joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad97c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x4ad999
add esp, 0xfffffff0
call fcn.00403738
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4adb34
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004a26d4
test al, al
jne 0x4ad9d6
mov ecx, 0x4adb68
mov dl, 1
mov eax, dword [0x496dd0]
call fcn.0040c8ac
call fcn.00403c64
xor eax, eax
push ebp
push 0x4ada02
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004a1180
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.004a106c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ada22
mov eax, edi
xor edx, edx
call fcn.00404bf8
jne 0x4ada4f
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00404bf8
je 0x4ada4f
mov ecx, 0x4adb8c
mov dl, 1
mov eax, dword [0x497078]
call fcn.0040c8ac
call fcn.00403c64
mov eax, dword [ebp - 0x10]
mov edx, 0x4adba4
call fcn.00404bf8
jne 0x4ada82
mov eax, edi
mov edx, 0x4adbb0
call fcn.00404bf8
je 0x4ada82
mov ecx, 0x4adb8c
mov dl, 1
mov eax, dword [0x497078]
call fcn.0040c8ac
call fcn.00403c64
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004a9fb8
lea eax, [ebx + 4]
mov edx, esi
call fcn.0040498c
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.0040498c
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.0040498c
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.0040498c
lea eax, [ebx + 8]
call fcn.00404950
mov byte [ebx + 0xc], 1
mov dl, 1
mov eax, dword [0x419d94]
call fcn.004033dc
mov dword [ebx + 0x38], eax
mov dl, 1
mov eax, dword [0x419d94]
call fcn.004033dc
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x419d94]
call fcn.004033dc
mov dword [ebx + 0x34], eax
push ebx
mov eax, dword [ebx + 0x38]
push eax
mov ax, word [0x4adbfc]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x499df4]
call fcn.004a9210
mov dword [ebx + 0x3c], eax
mov ax, word [0x4adc00]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adb3b
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404968
ret
Function at 0x4b0590
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4b05b2
add esp, 0xfffffff0
call fcn.00403738
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x4b071d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004a26d4
test al, al
jne 0x4b05ef
mov ecx, 0x4b0750
mov dl, 1
mov eax, dword [0x496dd0]
call fcn.0040c8ac
call fcn.00403c64
push dword [0x4fb8d0]
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xbc]
push dword [ebp - 0x10]
push dword [0x4fb8d0]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404bb0
mov eax, dword [ebp - 0xc]
call fcn.004a31ac
test al, al
jne 0x4b06c1
push dword [0x4fb8cc]
push dword [ebp + 8]
push dword [0x4fb8cc]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404bb0
mov eax, dword [ebp - 0x14]
call fcn.004a31ac
test al, al
jne 0x4b06c1
push dword [0x4fb8d0]
lea edx, [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xb8]
push dword [ebp - 0x1c]
push dword [0x4fb8d0]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404bb0
mov eax, dword [ebp - 0x18]
call fcn.004a32c4
test al, al
jne 0x4b06c1
push dword [0x4fb8cc]
push edi
push dword [0x4fb8cc]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404bb0
mov eax, dword [ebp - 0x20]
call fcn.004a32c4
test al, al
jne 0x4b06c1
mov ecx, 0x4b0750
mov dl, 1
mov eax, dword [0x496dd0]
call fcn.0040c8ac
call fcn.00403c64
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004a9fb8
lea eax, [ebx + 4]
mov edx, esi
call fcn.0040498c
lea eax, [ebx + 8]
call fcn.00404950
lea eax, [ebx + 0x30]
mov edx, edi
call fcn.0040498c
lea eax, [ebx + 0x34]
mov edx, dword [ebp + 8]
call fcn.0040498c
mov byte [ebx + 0xc], 0xc
mov ax, word [0x4b076c]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0724
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00404968
ret

Function at 0x4e5220
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e529b
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
push 0x59
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4e5282
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.004044b4
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.0040896c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e52a2
lea eax, [ebp - 0x104]
call fcn.00404244
ret
Function at 0x401270
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [0x42f0c0]
push esi
cmp ebx, 0xffffffff
mov esi, ecx
je 0x4012a0
mov edx, dword [esi]
push edi
lea eax, [esp + 0xc]
push 0
push eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
pop ebx
pop ecx
ret
Function at 0x401950
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2528
call fcn.0040cdb0
mov eax, dword [0x433be0]
push ebx
push ebp
push esi
test eax, eax
push edi
jne 0x40197f
push str.PSAPI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x433be0], eax
je 0x401b72
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcesses
push eax
call esi
mov dword [0x433be4], eax
mov eax, dword [0x433be0]
push str.EnumProcessModules
push eax
call esi
mov ecx, dword [0x433be0]
push str.GetModuleFileNameExA
push ecx
mov dword [0x433be8], eax
call esi
mov ecx, dword [0x433be4]
mov dword [0x433bec], eax
test ecx, ecx
je 0x401b72
mov edx, dword [0x433be8]
test edx, edx
je 0x401b72
test eax, eax
je 0x401b72
lea edx, [esp + 0x14]
lea eax, [esp + 0x538]
push edx
push 0x1000
push eax
call ecx
test eax, eax
je 0x401b72
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], 0
shr ebx, 2
mov dword [esp + 0x1c], ebx
je 0x401b72
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0x538]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x18]
mov eax, dword [edx]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401b56
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1538]
push eax
push 0x1000
push ecx
push esi
call dword [0x433be8]
test eax, eax
je 0x401b4f
mov eax, dword [esp + 0x14]
shr eax, 2
mov dword [esp + 0x24], eax
mov eax, 0
mov dword [esp + 0x10], eax
je 0x401b4f
jmp 0x401a84
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + eax*4 + 0x1538]
test eax, eax
jne 0x401ace
lea edx, [esp + 0x12c]
push 0x104
push edx
push eax
push esi
call dword [0x433bec]
lea eax, [esp + 0x12c]
lea ecx, [esp + 0x3b4]
push eax
push ecx
call ebp
lea edx, [esp + 0x3b4]
push 0x5c
push edx
call fcn.0040cd80
mov edi, eax
add esp, 8
mov byte [edi], 0
inc edi
lea eax, [esp + 0x28]
push 0x104
push eax
push ebx
push esi
call dword [0x433bec]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x230]
push ecx
push edx
call ebp
lea eax, [esp + 0x230]
push 0x5c
push eax
call fcn.0040cd80
mov ecx, dword [esp + 0x2544]
mov byte [eax], 0
inc eax
push ecx
push eax
call fcn.004014d0
add esp, 0x10
test eax, eax
je 0x401b36
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Process_module_name_matched._Now_check_if_its_loaded_by_rundll32.exe
call ebx
push str.rundll32.exe
push edi
call fcn.004014d0
add esp, 8
test eax, eax
jne 0x401b7f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jb 0x401a80
mov ebx, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
inc eax
add edx, 4
cmp eax, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edx
jb 0x401a25
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2528
ret
push str.Rundll32.exe_has_the_module_loaded
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2528
ret
Function at 0x402290
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423400
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb44
push ebx
push esi
push edi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x10], esp
push 0x104
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x402316
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x320]
push str.GetWindowsDirectory_failed:__d
push ecx
mov dword [ebp - 0x118], eax
call fcn.0040c660
add esp, 0xc
mov ecx, 0x83
lea esi, [ebp - 0x320]
lea edi, [ebp - 0x52c]
lea edx, [ebp - 0x52c]
push 0x42a060
rep movsd dword es:[edi], dword [esi]
push edx
call fcn.0040cba6
cmp eax, 0x104
jle 0x402355
lea eax, [ebp - 0x320]
push str.GetWindowsDirectory_failed___Buffer_insufficient
push eax
call fcn.0040c660
mov ecx, 0x83
lea esi, [ebp - 0x320]
lea edi, [ebp - 0x738]
add esp, 8
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x738]
push 0x42a060
push ecx
call fcn.0040cba6
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x114]
push 0x42f664
push edx
call esi
lea eax, [ebp - 0x114]
push str.hpbvspst.ini
push eax
call esi
push 3
push 1
lea ecx, [ebp - 0x114]
push 1
push ecx
call fcn.00403520
add esp, 0x10
test eax, eax
jne 0x4023c8
lea edx, [ebp - 0x320]
push str.Factory_Initialization_failed
push edx
call fcn.0040c660
add esp, 8
mov ecx, 0x83
lea esi, [ebp - 0x320]
lea edi, [ebp - 0x944]
lea eax, [ebp - 0x944]
push 0x42a060
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0040cba6
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403520
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xc
xor eax, eax
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
push esi
mov word [esp + 0x10], ax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x104
jg 0x4035e2
push esi
push 0x433bf8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea ecx, [esp + 8]
push 0xa
push ecx
push str.Default
push str.InProc
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 4]
push str.Default
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x403590
call fcn.00403600
call fcn.00403710
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x42fab4
push str.InProc
push str.General
call esi
test eax, eax
je 0x4035e2
push 0
push 0
push 0
push 0
call esi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov dword [0x42faa8], eax
mov eax, 1
mov dword [0x42faac], ecx
mov dword [0x42fab0], edx
mov dword [0x433cfc], eax
pop esi
add esp, 0xc
ret
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x403600
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x218
push ebx
push ebp
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x124]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push 0x433bf8
push eax
call esi
lea ecx, [esp + 0x20]
lea edx, [esp + 0x124]
push ecx
push edx
call esi
lea eax, [esp + 0x20]
push 0x2e
push eax
call fcn.0040cd80
add esp, 8
mov edi, eax
lea ecx, [esp + 0x10]
push edi
push ecx
call esi
push str..bu2
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x20]
push edx
call ebx
lea eax, [esp + 0x124]
push 0x2e
push eax
call fcn.0040cd80
add esp, 8
push str..bu1
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x128]
push ecx
push edx
call ebp
lea eax, [esp + 0x10]
push eax
push edi
call esi
lea ecx, [esp + 0x124]
push 0
lea edx, [esp + 0x24]
push ecx
push edx
call ebp
lea eax, [esp + 0x20]
push eax
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x218
ret
Function at 0x403710
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x218
push ebx
push ebp
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x124]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push 0x433bf8
push eax
call esi
lea ecx, [esp + 0x20]
push 0x2e
push ecx
call fcn.0040cd80
add esp, 8
push str..his
push eax
call esi
lea edx, [esp + 0x20]
lea eax, [esp + 0x124]
push edx
push eax
call esi
lea ecx, [esp + 0x20]
push 0x2e
push ecx
call fcn.0040cd80
add esp, 8
mov edi, eax
lea edx, [esp + 0x10]
push edi
push edx
call esi
push str..hi2
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x20]
push eax
call ebx
lea ecx, [esp + 0x124]
push 0x2e
push ecx
call fcn.0040cd80
add esp, 8
push str..hi1
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [esp + 0x20]
push 0
lea eax, [esp + 0x128]
push edx
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
push edi
call esi
lea edx, [esp + 0x124]
push 0
lea eax, [esp + 0x24]
push edx
push eax
call ebp
lea ecx, [esp + 0x20]
push ecx
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x218
ret
Function at 0x4199f4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x423a9c
call fcn.0040d81c
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.00420b29
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x419a33
call fcn.00420b29
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x419a41
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x419a4f
or eax, 0xffffffff
jmp 0x419b37
mov ecx, esi
call fcn.0041996a
mov dword [ebp - 0x14], eax
call fcn.0041b535
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x419a86
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x419a86
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0041b4e9
push dword [ebp - 0x14]
call fcn.0041b01b
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.00419702
cmp eax, edi
je 0x419af9
test byte [esi + 0x24], 0x10
je 0x419ac7
push 4
mov ecx, esi
pop ebx
call fcn.0041d638
test ah, 1
je 0x419abf
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.0041d044
cmp dword [esi + 0x1c], edi
je 0x419af9
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0041d71e
jmp 0x419af9
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x419b0d
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x419b26
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x419b26
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.004199a4
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x41cef2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41cf34
call fcn.00420b29
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41cf34
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41cf2b
xor eax, eax
jmp 0x41cf3c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041cf42
pop edi
pop esi
pop ebx
ret 4
Function at 0x42069d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4206cb
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4206e9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00420603
jmp 0x4206e9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4206e9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00420603
test edi, edi
mov eax, edi
jne 0x4206d3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40b100
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b29b
sub esp, 0x3c
mov eax, dword [esp + 0x40]
cmp eax, 0x7000000
jle 0x40b12b
mov eax, 0x7000000
jmp 0x40b133
test eax, eax
je 0x40b28f
mov dword [esp + 0x18], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.0045f620
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
add eax, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
lea esi, [0x9edc40]
movsd xmm0, qword [esi + ebp*8]
movsd qword [esp + 0x1c], xmm0
movsd xmm1, qword [esi + ecx*8]
movsd qword [esp + 0x24], xmm1
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004589f0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x34], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
shl eax, 5
mov ecx, dword [esp + 0x10]
shr ecx, 0x1b
or ecx, eax
and ecx, 0xfffff
mov dword [esp], ecx
call fcn.00458ac0
movsd xmm0, qword [esp + 0x34]
movsd xmm1, qword [esp + 0x1c]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x24]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x894998]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x894a68]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40b26a
xorps xmm0, xmm0
mov eax, dword [esp + 0x18]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x894ac8]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x44], eax
add esp, 0x3c
ret
mov dword [esp + 0x44], 0
add esp, 0x3c
ret
call fcn.0045e260
jmp fcn.0040b100
Function at 0x45f520
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0xa43fa0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45dceb
je 0x45dd3e
cmp ebx, 0x20
jbe 0x45dd44
cmp ebx, 0x40
jbe 0x45dd8a
jmp 0x45de2b
test ebx, ebx
je 0x45dd34
add eax, 0x10
test ax, 0xff0
je 0x45dd20
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x897200]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x897400]
jmp 0x45dd08
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45dd08
pxor xmm1, xmmword [0xa43fb0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xa43fb0]
pxor xmm2, xmmword [0xa43fc0]
pxor xmm3, xmmword [0xa43fd0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xa43fb0]
pxor xmm2, xmmword [0xa43fc0]
pxor xmm3, xmmword [0xa43fd0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45de8a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0xa43999], 0
je 0x45f53a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45dcb0
jmp fcn.004079e0