joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423327
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xc]
add ecx, 0xc
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x423399
mov dword [esp], eax
movzx esi, word [ecx + 0x2c]
test esi, esi
je 0x42338c
mov ebx, dword [ecx + 0x30]
xor ebp, ebp
mov edi, 0x2fbc
mov dl, byte [ebx + ebp]
test dl, dl
jne 0x42336d
inc ebp
cmp ebp, esi
jb 0x42335f
jmp 0x423391
mov dh, dl
add dh, 0xe0
cmp dl, 0x61
movzx eax, dl
movzx edx, dh
cmovb edx, eax
mov eax, edi
shl eax, 5
add eax, edi
movzx edi, dl
add edi, eax
jmp 0x423366
mov edi, 0x2fbc
cmp edi, dword [esp + 4]
jne 0x423341
jmp 0x4233a0
mov dword [esp], 0
mov eax, dword [esp]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4233ab
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 0x14], edx
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x78]
mov edx, dword [eax + ecx + 0x20]
add edx, ecx
mov dword [esp + 0x10], edx
mov edx, dword [eax + ecx + 0x14]
mov dword [esp + 8], edx
mov edx, dword [eax + ecx + 0x18]
mov dword [esp + 0x18], edx
mov edx, dword [eax + ecx + 0x1c]
add edx, ecx
mov dword [esp], edx
mov eax, dword [eax + ecx + 0x24]
add eax, ecx
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], ecx
cmp eax, dword [esp + 0x18]
je 0x423452
mov edx, eax
mov eax, dword [esp + 0x10]
mov edi, dword [eax + edx*4]
add edi, ecx
mov esi, edi
mov eax, esi
inc esi
cmp byte [eax], 0
jne 0x423403
mov esi, 0x2fbc
sub eax, edi
jne 0x42341f
lea eax, [edx + 1]
cmp esi, dword [esp + 0x14]
jne 0x4233f0
jmp 0x423456
xor ebp, ebp
mov bl, byte [edi + ebp]
test bl, bl
jne 0x42342f
inc ebp
cmp ebp, eax
jb 0x423421
jmp 0x423414
mov bh, bl
add bh, 0xe0
cmp bl, 0x61
movzx ecx, bl
movzx ebx, bh
cmovb ebx, ecx
mov ecx, esi
shl ecx, 5
add ecx, esi
movzx esi, bl
add esi, ecx
mov ecx, dword [esp + 0xc]
jmp 0x423428
xor eax, eax
jmp 0x42346e
mov eax, dword [esp + 4]
movzx eax, word [eax + edx*2]
mov edx, dword [esp + 8]
cmp edx, eax
jbe 0x423476
mov edx, dword [esp]
add ecx, dword [edx + eax*4]
mov eax, ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, eax
push 0x4a5ddc
call fcn.0048d350
Function at 0x436858
Capabilities:
Delete file

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, edx
mov edi, ecx
mov edx, dword [edx + 4]
lea ebx, [esp + 0xc]
mov ecx, ebx
push dword [esi + 8]
call fcn.00462620
add esp, 4
mov ecx, dword [ebx]
mov ebp, dword [ebx + 4]
mov eax, dword [ebx + 8]
cmp ecx, 0x80000000
je 0x4368ac
lea edx, [esp + 0x18]
mov dword [edx], ecx
mov dword [edx + 4], ebp
mov dword [edx + 8], eax
mov ebx, esp
mov ecx, ebx
call fcn.00468a20
mov eax, dword [ebx]
mov ebp, dword [ebx + 4]
cmp eax, 0x80000000
jne 0x4368cf
mov eax, dword [esp + 8]
mov dword [edi + 4], eax
mov dword [edi], ebp
cmp dword [esi], 0
je 0x4368c7
push dword [esi + 4]
push 0
push dword [0x4c0b18]
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, eax
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4368e1
mov byte [edi], 4
jmp 0x4368ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [edi], 0
mov dword [edi + 4], eax
test ebx, ebx
je 0x4368b1
push ebp
push 0
push dword [0x4c0b18]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4368b1
Function at 0x43e648
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x180
xor ebx, ebx
lea esi, [esp + 0x40]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov eax, dword [0x4c003c]
push esi
call eax
mov eax, dword [esi]
mov edx, dword [esi + 4]
cmp eax, 0xd53e8000
mov ecx, edx
sbb ecx, 0x19db1de
mov ecx, 0
mov edi, 0
jl 0x43e6a5
add eax, 0x2ac18000
adc edx, 0xfe624e21
push 0
push 0x989680
push edx
push eax
call fcn.0047de80
mov ecx, eax
mov edi, edx
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov esi, 0x4c957f2d
mov eax, ecx
mul esi
imul ecx, ecx, 0x5851f42d
add ecx, edx
imul edi, edi, 0x4c957f2d
add edi, ecx
add eax, 0x6fbe17f3
adc edi, 0xa17654e4
mov ecx, edi
mov edx, edi
shld edx, eax, 5
shr ecx, 0xd
xor edx, ecx
mov ecx, edi
shr ecx, 0x1b
ror edx, cl
mov dword [esp + ebx], edx
add ebx, 4
mov ecx, eax
cmp ebx, 0x20
jne 0x43e6b6
movaps xmm0, xmmword [esp]
movaps xmmword [esp + 0x30], xmm0
movaps xmm0, xmmword [esp + 0x10]
movaps xmmword [esp + 0x20], xmm0
push 0x100
push 0
lea esi, [esp + 0x48]
push esi
call fcn.0047f090
add esp, 0xc
mov dword [esp + 0x140], 0x40
movaps xmm0, xmmword [esp + 0x30]
movups xmmword [esp + 0x148], xmm0
movaps xmm0, xmmword [esp + 0x20]
movups xmmword [esp + 0x158], xmm0
xorps xmm0, xmm0
movups xmmword [esp + 0x168], xmm0
mov edi, 0xb
mov eax, dword [esp + 0x140]
cmp eax, 0x3f
jae 0x43e772
lea ecx, [eax + 2]
mov dword [esp + 0x140], ecx
mov ebx, dword [esp + eax*4 + 0x40]
mov ecx, dword [esp + eax*4 + 0x44]
jmp 0x43e79f
jne 0x43e78b
mov ebx, dword [esp + 0x13c]
mov ecx, esi
xor edx, edx
inc edx
call fcn.00414d18
mov ecx, dword [esp + 0x40]
jmp 0x43e79f
mov ecx, esi
mov edx, 2
call fcn.00414d18
mov ebx, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov eax, ebx
mul edi
mov ebx, edx
mov eax, ecx
mul edi
add eax, ebx
adc edx, 0
shr eax, 0x1c
cmp eax, 0xa
ja 0x43e752
mov ecx, edx
xor edx, edx
push 0
call fcn.00462c50
add esp, 4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44ce7e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x4c0004]
test eax, eax
je 0x44cf2f
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x44cea5
mov esi, eax
cmp dword [eax + 4], 0
jne 0x44cf20
mov eax, dword [0x4c0004]
test eax, eax
je 0x44cf3e
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x44cf25
mov esi, eax
test eax, eax
jne 0x44cefb
mov al, byte [0x4c0b90]
xor ecx, ecx
mov edx, 0x20
call fcn.0046de40
test eax, eax
je 0x44cf59
mov esi, eax
mov dword [eax], 0x4c0004
mov dword [eax + 4], 0
mov eax, dword [0x4c0004]
test eax, eax
je 0x44cf4d
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, esp
mov ecx, edi
call fcn.0044caee
movups xmm0, xmmword [edi]
movups xmm1, xmmword [edi + 0xc]
movups xmmword [esi + 0x10], xmm1
cmp dword [esi + 4], 0
movups xmmword [esi + 4], xmm0
je 0x44cf20
lock dec dword [0x4c0aac]
add esi, 4
jmp 0x44cf27
xor esi, esi
mov eax, esi
add esp, 0x1c
pop esi
pop edi
ret
mov ecx, 0x4c0004
call fcn.00491290
jmp 0x44ce91
mov ecx, 0x4c0004
call fcn.00491290
jmp 0x44ceb3
mov ecx, 0x4c0004
call fcn.00491290
jmp 0x44cef3
mov ecx, 4
mov edx, 0x20
call fcn.0048d220
int3

Function at 0x44cfa9
Capabilities:
Set thread local storage value

Disassembly:
push esi
sub esp, 8
mov eax, ecx
mov edx, dword [ecx]
mov esi, dword [ecx + 4]
mov ecx, esp
mov dword [ecx], edx
mov dword [ecx + 4], esi
xor esi, esi
mov edx, 0x4a9340
push esi
push 1
push dword [eax + 8]
push esi
call fcn.0046fd50
push edi
push esi
mov edi, dword [esp + 0xc]
mov esi, dword [edi]
mov eax, dword [esi]
test eax, eax
je 0x44cff0
dec eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [edi + 4], 0
je 0x44cfce
lock dec dword [0x4c0aac]
push edi
push 0
push dword [0x4c0b18]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esi]
test eax, eax
je 0x44cff9
dec eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop edi
ret
mov ecx, esi
call fcn.00491290
jmp 0x44cfb8
mov ecx, esi
call fcn.00491290
jmp 0x44cfe4
Function at 0x44d86e
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
movzx eax, byte [esp + 0x3c]
mov dword [esp + 4], eax
test edx, edx
jne 0x44d9dc
mov eax, ebx
and eax, 0x1f
mov dword [esp + 0x10], eax
mov esi, ebx
and esi, 0xffffffe0
lea eax, [edi + esi]
mov dword [esp + 8], eax
xor eax, eax
dec eax
mov edi, 0x4a9588
xor ecx, ecx
mov ebp, eax
mov edx, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], edx
mov al, byte [edi]
movzx ecx, al
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x54]
push ebx
mov eax, dword [esp + 0x54]
push eax
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push eax
call fcn.0044da10
add esp, 0x1c
test esi, esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], ebp
je 0x44d942
mov dword [esp], 0
xor ecx, ecx
mov edx, ebx
mov ebx, esi
xor ebp, ebp
xor esi, esi
xor edi, edi
mov al, byte [edx + edi]
inc edi
mov ah, al
sar ah, 7
xor al, ah
sub al, ah
movzx eax, al
add ebp, eax
adc esi, 0
cmp edi, 0x20
jne 0x44d909
add edx, 0x20
mov edi, dword [esp]
add edi, ebp
adc ecx, esi
mov eax, 0xffffffff
cmovb ecx, eax
cmovb edi, eax
mov dword [esp], edi
add ebx, 0xffffffe0
jne 0x44d903
jmp 0x44d94b
mov dword [esp], 0
xor ecx, ecx
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x44d978
xor esi, esi
xor edx, edx
xor ebx, ebx
mov edi, dword [esp + 8]
mov al, byte [edi + esi]
mov ah, al
sar ah, 7
xor al, ah
sub al, ah
movzx eax, al
add edx, eax
adc ebx, 0
inc esi
cmp ebp, esi
jne 0x44d95d
jmp 0x44d97c
xor edx, edx
xor ebx, ebx
mov edi, dword [esp + 0x20]
inc edi
mov esi, dword [esp]
add esi, edx
adc ecx, ebx
mov eax, 0xffffffff
cmovb ecx, eax
cmovb esi, eax
mov ebp, dword [esp + 0x1c]
cmp ebp, esi
mov edx, dword [esp + 0x18]
mov eax, edx
sbb eax, ecx
movzx eax, byte [esp + 0x24]
mov ebx, dword [esp + 0x14]
cmovb ebx, eax
cmp esi, ebp
mov eax, ecx
sbb eax, edx
cmovb edx, ecx
cmovb ebp, esi
mov ecx, ebx
lea eax, [0x4a958c]
cmp edi, eax
mov esi, dword [esp + 0xc]
mov ebx, dword [esp + 0x54]
jne 0x44d8b5
mov al, 4
cmp cl, 4
mov edi, dword [esp + 0x50]
je 0x44da05
mov eax, ecx
movzx ecx, al
mov esi, eax
mov edx, dword [esp + 4]
push ebx
push edi
mov eax, dword [esp + 0x54]
push eax
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push eax
call fcn.0044da10
add esp, 0x1c
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x455ec4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xffffffc0
mov eax, 0x4e40
call fcn.0047df70
mov dword [esp + 0xf8], edx
mov dword [esp + 0xec], ecx
call fcn.00455eea
Function at 0x45fc40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x47d820
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x4c0b1c]
test al, al
je 0x45fe11
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x45fc8c
cmp eax, 3
jne 0x45fe0a
mov ebx, dword [0x4c0b20]
test ebx, ebx
je 0x45fe0a
mov dword [ebp - 0x20], 0
jmp 0x45fcb7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x45fce8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x45fe5b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45fcb0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x45fcb0
test byte [ebp - 0x20], 1
je 0x45fe0a
mov ebx, dword [0x4c0b20]
test ebx, ebx
je 0x45fe0a
mov dword [ebp - 0x20], 0
jmp 0x45fd17
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x45fd48
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x45fe5b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45fd10
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x45fd10
test byte [ebp - 0x20], 1
je 0x45fe0a
mov ebx, dword [0x4c0b20]
test ebx, ebx
je 0x45fe0a
mov dword [ebp - 0x20], 0
jmp 0x45fd77
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x45fda8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x45fe5b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45fd70
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x45fd70
test byte [ebp - 0x20], 1
je 0x45fe0a
mov ebx, dword [0x4c0b20]
test ebx, ebx
je 0x45fe0a
mov dword [ebp - 0x20], 0
jmp 0x45fdd7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x45fe04
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x45fe5b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45fdd0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x45fdd0
test byte [ebp - 0x20], 1
jne 0x45fe24
movzx eax, byte [0x4bc400]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x4c0b20]
jmp 0x45fe2f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x45fe0a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x45fe5b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45fe2c
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x45fe2c
mov ecx, 0x4b0790
mov dword [ebp - 0x10], 0
call fcn.0048d740
ud2
Function at 0x460a80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x4c0060]
test eax, eax
je 0x460b35
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x460aac
cmp dword [eax + 4], 0
mov edi, eax
je 0x460aac
add edi, 8
jmp 0x460b30
mov eax, dword [0x4c0060]
test eax, eax
je 0x460b44
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x460b2e
mov esi, eax
test eax, eax
jne 0x460b04
movzx eax, byte [0x4c0b90]
xor ecx, ecx
mov edx, 0xc
call fcn.0046de40
test eax, eax
je 0x460b5f
mov dword [eax], 0x4c0060
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4c0060]
test eax, eax
je 0x460b53
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x460b30
test ecx, ecx
je 0x460b30
lock dec dword [ecx]
jne 0x460b30
call fcn.00460780
jmp 0x460b30
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x4c0060
call fcn.00491290
jmp 0x460a90
mov ecx, 0x4c0060
call fcn.00491290
jmp 0x460aba
mov ecx, 0x4c0060
call fcn.00491290
jmp 0x460afc
mov ecx, 4
mov edx, 0xc
call fcn.0048d220
int3

Function at 0x461030
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x4c0070]
test eax, eax
je 0x4610b1
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x46104f
cmp byte [eax + 4], 0
mov esi, eax
jne 0x4610a6
mov eax, dword [0x4c0070]
test eax, eax
je 0x4610c0
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4610ab
mov esi, eax
test eax, eax
jne 0x4610a0
movzx eax, byte [0x4c0b90]
xor ecx, ecx
mov edx, 8
call fcn.0046de40
test eax, eax
je 0x4610d8
mov dword [eax], 0x4c0070
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x4c0070]
test eax, eax
je 0x4610cc
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x4610ad
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x4c0070
call fcn.00491290
jmp 0x46103b
mov ecx, 0x4c0070
call fcn.00491290
jmp 0x461059
mov ecx, 0x4c0070
call fcn.00491290
jmp 0x461098
mov ecx, 4
mov edx, 8
call fcn.0048d220
int3
Function at 0x461e90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x4c0050]
test eax, eax
je 0x461f25
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x461eb6
cmp dword [eax + 4], 0
je 0x461eb6
add eax, 8
pop esi
ret
mov eax, dword [0x4c0050]
test eax, eax
je 0x461f34
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x461f21
mov esi, eax
test eax, eax
jne 0x461f0a
movzx eax, byte [0x4c0b90]
xor ecx, ecx
mov edx, 0x10
call fcn.0046de40
test eax, eax
je 0x461f4c
mov dword [eax], 0x4c0050
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4c0050]
test eax, eax
je 0x461f40
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x4c0050
call fcn.00491290
jmp 0x461e9f
mov ecx, 0x4c0050
call fcn.00491290
jmp 0x461ec0
mov ecx, 0x4c0050
call fcn.00491290
jmp 0x461f02
mov ecx, 4
mov edx, 0x10
call fcn.0048d220
int3
Function at 0x462dc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x34], 0x47d9a0
lea eax, [esi + 0x30]
mov ecx, dword fs:[0]
mov dword [esi + 0x30], ecx
mov dword fs:[0], eax
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x462f1a
mov ebx, dword [esi + 8]
mov ecx, dword [esi + 0xc]
movq xmm0, qword [0x4c0b28]
movd edx, xmm0
pextrd edi, xmm0, 1
mov dword [esi + 0x1c], ecx
mov eax, edx
or eax, edi
jne 0x462e76
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x462f53
movq xmm0, qword [esi + 8]
mov edx, dword [esi + 8]
mov edi, dword [esi + 0xc]
movq qword [0x4c0b28], xmm0
mov eax, edx
mov ecx, dword [esi + 0x1c]
or eax, edi
je 0x462f06
mov dword [esi + 0x20], ebx
push edi
push edx
push ecx
push ebx
mov ebx, edi
mov edi, edx
call fcn.0047de80
mov ecx, ebx
mov dword [esi + 4], edx
mov dword [esi + 0x24], eax
imul ecx, eax
mul edi
add edx, ecx
mov ecx, edi
imul ecx, dword [esi + 4]
add ecx, edx
mov edx, dword [esi + 0x20]
sub edx, eax
mov eax, dword [esi + 0x1c]
sbb eax, ecx
imul ecx, eax, 0x3b9aca00
mov eax, edx
mov edx, 0x3b9aca00
mul edx
add edx, ecx
push ebx
push edi
push edx
push eax
call fcn.0047de80
mov ecx, eax
mov eax, dword [esi + 0x24]
mov ebx, edx
mov edx, 0x3b9aca00
mul edx
mov edi, eax
imul eax, dword [esi + 4], 0x3b9aca00
add eax, edx
add edi, ecx
adc eax, ebx
push 0
push 0x3b9aca00
push eax
push edi
call fcn.0047de80
imul ecx, eax, 0xc4653600
add ecx, edi
mov edi, dword [esi + 0x30]
mov dword fs:[0], edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.attempt_to_divide_by_zero
mov edx, 0x19
push 0x4afb40
call fcn.0048d410
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x38], 0
lea eax, [esi + 0x14]
mov ecx, 0x4b35f7
mov edx, 0x2b
push 0x4b0894
push 0x4aebd4
push eax
call fcn.0048d6c0
add esp, 0xc
jmp 0x462f8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x38], 1
lea eax, [esi + 0x14]
mov ecx, 0x4b35f7
mov edx, 0x2b
push 0x4b0884
push 0x4aebd4
push eax
call fcn.0048d6c0
add esp, 0xc
ud2
Function at 0x4687c0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x46880d
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x46881d
mov dword [esi + 4], 0
jmp 0x46882f
cmp eax, 0x103
je 0x468847
test eax, eax
js 0x468838
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x468832
mov eax, esp
mov dword [esp + 0x1c], 0x4b01c8
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.00460250
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.004603b0
mov ecx, 7
int 0x29
ud2
Function at 0x46c480
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x4c0080]
test eax, eax
je 0x46c535
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x46c4ac
cmp dword [eax + 4], 0
mov edi, eax
je 0x46c4ac
add edi, 8
jmp 0x46c530
mov eax, dword [0x4c0080]
test eax, eax
je 0x46c544
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x46c52e
mov esi, eax
test eax, eax
jne 0x46c504
movzx eax, byte [0x4c0b90]
xor ecx, ecx
mov edx, 0xc
call fcn.0046de40
test eax, eax
je 0x46c55f
mov dword [eax], 0x4c0080
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4c0080]
test eax, eax
je 0x46c553
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x46c530
test ecx, ecx
je 0x46c530
lock dec dword [ecx]
jne 0x46c530
call fcn.0046c570
jmp 0x46c530
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x4c0080
call fcn.00491290
jmp 0x46c490
mov ecx, 0x4c0080
call fcn.00491290
jmp 0x46c4ba
mov ecx, 0x4c0080
call fcn.00491290
jmp 0x46c4fc
mov ecx, 4
mov edx, 0xc
call fcn.0048d220
int3

Function at 0x46d830
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x47dbd0
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x30], xmm0
lea eax, [esi + 0x30]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x46d898
movaps xmm0, xmmword [esi + 0x30]
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
movups xmmword [edi], xmm0
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esi + 8]
lea ecx, [esi + 0x10]
mov dword [esi + 0x18], 0x4b03d4
mov dword [esi + 0x1c], 1
mov dword [esi + 0x28], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x10], edx
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x18]
mov edx, 0x4b0404
mov dword [esi + 0x14], fcn.004673c0
mov dword [esi + 0x24], 1
call fcn.0048d2c0
ud2