joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432e40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x4ce008]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x432e70
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462e56
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x432f70
push 0
push eax
push 0x432e20
push 0x4e1448
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x432f6b
cmp dword [0x4e144c], 0
jne 0x432e5c
push dword [0x4e1450]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x432e5c
mov esi, eax
mov eax, 0x4e1454
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x4e1458]
mov ebx, dword [0x4e145c]
mov eax, dword [0x4e1460]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x4e1464]
mov dword [ebp - 0x20], eax
mov eax, dword [0x4e1468]
mov dword [ebp - 0x24], eax
mov eax, 0x4e1454
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x432f04
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [section..00cfg]
push dword [ebp - 0x18]
call edi
add esp, 4
test ebx, ebx
je 0x432f19
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x432f2f
mov edi, dword [esi + 8]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
je 0x432f48
mov edi, dword [esi + 0xc]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
test ebx, ebx
je 0x432f5d
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
push esi
call fcn.0043c250
add esp, 4
jmp 0x432e5c
call fcn.004738e6
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4e1450], eax
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [0x4e144c], ecx
pop ebp
ret
Function at 0x432f90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x4ce008]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x432f70
push 0
push eax
push 0x432e20
push 0x4e1448
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x433074
mov esi, dword [ebp + 0xc]
cmp dword [0x4e144c], 0
jne 0x433061
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x4e1450]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x43301b
push 0x14
push 1
call fcn.0043c2f0
add esp, 8
test eax, eax
je 0x433061
mov edi, eax
push eax
push dword [0x4e1450]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x433058
mov ebx, dword [ebp + 8]
mov esi, 0x4e1454
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x4e1458], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462e56
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.0043c250
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x433044
call fcn.004738e6
int3

Function at 0x433480
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x4d1d78]
cmp eax, 0xffffffff
je 0x433541
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x433541
mov eax, dword [0x4e2480]
mov ecx, dword [0x4d1de0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x43354b
mov edi, dword [0x4e247c]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x433590
mov ecx, dword [0x4e1474]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx eax, al
mov ebx, eax
shl ebx, 4
cmp dword [ebx + 0x4e1478], 0
jne 0x43359c
lea ecx, [ebx + 0x4e1478]
mov dword [ecx], 1
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov edx, dword [0x4e2478]
inc edx
mov dword [0x4e2478], edx
mov dword [ecx + 0xc], edx
mov dword [0x4e1474], eax
mov dword [esi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x4335ab
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004335b0
jmp 0x4334a5
push 0x4e2480
call fcn.00462687
add esp, 4
cmp dword [0x4e2480], 0xffffffff
jne 0x4334c6
push 4
call fcn.004625e7
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.00446130
mov dword [0x4e247c], edi
push 0x4e2480
call fcn.004626fd
add esp, 4
jmp 0x4334c6
mov ecx, edi
call fcn.00446140
jmp 0x4334db
inc edx
cmp edx, 0x100
jne 0x4334e4
jmp 0x43352b
int3
Function at 0x4335b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov eax, dword [0x4ce008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x814], 0xffffffff
mov ecx, dword [0x4d1d78]
mov dword [ebp - 0x814], ecx
cmp ecx, 0xffffffff
je 0x43365d
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x4336ce
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0
push ebx
call fcn.00466490
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push dword [ebp - 0x814]
call fcn.004366b0
add esp, 8
push edi
call fcn.00462643
add esp, 4
mov esi, eax
push edi
push ebx
push eax
call fcn.00465f10
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x814]
call fcn.004366b0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462e56
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x814]
push esi
call fcn.00436690
add esp, 4
test al, al
je 0x4336d1
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xffffffff
je 0x4336a6
xor eax, eax
dec eax
lock cmpxchg dword [0x4d1d78], ecx
je 0x4335e1
push ecx
call fcn.004b3680
add esp, 4
mov ecx, dword [0x4d1d78]
mov dword [ebp - 0x814], ecx
jmp 0x4335e1
push esi
call fcn.00436690
add esp, 4
test al, al
je 0x4336d4
cmp dword [ebp - 0x814], 0xffffffff
je 0x4336d4
push 0xffffffffffffffff
call fcn.004b3680
add esp, 4
mov ecx, dword [ebp - 0x814]
jmp 0x43367b
int3
int3
int3
Function at 0x433b50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov edi, ecx
mov eax, dword [0x4ce008]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
push edx
push ecx
push esi
call fcn.004475a0
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x433b7e
mov esi, dword [ebp - 0x1c]
xor eax, eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
jns 0x433b9c
push dword [ebp - 0x1c]
call fcn.00462617
add esp, 4
cmp dword [ebp + 8], 0
je 0x433c35
test esi, esi
je 0x433c35
lea eax, [esi + esi]
xor ecx, ecx
dec ecx
test esi, esi
cmovns ecx, eax
push ecx
call fcn.00462643
add esp, 4
mov ecx, edi
mov edi, eax
mov eax, ebx
lea ebx, [ebp - 0x1c]
push eax
push ecx
push ebx
call fcn.004475a0
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x433bdf
mov ebx, dword [ebp - 0x1c]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x433bf9
push dword [ebp - 0x1c]
call fcn.00462617
add esp, 4
test edi, edi
mov ebx, dword [ebp + 8]
je 0x433c5a
push edi
call fcn.0047a8f1
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
push edi
push ecx
call fcn.00447950
add esp, 0xc
cmp byte [ebx + 0xb], 0
js 0x433c4e
mov eax, dword [ebp - 0x14]
mov dword [ebx + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebx], xmm0
push edi
call fcn.0046264c
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462e56
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [ebx]
call fcn.00462617
add esp, 4
jmp 0x433c1d
push str.null_pointer_passed_to_non_null_argument_of_char_traits_..._::length
push str.__s___nullptr
push 0x109
push str....._third_partylibc_srcinclude_string_view
push str._s:_d:_assertion__s_failed:__s_n
call fcn.0048cb70
int3

Function at 0x438810
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, edx
cmp edx, 4
jb 0x438856
nop word cs:[eax + eax]
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x438830
cmp edx, 3
je 0x43887f
cmp edx, 2
je 0x438888
cmp edx, 1
je 0x438891
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 8
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
jmp 0x438865
Function at 0x446390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov al, byte [0x4e0b74]
test al, 1
je 0x4463b1
call fcn.0044e8c0
pop esi
pop edi
pop ebp
jmp fcn.0044e8e0
mov eax, dword [0x4e0b7c]
mov ecx, dword [0x4d1de0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4463e6
mov ecx, dword [0x4e0b78]
call dword [section..00cfg]
push edi
push esi
call ecx
test eax, eax
je 0x44642f
pop esi
pop edi
pop ebp
ret
push 0x4e0b7c
call fcn.00462687
add esp, 4
cmp dword [0x4e0b7c], 0xffffffff
jne 0x4463ce
push 0x4bd38e
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x446432
push str.ProcessPrng
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x446435
mov dword [0x4e0b78], eax
push 0x4e0b7c
call fcn.004626fd
add esp, 4
jmp 0x4463ce
int3
int3
int3
Function at 0x44dfb0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x4ce008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4e0c74]
mov ecx, dword [0x4d1de0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x44e000
mov esi, dword [0x4e0c70]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462e56
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4e0c74
call fcn.00462687
add esp, 4
cmp dword [0x4e0c74], 0xffffffff
jne 0x44dfe3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.00466490
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.004625e7
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x4e0ca4]
mov ecx, dword [0x4d1de0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x44e0a9
mov ecx, esi
push ebx
push 0x4e0c80
push edi
call fcn.0042a620
mov dword [0x4e0c70], esi
push 0x4e0c74
call fcn.004626fd
add esp, 4
jmp 0x44dfe3
push 0x4e0ca4
call fcn.00462687
add esp, 4
cmp dword [0x4e0ca4], 0xffffffff
jne 0x44e083
xorps xmm0, xmm0
movups xmmword [0x4e0c90], xmm0
movups xmmword [0x4e0c80], xmm0
mov dword [0x4e0ca0], 0
push 0x4e0c80
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x4e0ca4
call fcn.004626fd
add esp, 4
jmp 0x44e083
Function at 0x44f1a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [0x4ce008]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 0x30
ja 0x44f26b
mov ecx, dword [ebp + 0xc]
movups xmm0, xmmword [ecx + 0x20]
movups xmmword [ebp - 0x20], xmm0
movups xmm0, xmmword [ecx]
movups xmm1, xmmword [ecx + 0x10]
movups xmmword [ebp - 0x30], xmm1
movups xmmword [ebp - 0x40], xmm0
test eax, eax
jne 0x44f26f
mov esi, dword [ebp + 8]
xor eax, eax
mov cl, byte [eax + 0x4c4b50]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp eax, 0x30
jne 0x44f1e7
lea edi, [esi + 0xf4]
push 1
call fcn.0044e890
add esp, 4
bt eax, 0x19
jae 0x44f286
lea eax, [ebp - 0x40]
push esi
push 0x100
push eax
call fcn.00403380
add esp, 0xc
mov ecx, section..text
mov eax, 0x401b90
test edi, edi
je 0x44f22f
mov dword [edi], ecx
mov dword [esi + 0xf8], eax
movups xmm0, xmmword [ebp - 0x20]
movups xmmword [esi + 0xfc], xmm0
mov dword [esi + 0x114], 0
mov dword [esi + 0x110], 1
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462e56
mov eax, esi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x44f257
mov ecx, dword [ebp + 0x10]
xor edx, edx
mov bl, byte [ecx + edx]
xor byte [ebp + edx - 0x40], bl
inc edx
cmp eax, edx
je 0x44f1e2
jmp 0x44f274
bt eax, 9
jae 0x44f2a7
lea eax, [ebp - 0x40]
push esi
push 0x100
push eax
call fcn.00403ea0
add esp, 0xc
xor eax, eax
mov ecx, 0x403f50
jmp 0x44f229
lea eax, [ebp - 0x40]
push esi
push 0x100
push eax
call fcn.004aa2e0
add esp, 0xc
mov ecx, 0x4aa1f0
mov eax, 0x4aaa80
jmp 0x44f229
Function at 0x44f2d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [ebp + 8]
mov eax, dword [0x4ce008]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0x30
ja 0x44f402
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [ebp - 0x44], eax
call dword [section..00cfg]
lea eax, [ebp - 0x40]
push esi
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
test ebx, ebx
je 0x44f3a1
xor eax, eax
mov cl, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp ebx, eax
jne 0x44f395
lea edi, [esi + 0xf4]
push 1
call fcn.0044e890
add esp, 4
bt eax, 0x19
jae 0x44f406
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403380
add esp, 0xc
mov ecx, section..text
mov eax, 0x401b90
test edi, edi
je 0x44f3d9
mov dword [edi], ecx
mov dword [esi + 0xf8], eax
lea eax, [ebp - 0x20]
movups xmm0, xmmword [eax]
mov eax, dword [ebp - 0x44]
movups xmmword [eax], xmm0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462e56
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x44f3ee
bt eax, 9
jae 0x44f427
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403ea0
add esp, 0xc
xor eax, eax
mov ecx, 0x403f50
jmp 0x44f3d3
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.004aa2e0
add esp, 0xc
mov ecx, 0x4aa1f0
mov eax, 0x4aaa80
jmp 0x44f3d3
Function at 0x4589a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x4ce008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x432f70
lea eax, [ebp - 0x14]
push 0
push eax
push 0x432e20
push 0x4e1448
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x458a1a
xor esi, esi
cmp dword [0x4e144c], 0
jne 0x458a06
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x4e1450]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x458a06
mov eax, dword [ebp + 8]
mov esi, dword [edi + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462e56
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004738e6
int3
Function at 0x458a40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2010
call fcn.004639c0
mov eax, dword [0x4ce008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4d1d78]
cmp eax, 0xffffffff
je 0x458c1c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x458c1c
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.00465f10
add esp, 0xc
mov ecx, dword [0x4d1d78]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x2014], ecx
push ecx
call fcn.004366b0
add esp, 8
test ebx, ebx
je 0x458abb
push ebx
call fcn.0046264c
add esp, 4
mov ecx, 0x101
lea esi, [ebp - 0x2010]
jmp 0x458b4b
mov ecx, edx
shl ecx, 4
cmp dword [ebp + ecx - 0x1810], 0
je 0x458b10
mov esi, dword [ebp + edx*8 - 0x80c]
cmp esi, dword [ebp + ecx - 0x1808]
jne 0x458b10
mov ecx, dword [ebp + ecx - 0x180c]
test ecx, ecx
je 0x458b10
mov dword [ebp + edx*8 - 0x810], 0
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov al, 1
nop
add ebx, 8
cmp ebx, 0x804
je 0x458b30
movzx edx, word [ebp + ebx - 0x2010]
mov edi, dword [ebp + edx*8 - 0x810]
test edi, edi
je 0x458b10
jmp 0x458acb
mov ecx, dword [ebp - 0x2018]
dec ecx
je 0x458c76
test al, 1
lea esi, [ebp - 0x2010]
je 0x458c0c
mov dword [ebp - 0x2018], ecx
mov eax, dword [0x4e2480]
mov ecx, dword [0x4d1de0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x458c31
mov ebx, dword [0x4e247c]
push ebx
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x458c7d
push 0x1000
push 0x4e1478
lea eax, [ebp - 0x1810]
push eax
call fcn.00465f10
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push 0x800
push 0xff
push esi
call fcn.00466490
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x1804]
nop word cs:[eax + eax]
mov edx, dword [ecx]
mov dword [ebp + eax*8 - 0x2010], edx
mov word [ebp + eax*8 - 0x200c], ax
inc eax
add ecx, 0x10
cmp eax, 0x100
jne 0x458bd0
mov ecx, esi
lea edx, [ebp - 0x1810]
push 1
push 0x10
call fcn.00458cc0
add esp, 8
mov ebx, 4
xor eax, eax
jmp 0x458b1b
push 2
push dword [ebp - 0x2014]
call fcn.004366b0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462e56
add esp, 0x2010
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4e2480
call fcn.00462687
add esp, 4
cmp dword [0x4e2480], 0xffffffff
jne 0x458b72
push 4
call fcn.004625e7
add esp, 4
mov ebx, eax
mov ecx, eax
call fcn.00446130
mov dword [0x4e247c], ebx
push 0x4e2480
call fcn.004626fd
add esp, 4
jmp 0x458b72
call fcn.004a66f0
jmp 0x458c0c
mov ecx, ebx
call fcn.00446140
jmp 0x458b87

Function at 0x459e80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x459eb8
mov edx, dword [ebp + 0xc]
xor esi, esi
nop word cs:[eax + eax]
movzx edi, al
movzx ebx, byte [edx + esi]
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x4c76e0]
inc esi
cmp ecx, esi
jne 0x459ea0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x462c83
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x462cc2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x462cc2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x462cc2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x462cc2
cmp dword [ecx + 0x74], 0xe
jbe 0x462cc2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x46f3b2
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0046f549
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x46f521
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x46f521
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x46f4d6
jg 0x46f40e
test eax, eax
je 0x46f4cc
push 1
push 0x1000
call fcn.0043c2f0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x46f431
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x46f4c3
push 0x8000
push ebx
call fcn.004739a9
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x46f45a
jg 0x46f455
cmp ecx, 0x1000
jb 0x46f45a
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004763a3
add esp, 0x10
cmp eax, 0xffffffff
je 0x46f49f
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x46f455
jl 0x46f486
test ecx, ecx
jne 0x46f447
push dword [ebp - 0xc]
push ebx
call fcn.004739a9
push esi
call fcn.0043c250
add esp, 0xc
xor ebx, ebx
jmp 0x46f52f
cmp byte [edi + 0x24], 0
je 0x46f4b6
cmp dword [edi + 0x20], 5
jne 0x46f4b6
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x46f4c1
mov ebx, dword [edi + 0x18]
jmp 0x46f4c3
xor ebx, ebx
push esi
call fcn.0043c250
pop ecx
jmp 0x46f52f
test ecx, ecx
jg 0x46f498
jl 0x46f4d6
test eax, eax
jae 0x46f498
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0047fafd
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x46f4f6
cmp byte [edi + 0x1c], 0
je 0x46f498
jmp 0x46f527
push ebx
call fcn.0047217a
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x46f498
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x46f52f
cmp byte [edi + 0x1c], 0
je 0x46f52c
mov ebx, dword [edi + 0x18]
jmp 0x46f52f
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0047fafd
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret