx
mov ecx, eax
call fcn.0040cff0
mov dword [0x4a2cf4], eax
jmp 0x40d1e7
mov dword [0x4a2cf4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [esp + 0x18], 7
xor eax, eax
mov dword [esp + 0x14], 0
mov word [esp + 4], ax
cmp word [edx], ax
jne 0x40d20f
xor ecx, ecx
jmp 0x40d223
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d214
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0xc]
call fcn.00404be0
mov ecx, dword [0x4a2cf4]
lea eax, [esp + 4]
push eax
call fcn.0040dcd0
cmp dword [esp + 0x18], 8
jb 0x40d251
push dword [esp + 4]
call fcn.00466fe4
add esp, 4
mov ecx, dword [esp + 0x1c]
mov al, 1
pop esi
xor ecx, esp
call fcn.00467f35
mov esp, ebp
pop ebp
ret

Function at 0x40dcd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x49f270]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, ecx
mov dword [esp + 8], 0
mov ecx, str._t_n_v_f_r
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], eax
lea edx, [ecx + 2]
mov word [esp + 0x24], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40dd23
sub ecx, edx
sar ecx, 1
push ecx
push str._t_n_v_f_r
lea ecx, [esp + 0x2c]
call fcn.00404be0
lea eax, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x2c]
mov ecx, esi
call fcn.0041a240
add esp, 8
cmp dword [esp + 0x38], 8
jb 0x40dd68
push dword [esp + 0x24]
call fcn.00466fe4
add esp, 4
cmp dword [esp + 0x1c], 0
je 0x40dda6
cmp dword [esp + 0x20], 8
lea ecx, [esp + 8]
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
cmovae eax, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, edi
push esi
push dword [esp + 0xc]
call fcn.0040d2b0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x20], 8
jb 0x40ddb9
push dword [esp + 0xc]
call fcn.00466fe4
add esp, 4
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.00467f35
mov esp, ebp
pop ebp
ret 4

Function at 0x4134a0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.00411920
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi], eax
mov eax, esi
mov dword [esi + 4], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], esi
mov dword [esi + 8], 0
pop esi
ret
Function at 0x4155b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov dword [ebp - 8], 0
mov eax, dword [ecx + 0xc]
push esi
push edi
test eax, eax
je 0x4155dd
mov ebx, 1
mov dword [ebp - 8], eax
mov ecx, ebx
add eax, 4
lock xadd dword [eax], ecx
lea ecx, [ebp - 8]
jmp 0x415614
mov ebx, 2
call fcn.0041e3e0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41560a
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x415611
mov ecx, 1
add eax, 4
lock xadd dword [eax], ecx
jmp 0x415611
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
mov esi, dword [ebp + 8]
or edi, 0xffffffff
mov eax, dword [ecx]
mov dword [ecx], 0
mov dword [esi], eax
test bl, 2
je 0x415654
mov eax, dword [ebp - 4]
and ebx, 0xfffffffd
test eax, eax
je 0x415654
lea ecx, [eax + 4]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
setne al
test al, al
jne 0x415654
test ecx, ecx
je 0x41564d
add ecx, 0xfffffffc
jmp 0x41564f
xor ecx, ecx
mov eax, dword [ecx]
call dword [eax + 0xc]
test bl, 1
je 0x41568e
mov eax, dword [ebp - 8]
test eax, eax
je 0x41568e
lea ecx, [eax + 4]
lock xadd dword [ecx], edi
dec edi
setne al
test al, al
jne 0x41568e
test ecx, ecx
je 0x415687
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
call dword [edx + 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
mov edx, dword [ecx]
call dword [edx + 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4158e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
test ebx, ebx
je 0x415907
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x415902
mov eax, dword [ebx]
jmp 0x415904
mov eax, ebx
mov byte [eax], 0
call fcn.00402890
test al, al
je 0x415919
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x49858c
push esi
call fcn.00405fd0
mov edi, eax
add esp, 8
mov dword [ebp - 0xc], edi
test edi, edi
je 0x415910
push 0x10000
call fcn.00466888
add esp, 4
mov dword [ebp - 8], 0
mov esi, eax
push edi
push 0x10000
push 1
push esi
call fcn.0046cea5
mov edi, eax
add esp, 0x10
mov dword [ebp - 0x10], edi
test edi, edi
je 0x4159b2
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x415985
sub eax, dword [ebp - 8]
lea edx, [ebp - 0x10]
cmp eax, edi
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
cmovae ecx, edx
push dword [ecx]
mov ecx, ebx
push esi
call fcn.00403ea0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
sub eax, ecx
cmp eax, edi
jb 0x4159c8
push dword [ebp - 0xc]
add ecx, edi
push 0x10000
push 1
push esi
mov dword [ebp - 8], ecx
call fcn.0046cea5
mov edi, eax
add esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], edi
test edi, edi
jne 0x415963
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0046cf51
add esp, 4
test eax, eax
jne 0x4159cb
mov byte [ebp - 1], 1
jmp 0x4159cf
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 0
push ebx
call fcn.0046d373
add esp, 4
test esi, esi
je 0x4159e5
push esi
call fcn.00467511
add esp, 4
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4199e0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x49f270]
xor eax, esp
mov dword [esp + 0x34], eax
xor eax, eax
mov dword [esp], edx
push ebx
mov word [esp + 8], ax
xor bl, bl
push esi
lea eax, [esp + 0xc]
mov dword [esp + 0x20], 7
push eax
mov esi, ecx
mov dword [esp + 0x20], 0
call fcn.004061c0
add esp, 4
test al, al
je 0x419a62
lea eax, [esp + 0x24]
mov ecx, esi
push eax
call fcn.00402330
cmp dword [esp + 0x34], 0
je 0x419a4f
cmp dword [esp + 0x38], 8
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov bl, 1
cmp dword [esp + 0x38], 8
jb 0x419a62
push dword [esp + 0x24]
call fcn.00466fe4
add esp, 4
cmp dword [esi + 0x14], 8
jb 0x419a6a
mov esi, dword [esi]
push esi
call dword [esp + 0xc]
mov esi, eax
test bl, bl
je 0x419a8a
cmp dword [esp + 0x20], 8
lea ecx, [esp + 0xc]
cmovae ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp dword [esp + 0x20], 8
jb 0x419a9d
push dword [esp + 0xc]
call fcn.00466fe4
add esp, 4
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.00467f35
mov esp, ebp
pop ebp
ret

Function at 0x419f40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov edx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0
push 0xffffffffffffffff
lea esi, [edi + 4]
mov ecx, esi
call fcn.004158e0
add esp, 4
test al, al
jne 0x419fc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x419fb4
cmp eax, 0x21
je 0x419fb4
cmp eax, 5
jne 0x419f8d
mov eax, 0x3e8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x14], 8
jb 0x419f95
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
lea eax, [ecx*2 + 0x3e9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 0x3ea
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x20], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41d0a0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1010
call fcn.00467f50
mov eax, dword [0x49f270]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [ebp + 8]
lea edx, [esp]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0xc], 0
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 1
push edx
push 0
push eax
push dword [ecx]
mov dword [esp + 0x20], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x41d1e7
mov ecx, dword [esp + 0xc]
cmp ecx, 1
jne 0x41d174
cmp word [esp + 0x10], ax
jne 0x41d138
xor ecx, ecx
lea eax, [esp + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.00404be0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00467f35
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d140
sub ecx, edx
lea eax, [esp + 0x10]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00404be0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00467f35
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x41d1e2
push 0x400
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], eax
test eax, eax
je 0x41d1c7
cmp eax, 0x400
ja 0x41d1c7
lea eax, [esp + 0x810]
mov ecx, edi
push eax
call fcn.00402f90
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00467f35
mov esp, ebp
pop ebp
ret 8
mov eax, 0xea
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00467f35
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
xor ecx, esp
call fcn.00467f35
mov esp, ebp
pop ebp
ret 8

Function at 0x41d4d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], 0
mov esi, edx
push edi
test ebx, ebx
je 0x41d53c
cmp dword [0x4a3f20], 0
jne 0x41d529
push 0x44
call fcn.00467030
add esp, 4
test eax, eax
je 0x41d50a
mov ecx, eax
call fcn.0040a4c0
mov edx, eax
jmp 0x41d50c
xor edx, edx
mov ecx, edx
mov edi, 0x4a3f20
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
je 0x41d529
test edx, edx
je 0x41d529
push ecx
mov ecx, edx
call fcn.0040a480
mov eax, dword [0x4a3f20]
cmp dword [eax], 1
jl 0x41d53c
mov dword [ebp - 4], 0x10000
jmp 0x41d53e
xor ebx, ebx
push 8
call fcn.00467030
add esp, 4
mov edi, eax
push 0
push dword [ebp - 4]
mov dword [edi], esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
push 0x41d380
push ebx
setne cl
push 0
mov byte [edi + 4], cl
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x41d581
push edi
call fcn.00466fe4
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x41d597
mov dword [esi], eax
mov al, 1
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41eb30
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
push edx
xor ebx, ebx
push ecx
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x41ebc2
cmp dword [0x4a2cc0], 3
jg 0x41ebb4
lea ebx, [eax + 1]
mov dword [esp + 8], 3
push ebx
push 2
lea ecx, [esp + 0x18]
call fcn.00405490
mov dword [esp + 0xac], str.d:webapps_b_build_slave_repo_build_src_base_threading_thread_local_win.cc
mov dword [esp + 0xb0], 0x23
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x23
push str.d:webapps_b_build_slave_repo_build_src_base_threading_thread_local_win.cc
lea ecx, [esp + 0x10]
mov dword [esp + 0xbc], eax
call fcn.0040b200
lea eax, [esp + 0x10]
push str.Failed_to_TlsSetValue__.
push eax
call fcn.00405180
add esp, 8
test bl, 1
je 0x41ebc2
lea ecx, [esp + 8]
call fcn.0040af80
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420e20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
call fcn.00411920
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 1
cmp byte [eax + 0x6d], 0
lea eax, [esp + 0x28]
je 0x420e82
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
push 0xf
push 0xf
push 0
push eax
call esi
test eax, eax
jne 0x420e7e
push 1
push 0x113
push 0x113
push eax
lea eax, [esp + 0x34]
push eax
call esi
test eax, eax
jne 0x420e7e
xor bl, bl
jmp 0x420e94
mov bl, 1
jmp 0x420e94
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
setne bl
mov esi, dword [0x4a2d9c]
test esi, esi
jne 0x420ec2
call fcn.004330b0
test eax, eax
jne 0x420eae
mov esi, 0x4a3e69
jmp 0x420ebc
push 0x498e90
mov ecx, eax
call fcn.00430220
mov esi, eax
mov dword [0x4a2d9c], esi
mov dword [esp + 0x10], 0
test byte [esi], 0xd
je 0x420f07
lea eax, [esp + 0x28]
mov edx, esi
push eax
push 0x498e94
sub esp, 0xc
push str.origin_base::MessagePumpForUI::ProcessPumpReplacementMessage
call fcn.004218a0
mov dword [esp + 0x34], eax
add esp, 0x18
lea eax, [esp + 0x14]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], str.origin_base::MessagePumpForUI::ProcessPumpReplacementMessage
mov dword [esp + 0x20], edx
mov dword [esp + 0x10], eax
xor ecx, ecx
lea eax, [edi + 0x28]
xchg dword [eax], ecx
test bl, bl
je 0x420f27
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
lea eax, [esp + 0x24]
mov ecx, edi
push eax
call fcn.004207b0
mov bl, al
cmp dword [esp + 0x10], 0
je 0x420f53
mov ecx, dword [esp + 0x14]
cmp byte [ecx], 0
je 0x420f53
call fcn.004330b0
push dword [esp + 0x20]
mov ecx, eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.00431680
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427de0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.00428130
mov eax, dword [0x4a0850]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
test edx, edx
jne 0x427e01
call fcn.00435e40
mov edx, eax
mov eax, dword [0x4a3e34]
cmp dword [edx + eax*4], 0
jne 0x427e49
push 0x70
call fcn.00467030
add esp, 4
test eax, eax
je 0x427e26
push esi
mov ecx, eax
call fcn.00427bb0
mov esi, eax
jmp 0x427e28
xor esi, esi
mov eax, dword [0x4a0850]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
test ecx, ecx
jne 0x427e41
call fcn.00435e40
mov ecx, eax
mov eax, dword [0x4a3e34]
mov dword [ecx + eax*4], esi
pop esi
ret

Function at 0x427e50
Capabilities:
Get thread local storage value

Disassembly:
cmp byte [0x4a3e30], 0
push ebx
push esi
push edi
jne 0x427e62
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [0x4a0850]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
test ecx, ecx
jne 0x427e7b
call fcn.00435e40
mov ecx, eax
mov eax, dword [0x4a3e34]
mov eax, dword [ecx + eax*4]
test eax, eax
jne 0x427f12
mov ecx, 0x4a3e10
xor edi, edi
xor ebx, ebx
call fcn.00413c70
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x4a3e08]
test ecx, ecx
je 0x427ebb
mov eax, dword [ecx + 4]
mov edi, ecx
mov dword [0x4a3e08], eax
mov dword [ecx + 4], ebx
jmp 0x427ec8
mov ebx, dword [0x4a3e44]
inc ebx
mov dword [0x4a3e44], ebx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x427eef
push 0x70
call fcn.00467030
add esp, 4
test eax, eax
je 0x427eed
push ebx
mov ecx, eax
call fcn.00427c70
mov edi, eax
jmp 0x427eef
xor edi, edi
mov eax, dword [0x4a0850]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
test ecx, ecx
jne 0x427f08
call fcn.00435e40
mov ecx, eax
mov eax, dword [0x4a3e34]
mov dword [ecx + eax*4], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x42b4b0
Capabilities:
Enumerate processes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32FirstW]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
mov edi, edi
push 0x22c
push 0
push edi
call fcn.004685d0
add esp, 0xc
mov dword [edi], 0x22c
cmp byte [esi + 8], 0
push edi
push dword [esi + 4]
jne 0x42b4e8
mov byte [esi + 8], 1
call ebx
jmp 0x42b4ee
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
setne al
test al, al
je 0x42b50a
mov edx, dword [esi]
mov ecx, esi
mov edx, dword [edx + 4]
call edx
test al, al
je 0x42b4c0
mov eax, edi
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x42c320
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x49f270]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x3c], edi
test edi, edi
jne 0x42c345
mov dword [ebp - 0x38], edi
jmp 0x42c364
cmp byte [edi], 0
jne 0x42c353
mov dword [ebp - 0x38], 0
jmp 0x42c364
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42c358
sub ecx, edx
mov dword [ebp - 0x38], ecx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004169e0
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x42c37c
mov eax, dword [eax]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp dword [ebp - 8], 8
mov esi, eax
mov dword [ebp - 0x38], esi
jb 0x42c39d
push dword [ebp - 0x1c]
call fcn.00466fe4
add esp, 4
test esi, esi
jne 0x42c3b6
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467f35
mov esp, ebp
pop ebp
ret 8
test ebx, ebx
je 0x42c4c1
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00466888
add esp, 4
mov dword [ebp - 0x44], edi
mov esi, eax
test edi, edi
jne 0x42c3e7
mov dword [ebp - 0x40], edi
jmp 0x42c404
cmp byte [edi], 0
jne 0x42c3f5
mov dword [ebp - 0x40], 0
jmp 0x42c404
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x42c3f8
sub edi, ecx
mov dword [ebp - 0x40], edi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004169e0
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x42c41c
mov eax, dword [eax]
push dword [ebp - 0x38]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp dword [ebp - 8], 8
jb 0x42c438
push dword [ebp - 0x1c]
call fcn.00466fe4
add esp, 4
push esi
lea ecx, [ebp - 0x1c]
call fcn.00406410
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004168d0
mov edi, eax
add esp, 8
cmp ebx, edi
je 0x42c480
cmp dword [ebx + 0x14], 0x10
jb 0x42c467
push dword [ebx]
call fcn.00466fe4
add esp, 4
mov dword [ebx + 0x14], 0xf
mov ecx, ebx
mov dword [ebx + 0x10], 0
push edi
mov byte [ebx], 0
call fcn.00403d80
cmp dword [ebp - 0x20], 0x10
jb 0x42c491
push dword [ebp - 0x34]
call fcn.00466fe4
add esp, 4
cmp dword [ebp - 8], 8
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x34], 0
jb 0x42c4b4
push dword [ebp - 0x1c]
call fcn.00466fe4
add esp, 4
test esi, esi
je 0x42c4c1
push esi
call fcn.00467511
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00467f35
mov esp, ebp
pop ebp
ret 8
Function at 0x42d4a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ecx]
mov ecx, dword [ecx + 4]
sub ecx, edi
sar ecx, 2
test ecx, ecx
je 0x42d50e
push ebx
push esi
mov ebx, ecx
mov eax, dword [edi]
lea edi, [edi + 4]
movzx esi, cl
movzx edx, al
xor esi, edx
shr ecx, 8
mov dword [ebp - 4], eax
movzx eax, ah
xor ecx, dword [esi*4 + 0x4996a0]
movzx edx, cl
xor edx, eax
shr ecx, 8
movzx eax, byte [ebp - 2]
xor ecx, dword [edx*4 + 0x4996a0]
movzx edx, cl
xor edx, eax
shr ecx, 8
movzx eax, byte [ebp - 1]
xor ecx, dword [edx*4 + 0x4996a0]
movzx edx, cl
xor edx, eax
shr ecx, 8
xor ecx, dword [edx*4 + 0x4996a0]
dec ebx
jne 0x42d4b7
pop esi
pop ebx
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x42f170
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi], 0x499de8
mov dword [esi + 4], edi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov eax, dword [edi + 0x234]
mov dword [esi + 0x20], eax
call fcn.00411920
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov dword [ebp + 8], esi
mov edx, dword [eax + 0x5c]
lea ecx, [eax + 0x58]
mov eax, dword [ecx]
cmp eax, edx
je 0x42f1e7
cmp dword [eax], esi
je 0x42f1e3
add eax, 4
cmp eax, edx
jne 0x42f1d8
cmp eax, edx
jne 0x42f1f0
lea eax, [ebp + 8]
push eax
call fcn.004121c0
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, byte [0x4a3cce]
lea ecx, [edi + 0x1e8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00434660
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4