joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49fe3b
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xd4]
mov dword [esp + 4], eax
test edx, edx
je 0x49fef1
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
neg eax
add ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
push ebp
push edi
lea edi, [ecx + eax*4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xcc]
mov ebp, edi
imul ecx, ebx
add ecx, dword [esi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x49fed1
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, esi
dec edx
jne 0x49feac
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec edx
inc ebx
cmp dword [esi + 0xe8], 0
mov dword [esp + 0x3c], edx
jne 0x49fee6
add edi, dword [esp + 0x14]
jmp 0x49feea
add edi, dword [esp + 0x24]
test edx, edx
jne 0x49fe8a
pop edi
pop ebp
pop ebx
pop esi
pop ecx
pop ecx
ret 0x24

Function at 0x4a01fc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], edx
test ebx, ebx
je 0x4a02d6
imul eax, dword [esp + 0x1c], 3
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
neg ecx
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
push edi
imul edi, dword [esp + 0x30], 3
mov dword [esp + 0x10], ecx
add eax, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], edi
mov esi, dword [eax + 0xcc]
imul esi, ebp
mov dword [esp + 0x34], edi
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x28]
test edx, edx
jle 0x4a02ac
mov ebp, dword [esp + 0x34]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov edi, edx
movzx eax, byte [esi]
movzx ecx, byte [ebp]
imul ecx, dword [esp + 0x40]
imul eax, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [esi], al
inc esi
dec edi
jne 0x4a0274
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x4a02c3
add edi, ecx
jmp 0x4a02c7
add edi, dword [esp + 0x24]
mov dword [esp + 0x38], edi
test ebx, ebx
jne 0x4a024a
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x4a08f6
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x4a09ab
imul eax, dword [esp + 0x20]
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x34]
add eax, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x4a098c
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [ecx], al
add ecx, edi
dec esi
jne 0x4a0967
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x3c], esi
jne 0x4a09a1
add edx, dword [esp + 0x14]
jmp 0x4a09a5
add edx, dword [esp + 0x24]
test esi, esi
jne 0x4a0945
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 0x24
Function at 0x4a2b9f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
xor ebp, ebp
push esi
test ebx, ebx
je 0x4a2bb3
mov esi, ebx
jmp 0x4a2bbd
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
je 0x4a2cae
lea eax, [esp + 0x18]
push eax
push 0x18
pop eax
push eax
push dword [esp + 0x68]
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x4a2ca3
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push edi
mov edi, dword [esp + 0x24]
push 0x2c
push 0
push eax
mov dword [esp + 0x20], ebp
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [esp + 0x34], 0x28
xor eax, eax
mov dword [esp + 0x38], ebp
inc eax
mov dword [esp + 0x3c], edi
mov word [esp + 0x40], ax
xor ecx, ecx
push 0x18
pop eax
push ecx
push ecx
mov word [esp + 0x4a], ax
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [esp + 0x44]
mov dword [esp + 0x54], ecx
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x4a2ca2
push 0
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x18]
push edi
push 0
push dword [esp + 0x78]
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
imul edi, dword [esp + 0x14]
test edi, edi
jle 0x4a2ca2
mov ebx, dword [esp + 0x10]
push 3
pop ebp
movzx ecx, byte [ebx + 1]
movzx eax, byte [ebx + 2]
add eax, ecx
movzx ecx, byte [ebx]
add eax, ecx
cdq
idiv ebp
mov byte [ebx], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 1], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 2], al
mov ebx, dword [esp + 0x10]
add ebx, ebp
mov dword [esp + 0x10], ebx
dec edi
jne 0x4a2c6b
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x18]
pop edi
test ebx, ebx
jne 0x4a2cae
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x50
ret 8

Function at 0x4a4d90
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x4a4dc2
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4a4dbd
cmp dword [esp + 0xc], esi
je 0x4a4dd9
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret

Function at 0x4aa9b6
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0xb41fa8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x4aaa17
push esi
push dword [0xb41fa4]
push 8
push dword [0xb3fee4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0xb41fa8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0xb41fa0]
jmp 0x4aaa07
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4aaa05
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x4aa9f5
push edi
push 0x4aa954
call fcn.005323a0
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4
Function at 0x4aaa21
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ecx, esi
push edi
and ecx, 3
je 0x4aaa37
push 4
pop eax
sub eax, ecx
add esi, eax
mov eax, dword [0xb41fa4]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x4aaa6e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
push 8
push dword [0xb3fee4]
mov dword [0xb41fa8], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0xb41fa8]
call ebx
mov eax, dword [0xb41fa4]
mov edi, eax
add eax, esi
push eax
push dword [0xb41fa8]
mov dword [0xb41fa4], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0xb3fee4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0xb41fa8]
call ebx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test esi, esi
jne 0x4aaaae
test ebx, ebx
je 0x4aaacf
push 0x14
push 0xb41fa0
call fcn.004ab29c
pop ecx
pop ecx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
test esi, esi
je 0x4aaacf
lea ecx, [edi + ebp]
push ecx
call esi
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x4ab870
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0xb41fe8], 0
jne 0x4ab87e
call fcn.004ab7f0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0xb41fec]
call esi
test eax, eax
jne 0x4ab8a1
call fcn.004ab7f0
push dword [0xb41fec]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x4ab8b0
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x4ab910
mov ebx, 0x10
test edi, edi
jns 0x4ab919
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x4ab8e2
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4ab930
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0xb41fe8], 0
jne 0x4ab93e
call fcn.004ab7f0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0xb41fec]
call esi
mov edx, eax
test edx, edx
jne 0x4ab965
call fcn.004ab7f0
push dword [0xb41fec]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x4ab998
mov ebx, 0x10
test esi, esi
jns 0x4ab9a1
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x4ab9b0
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4abac0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0xb3b2c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 8]
mov dword [eax + edx*4 + 0xc], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x19c]
add eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x19c], eax
mov esp, ebp
pop ebp
ret

Function at 0x4abb10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [0xb3b2c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
sub edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x19c], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx*4 + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4abb70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0xb3b2c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
sub edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x19c], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
Function at 0x4abbc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0xb3b2c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
sub edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x19c], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
add eax, dword [ecx + 8]
mov esp, ebp
pop ebp
ret

Function at 0x4abc10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0xb3b2c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
sub edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x19c], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x19c]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
add eax, dword [ecx + edx*4 + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4abc90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0xb3b2c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
sub edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x4abcd6
mov ecx, dword [ebp - 4]
add ecx, 0xa
push ecx
push 0
mov edx, dword [0xb428fc]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x4abcf7
mov edx, dword [ebp - 4]
add edx, 0xa
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0xb428fc]
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
shr edx, 1
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.004ac630
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov esp, ebp
pop ebp
ret 8

Function at 0x4abf70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0xb3b2c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 2
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret
Function at 0x4ac2a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0xb3b2c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x4ac2c4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
lea eax, [ecx + edx*2]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
sub edx, 4
cmp dword [ebp - 8], edx
jl 0x4ac314
mov eax, dword [ebp - 8]
add eax, 0x4000
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0xb428fc]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x4ac35c
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0x100000
jle 0x4ac35c
cmp dword [ebp - 8], 0x100000
jge 0x4ac330
mov dword [ebp - 8], 0x100000
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0xb428fc]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*2]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x4ac3b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0xb3b2c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
shl ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
sub eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4ac530
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0xb3b2c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x4ac56e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x4ac56e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x4ac570
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4ac600
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0xb3b2c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x4ac9b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, edx
mov edx, dword [esp + 0x18]
push ebp
push esi
push edi
movzx esi, word [edx]
mov ebp, ecx
mov edi, dword [esp + 0x28]
mov eax, esi
xor eax, 0x7f0
shr esi, 4
shr eax, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov ecx, dword [edi + esi*4]
mov eax, dword [edi + eax*4]
mov dword [esp + 0x28], eax
movzx eax, word [edx + 0x10]
mov esi, dword [esp + 0x28]
shr eax, 4
mov dword [esp + 0x1c], ecx
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x4aca4a
lea ebx, [ebp + 4]
mov esi, edx
mov ebp, dword [esp + 0x14]
lea ebx, [ebx]
push edi
push ebx
push ecx
push esi
call fcn.004b0720
push edi
lea eax, [ebx + 0x20]
push eax
push dword [esp + 0x30]
lea eax, [esi + 0x10]
push eax
call fcn.004b0720
mov ecx, dword [esp + 0x3c]
add esp, 0x20
add ebx, 0x440
add esi, 0x20
dec ebp
jne 0x4aca10
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x10]
mov ebx, dword [ebp]
cmp ebx, 0x10
jbe 0x4acb20
lea eax, [ebp + 0x44]
add ebx, 0xfffffff1
mov dword [esp + 0x18], eax
movzx eax, word [edx + 0x10]
xor eax, 0x7f0
shr ebx, 1
shr eax, 4
lea ebp, [ebx + 0x180]
add esi, dword [edi + eax*4]
lea ebp, [edx + ebp*2]
mov dword [esp + 0x28], esi
mov edi, edi
dec ebx
lea ebp, [ebp - 2]
mov dword [esp + 0x1c], ebx
lea eax, [ebx + 0x80]
mov ebx, dword [esp + 0x24]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x200]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
add esi, dword [edi + ecx*4]
cmp eax, 2
jae 0x4aca92
movzx ecx, word [ebp]
mov ebx, dword [esp + 0x1c]
mov eax, ecx
mov edx, dword [esp + 0x18]
xor ecx, 0x7f0
shr eax, 4
shr ecx, 4
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [edx + ebx*8], eax
mov eax, dword [edi + ecx*4]
add eax, esi
mov esi, dword [esp + 0x28]
mov dword [edx + ebx*8 + 4], eax
test ebx, ebx
jne 0x4aca80
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
lea ebx, [eax*4 - 0x40]
mov eax, dword [esp + 0x14]
cmp eax, 1
jbe 0x4acb20
add esi, 0x484
lea edi, [eax - 1]
push ebx
push edx
push esi
call sub.MSVCRT.dll_memcpy
mov edx, dword [esp + 0x24]
add esp, 0xc
add esi, 0x440
dec edi
jne 0x4acb08
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x4aee20
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
xor ebx, ebx
push esi
mov esi, 0x100
push edi
mov edi, dword [esp + 0x1c]
or ecx, esi
lea esp, [esp]
add edi, edi
mov edx, esi
and edx, edi
mov eax, ecx
add edx, esi
shr eax, 8
add eax, edx
mov edx, dword [esp + 0x14]
movzx edx, word [edx + eax*2]
mov eax, ecx
shr eax, 7
add ecx, ecx
and eax, 1
shr edx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor edx, eax
add ebx, dword [ebp + edx*4]
mov edx, ecx
xor edx, edi
not edx
and esi, edx
cmp ecx, 0x10000
jb 0x4aee40
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x4afde0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, 0x400
push edi
mov edi, 0xc
mov dword [esi + 0x2c], 0
lea edx, [esi + 0x1c50]
mov dword [esi + 0x44], 1
mov dword [esi + 0x40], 1
mov dword [esi + 0x3c], 1
mov dword [esi + 0x38], 1
mov eax, dword [esi + 0x78]
mov dword [esi + 0x70], eax
lea eax, [esi + 0x1e18]
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x1c18], 0x4000400
mov dword [esi + 0x1c1c], 0x4000400
mov dword [esi + 0x1c20], 0x4000400
mov dword [esi + 0x1c24], 0x4000400
mov dword [esi + 0x1c28], 0x4000400
mov dword [esi + 0x1c2c], 0x4000400
mov dword [esi + 0x1c30], 0x4000400
mov dword [esi + 0x1c34], 0x4000400
mov edi, edi
mov ecx, 0x10
jmp 0x4afed0
mov word [eax - 0x180], bx
mov word [eax], bx
add eax, 2
dec ecx
jne 0x4afed0
mov word [edx - 0x18], bx
mov word [edx], bx
mov word [edx + 0x18], bx
mov word [edx + 0x30], bx
add edx, 2
dec edi
jne 0x4afec0
mov eax, 0x4000400
lea edi, [esi + 0x1f98]
mov ecx, pe_nt_image_headers32
rep stosd dword es:[edi], eax
lea edi, [esi + 0x2198]
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x98]
mov eax, 0x300
add ecx, dword [esi + 0x94]
shl eax, cl
test eax, eax
je 0x4aff3e
mov edi, dword [esi + 0x50]
mov ecx, eax
shr ecx, 1
mov eax, 0x4000400
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, 0x4000400
lea edi, [esi + 0x2298]
mov ecx, pe_nt_image_headers32
rep stosd dword es:[edi], eax
lea edi, [esi + 0x2498]
mov ecx, pe_nt_image_headers32
rep stosd dword es:[edi], eax
mov ecx, pe_nt_image_headers32
lea edi, [esi + 0x2698]
rep stosd dword es:[edi], eax
lea edi, [esi + 0x2898]
mov ecx, pe_nt_image_headers32
rep stosd dword es:[edi], eax
mov dword [esi + 0x1c], 0
lea eax, [esi + 0xbaa0]
mov dword [esi + 0x18], 0
mov ecx, 0x800
mov dword [eax], 0x40000000
lea eax, [eax + 0x20]
dec ecx
jne 0x4aff90
mov dword [esi + 0x34], ecx
mov eax, 1
mov ecx, dword [esi + 0x9c]
mov edx, 0x100
shl eax, cl
mov ecx, dword [esi + 0x98]
dec eax
mov dword [esi + 0x4c], eax
mov eax, edx
shl eax, cl
mov ecx, dword [esi + 0x94]
shr edx, cl
sub eax, edx
pop edi
mov dword [esi + 0x48], eax
pop esi
pop ebx
ret