joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x447004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0
mov ebx, edx
mov dword [ebp - 0x24], 0
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, dword [esi + 0x440]
mov ecx, dword [esi + 0x41c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x14]
imul eax, ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
movlpd qword [ebp - 0x34], xmm0
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x444]
mov dword [ebp - 0x2c], eax
cdq
lea eax, [ebp - 0x34]
mov dword [ebp - 0x28], edx
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x438]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x408358
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, 0xa0
test esi, esi
cmove esi, eax
test edi, edi
je 0x408345
mov edx, dword [edi + 4]
test edx, edx
je 0x408335
mov ecx, dword [edx]
mov eax, dword [ecx]
add eax, edx
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 4
mov ecx, esi
mov dword [edi], 0x19
call fcn.0041b480
mov dword [edi + 4], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00425576
mov esp, ebp
pop ebp
ret
add dword [esi + 0x444], 0x10
inc dword [esi + 0x440]
mov eax, dword [esi + 0x430]
test eax, eax
je 0x408380
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [esi + 0x434]
call eax
add esp, 0xc
mov eax, dword [esi + 0x444]
xorps xmm0, xmm0
mov dword [ebp - 0x2c], eax
cdq
lea eax, [ebp - 0x34]
movlpd qword [ebp - 0x34], xmm0
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 0
push eax
push dword [esi + 0x41c]
mov dword [ebp - 0x28], edx
push dword [ebx + 0x10]
push dword [esi + 0x438]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4083c6
mov dword [ebp - 0x1c], 1
jmp 0x40840c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, 0xa0
test ebx, ebx
cmove ebx, eax
test edi, edi
je 0x408402
mov edx, dword [edi + 4]
test edx, edx
je 0x4083f2
mov ecx, dword [edx]
mov eax, dword [ecx]
add eax, edx
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 4
mov ecx, ebx
mov dword [edi], 0x19
call fcn.0041b480
mov dword [edi + 4], eax
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0
mov eax, dword [esi + 0x42c]
test eax, eax
je 0x408427
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [esi + 0x434]
call eax
add esp, 0xc
cmp dword [ebp - 0x1c], 0
je 0x408345
mov eax, dword [esi + 0x41c]
mov edx, 1
add dword [esi + 0x444], eax
mov ecx, esi
push edi
push dword [esi + 0x440]
call fcn.004081c0
mov ecx, dword [ebp - 8]
add esp, 8
neg eax
sbb eax, eax
xor ecx, ebp
pop edi
pop esi
neg eax
pop ebx
call fcn.00425576
mov esp, ebp
pop ebp
ret
Function at 0x419880
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x447004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, edx
mov dword [ebp - 0x228], ecx
lea edx, [ebp - 0x224]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x234], ecx
xorps xmm0, xmm0
push 0
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x224], edx
mov edx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x214]
movlpd qword [ebp - 0x214], xmm0
push ecx
mov ecx, eax
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0x447a78
mov dword [ebp - 0x230], 0x200
mov dword [ebp - 0x22c], 0x200
call fcn.0041d620
mov esi, eax
add esp, 0xc
test esi, esi
je 0x41994a
mov esi, dword [ebp - 0x214]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x419968
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41996c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x41996c
xor esi, esi
lea ecx, [ebp - 0x234]
call fcn.0041dfc0
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425576
mov esp, ebp
pop ebp
ret
test al, 0x10
je 0x419948
mov esi, 1
test edi, edi
je 0x41994a
push dword [ebp - 0x214]
push ebx
call edi
add esp, 8
mov esi, eax
jmp 0x41994a

Function at 0x419990
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
push edi
mov esi, ecx
mov edi, edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4199c1
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4199bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4199ca
pop edi
mov eax, esi
pop esi
ret
test al, 0x10
jne 0x4199bc
mov eax, 0x52
mov ecx, edi
mov edx, eax
pop edi
pop esi
jmp fcn.0041b5e0
Function at 0x419e80
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi], 1
lea esi, [edi + 0x9c]
mov dword [ebp - 4], esi
je 0x419ef0
push dword [edi + 0x104]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [edi + 4], 0x10
je 0x419eb4
mov ecx, esi
call fcn.004211f0
jmp 0x419eb7
mov dword [ebp - 4], esi
test byte [edi + 4], 8
lea ebx, [edi + 0x3c]
je 0x419ec7
mov ecx, ebx
call fcn.004217b0
test byte [edi + 4], 1
je 0x419ee8
lea ecx, [edi + 8]
call fcn.004218d0
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 4]
mov dword [edi + 0x20], 0
mov dword [edi], 1
jmp 0x419ef3
lea ebx, [edi + 0x3c]
mov ecx, esi
call fcn.004211f0
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x419f0f
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [ebx + 8]
test eax, eax
je 0x419f5d
push ebx
push eax
push 0x421790
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xfa0
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x419f43
push 0
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebx + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov dword [ebx], 0
mov dword [ebx + 8], 0
jmp 0x419f63
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebx + 0x14]
call fcn.004252f0
mov eax, dword [ebx + 4]
test eax, eax
je 0x419f7f
push eax
call esi
lea eax, [ebx + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esi + 0x28]
test eax, eax
je 0x419f97
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [edi + 0xfc]
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov ecx, dword [0x4478b4]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], 0x108
mov eax, dword [ecx]
add eax, 0x4478b4
push 0
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ce40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x447004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
push eax
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movsx eax, byte [esi + 0x442f44]
push eax
movzx eax, word [ebp - 8]
mov esi, dword [ebp - 0x18]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x14]
push eax
push str._04d__02d__02dT_02d:_02d:_02d__c
push esi
call fcn.004011e0
push esi
push dword [ebp + 8]
push 1
push edi
call fcn.0042bcb7
push esi
push dword [ebx]
push 1
push dword [ebx + 4]
call fcn.0042bcb7
add esp, 0x44
push esi
call fcn.0042c00d
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00425576
mov esp, ebp
pop ebp
ret

Function at 0x41cee0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x447004]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, edx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movsx eax, byte [esi + 0x442f44]
push eax
movzx eax, word [esp + 0x24]
mov esi, dword [esp + 0x10]
push eax
movzx eax, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push eax
movzx eax, word [esp + 0x2a]
push eax
movzx eax, word [esp + 0x2a]
push eax
movzx eax, word [esp + 0x2c]
push eax
push str._04d__02d__02dT_02d:_02d:_02d__c
push esi
call fcn.004011e0
add esp, 0x24
push edi
push 0
push ebx
push esi
call fcn.004011d0
push dword [eax + 4]
push dword [eax]
call fcn.0042ab31
mov eax, dword [esp + 0x28]
push esi
push dword [eax]
push 1
push dword [eax + 4]
call fcn.0042bcb7
push esi
call fcn.0042c00d
mov ecx, dword [esp + 0x50]
add esp, 0x2c
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00425576
mov esp, ebp
pop ebp
ret
Function at 0x41cfb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x447004]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
push eax
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movsx eax, byte [esi + 0x442f44]
push eax
movzx eax, word [esp + 0x24]
mov esi, dword [esp + 0x10]
push eax
movzx eax, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push eax
movzx eax, word [esp + 0x2a]
push eax
movzx eax, word [esp + 0x2a]
push eax
movzx eax, word [esp + 0x2c]
push eax
push str._04d__02d__02dT_02d:_02d:_02d__c
push esi
call fcn.004011e0
add esp, 0x24
mov dword [esp + 0xc], esi
test edi, edi
mov dword [esp + 0x10], 0x447a24
mov edx, 0x4479c8
lea eax, [esp + 0x10]
cmovne edx, edi
push eax
mov ecx, dword [edx]
mov eax, dword [ecx]
add eax, edx
push eax
mov eax, dword [ecx + 0xc]
call eax
push esi
push dword [ebx]
push 1
push dword [ebx + 4]
call fcn.0042bcb7
push esi
call fcn.0042c00d
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00425576
mov esp, ebp
pop ebp
ret
Function at 0x41e180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
mov dword [ebp - 0xc], eax
mov esi, edx
push edi
cdq
lea eax, [ebp - 0x14]
movlpd qword [ebp - 0x14], xmm0
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
mov dword [ebp - 8], edx
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41e1ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x10]
mov edi, eax
test edi, edi
mov eax, 0xa0
cmove edi, eax
test esi, esi
je 0x41e223
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41e1e9
mov edx, dword [ecx]
mov eax, dword [edx]
add eax, ecx
push eax
mov eax, dword [edx + 4]
call eax
add esp, 4
mov ecx, edi
jmp 0x41e215
cmp dword [ebp + 0xc], 0
jne 0x41e22b
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x41e223
mov edx, dword [esi + 4]
test edx, edx
je 0x41e210
mov ecx, dword [edx]
mov eax, dword [ecx]
add eax, edx
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 4
mov ecx, 0x26
mov dword [esi], 0x19
call fcn.0041b480
mov dword [esi + 4], eax
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41f5a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x10], 0
jne 0x41f6c1
mov eax, dword [ebp + 0x14]
mov edi, dword [esi + 0xc]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x14], 0x41f6d0
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], 0
mov edx, dword [eax]
mov ecx, dword [edx]
add ecx, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edx + 4]
push ecx
call eax
add esp, 8
test eax, eax
jne 0x41f613
test edi, edi
je 0x41f6ba
mov dword [edi], 0x1d
mov dword [edi + 4], 0x4479a8
pop edi
mov dword [esi + 0x10], 2
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 0
push dword [ebp - 4]
test eax, eax
je 0x41f658
lea edx, [ebp + 8]
push edx
push eax
mov eax, dword [esi]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41f668
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x3e5
je 0x41f668
cmp ebx, 0x6d
jne 0x41f674
push dword [ebp - 4]
mov eax, dword [esi + 4]
push 0
push 0
push dword [eax + 0x20]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esi + 0xc]
test ebx, ebx
je 0x41f6a5
test edi, edi
je 0x41f6a5
mov edx, dword [edi + 4]
test edx, edx
je 0x41f695
mov ecx, dword [edx]
mov eax, dword [ecx]
add eax, edx
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 4
mov ecx, ebx
mov dword [edi], 0x19
call fcn.0041b480
mov dword [edi + 4], eax
mov ecx, dword [esi + 8]
push dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [edx]
add eax, ecx
push eax
mov eax, dword [edx + 8]
call eax
add esp, 8
mov dword [esi + 0x10], 2
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f8c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x10], 2
je 0x41f9d7
mov eax, dword [ebp + 0x14]
mov edi, dword [esi + 0xc]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x40], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x14], 0x41f9e0
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], 0
mov edx, dword [eax]
mov ecx, dword [edx]
add ecx, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edx + 4]
push ecx
call eax
add esp, 8
test eax, eax
jne 0x41f933
test edi, edi
je 0x41f9d0
mov dword [edi], 0x1d
mov dword [edi + 4], 0x4479a8
pop edi
mov dword [esi + 0x10], 2
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], 0
push dword [ebp - 4]
test eax, eax
jne 0x41f967
push eax
push eax
mov eax, dword [esi + 4]
push dword [eax + 0x20]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp + 8]
push edx
push eax
mov eax, dword [esi]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41f95b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x3e5
je 0x41f95b
mov edi, dword [esi + 0xc]
test ebx, ebx
je 0x41f9bb
test edi, edi
je 0x41f9bb
mov edx, dword [edi + 4]
test edx, edx
je 0x41f9ab
mov ecx, dword [edx]
mov eax, dword [ecx]
add eax, edx
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 4
mov ecx, ebx
mov dword [edi], 0x19
call fcn.0041b480
mov dword [edi + 4], eax
mov ecx, dword [esi + 8]
push dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [edx]
add eax, ecx
push eax
mov eax, dword [edx + 8]
call eax
add esp, 8
mov dword [esi + 0x10], 2
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
mov edx, ecx
mov dword [ebp - 0xc], eax
mov ecx, eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
push esi
mov esi, 0x9e3779b9
mov ebx, esi
push edi
mov edi, dword [ebp + 8]
cmp eax, 0xc
jb 0x420487
mov eax, 0xaaaaaaab
mul ecx
shr edx, 3
mov dword [ebp + 8], edx
mov edx, dword [ebp - 4]
nop dword [eax + eax]
movzx ecx, byte [edx + 7]
movzx eax, byte [edx + 6]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx + 4]
add esi, eax
shl ecx, 8
movzx eax, byte [edx + 0xa]
add esi, ecx
movzx ecx, byte [edx + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx + 8]
movzx edx, byte [edx + 3]
add edi, eax
shl ecx, 8
add edi, ecx
shl edx, 8
mov ecx, dword [ebp - 4]
movzx eax, byte [ecx + 2]
add edx, eax
movzx eax, byte [ecx + 1]
movzx ecx, byte [ecx]
shl edx, 8
add edx, eax
mov eax, edi
shr eax, 0xd
shl edx, 8
sub edx, edi
sub edx, esi
sub esi, edi
add ebx, edx
mov edx, dword [ebp - 4]
add ebx, ecx
xor ebx, eax
sub esi, ebx
mov eax, ebx
shl eax, 8
xor esi, eax
sub edi, esi
mov eax, esi
sub edi, ebx
shr eax, 0xd
xor edi, eax
sub ebx, edi
mov eax, edi
shr eax, 0xc
sub ebx, esi
xor ebx, eax
sub esi, edi
sub esi, ebx
mov eax, ebx
shl eax, 0x10
xor esi, eax
sub edi, esi
mov eax, esi
sub edi, ebx
shr eax, 5
xor edi, eax
sub ebx, edi
mov eax, edi
shr eax, 3
sub ebx, esi
xor ebx, eax
sub esi, edi
mov eax, ebx
sub esi, ebx
shl eax, 0xa
xor esi, eax
sub edi, esi
mov eax, esi
sub edi, ebx
shr eax, 0xf
xor edi, eax
add edx, 0xc
mov ecx, dword [ebp - 8]
sub ecx, 0xc
mov dword [ebp - 4], edx
sub dword [ebp + 8], 1
mov dword [ebp - 8], ecx
jne 0x4203a0
mov eax, dword [ebp - 0xc]
add edi, eax
lea eax, [ecx - 1]
cmp eax, 0xa
ja case.default.0x420491
jmp dword [eax*4 + 0x420560]
movzx eax, byte [edx + 0xa]
shl eax, 0x18
add edi, eax
movzx eax, byte [edx + 9]
shl eax, 0x10
add edi, eax
movzx eax, byte [edx + 8]
shl eax, 8
add edi, eax
movzx eax, byte [edx + 7]
shl eax, 0x18
add esi, eax
movzx eax, byte [edx + 6]
shl eax, 0x10
add esi, eax
movzx eax, byte [edx + 5]
shl eax, 8
add esi, eax
movzx eax, byte [edx + 4]
add esi, eax
movzx eax, byte [edx + 3]
shl eax, 0x18
add ebx, eax
movzx eax, byte [edx + 2]
shl eax, 0x10
add ebx, eax
movzx eax, byte [edx + 1]
shl eax, 8
add ebx, eax
movzx eax, byte [edx]
add ebx, eax
sub ebx, edi
mov eax, edi
sub ebx, esi
shr eax, 0xd
xor ebx, eax
sub esi, edi
sub esi, ebx
mov eax, ebx
shl eax, 8
xor esi, eax
sub edi, esi
mov eax, esi
sub edi, ebx
shr eax, 0xd
xor edi, eax
sub ebx, edi
mov eax, edi
sub ebx, esi
shr eax, 0xc
xor ebx, eax
sub esi, edi
sub esi, ebx
mov eax, ebx
shl eax, 0x10
xor esi, eax
sub edi, esi
mov eax, esi
sub edi, ebx
shr eax, 5
xor edi, eax
sub ebx, edi
mov eax, edi
sub ebx, esi
shr eax, 3
xor ebx, eax
sub esi, edi
sub esi, ebx
mov ecx, ebx
shl ecx, 0xa
xor esi, ecx
sub edi, esi
shr esi, 0xf
sub edi, ebx
xor edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4211f0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x5c], 0
je 0x421295
push ebx
mov dword [ebx + 0x5c], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebx + 0x20], 0
mov edx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jbe 0x421292
push esi
push edi
lea edi, [ebx + 0x18]
cmp dword [edi + 8], 0
jne 0x42122a
xor ecx, ecx
jmp 0x421236
mov ecx, dword [edi]
mov eax, dword [ecx]
mov dword [eax + 4], edi
dec dword [edi + 8]
mov dword [edi], eax
mov esi, dword [ecx + 0xc]
push ebx
mov dword [ebp - 4], esi
mov dword [ecx + 0xc], 0
call edx
push 0
push esi
push 0x4211e0
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0x7d0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp esi, 0x102
mov esi, dword [ebp - 4]
jne 0x42127d
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebx + 0x20], 0
mov edx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
ja 0x421220
pop edi
pop esi
push ebx
call edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4212a0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
xor eax, eax
push edi
lea edi, [esi + 0x30]
xchg dword [edi], eax
test eax, eax
je 0x4212ee
push 0
push 4
push esi
push 0x4214d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2c], eax
test eax, eax
je 0x4212e7
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
xchg dword [edi], eax
pop edi
pop esi
ret

Function at 0x4217b0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x4217fd
push esi
push eax
push 0x421790
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xfa0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4217e7
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov dword [esi + 8], 0
pop esi
ret
Function at 0x4218d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], edi
movups xmmword [ebp - 0x30], xmm0
cmp dword [edi + 0x2c], 0
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 0x1c], 0x4218b0
mov dword [ebp - 0x18], edi
jle 0x421944
mov esi, dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ebx, dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
nop word [eax + eax]
push dword [edi + 0x28]
call esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
push 0
push 0
push dword [edi + 0x18]
call ebx
push 0x7d0
push dword [edi + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x421944
cmp dword [edi + 0x2c], 0
jg 0x421910
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [edi + 0x1c]
lea eax, [edi + 0x1c]
cmp ebx, eax
je 0x42197f
mov edi, eax
push dword [ebx + 0xc]
mov ebx, dword [ebx]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, edi
jne 0x421957
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421990
Capabilities:
Set thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, edx
lea eax, [edi + 0x10]
mov dword [eax + 8], 0
mov dword [eax], eax
mov dword [eax + 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
mov dword [edi + 0xc], eax
mov dword [edi + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x1c]
inc dword [esi + 0x2c]
mov dword [ecx + 4], edi
mov dword [edi + 4], eax
mov dword [eax], edi
mov dword [edi], ecx
inc dword [ecx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [edi + 8]
push eax
push dword [0x447cd8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, edi
pop edi
pop esi
ret

Function at 0x4219f0
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
push 0
push dword [0x447cd8]
mov edi, edx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebx + 4]
mov eax, dword [ebx]
push edi
mov dword [esi], eax
mov dword [eax + 4], esi
dec dword [edi + 0x24]
dec dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x10]
lea edi, [ebx + 0x10]
cmp eax, edi
je 0x421a4a
mov esi, dword [eax]
test eax, eax
je 0x421a4a
push dword [eax + 0x14]
mov eax, dword [eax + 0x18]
call eax
add esp, 4
cmp esi, edi
je 0x421a4a
mov eax, esi
mov esi, dword [esi]
test eax, eax
jne 0x421a33
pop edi
pop esi
mov eax, ebx
pop ebx
ret