joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ff30
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x462088]
test eax, eax
je 0x44000a
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x43ff60
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x440005
mov eax, dword [0x462088]
test eax, eax
je 0x440028
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x440041
mov esi, eax
test eax, eax
jne 0x43ffc7
movzx eax, byte [0x476104]
mov ecx, 0x20
call fcn.0043d720
test eax, eax
je 0x44005a
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x462088
mov esi, eax
mov eax, dword [0x462088]
test eax, eax
je 0x44004b
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x43ffe6
movaps xmm0, xmmword [esp]
jmp 0x43fff4
lea ecx, [esp + 0x10]
call fcn.0043d5e0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x440043
mov ecx, 0x462088
call fcn.004193f0
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jae 0x43ff53
jmp 0x43ff60
mov ecx, 0x462088
call fcn.004193f0
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jne 0x43ff7d
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x462088
call fcn.004193f0
jmp 0x43ffc0
mov ecx, 8
mov edx, 0x20
call fcn.004068b0
nop dword [eax]
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x18]
mov eax, dword [esi]
test eax, eax
je 0x440087
dec eax
jmp 0x44008e
mov ecx, esi
call fcn.004193f0
push 1
push eax
call sub.kernel32.dll_TlsSetValue
push edi
push 0
push dword [0x4760c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [esi]
test eax, eax
je 0x4400ad
dec eax
jmp 0x4400b4
mov ecx, esi
call fcn.004193f0
push 0
push eax
call sub.kernel32.dll_TlsSetValue
add esp, 0x2c
pop esi
pop edi
pop ebp
ret
Function at 0x440070
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x462088]
test eax, eax
je 0x44000a
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x43ff60
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x440005
mov eax, dword [0x462088]
test eax, eax
je 0x440028
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x440041
mov esi, eax
test eax, eax
jne 0x43ffc7
movzx eax, byte [0x476104]
mov ecx, 0x20
call fcn.0043d720
test eax, eax
je 0x44005a
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x462088
mov esi, eax
mov eax, dword [0x462088]
test eax, eax
je 0x44004b
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x43ffe6
movaps xmm0, xmmword [esp]
jmp 0x43fff4
lea ecx, [esp + 0x10]
call fcn.0043d5e0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x440043
mov ecx, 0x462088
call fcn.004193f0
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jae 0x43ff53
jmp 0x43ff60
mov ecx, 0x462088
call fcn.004193f0
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jne 0x43ff7d
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x462088
call fcn.004193f0
jmp 0x43ffc0
mov ecx, 8
mov edx, 0x20
call fcn.004068b0
nop dword [eax]
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x18]
mov eax, dword [esi]
test eax, eax
je 0x440087
dec eax
jmp 0x44008e
mov ecx, esi
call fcn.004193f0
push 1
push eax
call sub.kernel32.dll_TlsSetValue
push edi
push 0
push dword [0x4760c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [esi]
test eax, eax
je 0x4400ad
dec eax
jmp 0x4400b4
mov ecx, esi
call fcn.004193f0
push 0
push eax
call sub.kernel32.dll_TlsSetValue
add esp, 0x2c
pop esi
pop edi
pop ebp
ret
Function at 0x442690
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x46209c]
test eax, eax
je 0x4426bc
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x4426d1
mov ebx, eax
mov eax, dword [eax]
or eax, dword [ebx + 4]
je 0x4426d1
add ebx, 8
jmp 0x4427a3
mov ecx, 0x46209c
call fcn.004193f0
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jae 0x4426ab
mov eax, dword [0x46209c]
test eax, eax
je 0x442788
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x4427a1
mov esi, eax
test eax, eax
jne 0x442734
movzx eax, byte [0x476104]
mov ecx, 0x50
call fcn.0043d720
test eax, eax
je 0x4427b9
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x48], 0x46209c
mov esi, eax
mov eax, dword [0x46209c]
test eax, eax
je 0x4427aa
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
mov ecx, dword [esi]
lea ebx, [esi + 8]
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
mov dword [esi], 1
mov edi, ebx
or ecx, dword [esi + 4]
mov dword [esi + 4], 0
mov ecx, 0x10
mov esi, 0x468d80
rep movsd dword es:[edi], dword [esi]
je 0x4427a3
cmp edx, 2
je 0x4427a3
lock dec dword [eax]
sete cl
test edx, edx
je 0x44277b
test cl, cl
je 0x4427a3
mov ecx, eax
call fcn.004402e0
jmp 0x4427a3
test cl, cl
je 0x4427a3
mov ecx, eax
call fcn.004402b0
jmp 0x4427a3
mov ecx, 0x46209c
call fcn.004193f0
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jne 0x4426ee
xor ebx, ebx
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x46209c
call fcn.004193f0
jmp 0x44272d
mov ecx, 8
mov edx, 0x50
call fcn.004068b0
nop dword [eax + eax]
Function at 0x4454a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x4620ac]
test eax, eax
je 0x4454c9
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x4454de
cmp dword [eax + 4], 0
mov esi, eax
je 0x4454de
add esi, 4
mov eax, esi
pop esi
pop ebp
ret
mov ecx, 0x4620ac
call fcn.004193f0
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jae 0x4454b9
mov eax, dword [0x4620ac]
test eax, eax
je 0x445590
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x4455a9
mov esi, eax
test eax, eax
jne 0x44553a
movzx eax, byte [0x476104]
mov ecx, 8
call fcn.0043d720
test eax, eax
je 0x4455ce
mov dword [eax], 0x4620ac
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4620ac]
test eax, eax
je 0x4455b0
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
movzx eax, byte [0x476104]
mov ecx, 0x14
call fcn.0043d720
test eax, eax
je 0x4455bf
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
add esi, 4
mov byte [eax + 0x10], 0
mov ecx, dword [esi]
mov dword [esi], eax
test ecx, ecx
je 0x4454c4
lock dec dword [ecx]
jne 0x4454c4
call fcn.0041b0e0
mov eax, esi
pop esi
pop ebp
ret
mov ecx, 0x4620ac
call fcn.004193f0
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jne 0x4454fb
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret
mov ecx, 0x4620ac
call fcn.004193f0
jmp 0x445533
mov ecx, 4
mov edx, 0x14
call fcn.004068b0
mov ecx, 4
mov edx, 8
call fcn.004068b0
nop dword [eax]
Function at 0x449b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, ecx
mov dword [ebp - 0x10], edx
sub esi, eax
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jne 0x449c99
mov esi, dword [edi]
lea ebx, [eax + 0x80]
mov edx, eax
mov ecx, ebx
lock cmpxchg8b qword [esi + 8]
jne 0x449c1b
mov eax, dword [edi]
mov edx, dword [ebp + 8]
mov ebx, 1
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x18], edx
movzx edx, dl
mov eax, dword [ebp - 0x10]
mov esi, dword [ecx + edx*4]
xor edx, edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ecx
mov edi, esi
nop
mov ecx, dword [ebp - 0x18]
mov eax, edi
mov edi, dword [ebp - 0x1c]
add ecx, ebx
add ebx, 1
movzx ecx, cl
adc edx, 0
mov edi, dword [edi + ecx*4]
mov ecx, ebx
xor ecx, 0x80
or ecx, edx
mov dword [eax + 4], edi
jne 0x449b80
mov ebx, dword [ebp - 0x14]
mov cl, 1
xor eax, eax
mov dword [edi + 4], ebx
mov edi, dword [ebp + 0x10]
lock cmpxchg byte [edi + 0xd4], cl
jne 0x449c24
cmp byte [edi + 0xec], 0
je 0x449c38
xor ecx, ecx
mov al, 1
lock cmpxchg byte [edi + 0xd4], cl
je 0x449bf6
add edi, 0xd4
mov ecx, edi
call fcn.0040ff10
jmp 0x449bf6
test edi, edi
mov esi, edi
je 0x449c20
mov eax, 0xffffffc0
mov edi, dword [esi + 4]
lock xadd dword [esi], eax
cmp eax, 0x3f
jbe 0x449c85
and eax, 0xffffffc0
cmp eax, 0x40
jne 0x449bf0
mov eax, dword [esi + 8]
push esi
call dword [eax + 8]
add esp, 4
jmp 0x449bf0
mov ebx, dword [ebp - 0x10]
jmp 0x449c6c
xor ebx, ebx
jmp 0x449c6c
lea ecx, [edi + 0xd4]
call fcn.004101e0
cmp byte [edi + 0xec], 0
jne 0x449bc5
mov ecx, dword [edi + 0xe8]
lea eax, [edi + 0xe4]
test ecx, ecx
lea ecx, [ecx + 4]
cmove ecx, eax
mov al, 1
mov dword [ecx], esi
mov dword [edi + 0xe8], ebx
xor ebx, ebx
add dword [edi + 0xd0], 0x81
lock cmpxchg byte [edi + 0xd4], bl
jne 0x449c76
mov eax, ebx
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
add edi, 0xd4
mov ecx, edi
call fcn.0040ff10
jmp 0x449c6c
mov ecx, str.assertion_failed:_prev.ref_count_____1
mov edx, 0x27
push 0x469f48
call fcn.00407d90
lea eax, [ebp + 0xc]
mov dword [ebp - 0x48], 0x4692c8
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x30], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], 0x407260
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x24], 0x407260
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x48]
mov edx, 0x469204
lea ecx, [ebp - 0x20]
push 0x4692d8
push eax
call fcn.004451c0
add esp, 8
ud2
Function at 0x4527c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
xor ecx, 3
lock cmpxchg dword [esi], ecx
jne 0x4527d0
test al, 1
je 0x452875
test al, 2
jne 0x452889
test al, 8
jne 0x45280d
lea ecx, [esi + 0x18]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 4
lea edx, [esp + 0x10]
call fcn.004526e0
jmp 0x452827
test al, 0x10
je 0x452827
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4528f7
mov eax, dword [eax + 8]
push dword [esi + 0x44]
call eax
add esp, 4
mov dword [esp + 8], 1
mov eax, 0xffffffc0
lock xadd dword [esi], eax
shr eax, 6
cmp eax, dword [esp + 8]
jb 0x45289d
jne 0x45286d
lea ecx, [esi + 0x20]
call fcn.004500c0
mov eax, dword [esi + 0x40]
test eax, eax
je 0x45285d
mov eax, dword [eax + 0xc]
push dword [esi + 0x44]
call eax
add esp, 4
push dword [esi - 4]
push 0
push dword [0x4760c0]
call sub.kernel32.dll_HeapFree
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x469db0
mov edx, 0x23
push 0x469dd4
call fcn.00407d90
mov ecx, 0x469de4
mov edx, 0x25
push 0x469e0c
call fcn.00407d90
lea esi, [esp + 0xc]
lea edi, [esp + 8]
mov dword [esp + 0x3c], 0x469e2c
mov dword [esp + 0x40], 2
mov dword [esp + 0xc], eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x2c], esi
lea esi, [esp + 0x2c]
mov dword [esp + 0x30], 0x407260
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 0x407260
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], 2
lea ecx, [esp + 0x3c]
mov edx, 0x469e3c
call fcn.00407170
mov dword [esp + 0x10], str.waker_missing
mov dword [esp + 0x14], 1
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], str.Index_out_of_bounds
mov dword [esp + 0x1c], 0
lea ecx, [esp + 0x10]
mov edx, 0x469be0
call fcn.00407170
ud2
Function at 0x457670
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov dword [0x4620dc], eax
cmp eax, 0xffffffff
je 0x45e20c
add esp, 0xc
ret

Function at 0x457c50
Capabilities:
Print debug messages

Disassembly:
test eax, eax
je 0x457c80
push edi
push esi
push ebx
mov ebx, eax
add esp, 0xffffff80
mov dword [esp], eax
call fcn.0045ad40
cmp eax, 1
je 0x457c81
mov dword [ebx], 0xffffffff
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
ret
ret
lea ebx, [esp + 0x15]
xor eax, eax
mov esi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x3d]
mov ecx, 0x43
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
mov eax, 0x27
jne 0x457cd5
jmp 0x457ce3
cmp eax, 0x6a
je 0x457ced
add eax, 1
cmp byte [ebx + eax], 0
jne 0x457cd0
cmp eax, 0x6a
je 0x457ced
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + eax + 0x16], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x457d00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [0x476168], 1
je 0x457d15
call fcn.00457bc0
mov eax, dword [0x4620dc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x457d40
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00457b00
mov esi, eax
mov eax, dword [entry4]
test eax, eax
je 0x457d2c
test esi, esi
je 0x457d2c
mov dword [esi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x18], eax
sub esp, 0x10
lea eax, [esi + 0x38]
call fcn.00457c50
mov ebp, dword [sym.imp.kernel32.dll_GetCurrentProcess]
mov dword [esi + 0x64], 0
mov dword [esi + 0x14], 0
call ebp
mov edi, eax
call dword [sym.imp.kernel32.dll_GetCurrentThread]
mov ebx, eax
call ebp
lea edx, [esi + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x45e211
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], eax
movzx eax, byte [esi + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [esi + 0x20], al
mov eax, dword [0x4620dc]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x45e211
add esp, 0x2c
mov ebx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll_abort
mov eax, dword [pe_dos_header]
ud2
Function at 0x457f90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x457fc0
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x458070
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x4580a0
cmp eax, 3
jne 0x457faa
mov eax, dword [0x4620dc]
cmp eax, 0xffffffff
je 0x457faa
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x457faa
test byte [eax + 0x20], 0x30
je 0x4580d0
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x458003
call fcn.00457e90
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x458035
mov dword [esp], eax
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x458027
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.004573f0
lea eax, [ebx + 0x38]
call fcn.00457c50
mov eax, ebx
call fcn.00457880
mov eax, dword [0x4620dc]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
jmp 0x457faa
mov eax, dword [0x476144]
test eax, eax
je 0x457faa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x476144], 0
sub esp, 4
jmp 0x457faa
mov dword [esp + 4], 0x4575a0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x476144], eax
mov eax, 1
add esp, 0x10
pop ebx
pop esi
pop edi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x458148
test eax, eax
je 0x4580ea
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x458107
call fcn.00457e90
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
test byte [ebx + 0x24], 4
je 0x458180
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x45812c
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call fcn.004573f0
mov eax, esi
jmp 0x458043
test eax, eax
je 0x458158
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.004573f0
lea eax, [ebx + 0x38]
call fcn.00457c50
jmp 0x457faa
mov dword [esp], edi
call fcn.004573f0
mov eax, esi
call fcn.00457c50
jmp 0x457faa
Function at 0x458ae0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.00457d00
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x458b02
call fcn.00457e90
test byte [ebx + 0x20], 0x30
jne 0x458b1c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x4620dc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x458b5f
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x458ba3
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x458b52
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push ecx
mov dword [ebx + 0x18], 0
test byte [ebx + 0x24], 4
jne 0x458b68
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push edx
mov dword [ebx + 0x14], 0
mov eax, ebx
call fcn.00457880
mov eax, dword [0x4620dc]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push eax
push eax
jmp 0x458b5f
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x458bb7
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push esi
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jmp 0x458b82

Function at 0x45d380
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0045c4b0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0045c4b0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x45d3e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x4764fc]
test esi, esi
jle 0x45d4e0
mov eax, dword [0x476500]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x45d410
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x45d48f
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x45d400
mov dword [esp], ebx
call fcn.0045dd50
mov edi, eax
test eax, eax
je 0x45d507
mov eax, dword [0x476500]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0045de60
mov edx, dword [0x476500]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x45d4e7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x45d488
sub eax, 4
and eax, 0xfffffffb
jne 0x45d496
add dword [0x4764fc], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x476500]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x45d488
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0045d380
xor esi, esi
jmp 0x45d41a
mov eax, dword [0x476500]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0045d380
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0045d380
lea esi, [esi]
nop

Function at 0x45d9c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x476518
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x476510]
sub esp, 4
test ebx, ebx
je 0x45da15
mov ebp, dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x45da0e
test esi, esi
je 0x45da0e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x45d9f0
mov dword [esp], 0x476518
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x29a022df
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x29a022ee
pop dword [ebp - 0x44]
mov eax, 0x29a022ee
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xdf52c786
sub dword [ebp - 0x54], 0x9100823b
mov dword [ebp - 0x50], 0xec5708d
sub dword [ebp - 0x50], 0xdc922448
mov dword [ebp - 0x4c], 0xbcbeebc2
sub dword [ebp - 0x4c], 0x7072a794
mov dword [ebp - 0x48], 0x2eab4e5c
add dword [ebp - 0x48], 0xd154b1a4
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x8e7ce0db
sub dword [ebp - 0x54], 0x1a0a7785
mov dword [ebp - 0x50], 0x50a0f0db
add dword [ebp - 0x50], 0xf0cb709a
mov dword [ebp - 0x4c], 0x7cd86dfc
sub dword [ebp - 0x4c], 0x19690190
mov dword [ebp - 0x48], 0xb34240a7
sub dword [ebp - 0x48], 0xb34240a7
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x39be2
push 0
call eax
mov ecx, 0x451c
xor ebx, ebx
add ebx, eax
mov esi, 0x3a99024e
sub esi, 0x10f6e24e
add esi, dword [ebp - 0x44]
mov edi, 0xb4d0d768
add edi, 0x4a0746c1
add dword [ebp - 0xc], edx
mov edx, dword [esi]
xor dword [ebp - 8], edi
sub edx, edi
mov dword [ebp - 0x34], 0x6035dddb
mov dword [ebx], edx
xor dword [ebp - 0x38], 0x5014f2e7
add ebx, 0xfbda6c8f
add ebx, 0x4259375
add esi, 4
loop 0x29a023fd
add eax, 0x7c5086cf
sub eax, 0x7c4f7f8c
mov ebx, eax
add eax, 5
mov ecx, 0x29a00000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret