joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431c80
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x52eb64], 0
jne 0x431c8e
call fcn.00431ac0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x52eb60]
call esi
mov edi, eax
test edi, edi
jne 0x431cb5
call fcn.00431ac0
push dword [0x52eb60]
call esi
mov edi, eax
mov esi, dword [edi]
mov edx, dword [edi + 4]
mov ebp, dword [esp + 0x14]
mov ebx, dword [edi + esi*4 + 0x4c]
mov eax, dword [edi + esi*4 + 8]
mov ecx, dword [edi + edx*4 + 8]
ror eax, 5
ror ebx, 0xd
add eax, ecx
add ebx, dword [edi + edx*4 + 0x4c]
mov dword [edi + esi*4 + 0x4c], eax
mov eax, 0x10
mov dword [edi + esi*4 + 8], ebx
sub esi, 1
cmovs esi, eax
sub edx, 1
mov dword [edi], esi
cmovs edx, eax
mov eax, ebx
mov dword [edi + 4], edx
add ebp, 1
je 0x431cff
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x432561
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x530e94]
call fcn.00441b41
mov ebx, eax
test ebx, ebx
je 0x4325c5
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x43258a
push dword [esp + 0xc]
push ebx
call eax
jmp 0x4325c5
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.00442680
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call fcn.0041686c
pop ecx
sub edi, eax
push edi
call fcn.00442710
pop edi
pop esi
pop ebx
ret 8

Function at 0x4345b5
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
xor edi, edi
push edi
push edi
push 0x147
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
or eax, 0xffffffff
cmp ebx, eax
je 0x434644
push 0xfffffffffffffff0
push dword [ebp]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 1
jne 0x434644
push esi
push dword [ebp]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push edi
push dword [0x52d078]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
lea ecx, [esi + 1]
push ecx
xor eax, eax
push edi
mov word [edi], ax
push dword [ebp]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push edi
or esi, 0xffffffff
push esi
push 0x158
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
push dword [0x52d078]
cmp eax, esi
cmove ebx, esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
mov eax, ebx
pop ebp
cdq
pop ebx
ret 4
Function at 0x43951d
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
lea eax, [ebp - 0x208]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, dword [ebp + 8]
or eax, 0x4000
push eax
push 0x2b4
lea eax, [ebp - 0x4bc]
push eax
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
leave
ret 4

Function at 0x439560
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4395dc
cmp dword [0x530920], 1
je 0x4395dc
push ebx
mov ebx, 0x530928
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [0x530944]
and dword [0x53094c], 0
mov dword [0x530948], esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [0x530940]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1388
push dword [0x530944]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4395d4
push 0
push dword [0x530924]
mov dword [0x530920], 1
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
pop esi
ret 4
Function at 0x4398a8
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x530448], 0
jne 0x439979
push ebx
push ebp
push esi
xor ebp, ebp
inc ebp
push 0x530e9c
mov dword [0x530448], ebp
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov eax, 0x640
push eax
push 8
push dword [0x52d078]
mov dword [0x53090c], eax
mov dword [0x53044c], 0x1f4
call esi
mov dword [0x53091c], eax
mov eax, dword [0x53044c]
add eax, eax
push eax
push 8
push dword [0x52d078]
call esi
xor ebx, ebx
mov dword [0x530918], eax
push 0x530928
mov dword [0x530910], ebx
mov dword [0x530914], ebp
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push ebp
push ebx
call esi
push ebx
push ebx
push ebp
push ebx
mov dword [0x530940], eax
call esi
mov dword [0x530944], eax
cmp dword [0x530940], ebx
je 0x439970
test eax, eax
je 0x439970
lea eax, [esp + 0xc]
mov dword [0x530920], ebx
push eax
push ebx
push ebx
push 0x439306
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x530924], eax
jmp 0x439976
mov dword [0x530920], ebp
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x43997b
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x439a20
cmp dword [esp + 0xc], 0
je 0x439a20
cmp dword [0x530920], 1
je 0x439a20
push edi
push 0x1f
push 0
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov edi, eax
cmp edi, 0xffffffff
je 0x439a1f
push ebp
mov ebp, 0x530928
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [0x530944]
mov dword [0x530948], esi
mov dword [0x53094c], edi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [0x530940]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1388
push dword [0x530944]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x439a17
push 0
push dword [0x530924]
mov dword [0x530920], 1
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
pop edi
pop esi
ret 8
Function at 0x439ddb
Capabilities:
Check os version

Disassembly:
sub esp, 0x34c
push ebp
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x114
push eax
mov esi, 0xc8
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x439f44
mov eax, dword [esp + 0x1c]
sub eax, 1
je 0x439f27
sub eax, 1
jne 0x439f44
lea eax, [esp + 0x120]
xor edi, edi
push eax
call fcn.00439d94
pop ecx
test eax, eax
je 0x439e52
cmp byte [esp + 0x23a], 1
mov ecx, dword [esp + 0x124]
mov eax, dword [esp + 0x128]
mov ebp, dword [esp + 0x12c]
jne 0x439e88
inc edi
jmp 0x439e88
lea eax, [esp + 0x23c]
mov dword [esp + 0x23c], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x439f44
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x14]
inc edx
cmp byte [esp + 0x356], dl
cmove edi, edx
sub ecx, 3
je 0x439f23
sub ecx, 1
je 0x439f1f
sub ecx, 1
je 0x439f01
sub ecx, 1
je 0x439ec5
sub ecx, 4
jne 0x439f44
test eax, eax
jne 0x439f44
cmp ebp, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x439f44
sub eax, 0
je 0x439ef4
sub eax, 1
je 0x439ee7
sub eax, 1
je 0x439ee0
sub eax, 1
jne 0x439f44
push 0x69
pop esi
push 0x64
jmp 0x439ef9
push 0x5a
pop esi
push 0x5f
jmp 0x439eec
push 0x50
pop esi
push 0x55
test edi, edi
pop eax
cmove esi, eax
jmp 0x439f44
push 0x4b
pop esi
push 0x46
test edi, edi
pop eax
cmovne esi, eax
jmp 0x439f44
sub eax, 0
je 0x439f1b
sub eax, 1
je 0x439f17
sub eax, 1
jne 0x439f44
push 0x41
pop esi
push 0x3c
jmp 0x439ef9
push 0x3c
jmp 0x439f43
push 0x32
jmp 0x439f43
push 0x14
jmp 0x439f43
push 5
jmp 0x439f43
mov eax, dword [esp + 0x14]
test eax, eax
je 0x439f41
cmp eax, 0xa
je 0x439f3d
cmp eax, 0x5a
jne 0x439f44
push 0x28
jmp 0x439f43
push 0x1e
jmp 0x439f43
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x34c
ret
Function at 0x43a18c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x530ec0]
call fcn.00441b41
mov esi, eax
test esi, esi
je 0x43a268
cmp dword [ebp + 0xc], 0
je 0x43a1d8
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x43a1c9
cmp dword [esi + 0x1c], 0
jne 0x43a1c9
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43a268
test byte [ebp + 0x10], 3
push ebx
push 4
pop ebx
je 0x43a1f6
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.0043a7ab
cmp dword [esi + 0x3c], 0xffffffff
je 0x43a21a
xor eax, eax
cmp dword [esi + 0x3c], 0x1000000
sete al
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x43a232
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
mov eax, dword [ebp + 8]
test dword [ebp + 0x10], 0x2000000
je 0x43a24d
test eax, eax
je 0x43a243
push 8
jmp 0x43a253
push 7
test ecx, ecx
pop eax
cmovne ebx, eax
jmp 0x43a25e
test eax, eax
je 0x43a256
push 3
pop ebx
jmp 0x43a25e
xor ebx, ebx
test ecx, ecx
setne bl
inc ebx
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x43a92b
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x43a9c1
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x43a9be
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x43a9be
lea eax, [esi - 1]
push eax
push dword [0x530ec0]
call fcn.00441b41
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x43a9c0
mov ecx, dword [edi + 4]
add ecx, 4
pop esi
cmp word [ecx - 2], si
jne 0x43a9ae
mov edx, 0xfa01
cmp word [ecx], dx
je 0x43a9b9
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x43a99e
jmp 0x43a9be
and dword [esp + 0x10], 0
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x43aa67
push eax
call esi
test al, al
jns 0x43aa67
push 0x11
call esi
test al, al
js 0x43aa67
push 0x10
call esi
test al, al
js 0x43aa67
push 0x12
call esi
test al, al
js 0x43aa67
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x43aa67
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call fcn.00417f70
add esp, 0xc
test eax, eax
je 0x43aa3b
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call fcn.00417f70
add esp, 0xc
test eax, eax
jne 0x43aa52
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x43aaa8
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call fcn.004d694c
pop ecx
pop ecx
test eax, eax
je 0x43aaa8
test ebp, ebp
je 0x43aa8b
push 0x11
call esi
test al, al
js 0x43aa83
push 0x10
call esi
test al, al
js 0x43aa83
push 0x12
call esi
test al, al
jns 0x43aa8b
push 1
push ebp
call fcn.0043aab4
test ebx, ebx
je 0x43aa9f
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x43aaa8
test edi, edi
je 0x43aaa8
mov eax, dword [edi + 8]
jmp 0x43aaaa
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x43b6f4
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x43b83c
xor ecx, ecx
cmp word [eax], cx
je 0x43b83c
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004c9c66
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call fcn.0041686c
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x43b74d
cmp eax, 3
jne 0x43b787
cmp word [esp + 0xa], 0x3a
jne 0x43b787
cmp eax, 2
jne 0x43b76b
lea eax, [esp + 8]
push 0x4f4398
push eax
call fcn.004c9c35
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x43b83c
push 0xfffffffffffffffe
pop edi
jmp 0x43b83c
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x43b79c
cmp ax, bx
jne 0x43b7a6
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x43b78f
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x43b7e5
test byte [esp + 0x21c], 0x10
je 0x43b7cc
push 0xfffffffffffffffe
pop edi
jmp 0x43b7dc
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x43b83a
cmp word [esp + 0x10], bp
jne 0x43b7f3
cmp word [esp + 0x12], bp
je 0x43b812
cmp word [esp + 0x10], bx
jne 0x43b801
cmp word [esp + 0x12], bx
je 0x43b812
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x43b83a
cmp word [esp + 0x12], ax
jne 0x43b83a
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x43b827
test al, 0x10
je 0x43b83a
jmp 0x43b837
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x43b83a
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x43b84b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x43b8c3
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call fcn.004c9c66
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call fcn.0041686c
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x43b8a4
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x43b8a1
cmp ecx, 0x5c
je 0x43b8a1
cmp ecx, 0x2f
jne 0x43b8ae
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x43b88e
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x43b8c5
xor eax, eax
leave
ret 4
Function at 0x43bb2d
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebx
mov ebx, eax
mov eax, dword [0x530a78]
push esi
push edi
test eax, eax
jne 0x43bb53
push fcn.0043bc5c
push 0x10
push 0x258
call fcn.00441c13
mov dword [0x530a78], eax
mov edi, dword [esp + 0x10]
push edi
push eax
call fcn.00441b7f
mov esi, eax
test esi, esi
je 0x43bc54
cmp dword [esp + 0x14], ebx
mov eax, 0x4f7268
push ebp
cmovne eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
test ebp, ebp
je 0x43bb8b
xor ecx, ecx
cmp word [ebp], cx
jne 0x43bb94
mov ebp, 0x4f9c98
mov dword [esp + 0x1c], ebp
push eax
call fcn.0041686c
push ebp
mov dword [esp + 0x20], eax
call fcn.0041686c
add eax, dword [esp + 0x20]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x52d078]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x43bc41
push dword [esp + 0x14]
push ebp
call fcn.004c9c13
pop ecx
pop ecx
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x43bbf4
mov eax, dword [esp + 0x14]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x43bbf4
push 0x4f4398
push ebp
call fcn.004c9c35
pop ecx
pop ecx
push dword [esp + 0x1c]
push ebp
call fcn.004c9c35
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x43bc19
xor ecx, ecx
mov dword [esi + 4], ecx
jmp 0x43bc2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 2
jne 0x43bc2f
mov dword [esi + 4], 1
mov ebx, esi
push ebp
push ecx
push dword [0x52d078]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x43bc53
cmp edi, 0xffffffff
cmove edi, esi
push edi
push dword [0x530a78]
call fcn.00441af2
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
ret 0xc

Function at 0x43ec50
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x43ec88
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43ec83
xor eax, eax
cmp dword [esp + 0xc], esi
pop edi
sete al
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call fcn.00424d90
add dword [edi + 8], esi
add esp, 0xc
mov eax, 1
pop edi
pop esi
ret
Function at 0x4419a1
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x530abc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x441a02
push esi
push dword [0x530ab8]
push 8
push dword [0x52d078]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x530abc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x530ab4]
jmp 0x4419f2
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4419f0
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x4419e0
push edi
push 0x44193f
call fcn.004b2553
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4

Function at 0x441a0c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ecx, edi
and ecx, 3
je 0x441a22
push 4
pop eax
sub eax, ecx
add edi, eax
mov esi, dword [0x530ab8]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
jne 0x441a5b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push edi
push 8
push dword [0x52d078]
mov dword [0x530abc], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x530abc]
call ebx
mov esi, dword [0x530ab8]
lea eax, [edi + esi]
push eax
push dword [0x530abc]
mov dword [0x530ab8], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x52d078]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x530abc]
call ebx
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test edi, edi
jne 0x441a9a
test ebx, ebx
je 0x441abb
push 0x14
push 0x530ab4
call fcn.00442312
pop ecx
pop ecx
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
test edi, edi
je 0x441abb
lea ecx, [esi + ebp]
push ecx
call edi
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x442400
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x52a108]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov edi, eax
mov ebp, dword [esp + 0x14]
mov esi, dword [edi + 8]
mov ecx, dword [ebp]
sub esi, ebx
lea eax, [esi + 0xa]
push eax
test ecx, ecx
jne 0x442439
push ecx
push dword [0x53103c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x442448
push ecx
push 0
push dword [0x53103c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
shr esi, 1
mov dword [ebp], ecx
mov eax, dword [edi]
push esi
add eax, ebx
push eax
push ecx
call fcn.004427f0
mov dword [edi + 8], ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x4424c0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x52a108]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [eax + 8], 2
ret
Function at 0x442680
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x52a108]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov esi, eax
cmp ebx, 0xffffffff
jne 0x44269e
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x14]
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
lea ebp, [eax + eax]
add ecx, ebp
lea eax, [edx - 4]
cmp ecx, eax
jl 0x4426c2
lea eax, [ecx + 0x4000]
mov dword [esi + 4], eax
add eax, 0xa
jmp 0x4426dd
cmp edx, 0x100000
jle 0x4426f0
cmp ecx, 0x100000
jge 0x4426d7
mov ecx, 0x100000
mov dword [esi + 4], ecx
lea eax, [ecx + 0xa]
push eax
push dword [esi]
push 0
push dword [0x53103c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [esi], eax
lea eax, [ebx + ebp]
mov dword [esi + 8], eax
mov eax, dword [esi]
pop edi
pop esi
pop ebp
add eax, ebx
pop ebx
ret 8

Function at 0x442710
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x52a108]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
neg ecx
add ecx, ecx
add dword [eax + 8], ecx
ret 4

Function at 0x442750
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x52a108]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov eax, dword [esp + 4]
mov edx, dword [ecx]
cmp eax, edx
jb 0x442777
mov ecx, dword [ecx + 8]
add ecx, edx
cmp eax, ecx
ja 0x442777
sub eax, edx
inc eax
ret 4
xor eax, eax
ret 4

Function at 0x442780
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x52a108]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
mov eax, dword [esp + 4]
dec eax
add eax, ecx
ret 4

Function at 0x442860
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x52a108]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
mov dword [eax + 8], ecx
mov eax, dword [eax]
add eax, ecx
ret 4
Function at 0x455730
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
cmp edi, 8
jl 0x4557e5
push ebx
mov ebx, edi
shr ebx, 3
mov eax, ebx
neg eax
lea edi, [edi + eax*8]
mov eax, dword [esp + 0x10]
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0x10
movzx edx, cl
mov ecx, eax
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x509d20]
xor edx, dword [ecx*4 + 0x509920]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x50a120]
movzx ecx, byte [esi + 6]
xor edx, dword [ecx*4 + 0x508920]
movzx ecx, byte [esi + 5]
xor edx, dword [ecx*4 + 0x508d20]
movzx ecx, byte [esi + 7]
xor edx, dword [ecx*4 + 0x508520]
movzx ecx, byte [esi + 4]
add esi, 8
xor edx, dword [ecx*4 + 0x509120]
xor edx, dword [eax*4 + 0x509520]
mov eax, edx
sub ebx, 1
jne 0x455754
pop ebx
jmp 0x4557e9
mov eax, dword [esp + 0xc]
test edi, edi
je 0x45580c
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
mov edx, eax
shl eax, 8
shr edx, 0x18
xor edx, ecx
xor eax, dword [edx*4 + 0x508520]
sub edi, 1
jne 0x4557f0
pop edi
pop esi
ret

Function at 0x45b643
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.0045c15f
mov edx, dword [esi + 0x14]
pop ecx
test edx, edx
je 0x45b69e
mov ecx, dword [esi + 0x10]
mov eax, dword [esi]
push ebp
push edi
mov edi, dword [esi + 0x20]
mov ebp, dword [eax + ecx*4]
cmp edi, edx
jae 0x45b69c
push ebx
mov ebx, dword [esi + 0x18]
push 0x18
pop ecx
sub ecx, edi
mov eax, ebp
shr eax, cl
add edi, 8
movzx ecx, al
mov eax, ebx
shr eax, 8
xor ecx, eax
movzx ebx, bl
shl ebx, 8
movzx ecx, word [ecx*2 + 0x50b8b0]
xor ebx, ecx
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], ebx
cmp edi, edx
jb 0x45b66b
pop ebx
pop edi
pop ebp
mov ax, word [esi + 0x18]
pop esi
ret

Function at 0x45c15f
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0x1c]
mov edx, ecx
mov edi, dword [esi + 0x10]
cmp edi, ecx
jbe 0x45c1db
push ebx
mov ebx, dword [esi + 0x20]
test ebx, ebx
je 0x45c1da
mov eax, dword [esi]
lea edx, [ecx + 1]
mov dword [esp + 0xc], edx
push ebp
mov ebp, dword [eax + ecx*4]
mov eax, dword [esi + 0x18]
mov dword [esi + 0x1c], edx
mov dword [esp + 0x18], eax
cmp ebx, 0x20
jae 0x45c1d2
mov edx, eax
push 0x18
pop ecx
sub ecx, ebx
mov eax, ebp
shr eax, cl
add ebx, 8
movzx ecx, al
mov eax, edx
shr eax, 8
xor ecx, eax
movzx edx, dl
shl edx, 8
movzx ecx, word [ecx*2 + 0x50b8b0]
xor edx, ecx
mov dword [esi + 0x20], ebx
cmp ebx, 0x20
jb 0x45c198
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
and dword [esi + 0x20], 0
mov dword [esi + 0x18], eax
pop ebp
pop ebx
movzx eax, word [esi + 0x18]
sub edi, edx
push eax
mov eax, dword [esi]
push edi
lea eax, [eax + edx*4]
push eax
call fcn.0045fb53
add esp, 0xc
movzx eax, ax
and dword [esi + 0x1c], 0
mov dword [esi + 0x18], eax
pop edi
pop esi
pop ecx
ret