joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442da0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x443190
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [section..data]
test eax, eax
je 0x442de4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x442dfd
jmp 0x442e13
push section..data
call fcn.004eaa60
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x442e13
cmp dword [eax], 1
jne 0x442e13
add eax, 4
cmp dword [eax], 0
je 0x442eea
jmp 0x442f1a
mov eax, dword [section..data]
test eax, eax
je 0x442e34
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x442e4c
mov esi, eax
cmp eax, 1
je 0x442f01
jmp 0x442e8d
push section..data
call fcn.004eaa60
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x442e27
push 4
push 0x14
call fcn.0043c290
add esp, 8
test eax, eax
je 0x442f53
mov dword [eax], 0
mov dword [eax + 0x10], 0x61c000
mov esi, eax
mov eax, dword [section..data]
test eax, eax
jne 0x442e85
push section..data
call fcn.004eaa60
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
cmp dword [esi], 0
lea eax, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
je 0x442ee5
test ecx, ecx
je 0x442ee5
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], ecx
push ecx
mov dword [ebp - 0x2c], edx
call dword [edx]
add esp, 4
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx + 4]
test eax, eax
je 0x442f12
push dword [ecx + 8]
push eax
push dword [ebp - 0x24]
call fcn.0043c2a0
add esp, 0xc
mov eax, dword [ebp - 0x28]
cmp dword [eax], 0
jne 0x442f1a
mov edx, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
test edx, edx
jne 0x442f40
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
cmp dword [eax], 0
je 0x442eea
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x20]
push 0x576f70
push 0x576eec
push eax
push 0x10
push 0x576eb4
call fcn.005708f0
add esp, 0x14
ud2
mov dword [ebp - 0x10], 0xffffffff
push ecx
push edx
call fcn.004e53b0
add esp, 8
ud2
push 4
push 0x14
call fcn.00570650
add esp, 8
ud2
Function at 0x470140
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
movups xmm2, xmmword [eax]
mov ecx, dword [edx + 0xf0]
mov eax, dword [esp + 8]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
lea edx, [edx + 0x20]
xorps xmm2, xmm0
aesenc xmm2, xmm1
dec ecx
movups xmm1, xmmword [edx]
lea edx, [edx + 0x10]
jne 0x470162
aesenclast xmm2, xmm1
pxor xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [eax], xmm2
pxor xmm2, xmm2
ret
Function at 0x474c20
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
xorps xmm0, xmm0
mov edi, edx
mov esi, ecx
lea eax, [esp + 0x10]
mov dword [esp + 0x30], 0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
push eax
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x474d3a
mov ebx, dword [ebp + 0x10]
mov dword [esp], esi
mov esi, dword [ebp + 0x14]
push 0
push eax
push esi
push ebx
call fcn.0054a460
sub ebx, eax
mov dword [esp + 4], eax
mov dword [esp + 8], edi
sbb esi, edx
mov dword [esp + 0xc], esi
push edi
call fcn.00443ef0
add esp, 4
push eax
call fcn.00471ae0
add esp, 4
push 0
push 0
push 0
push dword [ebp + 8]
push 0
push eax
call sub.KERNEL32.dll_CreateFileMappingW
test eax, eax
je 0x474cf4
mov esi, eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 4]
add eax, ecx
push eax
push ebx
push dword [esp + 0x14]
push dword [ebp + 0xc]
push esi
call sub.KERNEL32.dll_MapViewOfFile
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x474cf4
push dword [esp + 8]
lea eax, [esp + 0x14]
push eax
call fcn.004dea50
add esp, 8
cmp dword [esp + 0x10], 1
mov ecx, dword [esp]
jne 0x474d15
movsd xmm0, qword [esp + 0x14]
movsd qword [ecx + 4], xmm0
jmp 0x474d06
call fcn.004eec00
mov ecx, dword [esp]
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0
mov eax, 1
mov dword [ecx], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x14]
mov dword [ecx + 4], 1
add edi, dword [esp + 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], eax
mov al, byte [ebp + 0x1c]
mov byte [ecx + 0x14], al
xor eax, eax
jmp 0x474d0b
push 0x5e9140
push 0x39
push 0x5e9150
call fcn.005707b0
add esp, 0xc
ud2
Function at 0x474d50
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, esp
mov dword [esi + 0x58], ebp
mov dword [esi + 0x5c], esp
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x64], 0x4750d0
mov edi, dword [ebp + 0x10]
lea eax, [esi + 0x60]
mov ecx, dword fs:[0]
mov dword [esi + 0x60], ecx
mov dword fs:[0], eax
push edi
call fcn.00443ef0
add esp, 4
push eax
call fcn.00471ae0
add esp, 4
push 0
push 0
push 0
push 4
push 0
push eax
call sub.KERNEL32.dll_CreateFileMappingW
mov ebx, eax
test eax, eax
je 0x474db7
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00443ef0
add esp, 4
push eax
call fcn.00471ae0
add esp, 4
push 0
push 0
push 0
push 0x20
push 0
push eax
call sub.KERNEL32.dll_CreateFileMappingW
test eax, eax
mov dword [esi + 0xc], eax
je 0x474dfd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x20
mov edx, 0x24
mov eax, 0x40
mov edi, 0x26
jmp 0x474e11
mov ecx, 2
mov eax, 4
mov edi, 6
mov edx, 4
test ebx, ebx
cmove edi, edx
mov edx, dword [ebp + 0x10]
cmove eax, ecx
lea ecx, [esi + 0x30]
push 0
push dword [ebp + 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push eax
call fcn.00474c20
add esp, 0x18
mov edx, dword [esi + 0x34]
cmp dword [esi + 0x30], 1
mov ecx, dword [esi + 0x38]
jne 0x474e54
mov edi, dword [ebp + 8]
mov dword [edi + 4], edx
mov dword [edi + 8], ecx
mov dword [edi], 1
jmp 0x474ef9
or ebx, dword [esi + 0xc]
mov eax, dword [esi + 0x44]
movsd xmm0, qword [esi + 0x3c]
mov dword [esi + 0x20], eax
movsd qword [esi + 0x18], xmm0
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], ecx
je 0x474ed6
mov eax, dword [esi + 0x18]
xorps xmm0, xmm0
mov dword [esi + 0x28], edx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x50], 0
mov dword [esi + 0x68], 0
movaps xmmword [esi + 0x40], xmm0
movaps xmmword [esi + 0x30], xmm0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x30]
push eax
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x474f52
mov edi, dword [esi + 0xc]
xor edx, edx
mov eax, edi
div ecx
mov ecx, dword [esi + 0x2c]
lea eax, [esi + 0x30]
mov dword [esi + 0x30], 0
sub edi, edx
add ecx, edx
push eax
push 2
push ecx
push edi
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x474f0c
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x20]
movsd xmm0, qword [esi + 0x10]
movsd xmm1, qword [esi + 0x18]
mov dword [edi + 0x14], eax
movsd qword [edi + 0xc], xmm1
movsd qword [edi + 4], xmm0
mov dword [edi], 0
mov eax, dword [esi + 0x60]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004eec00
mov ecx, dword [ebp + 8]
mov dword [esi + 0x68], 1
mov dword [ecx + 8], eax
lea eax, [esi + 0x10]
mov dword [ecx + 4], 0
mov dword [ecx], 1
push eax
call fcn.00474fb0
add esp, 4
cmp dword [esi + 0x28], 0
mov edi, dword [ebp + 8]
je 0x474ef9
mov dword [esi + 0x68], 0xffffffff
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x474ef9
push 0x5e918c
push 0x39
push 0x5e9150
call fcn.005707b0
add esp, 0xc
ud2
Function at 0x474fb0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, esp
mov dword [esi + 0x38], ebp
mov dword [esi + 0x3c], esp
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x44], 0x4750e0
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x40]
xorps xmm0, xmm0
lea ebx, [esi + 0x10]
mov edx, dword fs:[0]
mov dword [esi + 0x40], edx
mov dword fs:[0], ecx
movaps xmmword [esi + 0x20], xmm0
movaps xmmword [esi + 0x10], xmm0
mov dword [esi + 0x30], 0
mov edi, dword [eax + 8]
push ebx
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x475031
mov eax, edi
xor edx, edx
div ecx
sub edi, edx
push edi
call sub.KERNEL32.dll_UnmapViewOfFile
test eax, eax
je 0x475047
mov eax, dword [esi + 0x40]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5e919c
push 0x39
push 0x5e9150
call fcn.005707b0
add esp, 0xc
ud2
call fcn.004eec00
mov edx, esi
lea ecx, [esi + 8]
mov dword [esi + 0x10], 0x5e91c4
mov dword [esi + 0x14], 1
mov dword [esi + 0x18], 0
mov dword [esi + 4], eax
mov dword [esi], 0
mov dword [esi + 0x48], 0
mov dword [esi + 8], edx
mov dword [esi + 0x20], ecx
mov dword [esi + 0xc], fcn.004dff60
mov dword [esi + 0x24], 1
push 0x5e91cc
push ebx
call fcn.00570860
add esp, 8
ud2

Function at 0x47abd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], esp
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x2c], 0x47ad40
lea eax, [esi + 0x28]
mov ecx, dword fs:[0]
mov dword [esi + 0x28], ecx
mov dword fs:[0], eax
push 1
push 0xa
call fcn.0043c290
add esp, 8
test eax, eax
je 0x47aca3
mov dword [esi + 4], eax
lea eax, [esi + 0x10]
mov dword [esi + 8], 0xa
mov dword [esi + 0xc], 0
mov dword [esi + 0x30], 0
push eax
call fcn.0047e260
add esp, 4
mov eax, dword [ebp + 8]
movsd xmm0, qword [esi + 0x10]
movsd xmm1, qword [esi + 0x18]
mov ecx, dword [esi + 0xc]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov dword [eax + 0x20], ecx
movsd xmm1, qword [esi + 4]
mov ecx, dword [esi + 0x28]
movsd qword [eax + 0x18], xmm1
mov dword [eax + 0x50], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x48], 0
mov byte [eax + 0x4c], 0
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
push 0xa
call fcn.00570650
add esp, 8
ud2
Function at 0x47e350
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp esi, 0x80
jae 0x47e36a
push esi
push edx
push ecx
call fcn.0047e520
add esp, 0xc
pop esi
ret
movdqu xmm4, xmmword [edx]
not ecx
movdqu xmm2, xmmword [edx + 0x10]
movdqu xmm1, xmmword [edx + 0x20]
movdqu xmm0, xmmword [edx + 0x30]
movdqa xmm5, xmmword [0x5ea040]
add edx, 0x40
add esi, 0xffffffc0
movd xmm3, ecx
pxor xmm3, xmm4
movdqa xmm4, xmmword [0x5ea030]
nop dword [eax]
movdqu xmm7, xmmword [edx]
movdqa xmm6, xmm3
pclmulqdq xmm3, xmm5, 0x11
add esi, 0xffffffc0
pclmulqdq xmm6, xmm4, 0
pxor xmm3, xmm7
movdqa xmm7, xmm2
pclmulqdq xmm2, xmm5, 0x11
pxor xmm3, xmm6
movdqu xmm6, xmmword [edx + 0x10]
pclmulqdq xmm7, xmm4, 0
pxor xmm2, xmm6
movdqu xmm6, xmmword [edx + 0x20]
pxor xmm2, xmm7
movdqa xmm7, xmm1
pclmulqdq xmm1, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm1, xmm6
movdqu xmm6, xmmword [edx + 0x30]
add edx, 0x40
cmp esi, 0x3f
pxor xmm1, xmm7
movdqa xmm7, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm0, xmm6
pxor xmm0, xmm7
ja 0x47e3a0
movdqa xmm4, xmmword [0x5ea050]
movdqa xmm5, xmmword [0x5ea060]
movdqa xmm6, xmm3
cmp esi, 0x10
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
pxor xmm6, xmm2
pxor xmm6, xmm3
movdqa xmm2, xmm6
pclmulqdq xmm6, xmm5, 0x11
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pxor xmm2, xmm6
movdqa xmm1, xmm2
pclmulqdq xmm2, xmm5, 0x11
pclmulqdq xmm1, xmm4, 0
pxor xmm1, xmm0
pxor xmm1, xmm2
jb 0x47e4a7
nop dword [eax + eax]
movdqu xmm0, xmmword [edx]
movdqa xmm2, xmm1
pclmulqdq xmm1, xmm5, 0x11
add esi, 0xfffffff0
add edx, 0x10
pclmulqdq xmm2, xmm4, 0
cmp esi, 0xf
pxor xmm1, xmm0
pxor xmm1, xmm2
ja 0x47e480
movdqa xmm0, xmmword [0x5ea060]
pxor xmm2, xmm2
test esi, esi
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm2, xmm1, 3
psrldq xmm1, 4
pclmulqdq xmm2, xmmword [0x5ea070], 0
pxor xmm1, xmm2
pxor xmm2, xmm2
pblendw xmm2, xmm1, 3
pclmulqdq xmm2, xmmword [0x5ea080], 0x10
pblendw xmm2, xmm0, 0xfc
pclmulqdq xmm2, xmmword [0x5ea090], 0
pxor xmm2, xmm1
pextrd eax, xmm2, 1
not eax
je 0x47e51e
push esi
push edx
push eax
call fcn.0047e520
add esp, 0xc
pop esi
ret
Function at 0x48f2a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
mov esi, esp
mov dword [esi + 0x50], ebp
mov dword [esi + 0x54], esp
mov dword [esi + 0x60], 0xffffffff
mov dword [esi + 0x5c], 0x48fc80
mov eax, dword fs:[0]
mov dword [esi + 0x58], eax
lea eax, [esi + 0x58]
mov dword fs:[0], eax
mov byte [esi + 7], 1
mov dword [esi + 0x60], 0
mov edi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x10]
push edi
push eax
mov dword [esi + 0xc], edi
push edi
push 0
mov dword [esi + 0x14], edx
push edx
mov dword [esi + 8], ecx
push ecx
call fcn.004be350
add esp, 0x18
mov edx, dword [esi + 8]
mov eax, dword [edx + 0x14]
lea edi, [edx + 0x10]
cmp dword [esi + 0xc], eax
jne 0x48f331
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov byte [esi + 7], 1
add eax, dword [edx + 0xc]
sub eax, ecx
push eax
push ecx
mov dword [esi + 0x10], edi
push edi
call fcn.004af8e0
add esp, 0xc
mov edx, dword [esi + 8]
mov edi, dword [esi + 0x10]
mov eax, dword [edx + 0x14]
mov ecx, dword [ebp + 0x10]
movsd xmm2, qword [ecx + 0x18]
movsd xmm1, qword [ecx + 0x10]
movsd xmm0, qword [ecx + 0x20]
movsd qword [esi + 0x38], xmm2
movsd qword [esi + 0x30], xmm1
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov ecx, dword [esi + 0x14]
movsd qword [esi + 0x40], xmm0
movsd qword [esi + 0x28], xmm1
movsd qword [esi + 0x20], xmm2
mov dword [esi + 0x48], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x1c], ecx
mov ecx, dword [ebp + 8]
mov dword [esi + 0x18], ecx
mov ecx, dword [edx + 0x18]
cmp ecx, eax
jne 0x48f397
mov dword [esi + 0x60], 1
push 1
push eax
push edi
call fcn.0056c230
add esp, 0xc
mov edx, dword [esi + 8]
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x10]
movsd xmm0, qword [esi + 0x48]
imul ecx, ecx, 0x38
movsd qword [eax + ecx + 0x30], xmm0
movsd xmm0, qword [esi + 0x40]
movsd qword [eax + ecx + 0x28], xmm0
movsd xmm0, qword [esi + 0x38]
movsd qword [eax + ecx + 0x20], xmm0
movsd xmm0, qword [esi + 0x30]
movsd qword [eax + ecx + 0x18], xmm0
movsd xmm0, qword [esi + 0x28]
movsd qword [eax + ecx + 0x10], xmm0
movsd xmm0, qword [esi + 0x18]
movsd xmm1, qword [esi + 0x20]
movsd qword [eax + ecx + 8], xmm1
movsd qword [eax + ecx], xmm0
inc dword [edx + 0x18]
mov eax, dword [esi + 0x58]
mov dword fs:[0], eax
mov eax, dword [esi + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4923b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
test ebx, ebx
je 0x4923eb
mov ebp, dword [esp + 0x18]
mov esi, 0x1b3
nop
movzx ecx, byte [ebp]
imul edi, edi, 0x1b3
inc ebp
xor ecx, eax
mov eax, ecx
shl ecx, 8
mul esi
add ecx, edx
add edi, ecx
dec ebx
jne 0x4923d0
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
mov dword [ecx + 4], edi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4a4390
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], esp
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x2c], 0x4a4510
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword fs:[0]
mov dword [esi + 0x28], ecx
lea ecx, [esi + 0x28]
mov dword fs:[0], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esi + 8], eax
mov eax, dword [0x5f01a0]
mov ebx, dword [edi + 8]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
cmp ebx, dword [edi + 4]
mov ecx, ebx
jne 0x4a4414
mov dword [esi + 0x30], 0
push 1
mov dword [esi + 4], ebx
push ebx
push edi
call fcn.0056b490
add esp, 0xc
mov edi, dword [ebp + 8]
mov ebx, dword [esi + 4]
mov ecx, dword [edi + 8]
mov edx, dword [edi]
movsd xmm0, qword [esi + 0x18]
lea ecx, [ecx + ecx*2]
mov eax, dword [ebp + 0xc]
movsd qword [edx + ecx*8 + 0x10], xmm0
movsd xmm0, qword [esi + 8]
movsd xmm1, qword [esi + 0x10]
movsd qword [edx + ecx*8 + 8], xmm1
movsd qword [edx + ecx*8], xmm0
mov ecx, dword [edi + 8]
inc ecx
cmp ecx, eax
mov dword [edi + 8], ecx
jbe 0x4a448d
mov ecx, dword [edi]
lea edx, [eax + eax*2]
mov eax, dword [ecx + edx*8 + 0x10]
lea edi, [ecx + edx*8 + 8]
cmp eax, dword [ecx + edx*8 + 0xc]
je 0x4a4475
mov ecx, dword [edi]
mov dword [ecx + eax*4], ebx
inc dword [edi + 8]
mov eax, dword [esi + 0x28]
mov dword fs:[0], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x30], 0xffffffff
push 1
push eax
push edi
call fcn.0056b320
add esp, 0xc
mov eax, dword [edi + 8]
jmp 0x4a445a
mov dword [esi + 0x30], 0xffffffff
push 0x5f0210
push ecx
push eax
call fcn.00570800
add esp, 0xc
ud2
Function at 0x4b5510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
cmp dword [edx], 1
mov dword [esp], ecx
jne 0x4b553d
mov esi, dword [edx + 0x30]
cmp dword [edx + 0x24], 0xffffffff
mov edi, dword [edx + 0x34]
mov ebx, dword [edx + 0x38]
mov ebp, dword [edx + 0x3c]
lea eax, [edx + 8]
je 0x4b5551
mov ecx, dword [esp]
mov edx, eax
push 0
jmp 0x4b5558
cmp byte [edx + 0xe], 0
je 0x4b5569
mov eax, dword [esp]
mov dword [eax], 0
add esp, 0xc
jmp 0x4b5564
mov ecx, dword [esp]
mov edx, eax
push 1
push ebp
push ebx
push edi
push esi
call fcn.004b4fc0
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [edx + 0x30]
mov esi, dword [edx + 0x34]
mov bl, byte [edx + 0xc]
mov edi, dword [edx + 4]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
jmp 0x4b5590
add edi, eax
mov dword [edx + 4], edi
mov ebx, dword [edx + 0xc]
test ebx, 0xff0000
jne 0x4b5543
mov eax, ebx
xor al, 1
test edi, edi
mov byte [edx + 0xc], al
mov eax, dword [esp + 8]
je 0x4b55b6
cmp esi, edi
jbe 0x4b55b0
cmp byte [eax + edi], 0xbf
jg 0x4b55b6
jmp 0x4b567a
jne 0x4b567a
cmp edi, esi
je 0x4b5657
movzx ecx, byte [eax + edi]
movzx ebp, cl
test cl, cl
jns 0x4b5616
movzx esi, byte [eax + edi + 1]
and ebp, 0x1f
and esi, 0x3f
cmp cl, 0xdf
jbe 0x4b5606
movzx eax, byte [eax + edi + 2]
shl esi, 6
and eax, 0x3f
or eax, esi
cmp cl, 0xf0
jb 0x4b560d
mov ecx, dword [esp + 8]
and ebp, 7
shl eax, 6
shl ebp, 0x12
movzx ecx, byte [ecx + edi + 3]
and ecx, 0x3f
or ecx, eax
or ebp, ecx
jmp 0x4b5612
shl ebp, 6
or ebp, esi
jmp 0x4b5612
shl ebp, 0xc
or ebp, eax
mov esi, dword [esp + 4]
test bl, bl
jne 0x4b5664
cmp ebp, 0x110000
je 0x4b565b
mov eax, 1
cmp ebp, 0x80
jb 0x4b5580
mov eax, 2
cmp ebp, 0x800
jb 0x4b5580
cmp ebp, 0x10000
mov eax, 4
sbb eax, 0
jmp 0x4b5580
test bl, bl
jne 0x4b5666
mov byte [edx + 0xe], 1
jmp 0x4b5543
mov esi, edi
mov eax, dword [esp]
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax], 1
jmp 0x4b554c
push 0x5f0938
push esi
push edi
push esi
push eax
call fcn.00570b30
add esp, 0x14
ud2
Function at 0x4cf700
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x61c0e0]
test eax, eax
je 0x4cf718
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x4cf731
jmp 0x4cf739
push 0x61c0e0
call fcn.004eaa60
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4cf739
cmp byte [eax + 4], 2
mov esi, eax
jne 0x4cf792
mov eax, dword [0x61c0e0]
test eax, eax
je 0x4cf799
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4cf7b2
mov esi, eax
test eax, eax
jne 0x4cf78e
push 4
push 8
call fcn.0043c290
add esp, 8
test eax, eax
je 0x4cf7b8
mov byte [eax + 4], 2
mov dword [eax], 0x61c0e0
mov esi, eax
mov eax, dword [0x61c0e0]
test eax, eax
jne 0x4cf786
push 0x61c0e0
call fcn.004eaa60
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov byte [esi + 4], 0
add esi, 4
mov eax, esi
pop esi
ret
push 0x61c0e0
call fcn.004eaa60
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x4cf74e
xor esi, esi
mov eax, esi
pop esi
ret
push 4
push 8
call fcn.00570650
add esp, 8
ud2
Function at 0x4dd700
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x434
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4f7310
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
lea eax, [ebp - 0x440]
push 0x400
push 0
push eax
call fcn.0054c590
add esp, 0xc
mov eax, dword [0x5f5ba8]
mov ebx, 0x200
xor esi, esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0
cmp ebx, 0x201
jae 0x4dd782
jmp 0x4dd7c0
cmp edi, ebx
mov ebx, edi
jb 0x4dd816
cmp ebx, 0x201
jb 0x4dd7c0
mov ecx, dword [ebp - 0x30]
mov eax, ebx
sub eax, esi
sub ecx, esi
cmp ecx, eax
jae 0x4dd7b0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
mov edx, esi
push eax
call fcn.0056fb00
add esp, 4
mov eax, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov edi, dword [ebp - 0x20]
mov esi, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
jmp 0x4dd7cd
lea edi, [ebp - 0x440]
mov dword [ebp - 0x28], 0x200
mov dword [ebp - 0x24], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x4dd7f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4dd854
cmp edi, ebx
jne 0x4dd770
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4dd770
add ebx, ebx
cmp ebx, 0x201
jb 0x4dd7c0
jmp 0x4dd782
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0
cmp edi, eax
ja 0x4dd8a3
lea eax, [ebp - 0x40]
push edi
push dword [ebp - 0x24]
push eax
call fcn.004e4fb0
add esp, 0xc
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp - 0x40]
mov dword [esi + 0xc], eax
movsd qword [esi + 4], xmm0
xor eax, eax
mov dword [esi], eax
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x4dd875
jmp 0x4dd88d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, 1
mov dword [esi + 4], 0
mov dword [esi], eax
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4dd88d
cmp dword [ebp - 0x20], 0
je 0x4dd88d
add eax, eax
je 0x4dd88d
push 2
push eax
push dword [ebp - 0x20]
call fcn.0043c2a0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x434
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5f79e4
push eax
push edi
call fcn.005709d0
add esp, 0xc
ud2
Function at 0x4dec40
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push eax
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp], 0
mov edi, esp
mov edx, dword [edx]
push 0
push edi
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4dec78
mov eax, dword [esp]
mov dword [esi + 4], eax
xor eax, eax
jmp 0x4dec8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 8], eax
mov eax, 1
mov dword [esi + 4], 0
mov dword [esi], eax
mov eax, esi
add esp, 4
pop esi
pop edi
ret