joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414f70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x4ab09c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x4150ab
cmp byte [edi + 0x3d], 0
je 0x4150ab
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x414fbd
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [esp + 0x14], 0
xorps xmm0, xmm0
mov dword [esp + 0x28], ecx
cmp ecx, 0x10
movq qword [esp + 0x14], xmm0
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 8
cmovae eax, dword [esp + 0x14]
mov byte [eax + 8], 0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov eax, dword [edi + 0x38]
lea ebx, [esp + 0x14]
cmp ecx, 0x10
lea esi, [esp + 0x14]
cmovae ebx, edx
cmovae esi, edx
mov eax, dword [eax]
mov dword [esp + 0x10], eax
cmp eax, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x4150bf
mov dword [esp + 0xc], esi
xor eax, eax
sub eax, 0
je 0x415032
sub eax, 1
je 0x415036
sub eax, 2
je 0x415084
xor bl, bl
jmp 0x415086
mov byte [edi + 0x3d], 0
cmp ecx, 0x10
lea eax, [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x415069
push dword [edi + 0x4c]
cmp ecx, 0x10
lea eax, [esp + 0x18]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0045db92
mov ecx, dword [esp + 0x38]
add esp, 0x10
mov edx, dword [esp + 0x14]
cmp esi, eax
jne 0x41502e
cmp byte [edi + 0x3d], 0
je 0x415084
test esi, esi
jne 0x414ff4
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.00405e40
jmp 0x414fec
mov bl, 1
cmp ecx, 0x10
jb 0x415097
inc ecx
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.00404d90
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x38]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x28]
add eax, ebx
push eax
push esi
lea eax, [edi + 0x40]
push eax
mov eax, dword [esp + 0x20]
call dword [eax + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
jmp 0x41501f

Function at 0x415570
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x41557e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x415590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x41559e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4155b2
shr eax, 4
and eax, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x4155c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x248
mov eax, dword [0x4ab09c]
xor eax, esp
mov dword [esp + 0x244], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x34]
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x4156d7
sub esp, 8
lea eax, [esp + 0x40]
mov edx, esp
mov dword [edx], eax
cmp word [esp + 0x40], 0
jne 0x415612
xor ecx, ecx
jmp 0x41562f
lea ecx, [esp + 0x40]
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415620
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [esp + 0x28]
call fcn.0040c6c0
sub esp, 8
mov edx, esp
cmp dword [eax + 0x14], 8
jb 0x41564a
mov ecx, dword [eax]
jmp 0x41564c
mov ecx, eax
mov dword [edx], ecx
lea ecx, [esp + 0x10]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.0040c6c0
lea ecx, [esp + 8]
call fcn.0040d180
lea eax, [esp + 8]
cmp esi, eax
je 0x41567a
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.004043a0
mov eax, dword [esp + 0x1c]
cmp eax, 8
jb 0x415692
inc eax
lea ecx, [esp + 8]
push eax
push dword [esp + 0xc]
call fcn.004065a0
xor eax, eax
mov dword [esp + 0x1c], 7
mov word [esp + 8], ax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], 0
cmp eax, 8
jb 0x4156c1
inc eax
lea ecx, [esp + 0x20]
push eax
push dword [esp + 0x24]
call fcn.004065a0
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x24c]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret
Function at 0x4156f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x4ab09c]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x1c]
push edi
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x41579f
cmp word [esp + 0x20], 0
je 0x41579f
sub esp, 8
lea eax, [esp + 0x28]
mov edx, esp
mov dword [edx], eax
cmp word [esp + 0x28], 0
jne 0x415763
xor ecx, ecx
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.0040c6c0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x28]
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415770
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.0040c6c0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esp + 0x1c], 7
mov word [esp + 8], ax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x1c], 0
call fcn.004155c0
add esp, 4
mov ecx, esi
test al, al
je 0x4157eb
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
mov dword [esi + 0x10], 0
push eax
mov word [esi], ax
lea eax, [esp + 0x10]
push eax
call fcn.004043a0
jmp 0x415802
sub esp, 8
mov eax, esp
mov dword [eax], 0x4a55ec
mov dword [eax + 4], 3
call fcn.0040c6c0
mov eax, dword [esp + 0x1c]
cmp eax, 8
jb 0x41581a
inc eax
lea ecx, [esp + 8]
push eax
push dword [esp + 0xc]
call fcn.004065a0
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret
Function at 0x415830
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x4ab09c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0
mov esi, edx
cmp dword [edi + 0x14], 8
jb 0x41585d
mov ebx, dword [edi]
jmp 0x41585f
mov ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4158a1
test al, 0x10
je 0x415883
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x41588d
mov dword [esi], 0xfffffff7
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.0040cb80
cmp dword [edi + 0x14], 8
jb 0x4158b7
mov ecx, dword [edi]
jmp 0x4158b9
mov ecx, edi
push dword [edi + 0x10]
cmp dword [esp + 0x2c], 8
lea eax, [esp + 0x18]
push ecx
cmovae eax, dword [esp + 0x1c]
push dword [esp + 0x2c]
push eax
call fcn.00409e40
add esp, 0x10
test eax, eax
jne 0x4158ea
test esi, esi
je 0x415934
mov dword [esi], 0xfffffffc
xor bl, bl
jmp 0x41593a
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.00415830
test al, al
jne 0x4158fd
xor bl, bl
jmp 0x41593a
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x415938
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xb7
jne 0x415927
push edi
call fcn.00415590
add esp, 4
test al, al
jne 0x415938
test esi, esi
je 0x415934
mov ecx, ebx
call fcn.00412290
mov dword [esi], eax
xor bl, bl
jmp 0x41593a
mov bl, 1
mov ecx, dword [esp + 0x28]
cmp ecx, 8
jb 0x415952
inc ecx
push ecx
push dword [esp + 0x18]
lea ecx, [esp + 0x1c]
call fcn.004065a0
mov ecx, dword [esp + 0x2c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret
Function at 0x415970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
mov eax, dword [0x4ab09c]
xor eax, esp
mov dword [esp + 0x258], eax
xor eax, eax
push esi
mov esi, dword [ebp + 8]
mov word [esp + 0x50], ax
lea eax, [esp + 0x50]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x415a5a
cmp eax, 0x104
ja 0x415a5a
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0xc]
call fcn.004029b0
sub esp, 8
lea eax, [esp + 0x10]
cmp dword [esp + 0x24], 8
mov ecx, esp
cmovae eax, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
lea ecx, [esp + 0x40]
call fcn.0040c6c0
sub esp, 8
mov edx, esp
cmp dword [eax + 0x14], 8
jb 0x4159fa
mov ecx, dword [eax]
jmp 0x4159fc
mov ecx, eax
mov dword [edx], ecx
lea ecx, [esp + 0x28]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.0040c6c0
lea ecx, [esp + 0x20]
call fcn.0040d180
lea eax, [esp + 0x20]
cmp esi, eax
je 0x415a2a
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.004043a0
lea ecx, [esp + 0x20]
call fcn.00402940
lea ecx, [esp + 0x38]
call fcn.00402940
lea ecx, [esp + 8]
call fcn.00402940
mov al, 1
pop esi
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x25c]
xor al, al
pop esi
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret

Function at 0x416000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov dword [esp + 4], 0
push edi
test esi, esi
je 0x416097
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x416097
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x416097
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x416097
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push eax
lea eax, [esp + 0xc]
push eax
push str.VarFileInfoTranslation
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x416097
mov edi, dword [esp + 8]
test edi, edi
je 0x416097
push 0x1c
call fcn.004521ed
movzx ecx, word [edi + 2]
add esp, 4
push ecx
movzx ecx, word [edi]
push ecx
push esi
mov ecx, eax
call fcn.00416510
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x416300
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x4ab09c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push edi
mov edi, ecx
mov dword [ebp - 0x228], eax
movzx eax, word [edi + 0x14]
mov word [ebp - 0x18], ax
movzx eax, word [edi + 0x16]
mov word [ebp - 0x16], ax
call esi
mov word [ebp - 0x14], ax
movzx eax, word [edi + 0x16]
mov word [ebp - 0x12], ax
movzx eax, word [edi + 0x14]
mov word [ebp - 0x10], ax
mov eax, 0x4e4
mov word [ebp - 0xe], ax
call esi
mov word [ebp - 0xc], ax
xor esi, esi
mov eax, 0x4e4
mov word [ebp - 0xa], ax
nop word [eax + eax]
movzx eax, word [ebp + esi*2 - 0x16]
movzx ecx, word [ebp + esi*2 - 0x18]
add esi, 2
push ebx
push eax
push ecx
push 0x4a5984
push 0x104
lea eax, [ebp - 0x220]
push 0x104
push eax
call fcn.00415f60
add esp, 0x1c
mov dword [ebp - 0x224], 0
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [edi + 0x10]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4163d4
mov edx, dword [ebp - 0x224]
test edx, edx
jne 0x4163ee
cmp esi, 8
jb 0x416370
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045248d
mov esp, ebp
pop ebp
ret 8
cmp word [edx], 0
jne 0x416418
mov ecx, dword [ebp - 0x228]
xor eax, eax
push eax
push edx
call fcn.004042a0
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045248d
mov esp, ebp
pop ebp
ret 8
mov eax, edx
lea esi, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416420
mov ecx, dword [ebp - 0x228]
sub eax, esi
sar eax, 1
push eax
push edx
call fcn.004042a0
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045248d
mov esp, ebp
pop ebp
ret 8

Function at 0x4165d0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
push dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x416632
cmp dword [0x4ad280], 3
jg 0x416624
push 3
push 0x23
push str.c:_nwjs_src_base_threading_thread_local_win.cc
lea ecx, [esp + 0x14]
call fcn.00401ea0
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.00406a20
add esp, 8
mov ebx, 1
test bl, 1
je 0x416632
lea ecx, [esp + 8]
call fcn.00401f60
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416840
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
mov dword [esp + 8], 0
mov ebx, dword [0x4ae18c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
push esi
mov esi, ecx
push edi
test ebx, ebx
jne 0x41687c
mov dword [esi], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x4aba8c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x416895
call fcn.0041f940
mov edi, eax
mov eax, dword [ebx + 0xc]
mov edi, dword [edi + eax*4]
mov dword [esi], edi
test edi, edi
je 0x4168e0
mov eax, dword [edi + 4]
mov ebx, dword [eax + 0x2c]
cmp ebx, dword [edi + 0xc]
jb 0x4168c0
mov eax, dword [edi + 4]
lea ecx, [ebx + 1]
mov dword [eax + 0x2c], ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
imul ecx, ebx, 0x70
lea eax, [esp + 0x10]
push eax
push 0x20
xor edx, edx
add ecx, dword [edi + 8]
call fcn.004167b0
mov ecx, dword [edi + 4]
add esp, 8
lea eax, [ebx + 1]
mov dword [ecx + 0x2c], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x417250
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x4ab09c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0xffffffffffffffff
lea ecx, [esi + 4]
push 0
mov dword [esi], 0x4a5f60
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edi
mov byte [ecx], 0
call fcn.00404790
mov dword [esi + 0x1c], 0
mov dword [esi], 0x4a5af4
mov dword [esi + 0x20], 0
push 0x30
mov byte [esi + 0x24], 0
call fcn.004521ed
add esp, 4
mov ebx, eax
cmp dword [edi + 0x14], 0x10
jb 0x4172ba
mov ecx, dword [edi]
jmp 0x4172bc
mov ecx, edi
mov eax, dword [edi + 0x10]
lea edx, [ebp - 0x6c]
mov dword [ebp - 0x6c], ecx
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], 0x67452301
mov dword [ebp - 0x60], 0xefcdab89
mov dword [ebp - 0x5c], 0x98badcfe
mov dword [ebp - 0x58], 0x10325476
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x68], eax
call fcn.00423da0
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x74]
call fcn.00423ec0
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x70]
bswap eax
bswap ecx
push eax
push ecx
mov ecx, ebx
call fcn.004223d0
push 0x30
mov dword [esi + 0x28], eax
call fcn.004521ed
mov edx, eax
add esp, 4
mov eax, dword [esi + 0x28]
mov ecx, dword [eax + 0x20]
push dword [ecx + 4]
push dword [ecx]
mov ecx, edx
call fcn.004223d0
mov ecx, dword [ebp - 8]
mov dword [esi + 0x2c], eax
xor ecx, ebp
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0045248d
mov esp, ebp
pop ebp
ret 4
Function at 0x417360
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x4ab09c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
mov dword [ebp - 0x68], eax
push 0xffffffffffffffff
lea ecx, [edi + 4]
push 0
mov dword [edi], 0x4a5f60
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push ebx
mov byte [ecx], 0
call fcn.00404790
mov dword [edi + 0x1c], 0
mov dword [edi], 0x4a5af4
mov dword [edi + 0x20], 0
push 0x38
mov byte [edi + 0x24], 0
call fcn.004521ed
add esp, 4
mov dword [ebp - 0x64], eax
cmp dword [ebx + 0x14], 0x10
push esi
push dword [ebp + 8]
jb 0x4173d8
mov ecx, dword [ebx]
jmp 0x4173da
mov ecx, ebx
mov eax, dword [ebx + 0x10]
lea edx, [ebp - 0x70]
mov dword [ebp - 0x70], ecx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x6c], eax
call fcn.00423da0
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x78]
call fcn.00423ec0
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
bswap eax
bswap ecx
push eax
push ecx
mov ecx, dword [ebp - 0x64]
call fcn.00421790
push 0x38
mov dword [edi + 0x28], eax
call fcn.004521ed
mov esi, eax
add esp, 4
mov eax, dword [edi + 0x28]
push dword [ebp - 0x68]
mov eax, dword [eax + 0x20]
push dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 4]
add edx, 1
adc ecx, 0
push ecx
push edx
mov ecx, esi
call fcn.00421790
mov ecx, dword [ebp - 4]
mov dword [edi + 0x2c], eax
xor ecx, ebp
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.0045248d
mov esp, ebp
pop ebp
ret 0x10

Function at 0x418cd0
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
call fcn.0041f1a0
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [eax]
call esi
test eax, eax
jne 0x418d3f
call fcn.00418e30
mov eax, dword [0x4aba8c]
push eax
call esi
mov ecx, eax
test ecx, ecx
jne 0x418d02
call fcn.0041f940
mov ecx, eax
mov eax, dword [0x4ae1c0]
cmp dword [ecx + eax*4], 0
jne 0x418d3f
push 0x5c
call fcn.004521ed
add esp, 4
mov ecx, eax
push edi
call fcn.00418b20
mov ecx, dword [0x4aba8c]
mov edi, eax
push ecx
call esi
mov ecx, eax
test ecx, ecx
jne 0x418d37
call fcn.0041f940
mov ecx, eax
mov eax, dword [0x4ae1c0]
mov dword [ecx + eax*4], edi
pop edi
pop esi
pop ecx
ret
Function at 0x419e20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x4aba8c]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
mov esi, eax
test esi, esi
jne 0x419e43
call fcn.0041f940
mov esi, eax
mov eax, dword [0x4ae1d8]
mov esi, dword [esi + eax*4]
cmp esi, 0xffffffff
jne 0x419e58
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x419eae
mov eax, dword [0x4aba8c]
push eax
call edi
mov ecx, eax
test ecx, ecx
jne 0x419e71
call fcn.0041f940
mov ecx, eax
mov eax, dword [0x4ae1d8]
push 0x20
mov dword [ecx + eax*4], 0xffffffff
call fcn.004521ed
add esp, 4
mov ecx, eax
call fcn.00419ec0
mov ecx, dword [0x4aba8c]
mov esi, eax
push ecx
call edi
mov ecx, eax
test ecx, ecx
jne 0x419ea6
call fcn.0041f940
mov ecx, eax
mov eax, dword [0x4ae1d8]
mov dword [ecx + eax*4], esi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41f1a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov eax, dword [0x4ae1e8]
mov dword [esp + 4], 0
test eax, 0xfffffffe
jne 0x41f1f9
push 0x4ae1e8
call fcn.00415dd0
add esp, 4
test al, al
je 0x41f1f9
mov dword [0x4ae1ec], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4ae1ec], eax
cmp eax, 0xffffffff
jne 0x41f1ef
mov byte [0], 0
mov dword [0x4ae1e8], 0x4ae1ec
mov eax, dword [0x4ae1e8]
mov esp, ebp
pop ebp
ret

Function at 0x41f210
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
mov eax, edi
test edi, edi
jle 0x41f2d7
test esi, esi
je 0x41f2d7
push ebx
mov ebx, edi
sar edi, 2
and ebx, 3
test edi, edi
jle 0x41f259
movzx ecx, word [esi]
dec edi
movzx edx, word [esi + 2]
add eax, ecx
mov ecx, eax
add esi, 4
shl ecx, 5
xor edx, ecx
shl edx, 0xb
xor eax, edx
mov ecx, eax
shr ecx, 0xb
add eax, ecx
test edi, edi
jg 0x41f235
sub ebx, 1
je 0x41f295
sub ebx, 1
je 0x41f282
sub ebx, 1
jne 0x41f2a7
movzx ecx, word [esi]
add eax, ecx
movsx ecx, byte [esi + 2]
shl ecx, 2
xor ecx, eax
shl ecx, 0x10
xor eax, ecx
mov ecx, eax
shr ecx, 0xb
jmp 0x41f2a5
movzx ecx, word [esi]
add eax, ecx
mov ecx, eax
shl ecx, 0xb
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
jmp 0x41f2a5
movsx ecx, byte [esi]
add eax, ecx
mov ecx, eax
shl ecx, 0xa
xor eax, ecx
mov ecx, eax
shr ecx, 1
add eax, ecx
lea ecx, [eax*8]
xor eax, ecx
mov ecx, eax
shr ecx, 5
add eax, ecx
mov ecx, eax
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add eax, ecx
mov ecx, eax
shl ecx, 0x19
xor eax, ecx
mov ecx, eax
pop ebx
shr ecx, 6
pop edi
add eax, ecx
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x41f940
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x4ab09c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x4aba8c]
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x40c], ebx
push esi
push edi
cmp ebx, 0xffffffff
jne 0x41f9d2
mov edi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_TlsFree]
cmp eax, ebx
je 0x41f98d
mov ebx, eax
mov dword [ebp - 0x40c], ebx
jmp 0x41f9b0
mov byte [0], 0
call edi
cmp eax, 0xffffffff
je 0x41f9a5
mov ebx, eax
mov dword [ebp - 0x40c], ebx
jmp 0x41f9ac
mov byte [0], 0
push 0xffffffffffffffff
call esi
mov ecx, ebx
mov edx, 0x4aba8c
or eax, 0xffffffff
lock cmpxchg dword [edx], ecx
cmp eax, 0xffffffff
je 0x41f9d2
push ebx
call esi
mov ebx, dword [0x4aba8c]
mov dword [ebp - 0x40c], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41f9e4
mov byte [0], 0
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.00456820
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x400
call fcn.004524a3
add esp, 4
lea esi, [ebp - 0x408]
mov ebx, eax
mov ecx, 0x100
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045248d
mov esp, ebp
pop ebp
ret

Function at 0x41fa50
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x4ab09c]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [0x4aba8c]
push ebx
push esi
mov ebx, ecx
mov dword [esp + 8], 0
push edi
mov ecx, 0x100
mov dword [esp + 0xc], eax
mov esi, ebx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.0045249e
add esp, 4
mov edi, 0x100
nop word [eax + eax]
mov esi, dword [0x4ae1f4]
xor dl, dl
test esi, esi
jle 0x41fae8
nop dword [eax]
mov ecx, dword [esp + esi*4 + 0x10]
test ecx, ecx
je 0x41fae3
mov eax, dword [esi*4 + 0x4adc40]
test eax, eax
je 0x41fae3
push ecx
mov dword [esp + esi*4 + 0x14], 0
call eax
add esp, 4
mov dl, 1
dec esi
test esi, esi
jg 0x41fac0
dec edi
test edi, edi
jle 0x41faf1
test dl, dl
jne 0x41fab0
push 0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045248d
mov esp, ebp
pop ebp
ret