joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444ca0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
mov dword [esi + 4], esp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edx, edx
dec edx
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x4540e0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x18]
mov word [eax + 4], 0
mov dword [eax], 0x7025
lea edi, [esi + 0x50]
mov dword [edi + 0x10], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
push eax
sub esp, 0x18
mov ebx, esp
lea eax, [ebx + 8]
push eax
call fcn.0043fa00
add esp, 4
mov dword [ebx], edi
mov dword [ebx + 4], 0x14
lea eax, [esi + 0x18]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x18], eax
call fcn.004572ae
add esp, 0x1c
mov esp, dword [esi + 4]
mov dword [esi + 4], eax
add eax, esi
add eax, 0x50
mov ebx, dword [ebp + 0x10]
push ebx
mov dword [esi + 0x14], eax
push eax
push edi
call fcn.00443672
add esp, 0xc
mov dword [esi + 0x10], eax
xor eax, eax
dec eax
mov dword [esi + 0x41], eax
mov dword [esi + 0x3d], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
lea edi, [esi + 8]
mov ecx, ebx
push edi
call fcn.00439eca
lea eax, [esi + 0x70]
mov dword [eax + 8], 0
mov ecx, edi
push 0x7add60
call fcn.0044f3ea
mov ebx, eax
mov edi, dword [esi + 8]
xor eax, eax
dec eax
lock xadd dword [edi + 4], eax
test eax, eax
jne 0x444da7
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x78], 0xffffffff
call dword [section..00cfg]
mov ecx, edi
call dword [esi + 0xc]
mov eax, dword [ebx]
mov edi, dword [eax + 0x18]
mov dword [esi + 0x78], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
lea eax, [esi + 0x20]
mov ecx, ebx
push eax
mov ebx, dword [esi + 0x14]
push ebx
lea eax, [esi + 0x50]
push eax
call edi
mov ecx, dword [esi + 0x10]
mov eax, ecx
lea edx, [esi + 0x50]
sub eax, edx
cmp ecx, ebx
mov ecx, dword [esi + 4]
lea ecx, [esi + ecx + 0x20]
lea eax, [esi + eax + 0x20]
cmove eax, ecx
movsx edx, byte [ebp + 0x14]
push edx
push dword [ebp + 0x10]
push ecx
push eax
lea eax, [esi + 0x20]
push eax
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.00402bd0
add esp, 0x1c
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x444e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4540f0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov edi, dword [ebp + 0x10]
mov dword fs:[0], eax
test byte [edi + 4], 1
jne 0x444ebf
movzx eax, byte [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [esi]
mov ebx, dword [eax + 0x18]
mov ecx, ebx
call dword [section..00cfg]
movzx eax, word [ebp + 0x14]
mov ecx, esi
push dword [ebp - 0x20]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x444fee
lea esi, [ebp - 0x2c]
mov ecx, edi
push esi
call fcn.00439eca
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0x7add90
call fcn.0044f3ea
mov esi, eax
mov edi, dword [ebp - 0x2c]
xor ebx, ebx
dec ebx
mov eax, ebx
lock xadd dword [edi + 4], eax
test eax, eax
jne 0x444f0a
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], 0xffffffff
call dword [section..00cfg]
mov ecx, edi
call dword [ebp - 0x20]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov eax, dword [esi]
mov cl, byte [ebp + 0x18]
xor cl, 1
movzx ecx, cl
mov edi, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], ebx
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
lea esi, [ebp - 0x2c]
push esi
call edi
mov edi, esi
mov al, byte [ebp - 0x21]
test al, al
jns 0x444f41
mov edi, dword [ebp - 0x2c]
mov ebx, dword [ebp + 0xc]
test al, al
js 0x444f5a
movzx ecx, al
lea ecx, [ecx*2 - 0x2c]
add ecx, ebp
cmp edi, ecx
jne 0x444f67
jmp 0x444fcd
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
lea edx, [ecx + edx*2]
cmp edi, edx
je 0x444fd4
test ebx, ebx
je 0x444f81
movzx esi, word [edi]
mov eax, dword [ebx + 0x18]
cmp eax, dword [ebx + 0x1c]
je 0x444f85
lea ecx, [eax + 2]
mov dword [ebx + 0x18], ecx
mov word [eax], si
jmp 0x444fb6
xor ecx, ecx
jmp 0x444fc3
mov dword [ebp - 0x30], edi
mov eax, dword [ebx]
mov edi, dword [eax + 0x30]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov dword [ebp - 0x10], 1
movzx eax, si
mov dword [ebp - 0x20], ebx
mov ecx, ebx
push eax
call edi
mov esi, eax
mov ebx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x30]
xor ecx, ecx
cmp si, 0xffff
je 0x444fc0
mov ecx, ebx
mov al, byte [ebp - 0x21]
add edi, 2
mov ebx, ecx
jmp 0x444f44
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x444fe4
mov esi, dword [ebp + 8]
mov dword [esi], ebx
push ecx
call fcn.006c90e6
mov eax, esi
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x448d84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00453cd8
mov ebx, eax
test esi, esi
je 0x448dc9
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x448da9
movzx eax, word [eax]
jmp 0x448dba
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
call edi
cmp ax, 0xffff
je 0x448dc9
test bl, bl
jne 0x448dd3
jmp 0x448e6d
xor esi, esi
test bl, bl
jne 0x448e5d
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebx + 0x10]
mov dword [ebp - 0x10], esi
je 0x448de8
movzx ebx, word [eax]
jmp 0x448dfb
mov eax, dword [ebx]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
mov ebx, eax
mov esi, dword [ebp + 0x14]
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
movzx eax, bx
mov ecx, esi
push eax
push 8
call edi
test al, al
je 0x448e4a
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebx + 0x10]
mov esi, dword [ebp - 0x10]
je 0x448e34
add eax, 2
mov dword [ebx + 0xc], eax
jmp 0x448d8e
mov eax, dword [ebx]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
jmp 0x448d8e
mov ecx, dword [ebp + 8]
call fcn.00453cd8
mov ebx, eax
mov esi, dword [ebp - 0x10]
test esi, esi
jne 0x448e77
jmp 0x448e67
mov ecx, dword [ebp + 8]
call fcn.00453cd8
mov ebx, eax
test bl, bl
jne 0x448ea0
jmp 0x448ea6
mov ecx, dword [ebp + 8]
call fcn.00453cd8
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x448e84
movzx eax, word [eax]
jmp 0x448e95
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
call edi
cmp ax, 0xffff
sete al
xor bl, al
jne 0x448ea6
mov eax, dword [ebp + 0x10]
or byte [eax], 2
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x457892
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 8
call fcn.006c90b6
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
xor ecx, ecx
push ecx
push ecx
push eax
push 0x4578e0
push ecx
push ecx
call fcn.006d7d0c
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4578d1
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x4596d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, dword [0x7ae45c]
test ebx, ebx
jne 0x45979f
push 0x24
call fcn.006c90b6
add esp, 4
mov esi, eax
mov dword [eax + 4], 0
mov dword [eax], 0
push 0xc
call fcn.006c90b6
add esp, 4
mov dword [esi + 8], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x10], ecx
mov dword [eax + 8], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [esi + 0xc], ecx
lea eax, [esi + 0x18]
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], 1
mov dword [0x7ae45c], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
test eax, eax
je 0x45976c
push edi
call fcn.006e6814
add esp, 4
jmp 0x459796
lea eax, [ebp - 0x14]
push 0x6fb826
push 0x7d
push 0x731e24
push eax
call fcn.00458d10
add esp, 0x10
lea ecx, [ebp - 0x14]
call fcn.00458d80
lea ecx, [ebp - 0x14]
call fcn.00458d90
xor eax, eax
mov ecx, esi
push eax
push edi
call fcn.004597c0
test ebx, ebx
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006c9121
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4597c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x7a8498]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea ebx, [ebp - 0x20]
push 3
push ecx
push eax
push ebx
call fcn.004b1120
add esp, 0x10
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x459984
mov esi, dword [ebp - 0x20]
mov dword [edi], esi
mov dword [edi + 4], eax
mov dword [ebp - 0x14], 0
push 0x800
push 0
push str.api_ms_win_downlevel_shell32_l1_1_0.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [ebp - 0x34], eax
je 0x459840
push 0x731e02
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x459850
mov ecx, eax
call dword [section..00cfg]
lea eax, [ebp - 0x14]
push eax
push esi
call ecx
jmp 0x45984b
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x24], eax
jmp 0x459857
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
test eax, eax
je 0x459940
mov dword [ebp - 0x30], edi
cmp eax, 0x15555556
jae 0x4599c4
shl eax, 2
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
lea esi, [eax + eax*2]
push esi
call fcn.006c90b6
add esp, 4
mov dword [ebp - 0x20], eax
mov ecx, eax
add ecx, esi
mov dword [ebp - 0x18], ecx
xor edi, edi
jmp 0x4598fe
lea esi, [ebx + 8]
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.006c90b6
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x28]
mov dword [eax], ecx
or esi, 0x80000000
mov dword [eax + 8], esi
mov dword [eax + 4], ebx
mov eax, ebx
add eax, ebx
push eax
push dword [ebp - 0x38]
push ecx
mov esi, ecx
call fcn.006cca40
mov ecx, esi
mov eax, dword [ebp - 0x28]
add esp, 0xc
mov word [ecx + ebx*2], 0
add eax, 0xc
add edi, 4
cmp dword [ebp - 0x2c], edi
je 0x459933
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + edi]
mov dword [ebp - 0x38], eax
push eax
call fcn.006e6814
add esp, 4
cmp eax, 0x7ffffff0
jae 0x4599bc
mov ebx, eax
cmp eax, 5
jae 0x4598b0
mov eax, dword [ebp - 0x28]
mov byte [eax + 0xb], bl
mov ecx, eax
test ebx, ebx
jne 0x4598d5
jmp 0x4598ed
mov esi, eax
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp - 0x30]
lea ebx, [ebp - 0x20]
jmp 0x459942
xor esi, esi
mov ecx, edi
push ebx
call fcn.004595c0
mov dword [edi], 0
mov dword [edi + 4], 0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x45996e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [ebp - 0x20]
test edi, edi
je 0x459984
mov eax, esi
cmp esi, edi
jne 0x4599a6
push edi
call fcn.006c90e6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006c9121
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, esi
cmp esi, edi
je 0x45997b
lea esi, [eax - 0xc]
cmp byte [eax - 1], 0
jns 0x4599a0
push dword [eax - 0xc]
call fcn.006c90e6
add esp, 4
jmp 0x4599a0
mov ecx, dword [ebp - 0x28]
call fcn.0045482c
lea ecx, [ebp - 0x20]
call fcn.00456e1c
int3
Function at 0x45f080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 0xa8], eax
test ecx, ecx
je 0x45f0c2
cmp byte [ecx + 0xb], 0
js 0x45f0b6
mov byte [ecx], 0
mov byte [ecx + 0xb], 0
jmp 0x45f0c2
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
xor ebx, ebx
test edi, edi
je 0x45f2b2
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
push 0
push 0
push edi
call fcn.006db4f0
add esp, 0xc
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x90], xmm0
movdqa xmmword [esp + 0x80], xmm0
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x60], xmm0
lea esi, [esp + 0x20]
push 0xcb
push str..._.._base_files_file_util.cc
push str.ReadStreamToStringWithMaxSize
push esi
call fcn.0045f9a0
add esp, 0x10
lea ecx, [esp + 0x60]
push 0
push esi
call fcn.004b4d70
pxor xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x50], 0
push edi
call fcn.006db3f9
add esp, 4
push eax
call fcn.006dcb5a
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x45f188
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
xor ecx, ecx
mov edx, esi
neg edx
mov edx, 0
sbb edx, eax
cmovl ecx, eax
mov ebx, 0xffff
cmovl ebx, esi
jmp 0x45f18f
xor ecx, ecx
mov ebx, 0xffff
xor esi, esi
mov edx, dword [ebp + 0xc]
cmp edx, ebx
mov eax, 0
sbb eax, ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
cmovb ebx, edx
add ebx, 1
lea edi, [esp + 0x10]
mov ecx, edi
push 0
push ebx
call fcn.00455392
cmp byte [esp + 0x1b], 0
jns 0x45f1d4
mov edi, dword [esp + 0x10]
push dword [ebp + 8]
push ebx
push 1
push edi
call fcn.006e4b20
add esp, 0x10
test eax, eax
je 0x45f247
xor esi, esi
jmp 0x45f205
add edi, esi
push dword [ebp + 8]
push ebx
push 1
push edi
call fcn.006e4b20
add esp, 0x10
test eax, eax
je 0x45f247
mov ecx, dword [ebp + 0xc]
sub ecx, esi
cmp ecx, eax
jb 0x45f25d
test esi, esi
mov ecx, 0x10000
cmove ebx, ecx
add esi, eax
push dword [ebp + 8]
call fcn.006e423b
add esp, 4
test eax, eax
jne 0x45f247
lea eax, [esi + ebx]
lea edi, [esp + 0x10]
mov ecx, edi
push 0
push eax
call fcn.00455392
cmp byte [esp + 0x1b], 0
jns 0x45f1f0
mov edi, dword [esp + 0x10]
jmp 0x45f1f0
push dword [ebp + 8]
call fcn.006e4267
add esp, 4
test eax, eax
sete bl
mov dword [esp + 0xc], esi
jmp 0x45f25f
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x45f296
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
mov edx, dword [ecx + 8]
mov esi, dword [esp + 0x18]
mov dword [ecx + 8], esi
movq xmm0, qword [esp + 0x10]
movq qword [ecx], xmm0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edx
push 0
push dword [esp + 0x10]
call fcn.00455392
cmp byte [esp + 0x1b], 0
jns 0x45f2a9
push dword [esp + 0x10]
call fcn.006c90e6
add esp, 4
lea ecx, [esp + 0x60]
call fcn.004b4dd0
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.006c9121
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45faf0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.004599e0
test al, al
je 0x45fbfe
call fcn.004599d0
mov esi, eax
mov ecx, eax
push 0x73b99b
call fcn.00459e60
test al, al
jne 0x45fb3e
mov ecx, esi
push str.vmodule
call fcn.00459e60
test al, al
je 0x45fbfe
cmp dword [0x7ae474], 0
je 0x45fb70
lea edi, [ebp - 0x1c]
push str._g_vlog_info_prev
push 0x1a6
push str..._.._base_logging.cc
push edi
call fcn.00458d10
add esp, 0x10
mov ecx, edi
call fcn.00458d80
mov ecx, edi
call fcn.00458d90
mov eax, dword [0x7ae478]
mov dword [0x7ae474], eax
push 0x10
call fcn.006c90b6
add esp, 4
mov edi, eax
push str.vmodule
call fcn.006e65e0
add esp, 4
lea edx, [ebp - 0x1c]
mov ecx, esi
push eax
push str.vmodule
push edx
call fcn.00459ef0
push 0x73b99b
call fcn.006e65e0
add esp, 4
lea ebx, [ebp - 0x28]
mov ecx, esi
push eax
push 0x73b99b
push ebx
call fcn.00459ef0
mov ecx, edi
push 0x7ae47c
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.004b5570
mov dword [0x7ae478], edi
cmp byte [ebp - 0x1d], 0
jns 0x45fbea
push dword [ebp - 0x28]
call fcn.006c90e6
add esp, 4
cmp byte [ebp - 0x11], 0
mov edi, dword [ebp + 8]
jns 0x45fbfe
push dword [ebp - 0x1c]
call fcn.006c90e6
add esp, 4
mov eax, dword [edi]
mov dword [0x7ae480], eax
mov bl, 1
test al, 1
je 0x45fc94
mov eax, dword [0x7ae490]
test eax, eax
je 0x45fc3c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x7ae490], 0
mov ecx, dword [0x7ae484]
test ecx, ecx
jne 0x45fc6b
and byte [0x7ae480], 0xfe
jmp 0x45fc46
mov ecx, dword [0x7ae484]
test ecx, ecx
jne 0x45fc6b
push 0xc
call fcn.006c90b6
add esp, 4
mov ecx, eax
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [0x7ae484], eax
push dword [edi + 4]
call fcn.00455b28
cmp dword [edi + 0xc], 0
jne 0x45fc8d
mov eax, dword [0x7ae484]
cmp byte [eax + 0xb], 0
jns 0x45fc86
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0045fcb0
mov ebx, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006c9121
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x463cc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jae 0x463ce2
cmp dword [esi], edi
jne 0x463cee
jmp 0x463d0d
call fcn.0045f9d0
mov eax, dword [ebp + 8]
cmp dword [esi], edi
je 0x463d0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jae 0x463d29
cmp ebx, 2
jae 0x463d49
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 8]
movups xmm0, xmmword [eax + 4]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [esi + 0x10], xmm1
movups xmmword [esi + 4], xmm0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.0045f9d0
push dword [esi]
call fcn.00474ca0
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp ebx, 2
jb 0x463d03
mov dword [esi], edi
mov edi, eax
call fcn.0045f9d0
mov eax, edi
jmp 0x463d03

Function at 0x468340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00468350

Function at 0x46a0c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7ae528]
mov ecx, dword [0x7bafb8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x14]
jg 0x46a0eb
mov ecx, 0x7ae520
pop ebp
jmp fcn.0046cea0
push 0x7ae528
call fcn.006c9157
add esp, 4
cmp dword [0x7ae528], 0xffffffff
jne 0x46a0e0
mov dword [0x7ae524], 0
mov dword [0x7ae520], 0
mov ecx, 0x7ae520
push 0
call fcn.0046cf10
push 0x7ae528
call fcn.006c91cd
add esp, 4
jmp 0x46a0e0
Function at 0x46c7e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x140c
call fcn.006c9620
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x7a74b0]
cmp eax, 0xffffffff
je 0x46c94c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x46c94c
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.006cca40
add esp, 0xc
mov ecx, dword [0x7a74b0]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.004c98b0
add esp, 8
test ebx, ebx
je 0x46c85b
push ebx
call fcn.006c911c
add esp, 4
mov eax, dword [0x7af158]
mov ecx, dword [0x7bafb8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x14]
jg 0x46c96d
mov esi, dword [0x7af154]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x46c961
lea eax, [ebp - 0x1410]
push 0xc00
push 0x7ae554
push eax
call fcn.006cca40
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ecx, 0x100
jmp 0x46c8ce
mov edx, dword [ebp - 0x1418]
lea ecx, [edx - 1]
cmp edx, 2
jb 0x46c93c
test al, 1
je 0x46c93c
mov dword [ebp - 0x1418], ecx
xor edi, edi
lea esi, [ebp - 0x1408]
xor eax, eax
jmp 0x46c8fe
add edi, 1
add esi, 0xc
cmp edi, 0x100
je 0x46c8c0
mov ebx, dword [ebp + edi*8 - 0x810]
test ebx, ebx
je 0x46c8f0
cmp dword [esi - 8], 0
je 0x46c8f0
mov ecx, dword [ebp + edi*8 - 0x80c]
cmp ecx, dword [esi]
jne 0x46c8f0
mov ecx, dword [esi - 4]
test ecx, ecx
je 0x46c8f0
mov dword [ebp + edi*8 - 0x810], 0
call dword [section..00cfg]
push ebx
call ecx
add esp, 4
mov al, 1
jmp 0x46c8f0
push 2
push dword [ebp - 0x1414]
call fcn.004c98b0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006c9121
add esp, 0x140c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.00474260
jmp 0x46c891
push 0x7af158
call fcn.006c9157
add esp, 4
cmp dword [0x7af158], 0xffffffff
jne 0x46c87c
push 4
call fcn.006c90b6
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.0041e2c0
mov dword [0x7af154], esi
push 0x7af158
call fcn.006c91cd
add esp, 4
jmp 0x46c87c

Function at 0x46c9c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7a74b0]
cmp eax, 0xffffffff
je 0x46c9e2
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
add eax, 0xffffffff
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x46c9f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x7a74b0]
cmp eax, 0xffffffff
je 0x46ca1a
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x46ca1f
call fcn.0046cc00
mov eax, dword [0x7af158]
mov ecx, dword [0x7bafb8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x14]
jg 0x46cbb9
mov edi, dword [0x7af154]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x46cbad
mov ecx, dword [0x7ae550]
add ecx, 1
mov edx, 0x100
nop word cs:[eax + eax]
nop dword [eax]
movzx ebx, cl
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x7ae554], 0
je 0x46ca9d
lea eax, [ecx + 1]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x7ae554], 0
je 0x46ca9d
add ecx, 2
add edx, 0xfffffffe
jne 0x46ca70
jmp 0x46cacd
lea ecx, [eax*4 + 0x7ae554]
mov dword [ecx], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x7ae558], ecx
mov dword [0x7ae550], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x7ae55c]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov dword [ebp - 0x14], 0xffffffff
mov ebx, dword [esi]
cmp ebx, 0xffffffff
jne 0x46cb36
push 0xffffffffffffffff
call fcn.00458ed0
add esp, 4
mov ebx, eax
push 0xffffffffffffffff
call fcn.00458ed0
add esp, 4
lea edi, [ebp - 0x14]
mov ecx, edi
push ebx
push eax
push str.slot____kInvalidSlotValue
call fcn.004592d0
cmp dword [ebp - 0x14], 0
je 0x46cb34
lea ebx, [ebp - 0x18]
push edi
push 0x19c
push str..._.._base_threading_thread_local_storage.cc
push ebx
call fcn.00458dc0
add esp, 0x10
mov ecx, ebx
call fcn.00458d80
mov ecx, ebx
call fcn.00458d90
mov ebx, dword [esi]
mov dword [ebp - 0x14], 0xffffffff
cmp ebx, 0x100
jl 0x46cb99
push 0x100
call fcn.00458ed0
add esp, 4
mov edi, eax
push ebx
call fcn.00458ed0
add esp, 4
lea esi, [ebp - 0x14]
mov ecx, esi
push edi
push eax
push str.slot____kThreadLocalStorageSize
call fcn.004592d0
cmp dword [ebp - 0x14], 0
je 0x46cb99
lea edi, [ebp - 0x18]
push esi
push 0x19d
push str..._.._base_threading_thread_local_storage.cc
push edi
call fcn.00458dc0
add esp, 0x10
mov ecx, edi
call fcn.00458d80
mov ecx, edi
call fcn.00458d90
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006c9121
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ecx, edi
call fcn.00474260
jmp 0x46ca55
push 0x7af158
call fcn.006c9157
add esp, 4
cmp dword [0x7af158], 0xffffffff
jne 0x46ca40
push 4
call fcn.006c90b6
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.0041e2c0
mov dword [0x7af154], edi
push 0x7af158
call fcn.006c91cd
add esp, 4
jmp 0x46ca40