joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481ea0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x582270]
cmp eax, 0xffffffff
je 0x481f61
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x481f61
mov eax, dword [0x5930ac]
mov ecx, dword [0x5822ec]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x481f6b
mov edi, dword [0x5930a8]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x481fb3
mov ecx, dword [0x5920a0]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx eax, al
mov ebx, eax
shl ebx, 4
cmp dword [ebx + 0x5920a4], 0
jne 0x481fbf
lea ecx, [ebx + 0x5920a4]
mov dword [ecx], 1
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov edx, dword [0x5930a4]
inc edx
mov dword [0x5930a4], edx
mov dword [ecx + 0xc], edx
mov dword [0x5920a0], eax
mov dword [esi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x481fb0
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00481fe0
jmp 0x481ec5
push 0x5930ac
call fcn.004e6c81
add esp, 4
cmp dword [0x5930ac], 0xffffffff
jne 0x481ee6
push 4
call fcn.004e6c0e
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.004a5160
mov dword [0x5930a8], edi
push 0x5930ac
call fcn.004e6cfb
add esp, 4
jmp 0x481ee6
int3
mov ecx, edi
call fcn.004a5170
jmp 0x481efb
inc edx
cmp edx, 0x100
jne 0x481f04
jmp 0x481f4b

Function at 0x481fe0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov eax, dword [0x57f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x814], 0xffffffff
mov ecx, dword [0x582270]
mov dword [ebp - 0x814], ecx
cmp ecx, 0xffffffff
je 0x48208d
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x4820d6
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0
push ebx
call fcn.004eac00
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push dword [ebp - 0x814]
call fcn.00491400
add esp, 8
push edi
call fcn.004e6c73
add esp, 4
mov esi, eax
push edi
push ebx
push eax
call fcn.004ea680
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x814]
call fcn.00491400
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e71b0
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x814]
push esi
call fcn.004913e0
add esp, 4
test al, al
je 0x4820d9
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xffffffff
je 0x4820dc
xor eax, eax
dec eax
lock cmpxchg dword [0x582270], ecx
je 0x482011
push ecx
call fcn.0054dd70
add esp, 4
mov ecx, dword [0x582270]
mov dword [ebp - 0x814], ecx
jmp 0x482011
int3
int3
push esi
call fcn.004913e0
add esp, 4
test al, al
je 0x482104
cmp dword [ebp - 0x814], 0xffffffff
je 0x482104
push 0xffffffffffffffff
call fcn.0054dd70
add esp, 4
mov ecx, dword [ebp - 0x814]
jmp 0x4820ab
int3
Function at 0x482110
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edi, ecx
mov eax, dword [0x57f040]
xor eax, ebp
mov dword [esp + 0x1c], eax
push dword [0x582270]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and ecx, 3
cmp ecx, 2
je 0x482155
xor esi, esi
and eax, 0xfffffffc
je 0x482198
mov ecx, dword [edi]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [edi + 4]
jne 0x482198
mov esi, dword [eax + ecx*8]
jmp 0x482198
mov dword [esp + 0x14], 0x14
mov dword [esp + 0x10], 0x1dd76000
mov esi, esp
push 0x1f6
push str....._base_threading_thread_local_storage.cc
push 0x572429
push esi
call fcn.004b6790
add esp, 4
movsd xmm0, qword [esp + 0x1c]
movsd qword [esp + 4], xmm0
mov dword [esp], esi
call fcn.00538e20
add esp, 0xc
xor esi, esi
mov ecx, dword [esp + 0x1c]
xor ecx, ebp
call fcn.004e71b0
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret

Function at 0x482a70
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp byte [edx + 0xb], 0
jns 0x482a89
mov edx, dword [edx]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x482aa1
cmp byte [esi + 0x28], 0
jne 0x482b12
or ebx, 0x20000000
test bl, 8
jne 0x482b1a
mov dword [ebp - 0x10], 0
cmp byte [esi + 0x30], 0
mov eax, 0
je 0x482abb
mov eax, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x482ac9
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x18], eax
cmp byte [esi + 0x1c], 0
jne 0x482b6c
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 0
jne 0x482b82
test ecx, ecx
jne 0x482b3f
xor ecx, ecx
inc ecx
push dword [ebp - 0x18]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x482b36
test esi, esi
sete al
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
or ebx, 0x80000000
jmp 0x482aa1
cmp byte [esi + 0x34], 0
je 0x482b2b
or ebx, 0x40000000
jmp 0x482aa6
or ebx, 0x10000000
jmp 0x482aa6
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x482b03
cmp ecx, 4
jne 0x482b4b
mov ecx, 6
jmp 0x482aec
mov esi, ecx
add ecx, 0xfffffffe
cmp ecx, 2
jae 0x482b5c
mov ecx, 7
jmp 0x482aec
cmp esi, 1
jne 0x482b68
mov ecx, 4
jmp 0x482aec
xor ecx, ecx
jmp 0x482aec
lea ecx, [esi + 0x10]
mov dword [ebp - 0x14], edx
call fcn.0045c540
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x482ad6
mov ecx, esi
mov esi, edx
call fcn.0045c540
mov ecx, dword [ebp + 0xc]
mov edx, esi
jmp 0x482ae5
Function at 0x482ba0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x482bca
cmp byte [esi + 0x28], 0
jne 0x482c50
or ebx, 0x20000000
test bl, 8
jne 0x482c5b
xor eax, eax
cmp byte [esi + 0x30], 0
mov ecx, 0
je 0x482be3
mov ecx, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x482bf1
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0x1c], 0
jne 0x482c77
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 0
jne 0x482c8d
mov ecx, dword [ebp + 8]
cmp edx, 4
jne 0x482c3f
mov edx, 6
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x482c84
test esi, esi
sete al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov esi, edx
add edx, 0xfffffffe
cmp edx, 2
jae 0x482c9d
mov edx, 7
jmp 0x482c19
or ebx, 0x80000000
jmp 0x482bca
cmp byte [esi + 0x34], 0
je 0x482c6c
or ebx, 0x40000000
jmp 0x482bd3
or ebx, 0x10000000
jmp 0x482bd3
lea ecx, [esi + 0x10]
call fcn.0045c540
jmp 0x482bfa
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x482c30
mov ecx, esi
mov esi, edx
call fcn.0045c540
mov edx, esi
jmp 0x482c0c
test esi, esi
jne 0x482ca9
xor edx, edx
inc edx
jmp 0x482c19
mov edx, esi
cmp esi, 1
jne 0x482cba
mov edx, 4
jmp 0x482c19
xor edx, edx
jmp 0x482c19
Function at 0x483180
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x57f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x5930e8]
mov ecx, dword [0x5822ec]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x483306
mov esi, dword [0x5930d8]
lea edi, [esi + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x48333c
mov ebx, esi
mov esi, dword [esi + 0x18]
test esi, esi
je 0x4832bd
imul eax, dword [ebp + 8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0x6f47a654
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
add ebx, 0x14
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x20], eax
cmp eax, 1
jbe 0x4832fc
mov edx, ecx
cmp ecx, esi
jb 0x483257
mov eax, ecx
xor edx, edx
div esi
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4832bd
mov ebx, dword [eax]
test ebx, ebx
je 0x4832bd
lea eax, [esi - 1]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 4]
cmp eax, ecx
jne 0x4832d6
mov eax, dword [ebp + 8]
cmp dword [ebx + 8], eax
jne 0x4832f0
mov dword [ebp - 0x20], edi
lea edi, [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
push ebx
push edi
call fcn.004839c0
mov esi, dword [edi]
mov dword [edi], 0
test esi, esi
je 0x4832ba
cmp byte [ebp - 0x14], 0
je 0x4832b1
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4832b1
lock dec dword [eax + 4]
je 0x483348
push esi
call fcn.004e6c3e
add esp, 4
mov edi, dword [ebp - 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e71b0
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [ebp - 0x20], 1
mov dword [ebp - 0x24], edx
jbe 0x483356
cmp eax, esi
jb 0x4832e9
xor edx, edx
div esi
mov eax, edx
mov edx, dword [ebp - 0x24]
cmp eax, edx
jne 0x4832bd
mov ebx, dword [ebx]
test ebx, ebx
jne 0x48326f
jmp 0x4832bd
lea edx, [esi - 1]
and edx, ecx
jmp 0x483257
push 0x5930e8
call fcn.004e6c81
add esp, 4
cmp dword [0x5930e8], 0xffffffff
jne 0x4831b4
mov ecx, 0x5930b0
call fcn.00483360
push 0x5930e8
call fcn.004e6cfb
add esp, 4
jmp 0x4831b4
mov ecx, edi
call fcn.004a5170
jmp 0x4831cc
push eax
call fcn.004aaef0
add esp, 4
jmp 0x4832b1
and eax, dword [ebp - 0x28]
jmp 0x4832e9
Function at 0x48fd40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x48fd57
test eax, eax
je 0x48fd57
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
jne 0x48fd65
mov ecx, dword [0x593138]
test ecx, ecx
jne 0x48fda1
cmp dword [0x593130], 0
je 0x48fd51
mov esi, dword [0x593134]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x48fdab
test esi, esi
je 0x48fd51
mov ecx, dword [0x593130]
call dword [0x5798d8]
push esi
call ecx
add esp, 4
jmp 0x48fd51
call dword [0x5798d8]
call ecx
jmp 0x48fd65
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x48fd89
Function at 0x4925c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x5945c4]
mov ecx, dword [0x5822ec]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x49262a
mov ecx, 0x5945bc
call fcn.00482110
test eax, eax
jne 0x49261d
push 4
call fcn.004e6c0e
add esp, 4
mov edi, eax
mov dword [eax], 0
mov ecx, 0x5945bc
call fcn.00482110
mov esi, eax
mov ecx, 0x5945bc
push edi
call fcn.004821b0
test esi, esi
jne 0x49266d
mov ecx, 0x5945bc
pop esi
pop edi
pop ebp
jmp fcn.00482110
push 0x5945c4
call fcn.004e6c81
add esp, 4
cmp dword [0x5945c4], 0xffffffff
jne 0x4925e2
xor eax, eax
mov dword [0x5945c0], eax
mov dword [0x5945bc], eax
mov ecx, 0x5945bc
push 0x416aa0
call fcn.004821f0
push 0x5945c4
call fcn.004e6cfb
add esp, 4
jmp 0x4925e2
push esi
call fcn.004e6c3e
add esp, 4
jmp 0x49261d
Function at 0x49fd70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x49fda5
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x49fdac
lea eax, [ebx + 1]
cmp eax, 2
jb 0x49fd9e
mov dword [esi], ebx
call fcn.004b67c0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004b67c0
push dword [esi]
call fcn.004a4410
add esp, 4
mov dword [esi], 0
jmp 0x49fd8f

Function at 0x4a4150
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x57f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x585ebc]
mov ecx, dword [0x5822ec]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4a419d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e71b0
mov eax, 0x585eb8
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x585ebc
call fcn.004e6c81
add esp, 4
cmp dword [0x585ebc], 0xffffffff
jne 0x4a4183
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.004eac00
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.004e6c0e
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x585eec]
mov ecx, dword [0x5822ec]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4a4246
mov ecx, esi
push ebx
push 0x585ec8
push edi
call fcn.004556b0
mov dword [0x585eb8], esi
push 0x585ebc
call fcn.004e6cfb
add esp, 4
jmp 0x4a4183
push 0x585eec
call fcn.004e6c81
add esp, 4
cmp dword [0x585eec], 0xffffffff
jne 0x4a4220
xorps xmm0, xmm0
movups xmmword [0x585ed8], xmm0
movups xmmword [0x585ec8], xmm0
mov dword [0x585ee8], 0
push 0x585ec8
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x585eec
call fcn.004e6cfb
add esp, 4
jmp 0x4a4220
Function at 0x4a42a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x57f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x585ebc]
mov ecx, dword [0x5822ec]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4a42f0
mov esi, dword [0x585eb8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e71b0
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x585ebc
call fcn.004e6c81
add esp, 4
cmp dword [0x585ebc], 0xffffffff
jne 0x4a42d3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.004eac00
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.004e6c0e
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x585eec]
mov ecx, dword [0x5822ec]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4a4399
mov ecx, esi
push ebx
push 0x585ec8
push edi
call fcn.004556b0
mov dword [0x585eb8], esi
push 0x585ebc
call fcn.004e6cfb
add esp, 4
jmp 0x4a42d3
push 0x585eec
call fcn.004e6c81
add esp, 4
cmp dword [0x585eec], 0xffffffff
jne 0x4a4373
xorps xmm0, xmm0
movups xmmword [0x585ed8], xmm0
movups xmmword [0x585ec8], xmm0
mov dword [0x585ee8], 0
push 0x585ec8
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x585eec
call fcn.004e6cfb
add esp, 4
jmp 0x4a4373

Function at 0x4a4e50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x4a4ece
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4a4eb7
lea eax, [edi + 1]
cmp eax, 2
jb 0x4a4e9b
mov dword [esi], edi
call fcn.004b67c0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 0
inc eax
cmp eax, 1
jbe 0x4a4ed2
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.004b67c0
push dword [esi]
call fcn.004a4410
add esp, 4
mov dword [esi], 0
jmp 0x4a4e8c
mov byte [esi + 4], 0
int3
Function at 0x4a5590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
movzx eax, byte [0x585f8c]
test al, 1
je 0x4a55fc
call fcn.004bc580
pop esi
pop edi
pop ebp
jmp fcn.004bc5a0
push 0x585f94
call fcn.004e6c81
add esp, 4
cmp dword [0x585f94], 0xffffffff
jne 0x4a5619
push str.bcryptprimitives.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4a5634
push str.ProcessPrng
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a5637
mov dword [0x585f90], eax
push 0x585f94
call fcn.004e6cfb
add esp, 4
jmp 0x4a5619
mov eax, dword [0x585f94]
mov ecx, dword [0x5822ec]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4a55b3
mov ecx, dword [0x585f90]
call dword [0x5798d8]
push edi
push esi
call ecx
test eax, eax
je 0x4a5631
pop esi
pop edi
pop ebp
ret
int3
int3
int3
Function at 0x4b7050
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c8760
Function at 0x4c7db0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
test ecx, ecx
js 0x4c7ded
mov eax, dword [ebp + 8]
je 0x4c7de8
mov edx, dword [ebp + 0xc]
xor esi, esi
nop word [eax + eax]
movzx edi, byte [edx + esi]
movzx ebx, al
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x571560]
inc esi
cmp ecx, esi
jne 0x4c7dd0
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x4cf500
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x57f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x4814c0
lea eax, [ebp - 0x14]
push 0
push eax
push 0x481360
push 0x59205c
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x4cf57a
xor esi, esi
cmp dword [0x592060], 0
jne 0x4cf566
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x592064]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x4cf566
mov eax, dword [ebp + 8]
mov esi, dword [edi + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e71b0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004fb0c0
int3
Function at 0x4d02e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2010
call fcn.004e7f70
mov eax, dword [0x57f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x582270]
cmp eax, 0xffffffff
jne 0x4d032b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e71b0
add esp, 0x2010
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
push dword [ebp - 0x2018]
call fcn.00491400
add esp, 8
jmp 0x4d0304
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x4d0304
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.004ea680
add esp, 0xc
mov ecx, dword [0x582270]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x2018], ecx
push ecx
call fcn.00491400
add esp, 8
test ebx, ebx
je 0x4d037a
push ebx
call fcn.004e6c7c
add esp, 4
mov esi, 0x101
lea edi, [ebp - 0x2010]
mov eax, dword [0x5930ac]
mov ecx, dword [0x5822ec]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4d04be
mov ebx, dword [0x5930a8]
push ebx
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4d051a
push 0x1000
push 0x5920a4
lea eax, [ebp - 0x1810]
push eax
call fcn.004ea680
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push 0x800
push 0xff
push edi
call fcn.004eac00
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x1804]
mov edx, dword [ecx]
mov dword [ebp + eax*8 - 0x2010], edx
mov word [ebp + eax*8 - 0x200c], ax
inc eax
add ecx, 0x10
cmp eax, 0x100
jne 0x4d03f6
mov ecx, edi
lea edx, [ebp - 0x1810]
push 1
push 0x10
call fcn.004d0530
add esp, 8
mov ebx, 4
xor eax, eax
movzx edx, word [ebp + ebx - 0x2010]
mov edi, dword [ebp + edx*8 - 0x810]
test edi, edi
jne 0x4d0465
add ebx, 8
cmp ebx, 0x804
jne 0x4d042d
dec esi
je 0x4d0503
test al, 1
lea edi, [ebp - 0x2010]
jne 0x4d0385
jmp 0x4d0319
mov dword [ebp - 0x2014], eax
mov eax, esi
mov ecx, edx
shl ecx, 4
cmp dword [ebp + ecx - 0x1810], 0
je 0x4d050d
add ecx, ebp
add ecx, 0xffffe7f0
mov esi, dword [ebp + edx*8 - 0x80c]
cmp esi, dword [ecx + 8]
jne 0x4d050d
mov ecx, dword [ecx + 4]
test ecx, ecx
mov esi, eax
mov eax, dword [ebp - 0x2014]
je 0x4d0440
mov dword [ebp + edx*8 - 0x810], 0
call dword [0x5798d8]
push edi
call ecx
add esp, 4
mov al, 1
jmp 0x4d0440
push 0x5930ac
call fcn.004e6c81
add esp, 4
cmp dword [0x5930ac], 0xffffffff
jne 0x4d03a6
push 4
call fcn.004e6c0e
add esp, 4
mov ebx, eax
mov ecx, eax
call fcn.004a5160
mov dword [0x5930a8], ebx
push 0x5930ac
call fcn.004e6cfb
add esp, 4
jmp 0x4d03a6
call fcn.00539ab0
jmp 0x4d0319
mov esi, eax
mov eax, dword [ebp - 0x2014]
jmp 0x4d0440
mov ecx, ebx
call fcn.004a5170
jmp 0x4d03bb
Function at 0x4e4ae0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, ecx
mov eax, dword [0x57f040]
xor eax, ebp
mov dword [esp + 0x10], eax
mov byte [ecx], 0
mov eax, dword [0x5822ec]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
lea ecx, [eax + 0xf8]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 0xf8]
mov dword [eax + 0xf8], esi
mov edi, dword [ebp + 8]
mov dword [esi + 8], ecx
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], edi
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi + 0x30], 0
xorps xmm0, xmm0
movups xmmword [esi + 0x10], xmm0
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x38], eax
mov eax, dword [0x56d274]
movzx eax, byte [eax + 0x7f]
test al, al
setne byte [esi + 0x20]
jne 0x4e4b76
mov ecx, dword [esp + 0x10]
xor ecx, ebp
call fcn.004e71b0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [esi + 0x10]
mov dword [esp + 4], eax
mov eax, dword [edi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [0x5798d8]
lea eax, [esp + 8]
mov ecx, edi
push eax
mov edi, eax
call ebx
movsd xmm0, qword [edi]
mov eax, dword [esp + 4]
movsd qword [eax], xmm0
jmp 0x4e4b5f

Function at 0x4e7638
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4e7677
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4e7677
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4e7677
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4e7677
cmp dword [ecx + 0x74], 0xe
jbe 0x4e7677
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret