joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a710
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xa34], 0x8000
jne 0x44a7f8
cmp dword [esi + 0x434], 0x200
jne 0x44a7fb
push 0x513bb0
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x44a7fe
cmp byte [0x5211b4], 0
je 0x44a7c0
push 0x513bb0
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor eax, eax
lock cmpxchg dword [0x5211b8], esi
jne 0x44a80d
mov dword [0x524ac4], 0x44a820
add esi, 0x48
mov eax, 0xffffffb0
cmp dword [esi], 0
je 0x44a7f4
mov ecx, dword [esi + 0xc]
cmp ecx, 0x81
jb 0x44a7b5
cmp ecx, 0x101
jb 0x44a7b9
cmp ecx, 0x201
setb cl
shl cl, 4
add cl, 0x10
mov byte [eax + 0x5211b4], cl
add esi, 0x20
inc eax
jne 0x44a780
jmp 0x44a7bd
mov cl, 0x80
jmp 0x44a7a7
mov cl, 0x40
jmp 0x44a7a7
pop esi
pop ebp
ret
cmp dword [0x524abc], 0
jne 0x44a810
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x44a813
mov dword [0x521160], eax
mov dword [0x524ac0], eax
mov dword [0x524abc], 0x48f7e0
mov byte [0x5211b4], 1
jmp 0x44a753
xor ecx, ecx
jmp 0x44a7a7
int3
int3
mov ecx, 0x513bb0
call fcn.0045a230
jmp 0x44a74a
int3
int3
int3

Function at 0x44c260
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x514c54]
cmp eax, 0xffffffff
je 0x44c280
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
jmp 0x44c27e

Function at 0x44c290
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edi, ecx
mov eax, dword [0x511014]
xor eax, ebp
mov dword [esp + 0x1c], eax
push dword [0x514c54]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and ecx, 3
cmp ecx, 2
jne 0x44c303
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x11e1a300
mov esi, esp
push 0x1db
push str....._base_threading_thread_local_storage.cc
push 0x50535a
push esi
call fcn.00454af0
add esp, 4
movsd xmm0, qword [esp + 0x1c]
movsd qword [esp + 4], xmm0
mov dword [esp], esi
call fcn.004be150
add esp, 0xc
xor esi, esi
jmp 0x44c318
xor esi, esi
and eax, 0xfffffffc
je 0x44c318
mov ecx, dword [edi]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [edi + 4]
jne 0x44c318
mov esi, dword [eax + ecx*8]
mov ecx, dword [esp + 0x1c]
xor ecx, ebp
call fcn.00496ce3
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x44c420
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x44c437
test eax, eax
je 0x44c437
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
jne 0x44c445
mov ecx, dword [0x524ac4]
test ecx, ecx
jne 0x44c481
cmp dword [0x524abc], 0
je 0x44c431
mov esi, dword [0x524ac0]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x44c48b
test esi, esi
je 0x44c431
mov ecx, dword [0x524abc]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x44c431
call dword [section..00cfg]
call ecx
jmp 0x44c445
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x44c469
Function at 0x45e820
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, dword [ebp + 0x10]
mov eax, dword [0x511014]
xor eax, ebp
mov dword [esp + 0x38], eax
cvtsi2sd xmm0, dword [ebp + 0xc]
movsd qword [esp], xmm0
call fcn.004abd80
fstp qword [esp + 0x28]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
sub ecx, eax
cmp ecx, 4
jbe 0x45ea04
mov ebx, dword [ebp + 8]
movsd xmm0, qword [esp + 0x28]
movsd qword [esp + 0x10], xmm0
mov dword [eax + 4], ebx
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov edi, eax
sub edi, ecx
sar edi, 2
lea edx, [edi - 1]
cmp edx, 3
jb 0x45e957
mov eax, edi
neg eax
mov dword [esp + 0xc], eax
add edi, 0xfffffffd
mov esi, 2
nop word [eax + eax]
xorps xmm0, xmm0
cvtsi2sd xmm0, ebx
movsd qword [esp], xmm0
call fcn.004abd80
fstp qword [esp + 0x30]
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.00459370
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x10]
subsd xmm1, xmm0
mov dword [esp + 8], edi
movd xmm2, edi
por xmm2, xmmword [0x500420]
subsd xmm2, qword [0x500408]
divsd xmm1, xmm2
addsd xmm1, xmm0
movsd qword [esp], xmm1
call fcn.004ab420
fstp qword [esp + 0x20]
mov eax, dword [ebp + 0x10]
mov edi, dword [eax]
mov eax, dword [eax + 4]
sub eax, edi
sar eax, 2
cmp eax, esi
jbe 0x45ea01
movsd xmm0, qword [esp + 0x20]
movsd qword [esp], xmm0
call fcn.004be045
fstp qword [esp + 0x18]
cvttsd2si eax, qword [esp + 0x18]
cmp ebx, eax
lea ebx, [ebx + 1]
cmovl ebx, eax
mov dword [edi + esi*4], ebx
mov eax, dword [esp + 0xc]
add eax, esi
inc eax
inc esi
mov edi, dword [esp + 8]
dec edi
cmp eax, 0xffffffff
jne 0x45e8a0
mov esi, dword [ebp + 0x10]
mov ecx, dword [esi]
mov eax, dword [esi + 4]
cmp eax, ecx
je 0x45ea07
mov dword [eax - 4], 0x7fffffff
mov ecx, dword [esi]
mov esi, dword [esi + 4]
mov edx, esi
sub edx, ecx
je 0x45ea0a
mov eax, edx
sar eax, 2
mov edi, ecx
not edi
add edi, esi
mov dword [esp + 8], edx
jne 0x45e98a
xor esi, esi
jmp 0x45e9ce
mov ebx, edx
and ebx, 0xfffffffe
xor esi, esi
nop word cs:[eax + eax]
movzx edi, al
movzx edx, byte [ecx + esi]
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x50a038]
movzx edx, al
movzx edi, byte [ecx + esi + 1]
xor edi, edx
shr eax, 8
xor eax, dword [edi*4 + 0x50a038]
add esi, 2
cmp ebx, esi
jne 0x45e9a0
test byte [esp + 8], 1
je 0x45e9e8
movzx edx, al
movzx ecx, byte [ecx + esi]
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x50a038]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 0xc], eax
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.00496ce3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
int3
int3
int3
xor eax, eax
jmp 0x45e9e8
Function at 0x463e90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, esp
mov eax, dword [0x511014]
xor eax, ebp
mov dword [esi + 0x28], eax
mov dword [esi], ecx
cmp byte [ecx + 0xc], 0
je 0x46402b
mov eax, dword [0x526230]
mov ecx, dword [0x514f00]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x464047
push dword [0x514c54]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
cmp eax, 2
jne 0x463f28
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x11e1a300
lea edi, [esi + 0x10]
push 0x1db
push str....._base_threading_thread_local_storage.cc
push 0x50535a
push edi
call fcn.00454af0
add esp, 4
movsd xmm0, qword [esi + 0x20]
movsd qword [esp + 4], xmm0
mov dword [esp], edi
call fcn.004be150
add esp, 0xc
mov eax, dword [0x526230]
mov ecx, dword [0x514f00]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x464093
push dword [0x514c54]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x463f77
mov ecx, dword [0x526228]
mov dword [eax + ecx*8], 0
mov ecx, dword [0x52622c]
mov edx, dword [0x526228]
mov dword [eax + edx*8 + 4], ecx
mov ecx, dword [esi]
mov ebx, dword [ecx]
mov edi, dword [ecx + 4]
cmp ebx, edi
jne 0x463fe4
test ebx, ebx
jne 0x463f98
mov ecx, dword [esi + 0x28]
xor ecx, ebp
call fcn.00496ce3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ecx + 4]
mov eax, ebx
cmp edx, ebx
je 0x464036
mov edi, dword [edx - 0xc]
test edi, edi
jne 0x463fc6
mov eax, dword [edx - 0x20]
add edx, 0xffffffe0
test eax, eax
je 0x463fc0
lock dec dword [eax + 4]
je 0x4640df
cmp edx, ebx
jne 0x463fa5
jmp 0x464034
lock dec dword [edi]
jne 0x463fac
mov ecx, dword [edi + 8]
mov dword [esi + 4], edx
call dword [section..00cfg]
push edi
call ecx
mov edx, dword [esi + 4]
mov ecx, dword [esi]
add esp, 4
jmp 0x463fac
mov dword [esi + 4], esp
mov edx, dword [ebx]
mov dword [esi + 0xc], edx
push eax
sub esp, 0xc
mov eax, esp
movsd xmm0, qword [ebx + 0x18]
movsd qword [eax + 8], xmm0
mov ecx, dword [ebx + 0x14]
mov dword [eax + 4], ecx
mov dword [ebx + 0x14], 0
lea ecx, [ebx + 4]
mov dword [eax], ecx
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esi + 8], ecx
call dword [section..00cfg]
mov ecx, dword [esi + 0xc]
call dword [esi + 8]
mov esp, dword [esi + 4]
add ebx, 0x20
cmp ebx, edi
jne 0x463fe4
mov ecx, dword [esi]
mov ebx, dword [ecx]
jmp 0x463f82
mov eax, dword [ecx]
mov dword [ecx + 4], ebx
push eax
call fcn.00494aa1
add esp, 4
jmp 0x463f86
push 0x526230
call fcn.00494ba0
add esp, 4
cmp dword [0x526230], 0xffffffff
jne 0x463ed5
mov dword [0x52622c], 0
mov dword [0x526228], 0xffffffff
mov ecx, 0x526228
push 0
call fcn.00404c70
push 0x526230
call fcn.00495b95
add esp, 4
jmp 0x463ed5
push 0x526230
call fcn.00494ba0
add esp, 4
cmp dword [0x526230], 0xffffffff
jne 0x463f49
mov dword [0x52622c], 0
mov dword [0x526228], 0xffffffff
mov ecx, 0x526228
push 0
call fcn.00404c70
push 0x526230
call fcn.00495b95
add esp, 4
jmp 0x463f49
push eax
mov edi, edx
call fcn.0046f8d0
mov edx, edi
mov ecx, dword [esi]
add esp, 4
jmp 0x463fc0
Function at 0x46ae90
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x511014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x5168bc]
mov ecx, dword [0x514f00]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x46aedd
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496ce3
mov eax, 0x5168b8
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5168bc
call fcn.00494ba0
add esp, 4
cmp dword [0x5168bc], 0xffffffff
jne 0x46aec3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.00498980
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.00494aa6
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x516904]
mov ecx, dword [0x514f00]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x46af86
mov ecx, esi
push ebx
push 0x5168e0
push edi
call fcn.00416200
mov dword [0x5168b8], esi
push 0x5168bc
call fcn.00495b95
add esp, 4
jmp 0x46aec3
push 0x516904
call fcn.00494ba0
add esp, 4
cmp dword [0x516904], 0xffffffff
jne 0x46af60
xorps xmm0, xmm0
movups xmmword [0x5168f0], xmm0
movups xmmword [0x5168e0], xmm0
mov dword [0x516900], 0
push 0x5168e0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x516904
call fcn.00495b95
add esp, 4
jmp 0x46af60
Function at 0x4729c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x511014]
xor eax, ebp
mov dword [esp + 0x18], eax
mov eax, dword [0x526090]
mov ecx, dword [0x514f00]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x472a80
push dword [0x514c54]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and ecx, 3
cmp ecx, 2
jne 0x472a62
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x11e1a300
mov esi, esp
push 0x1db
push str....._base_threading_thread_local_storage.cc
push 0x50535a
push esi
call fcn.00454af0
add esp, 4
movsd xmm0, qword [esp + 0x1c]
movsd qword [esp + 4], xmm0
mov dword [esp], esi
call fcn.004be150
add esp, 0xc
xor esi, esi
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.00496ce3
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
xor esi, esi
and eax, 0xfffffffc
je 0x472a4f
mov ecx, dword [0x526088]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x52608c]
jne 0x472a4f
mov esi, dword [eax + ecx*8]
jmp 0x472a4f
push 0x526090
call fcn.00494ba0
add esp, 4
cmp dword [0x526090], 0xffffffff
jne 0x4729f6
xor eax, eax
mov dword [0x52608c], eax
mov dword [0x526088], 0xffffffff
mov ecx, 0x526088
push eax
call fcn.00404c70
push 0x526090
call fcn.00495b95
add esp, 4
jmp 0x4729f6

Function at 0x474fa0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x47508a
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x475015
lea eax, [edi + 1]
cmp eax, 2
jb 0x474ff2
mov dword [esi], edi
call fcn.00459380
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 1
inc eax
cmp eax, 1
jbe 0x47508e
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.00459380
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
cmp dword [0x523df0], 0
je 0x47504e
mov eax, dword [0x523df0]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [section..00cfg]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x474fe3
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x50511c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x475091
mov ecx, eax
cmp eax, sym.opera.exe_GetHandleVerifier
je 0x475084
call dword [section..00cfg]
call ecx
push 0
push eax
call fcn.00426270
add esp, 8
jmp 0x475028
push 1
push 0
jmp 0x47507a
mov byte [esi + 4], 1
int3
xor eax, eax
push eax
jmp 0x475079
Function at 0x47d040
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebx]
mov esi, dword [ebx + 4]
mov ecx, esi
sub ecx, edi
sar ecx, 2
lea edx, [ecx - 1]
cmp edx, 2
jb 0x47d0f3
cvtsi2sd xmm0, dword [ebp + 8]
cvtsi2sd xmm1, dword [ebp + 0xc]
add ecx, 0xfffffffd
movd xmm2, ecx
por xmm2, xmmword [0x500420]
subsd xmm2, qword [0x500408]
xor esi, esi
inc esi
movq xmm3, qword [0x500408]
movsd xmm4, qword [0x4fdc88]
nop word cs:[eax + eax]
mov edi, dword [ebx]
mov eax, dword [ebx + 4]
sub eax, edi
sar eax, 2
cmp eax, esi
jbe 0x47d185
movd xmm5, ecx
por xmm5, xmm3
subsd xmm5, xmm3
mulsd xmm5, xmm0
lea eax, [esi - 1]
movd xmm6, eax
por xmm6, xmm3
subsd xmm6, xmm3
mulsd xmm6, xmm1
addsd xmm6, xmm5
divsd xmm6, xmm2
addsd xmm6, xmm4
cvttsd2si eax, xmm6
mov dword [edi + esi*4], eax
dec ecx
inc esi
cmp esi, edx
jne 0x47d0a0
mov edi, dword [ebx]
mov esi, dword [ebx + 4]
cmp esi, edi
je 0x47d188
mov dword [esi - 4], 0x7fffffff
mov edx, dword [ebx]
mov esi, dword [ebx + 4]
mov ebx, esi
sub ebx, edx
je 0x47d18b
mov ecx, ebx
sar ecx, 2
mov edi, edx
not edi
add edi, esi
mov dword [ebp - 0x10], ebx
jne 0x47d121
xor esi, esi
jmp 0x47d15e
and ebx, 0xfffffffe
xor esi, esi
nop word cs:[eax + eax]
movzx edi, cl
movzx eax, byte [edx + esi]
xor eax, edi
shr ecx, 8
xor ecx, dword [eax*4 + 0x50a038]
movzx eax, cl
movzx edi, byte [edx + esi + 1]
xor edi, eax
shr ecx, 8
xor ecx, dword [edi*4 + 0x50a038]
add esi, 2
cmp ebx, esi
jne 0x47d130
test byte [ebp - 0x10], 1
je 0x47d177
movzx eax, cl
movzx edx, byte [edx + esi]
xor edx, eax
shr ecx, 8
xor ecx, dword [edx*4 + 0x50a038]
mov eax, dword [ebp + 0x10]
mov dword [eax + 0xc], ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
int3
int3
xor ecx, ecx
jmp 0x47d177
Function at 0x480b30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x511014]
xor eax, ebp
mov dword [esp + 0x18], eax
mov eax, dword [0x5260a8]
mov ecx, dword [0x514f00]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x480bb9
push dword [0x514c54]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and ecx, 3
cmp ecx, 2
je 0x480bfd
and eax, 0xfffffffc
je 0x480c3e
mov ecx, dword [0x5260a0]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x5260a4]
jne 0x480c3e
mov esi, dword [eax + ecx*8]
test esi, esi
je 0x480c3e
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.00496ce3
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x5260a8
call fcn.00494ba0
add esp, 4
cmp dword [0x5260a8], 0xffffffff
jne 0x480b62
xor eax, eax
mov dword [0x5260a4], eax
mov dword [0x5260a0], 0xffffffff
mov ecx, 0x5260a0
push eax
call fcn.00404c70
push 0x5260a8
call fcn.00495b95
add esp, 4
jmp 0x480b62
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x11e1a300
mov esi, esp
push 0x1db
push str....._base_threading_thread_local_storage.cc
push 0x50535a
push esi
call fcn.00454af0
add esp, 4
movsd xmm0, qword [esp + 0x1c]
movsd qword [esp + 4], xmm0
mov dword [esp], esi
call fcn.004be150
add esp, 0xc
int3

Function at 0x480c50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x511014]
xor eax, ebp
mov dword [esp + 0x1c], eax
mov eax, dword [0x526090]
mov ecx, dword [0x514f00]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x480d44
mov esi, dword [ebp + 8]
push dword [0x514c54]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and ecx, 3
cmp ecx, 2
jne 0x480d1b
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x11e1a300
mov edi, esp
push 0x1db
push str....._base_threading_thread_local_storage.cc
push 0x50535a
push edi
call fcn.00454af0
add esp, 4
movsd xmm0, qword [esp + 0x1c]
movsd qword [esp + 4], xmm0
mov dword [esp], edi
call fcn.004be150
add esp, 0xc
xor edi, edi
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x518914]
bt ecx, eax
jb 0x480d39
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x520914], 1
mov dword [esi], edi
mov ecx, dword [esp + 0x1c]
xor ecx, ebp
call fcn.00496ce3
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
xor edi, edi
and eax, 0xfffffffc
je 0x480ce3
mov ecx, dword [0x526088]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x52608c]
jne 0x480ce3
mov edi, dword [eax + ecx*8]
jmp 0x480ce3
push edi
call fcn.00455550
add esp, 4
jmp 0x480d05
push 0x526090
call fcn.00494ba0
add esp, 4
cmp dword [0x526090], 0xffffffff
jne 0x480c87
xor eax, eax
mov dword [0x52608c], eax
mov dword [0x526088], 0xffffffff
mov ecx, 0x526088
push eax
call fcn.00404c70
push 0x526090
call fcn.00495b95
add esp, 4
jmp 0x480c87
Function at 0x4826c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4470b0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x48289e
mov dword [esi], 0x4ffed4
mov eax, 0x4ffed4
mov dword [esi + 0x38], 0x4ff744
mov eax, dword [eax + 4]
mov dword [esi + eax], 0x4ff708
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], 0x4ff748
mov eax, dword [esi]
mov ebx, dword [eax + 4]
xor eax, eax
mov edi, esi
add edi, 4
mov dword [esi + ebx + 0x18], edi
sete al
mov dword [esi + ebx + 0x10], eax
xor eax, eax
mov dword [esi + ebx + 0x14], eax
mov dword [esi + ebx + 4], 0x1002
mov dword [esi + ebx + 0xc], eax
mov dword [esi + ebx + 8], 6
xorps xmm0, xmm0
movups xmmword [esi + ebx + 0x20], xmm0
movups xmmword [esi + ebx + 0x30], xmm0
mov dword [esi + ebx + 0x44], eax
mov dword [esi + ebx + 0x40], eax
mov eax, dword [0x514f00]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov ecx, dword [0x51612c]
cmp ecx, dword [eax + 4]
jg 0x4827de
add ebx, esi
mov eax, dword [0x516128]
mov eax, dword [eax]
mov dword [ebx + 0x1c], eax
lock inc dword [eax + 4]
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0xffffffff
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], 0x4ff708
mov ecx, edi
call fcn.004828e0
mov dword [esi + 4], 0x4ff710
xorps xmm0, xmm0
movups xmmword [esi + 0x24], xmm0
mov dword [esi + 0x34], 0x10
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x51612c
call fcn.00494ba0
add esp, 4
cmp dword [0x51612c], 0xffffffff
jne 0x482783
mov eax, dword [0x516120]
mov ecx, dword [0x514f00]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x48283d
mov eax, dword [0x51611c]
mov eax, dword [eax]
mov dword [0x516124], eax
lock inc dword [eax + 4]
mov dword [0x516128], 0x516124
push 0x51612c
call fcn.00495b95
add esp, 4
jmp 0x482783
push 0x516120
call fcn.00494ba0
add esp, 4
cmp dword [0x516120], 0xffffffff
jne 0x482811
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], 0
mov ecx, 0x516770
push 1
call fcn.0040fd30
mov dword [0x516118], 0x516770
mov dword [0x51611c], 0x516118
push 0x516120
call fcn.00495b95
add esp, 4
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
jmp 0x482811
mov eax, dword [esi]
jmp 0x48270a
Function at 0x483fc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp], ecx
mov eax, dword [0x511014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 4]
push 0x5b
push str....._base_files_file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.00454af0
add esp, 0x10
xor esi, esi
mov ecx, edi
push esi
push esi
push ebx
call fcn.0046afe0
test byte [0x512ba0], 0x19
jne 0x484072
mov ecx, dword [ebp + 0xc]
test ecx, ecx
js 0x48409d
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0xffffffff
push 0
push ebx
push ecx
push eax
mov eax, dword [esp + 0x10]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4840a2
mov ebx, dword [esp + 4]
test ebx, ebx
js 0x4840b4
lea ecx, [esp + 0x20]
call fcn.004840c0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.00496ce3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea edx, [esp + 0x14]
mov dword [edx], ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
sub esp, 8
movq xmm0, qword [esp + 0x20]
movq qword [esp], xmm0
mov ecx, str.ScopedBlockingCall
call fcn.004d8680
add esp, 8
jmp 0x484023
xor ebx, ebx
dec ebx
jmp 0x484052
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x484052
int3
Function at 0x485b40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x511014]
xor eax, ebp
mov dword [esp + 8], eax
push 0x526168
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x485c8b
cmp byte [0x52616c], 0
je 0x485c33
mov eax, dword [0x52617c]
mov ecx, dword [0x526178]
mov edx, dword [0x526170]
mov ebx, dword [0x526174]
mov esi, ebx
shld esi, edx, 0x17
mov edi, edx
shl edi, 0x17
xor edi, edx
xor esi, ebx
mov ebx, esi
shld ebx, edi, 0xf
mov edx, eax
shld edx, ecx, 6
xor edx, ecx
xor edx, edi
xor edx, ebx
mov edi, eax
shr edi, 0x1a
xor edi, eax
xor edi, esi
shr esi, 0x11
xor esi, edi
mov dword [0x526170], ecx
mov dword [0x526174], eax
mov dword [0x526178], edx
add edx, ecx
mov dword [0x52617c], esi
adc esi, eax
push 0x526168
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [0x514c84]
cmp eax, 0xffffffff
je 0x485c16
test eax, eax
je 0x485ca4
and esi, 0x3fff0000
add esi, 0x20000000
mov ecx, dword [esp + 8]
xor ecx, ebp
call fcn.00496ce3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x514c84
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x485c9a
mov eax, dword [0x514c84]
jmp 0x485bed
xorps xmm0, xmm0
movups xmmword [0x526170], xmm0
xor edi, edi
dec edi
mov esi, esp
mov dword [esi + 4], edi
mov dword [esi], edi
push 8
push esi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x485cab
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [0x526174], ecx
mov dword [0x526170], eax
mov dword [esp + 4], edi
mov dword [esp], edi
push 8
push esi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x485cae
mov ecx, dword [esp]
mov eax, dword [esp + 4]
mov byte [0x52616c], 1
jmp 0x485b82
mov ecx, 0x526168
call fcn.0045a230
jmp 0x485b6a
mov dword [0x514c84], 0
xor esi, esi
jmp 0x485c01
int3
int3