joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b45f
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x10037b6b
call fcn.1001df68
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.10031ab2
test eax, eax
je 0x1001b48a
call fcn.1001b450
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x10039bf0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x1001b4e5
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.1001d0df
pop ecx
pop ecx
push edi
push esi
call fcn.10031ab2
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.1001b85a
push eax
push esi
push 0x1003bebc
call fcn.1001d0df
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x1001b4de
ret
cmp ebx, edi
je 0x1001b4f0
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x1001b5a1
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x1001b54d
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x1001b4a9
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x1001b5a1
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x1001b5a1
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x1001b4a9
mov eax, esi
call fcn.1001dfd4
ret
Function at 0x1001bd69
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xf98]
mov eax, 0x1018
call fcn.1001e5c0
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0xf94], eax
mov eax, dword [ebp + 0xfa4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xfa0]
xor ebx, ebx
mov esi, 0x7ff
push esi
mov dword [ebp - 0x78], eax
lea eax, [ebp + 0x795]
push ebx
push eax
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x7c], 1
mov byte [ebp + 0x794], bl
call fcn.1001d760
push esi
lea eax, [ebp - 0x6b]
push ebx
push eax
mov byte [ebp - 0x6c], bl
call fcn.1001d760
push edi
call fcn.10021a46
add esp, 0x1c
cmp eax, ebx
je 0x1001bdf9
push eax
push dword [ebp + 0xfa8]
push dword [ebp - 0x78]
call fcn.10031ab2
add esp, 0xc
neg eax
sbb eax, eax
inc eax
jmp 0x1001bf5b
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x70]
push eax
push 0x20019
push ebx
push dword [0x10047550]
push SysReAllocString
call edi
test eax, eax
je 0x1001be21
xor eax, eax
jmp 0x1001bf5b
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0xfa8]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x7c]
push eax
push ebx
push dword [ebp - 0x80]
push dword [ebp - 0x70]
call esi
test eax, eax
je 0x1001be52
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1001bf5b
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x794]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push 0x1003cad8
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x800
call esi
test eax, eax
je 0x1001be7c
xor ebx, ebx
inc ebx
jmp 0x1001be42
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x70]
push eax
push 0x20019
push ebx
push str.SOFTWAREOracleJavaDeploy
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x1001be77
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push str.deployment.modified.timestamp
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x800
call esi
test eax, eax
jne 0x1001be77
lea eax, [ebp + 0x794]
push eax
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x74], 0x800
call fcn.10031ab2
pop ecx
pop ecx
test eax, eax
js 0x1001bf58
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x7c]
push eax
push ebx
push dword [ebp - 0x80]
push dword [ebp - 0x70]
call esi
test eax, eax
jne 0x1001be77
push dword [ebp - 0x70]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
call fcn.10031ab2
test eax, eax
jne 0x1001bf58
lea eax, [ebp - 0x70]
push eax
push 0x20006
push ebx
push dword [0x10047550]
push SysReAllocString
call edi
test eax, eax
jne 0x1001be1a
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push 1
push ebx
push dword [ebp - 0x80]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1001be42
push dword [ebp - 0x70]
call esi
push dword [ebp - 0x78]
push dword [ebp - 0x80]
call fcn.10031ab2
pop ecx
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp + 0xf94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d742
add ebp, 0xf98
leave
ret
Function at 0x1001d471
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10048aac], 0
push esi
push edi
jne 0x1001d3e7
call fcn.1001d353
test eax, eax
je 0x1001d42c
mov eax, dword [0x10048aac]
cmp eax, 1
jne 0x1001d408
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x1001d42c
jmp 0x1001d46e
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x1001d46e
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1001d430
xor eax, eax
jmp 0x1001d46e
mov eax, dword [esi]
push dword [0x10048aac]
call edi
mov edi, eax
test edi, edi
je 0x1001d452
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x1001d46e
lea edi, [esi + 0xff0]
push esi
push dword [0x10048aac]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1001d458
mov eax, esi
pop edi
pop esi
ret
jmp 0x1001d3d3

Function at 0x1001d742
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10047578]
jne 0x1001d74c
repz ret
jmp fcn.10023329

Function at 0x10031ab2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10031ac1
pop dword [ebp - 8]
mov eax, 0x332a7d5f
add eax, 0xdcd89d62
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x441aa
push 0
mov eax, 0x5906bed8
sub eax, 0x49033c08
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x7c05ada9
sub ecx, 0x7c0557d1
xor ebx, ebx
add ebx, eax
mov esi, 0xf7cf56d5
sub esi, 0xe7c7dcd5
add esi, dword [ebp - 8]
mov edx, 0xd212275f
add edx, 0xdc6176f0
xor dword [ebp - 4], esi
mov edi, dword [esi]
add dword [ebp - 4], 0xca93d7b8
add edi, edx
sub dword [ebp - 4], edi
mov dword [ebx], edi
add ebx, 0xd107ee43
sub ebx, 0xd107ee3f
add esi, 0x4bc83a88
sub esi, 0x4bc83a84
loop 0x10031b22
add eax, 0x14a33
mov ebx, eax
add eax, 0xe2ebfed9
sub eax, 0xe2ebfed4
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x405a71
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40d9fb
call fcn.0040c9ff
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x415350]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x405be2
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x405be2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405be2
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x405be2
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x405b5b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x405bd4
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x405bd4
mov ecx, 0x1234
cmp cx, ax
jne 0x405bd4
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x405bae
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x405ac9
mov eax, edi
call fcn.0040c9ba
ret 4

Function at 0x40cd2a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40cd39
pop dword [ebp - 0x50]
mov eax, 0xc0899c47
add eax, 0x3fb730f2
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x39094
push 0
mov eax, 0xe50cb1fe
add eax, 0x1b342eca
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x4a53
xor esi, esi
add esi, eax
mov edx, 0x6372a676
sub edx, 0x63310e76
add edx, dword [ebp - 0x50]
mov ebx, 0x67ae73e7
sub ebx, 0x19bf884c
xor dword [ebp - 0x3c], 0x10aa4d62
mov edi, dword [edx]
xor dword [ebp - 0x30], eax
xor edi, ebx
mov dword [ebp - 0x2c], 0xced137e6
mov dword [esi], edi
add esi, 0x6c4038de
sub esi, 0x6c4038da
add edx, 0x45ca468
add edx, 0xfba35b9c
loop 0x40cd94
add eax, 0xee07d63e
sub eax, 0xee06ba1f
xor ebx, ebx
add ebx, eax
add eax, 0xebd2b5ff
add eax, 0x142d4a06
mov ecx, 0x16bd2ea4
sub ecx, 0x167d2ea4
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x100039a6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
test edx, edx
jne 0x100039b9
push 0xd
pop eax
jmp 0x100039fd
push esi
xor eax, eax
push edi
mov dword [ebp + 0xc], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp + 0xc]
jne 0x100039cc
sub ecx, dword [ebp - 4]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x100039c4
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10003a1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10003a2b
pop dword [ebp - 0x4c]
mov eax, 0x10003a2b
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x88060a09
sub dword [ebp - 0x5c], 0x39b3c4be
mov dword [ebp - 0x58], 0x52a35403
sub dword [ebp - 0x58], 0x207007be
mov dword [ebp - 0x54], 0x9c5927f
sub dword [ebp - 0x54], 0xbd794e51
mov dword [ebp - 0x50], 0x9de497d8
add dword [ebp - 0x50], 0x621b6828
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x88f9b655
sub eax, 0x78f935f9
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x58ad385a
add dword [ebp - 0x5c], 0x1bc530fc
mov dword [ebp - 0x58], 0x4aae51fa
add dword [ebp - 0x58], 0xf6be0f7b
mov dword [ebp - 0x54], 0x94744d52
add dword [ebp - 0x54], 0xcefb1f1a
mov dword [ebp - 0x50], 0x6699dc3e
sub dword [ebp - 0x50], 0x6699dc3e
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xed841e2d
add eax, 0x227c623b
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x349ac
push 0
call eax
mov ecx, 0x95f4985f
add ecx, 0x6a0ba438
xor ebx, ebx
add ebx, eax
mov esi, 0x1000dc00
add esi, dword [ebp - 0x4c]
mov edx, 0xbb961772
add dword [ebp - 0x3c], esi
mov edi, dword [esi]
xor dword [ebp - 0x38], ecx
sub edi, edx
mov dword [ebx], edi
mov dword [ebp - 0x3c], 0xf4296d49
add ebx, 0x7d87a6d4
sub ebx, 0x7d87a6d0
add esi, 0xd15bd428
sub esi, 0xd15bd424
loop 0x10003b3e
add eax, 0xe52f
xor ebx, ebx
add ebx, eax
add eax, 0x512f945c
add eax, 0xaed06ba9
mov ecx, 0x72f379bb
add ecx, 0x9d0c8645
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x40d181
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, dword [edx + 8]
mov dword [esp + 4], ecx
mov edi, edx
mov esi, ebx
mov ecx, ebx
shr esi, 0xd
call fcn.0040d3a6
mov ecx, eax
mov eax, ebx
and ebx, 7
xor edx, edx
shr eax, 4
and eax, 0x1ff
add ebx, eax
mov eax, ebx
push 7
pop ebx
div ebx
mov dword [esp], edi
mov edi, dword [edi]
mov ebx, 0xe10
mov dword [esp + 0xc], edx
xor edx, edx
mov eax, edi
div ebx
mov dword [esp + 8], eax
push 0x3c
pop ebx
mov eax, edi
xor edx, edx
div ebx
mov edi, edx
xor edx, edx
div ebx
lea eax, [esp + 0x3c]
mov word [eax], si
mov esi, ecx
shr ecx, 4
shr esi, 9
and ecx, 0x1f
mov word [eax + 2], si
mov esi, dword [esp + 0xc]
mov word [eax + 4], si
mov word [eax + 6], cx
mov ecx, dword [esp + 8]
mov word [eax + 8], cx
mov word [eax + 0xa], dx
mov word [eax + 0xc], di
and word [eax + 0xe], 0
lea ecx, [esp + 0x10]
push ecx
push eax
push 0
call dword [sym.imp.kernel32.dll_SystemTimeToTzSpecificLocalTime]
test eax, eax
je 0x40d28b
lea esi, [esp + 0x10]
movzx eax, word [esi]
mov edx, dword [esi + 6]
mov edi, dword [esi + 2]
movzx ecx, word [esi + 0xe]
mov word [esp + 0x2c], ax
mov dword [esp + 0x32], edx
mov edx, dword [esi + 0xa]
mov dword [esp + 0x2e], edi
mov word [esp + 0x3a], cx
mov ecx, esi
mov dword [esp + 0x36], edx
lea edx, [esp + 0x3c]
call fcn.0040d31f
cmp dword [esi], 0
jne 0x40d27d
lea esi, [esp + 0x10]
lea edx, [esp + 0x2c]
mov edi, dword [esi + 8]
mov ecx, esi
call fcn.0040d31f
cmp dword [esi], 0
je 0x40d299
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
cmp al, 4
jne 0x40d295
jmp 0x40d2ae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
xor eax, eax
mov bl, 1
jmp 0x40d2b0
mov esi, dword [esp + 0x18]
sub esi, edi
lea eax, [esi - 0x15180]
cmp eax, 0xfffd5d00
jbe 0x40d30a
mov al, 4
xor ebx, ebx
movzx ecx, al
mov edx, esi
call fcn.0040d373
test bl, bl
jne 0x40d2de
mov edx, dword [esp]
mov ecx, dword [esp + 4]
mov eax, dword [edx + 8]
movsd xmm0, qword [edx]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
mov dword [ecx + 0xc], esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 0x10]
mov edx, 0x449d64
mov dword [ecx], 0x449e30
mov dword [ecx + 4], 1
and dword [ecx + 0x10], 0
mov dword [ecx + 8], 0x453da0
and dword [ecx + 0xc], 0
call fcn.00446250
ud2
push 0x2b
pop edx
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112librarycore_srcio_borrowed_buf.rs_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_alloc_srccollections_btree_navigate.rs
push 0x449ce4
call fcn.004463d0
pop eax
ud2
Function at 0x410170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x4101c0
cmp esi, edi
ja 0x410228
cmp edi, dword [esp + 0x1c]
ja 0x41023b
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x4101c2
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x4101b0
jmp 0x41021f
ja 0x4101c8
cmp eax, edx
mov esi, edi
jne 0x410183
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x410200
mov ebp, esi
sub ecx, edx
jns 0x410217
jmp 0x410221
cmp esi, edi
je 0x410250
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x410221
xor al, 1
cmp ebp, edi
jne 0x4101e0
jmp 0x410221
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x44a410
call fcn.00446570
add esp, 4
ud2
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x44a410
call fcn.00446360
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112librarycore_srcio_borrowed_buf.rs_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_alloc_srccollections_btree_navigate.rs
mov edx, 0x2b
push 0x44a400
call fcn.004463d0
add esp, 4
ud2
Function at 0x4117de
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, edx
mov edx, dword [esp + 0x18]
mov ebx, ecx
not ebx
cmp edx, 0x40
jb 0x411905
push 4
pop edi
sub edi, 1
jb 0x4117ed
cmp edx, 0xf
jbe 0x411915
movzx ebp, byte [eax + 0xe]
movzx esi, byte [eax + 0xf]
mov ecx, ebx
mov dword [esp], edx
mov edx, 0xff
shr ecx, 0x18
mov ebp, dword [ebp*4 + 0x44b204]
xor ebp, dword [esi*4 + 0x44ae04]
movzx esi, byte [eax + 0xd]
xor ebp, dword [esi*4 + 0x44b604]
movzx esi, byte [eax + 0xc]
xor ebp, dword [esi*4 + 0x44ba04]
movzx esi, byte [eax + 0xb]
xor ebp, dword [esi*4 + 0x44be04]
movzx esi, byte [eax + 0xa]
xor ebp, dword [esi*4 + 0x44c204]
movzx esi, byte [eax + 9]
xor ebp, dword [esi*4 + 0x44c604]
movzx esi, byte [eax + 8]
xor ebp, dword [esi*4 + 0x44ca04]
movzx esi, byte [eax + 7]
xor ebp, dword [esi*4 + 0x44ce04]
movzx esi, byte [eax + 6]
xor ebp, dword [esi*4 + 0x44d204]
movzx esi, byte [eax + 5]
xor ebp, dword [esi*4 + 0x44d604]
movzx esi, byte [eax + 4]
xor ebp, dword [esi*4 + 0x44da04]
movzx esi, byte [eax + 3]
xor ecx, esi
mov esi, ebx
xor ebp, dword [ecx*4 + 0x44de04]
movzx ecx, byte [eax + 2]
shr esi, 0x10
and esi, edx
xor esi, ecx
movzx ecx, byte [eax + 1]
xor ebp, dword [esi*4 + 0x44e204]
mov esi, ebx
and ebx, edx
shr esi, 8
and esi, edx
mov edx, dword [esp]
xor esi, ecx
movzx ecx, byte [eax]
xor ebp, dword [esi*4 + 0x44e604]
xor ebx, ecx
mov ecx, eax
xor ebp, dword [ebx*4 + 0x44ea04]
push 0x44adf4
call fcn.00411d6c
pop ecx
mov ebx, ebp
jmp 0x4117f9
mov cl, byte [eax]
inc eax
dec edx
xor cl, bl
shr ebx, 8
movzx esi, cl
xor ebx, dword [esi*4 + 0x44ae04]
test edx, edx
jne 0x4118f2
not ebx
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xf
pop ecx
push 0x44ade4
call fcn.004462f0
pop eax
ud2
Function at 0x41dad0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x45c04c]
test eax, eax
je 0x41db83
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x41dafc
cmp dword [eax + 4], 0
mov edi, eax
je 0x41dafc
add edi, 8
jmp 0x41db7e
mov eax, dword [0x45c04c]
test eax, eax
je 0x41db92
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x41db7c
mov esi, eax
test eax, eax
jne 0x41db52
movzx eax, byte [0x45ca98]
mov ecx, 0xc
call fcn.0040c250
test eax, eax
je 0x41dbad
mov dword [eax], 0x45c04c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45c04c]
test eax, eax
je 0x41dba1
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x41db7e
test ecx, ecx
je 0x41db7e
lock dec dword [ecx]
jne 0x41db7e
call fcn.0041d7d0
jmp 0x41db7e
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x45c04c
call fcn.00446e40
jmp 0x41dae0
mov ecx, 0x45c04c
call fcn.00446e40
jmp 0x41db0a
mov ecx, 0x45c04c
call fcn.00446e40
jmp 0x41db4a
mov ecx, 4
mov edx, 0xc
call fcn.00446130
ud2
Function at 0x41e7f0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x41e844
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x41e867
test eax, eax
js 0x41e853
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x41e85f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x452f20
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0041d2e0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0041d410
mov ecx, 7
int 0x29
ud2
Function at 0x41ee30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x45c03c]
test eax, eax
je 0x41eec3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x41ee56
cmp dword [eax + 4], 0
je 0x41ee56
add eax, 8
pop esi
ret
mov eax, dword [0x45c03c]
test eax, eax
je 0x41eed2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x41eebf
mov esi, eax
test eax, eax
jne 0x41eea8
movzx eax, byte [0x45ca98]
mov ecx, 0x10
call fcn.0040c250
test eax, eax
je 0x41eeea
mov dword [eax], 0x45c03c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45c03c]
test eax, eax
je 0x41eede
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x45c03c
call fcn.00446e40
jmp 0x41ee3f
mov ecx, 0x45c03c
call fcn.00446e40
jmp 0x41ee60
mov ecx, 0x45c03c
call fcn.00446e40
jmp 0x41eea0
mov ecx, 4
mov edx, 0x10
call fcn.00446130
ud2
Function at 0x420d40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x437690
mov dword [ebp - 0x28], ecx
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x30], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jae 0x420dd0
jmp 0x420dbe
jbe 0x420e5c
cmp esi, 0x201
jae 0x420dd0
mov dword [ebp - 0x2c], 0x200
lea ebx, [ebp - 0x44c]
mov edi, esi
jmp 0x420e0b
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x420dfc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
mov edx, edi
push esi
call fcn.004470d0
add esp, 4
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x420e2b
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x420e94
cmp esi, edi
jne 0x420db0
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x420ecf
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x420dbe
jmp 0x420dd0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
cmp esi, edx
ja 0x420eef
lea ecx, [ebp - 0x4c]
mov edx, ebx
push esi
call fcn.00421590
add esp, 4
movsd xmm0, qword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
movsd xmm1, qword [ebp - 0x44]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
jmp 0x420ea7
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp - 0x28]
mov byte [ecx], 0
mov dword [ecx + 4], eax
mov byte [ecx + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x420ebb
mov ecx, dword [ebp - 0x24]
mov edx, 2
call fcn.0040c280
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, str.internal_error:_entered_unreachable_code
mov edx, 0x28
push 0x453678
call fcn.004463d0
add esp, 4
jmp 0x420efe
mov ecx, esi
push 0x453668
call fcn.00446360
add esp, 4
ud2