joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478ab1
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x478b49
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x478b46
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x478b46
lea eax, [esi - 1]
push eax
push dword [0x6b2730]
call fcn.0048fbd2
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x478b48
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x478b3d
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x478c30
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x478b23
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x478bef
push eax
call esi
test al, al
jns 0x478bef
push 0x11
call esi
test al, al
js 0x478bef
push 0x10
call esi
test al, al
js 0x478bef
push 0x12
call esi
test al, al
js 0x478bef
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x478bef
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x478bc3
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x478bda
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x478c3a
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x478c3a
test ebp, ebp
je 0x478c13
push 0x11
call esi
test al, al
js 0x478c0b
push 0x10
call esi
test al, al
js 0x478c0b
push 0x12
call esi
test al, al
jns 0x478c13
push 1
push ebp
call fcn.00478c46
test ebx, ebx
je 0x478c27
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x478c3a
test edi, edi
je 0x478c3a
mov eax, dword [edi + 8]
jmp 0x478c3c
and dword [esp + 0x14], 0
jmp 0x478b48
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x4790e8
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0x6b1538]
push esi
test eax, eax
jne 0x47910d
push fcn.00479215
push 0x10
push 0x258
call fcn.0048fca5
mov dword [0x6b1538], eax
push dword [esp + 0xc]
push eax
call fcn.0048fc11
mov esi, eax
test esi, esi
je 0x47920e
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x47912f
mov edi, 0x52bbe0
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x47913f
xor eax, eax
cmp word [ebx], ax
jne 0x479144
mov ebx, 0x52ee1c
push edi
call sub.MSVCRT.dll_wcslen
push ebx
mov dword [esp + 0x24], eax
call sub.MSVCRT.dll_wcslen
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x637ce0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x4791f5
push edi
push eax
call sub.MSVCRT.dll_wcscpy
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x4791a5
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x4791a9
push 0x52ee18
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
jmp 0x4791a9
mov edi, dword [esp + 0x18]
push ebx
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x4791cd
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x4791e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4791e1
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0x637ce0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x47920c
cmp dword [esp + 0x14], 0xffffffff
je 0x479200
mov esi, dword [esp + 0x14]
push esi
push dword [0x6b1538]
call fcn.0048fb83
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc
Function at 0x47f941
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [0x6b2778]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov ecx, dword [ebx + 0x74]
cmp ecx, 2
je 0x47f96e
cmp ecx, 3
je 0x47f96e
cmp ecx, 8
je 0x47f96e
cmp ecx, 0xc
jne 0x47fa56
fldz
fld dword [ebp + 8]
fcom st(1)
fnstsw ax
test ah, 5
jp 0x47f980
fstp st(0)
jmp 0x47f98f
fstp st(1)
fld1
fcom st(1)
fnstsw ax
test ah, 5
jp 0x47f997
fstp st(1)
fstp dword [ebp + 8]
fld dword [ebp + 8]
jmp 0x47f999
fstp st(0)
push esi
mov esi, dword [ebx + 0xbc]
push edi
xor edi, edi
jmp 0x47f9c3
fld dword [esi + 4]
fld st(1)
fucompp
fnstsw ax
test ah, 0x44
jnp 0x47fa14
fld dword [esi + 4]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x47f9ea
mov edi, esi
mov esi, dword [esi]
test esi, esi
jne 0x47f9a5
fstp st(0)
push 0x18
push 0
push dword [0x637ce0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x47fa54
and dword [edx], 0
test edi, edi
je 0x47fa1e
mov dword [edi], edx
jmp 0x47fa24
push 0x18
push 0
push dword [0x637ce0]
fstp st(0)
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x47f9c9
mov dword [edx], esi
test edi, edi
je 0x47fa0c
mov dword [edi], edx
jmp 0x47fa18
mov dword [ebx + 0xbc], edx
jmp 0x47fa18
fstp st(0)
mov edx, esi
test edx, edx
jne 0x47fa24
jmp 0x47f9c9
mov dword [ebx + 0xbc], edx
mov ecx, dword [ebp + 0xc]
mov esi, 0xff
fld dword [ebp + 8]
movzx eax, cl
mov dword [edx + 8], eax
mov eax, ecx
sar eax, 8
and eax, esi
mov dword [edx + 0xc], eax
mov eax, ecx
sar eax, 0x10
and eax, esi
sar ecx, 0x18
and ecx, esi
mov dword [edx + 0x10], eax
fstp dword [edx + 4]
mov dword [edx + 0x14], ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x480012
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0x6b2778]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
mov eax, dword [edx + 0x2c]
test eax, eax
je 0x480049
push dword [ebp + 0x14]
mov ecx, dword [edx + 0x90]
add ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [edx + 0x8c]
add ecx, dword [ebp + 0xc]
push ecx
push dword [ebp + 8]
push edx
call eax
jmp 0x480064
mov eax, dword [edx + 0x90]
add eax, dword [ebp + 0x10]
push eax
mov eax, dword [edx + 0x8c]
add eax, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
push edx
call dword [edx + 0x24]
pop ebp
ret 0x10

Function at 0x480068
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0x6b2778]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi + 0xac]
je 0x480090
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
mov eax, dword [esi + 0x90]
mov ecx, dword [esi + 0x34]
add eax, dword [ebp + 0xc]
test ecx, ecx
je 0x4800ba
fld dword [ebp + 0x14]
push ecx
fstp dword [esp]
push dword [ebp + 0x10]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [ebp + 8]
push eax
push esi
call ecx
jmp 0x4800cc
push dword [ebp + 0x10]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [ebp + 8]
push eax
push esi
call dword [esi + 0x30]
pop esi
pop ebp
ret 0x14
Function at 0x48017f
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0x6b2778]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [ebp + 0x14], 0
mov ecx, eax
jle 0x4801bd
cmp dword [ebp + 0x18], 0
jle 0x4801bd
push dword [ebp + 0x18]
mov eax, dword [ecx + 0x90]
push dword [ebp + 0x14]
add eax, dword [ebp + 0x10]
push eax
mov eax, dword [ecx + 0x8c]
add eax, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
push ecx
call dword [ecx + 0x28]
pop ebp
ret 0x14

Function at 0x48024a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0x6b2778]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi + 0xac]
je 0x480272
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
mov ecx, dword [esi + 0x90]
mov eax, dword [ebp + 0x14]
mov edx, dword [esi + 0x8c]
add eax, ecx
push eax
mov eax, dword [ebp + 0x10]
add eax, edx
push eax
mov eax, dword [ebp + 0xc]
add eax, ecx
push eax
mov eax, dword [ebp + 8]
add eax, edx
push eax
push esi
call dword [esi + 0x48]
pop esi
pop ebp
ret 0x14

Function at 0x48029f
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0x6b2778]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi + 0xac]
je 0x4802c7
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [ebp + 0x14]
mov eax, dword [esi + 0x90]
push dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [ebp + 8]
push eax
push esi
call dword [esi + 4]
pop esi
pop ebp
ret 0x14

Function at 0x480353
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x184
push 8
push dword [0x637ce0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x6b2778]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x6b277c], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.00482f86
mov dword [esi + 0x58], 0x480f66
mov eax, esi
mov dword [esi + 0x5c], 0x480fb2
mov dword [esi + 0x10], fcn.00480b07
mov dword [esi + 0x30], 0x4809f9
mov dword [esi + 0x64], 0x48103c
mov dword [esi + 0x60], 0x480ff4
mov dword [esi + 0x34], 0x4806a9
mov dword [esi + 0x24], 0x480680
mov dword [esi + 0x28], 0x480655
mov dword [esi + 0x2c], 0x4805a7
mov dword [esi + 0x44], 0x480d6c
pop esi
ret 4
Function at 0x488fdf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
xor ebp, ebp
push esi
test ebx, ebx
je 0x488ff3
mov esi, ebx
jmp 0x488ffd
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
je 0x4890ee
lea eax, [esp + 0x18]
push eax
push 0x18
pop eax
push eax
push dword [esp + 0x68]
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x4890e3
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push edi
mov edi, dword [esp + 0x24]
push 0x2c
push 0
push eax
mov dword [esp + 0x20], ebp
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [esp + 0x34], 0x28
xor eax, eax
mov dword [esp + 0x38], ebp
inc eax
mov dword [esp + 0x3c], edi
mov word [esp + 0x40], ax
xor ecx, ecx
push 0x18
pop eax
push ecx
push ecx
mov word [esp + 0x4a], ax
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [esp + 0x44]
mov dword [esp + 0x54], ecx
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x4890e2
push 0
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x18]
push edi
push 0
push dword [esp + 0x78]
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
imul edi, dword [esp + 0x14]
test edi, edi
jle 0x4890e2
mov ebx, dword [esp + 0x10]
push 3
pop ebp
movzx ecx, byte [ebx + 1]
movzx eax, byte [ebx + 2]
add eax, ecx
movzx ecx, byte [ebx]
add eax, ecx
cdq
idiv ebp
mov byte [ebx], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 1], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 2], al
mov ebx, dword [esp + 0x10]
add ebx, ebp
mov dword [esp + 0x10], ebx
dec edi
jne 0x4890ab
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x18]
pop edi
test ebx, ebx
jne 0x4890ee
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x50
ret 8

Function at 0x48b3b0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x48b3e2
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x48b3dd
cmp dword [esp + 0xc], esi
je 0x48b3f9
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret

Function at 0x48f592
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x6b1ac0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x48f5f3
push esi
push dword [0x6b1abc]
push 8
push dword [0x637ce0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x6b1ac0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x6b1ab8]
jmp 0x48f5e3
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x48f5e1
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x48f5d1
push edi
push 0x48f530
call fcn.00529526
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4
Function at 0x48f5fd
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ecx, esi
push edi
and ecx, 3
je 0x48f613
push 4
pop eax
sub eax, ecx
add esi, eax
mov eax, dword [0x6b1abc]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x48f64a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
push 8
push dword [0x637ce0]
mov dword [0x6b1ac0], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x6b1ac0]
call ebx
mov eax, dword [0x6b1abc]
mov edi, eax
add eax, esi
push eax
push dword [0x6b1ac0]
mov dword [0x6b1abc], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x637ce0]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x6b1ac0]
call ebx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test esi, esi
jne 0x48f68a
test ebx, ebx
je 0x48f6ab
push 0x14
push 0x6b1ab8
call fcn.0048ff41
pop ecx
pop ecx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
test esi, esi
je 0x48f6ab
lea ecx, [edi + ebp]
push ecx
call esi
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x490090
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x633f80]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
sub edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x4900d6
mov ecx, dword [ebp - 4]
add ecx, 0xa
push ecx
push 0
mov edx, dword [0x6b288c]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x4900f7
mov edx, dword [ebp - 4]
add edx, 0xa
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x6b288c]
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
shr edx, 1
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.004906d0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov esp, ebp
pop ebp
ret 8

Function at 0x4901c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x633f80]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 2
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret

Function at 0x490220
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x633f80]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ebp - 4]
add eax, dword [edx + 8]
mov esp, ebp
pop ebp
ret
Function at 0x490250
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x633f80]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_wcsncpy
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov dword [edx + 8], eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4903c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x633f80]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x4903e4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
lea eax, [ecx + edx*2]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
sub edx, 4
cmp dword [ebp - 8], edx
jl 0x490434
mov eax, dword [ebp - 8]
add eax, 0x4000
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x6b288c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x49047c
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0x100000
jle 0x49047c
cmp dword [ebp - 8], 0x100000
jge 0x490450
mov dword [ebp - 8], 0x100000
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x6b288c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*2]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x4904a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x633f80]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
shl ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
sub eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x490620
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x633f80]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x49065e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x49065e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x490660
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x490720
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x633f80]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x490ab0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x633f80]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x490af0
Capabilities:
Query environment variable

Disassembly:
push str.EXPAT_ENTROPY_DEBUG
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x490b54
mov ecx, 0x531d30
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x490b27
test dl, dl
je 0x490b23
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x490b27
add eax, 2
add ecx, 2
test dl, dl
jne 0x490b07
xor eax, eax
jmp 0x490b2c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x490b54
push 4
push dword [esp + 0xc]
push 8
push dword [esp + 0x10]
push str.Entropy:__s_____0x_0lx___lu_bytes__n
call dword [sym.imp.MSVCRT.dll___p__iob]
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0x18
mov eax, dword [esp + 8]
ret

Function at 0x494ec0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub esp, 0xc
push esi
xor esi, esi
jmp 0x494ed0
push 4
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x494f21
mov edx, dword [esp + 4]
xor ecx, ecx
mov edi, edi
cmp esi, 4
jae 0x494f0b
mov eax, edx
shr eax, cl
add ecx, 8
mov byte [esp + esi + 8], al
inc esi
cmp ecx, 0x20
jb 0x494ef0
cmp esi, 4
jb 0x494ed0
push dword [esp + 8]
push str.rand_s
call fcn.00490af0
add esp, 8
pop esi
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [esp + 8]
xor esi, dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, esi
imul eax, eax, 0x7fffffff
push eax
push str.fallback_4_
call fcn.00490af0
add esp, 8
pop esi
add esp, 0xc
ret
Function at 0x4e8970
Capabilities:
Encode data using xor

Disassembly:
push edi
call fcn.004e89b0
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
not eax
test edi, edi
je 0x4e89a9
push esi
mov esi, dword [esp + 0xc]
lea esp, [esp]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x6b2890]
dec edi
jne 0x4e8990
pop esi
not eax
pop edi
ret
Function at 0x4ea0d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x6b1b08], 0
push ebx
push esi
push edi
jne 0x4ea1ee
mov byte [0x6b1b08], 1
xor esi, esi
lea esp, [esp]
mov ecx, esi
xor eax, eax
and ecx, 1
mov edx, esi
or ecx, eax
je 0x4ea110
shrd edx, eax, 1
shr eax, 1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
jmp 0x4ea116
shrd edx, eax, 1
shr eax, 1
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x4ea131
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x4ea14c
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x4ea167
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x4ea182
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x4ea19d
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x4ea1b8
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x4ea1d3
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov dword [esi*8 + 0x6b1b10], edx
mov dword [esi*8 + 0x6b1b14], eax
inc esi
cmp esi, 0x100
jb 0x4ea0f0
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
not ebx
mov edi, dword [esp + 0x14]
not edx
test edi, edi
je 0x4ea229
mov esi, dword [esp + 0x10]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
shrd ebx, edx, 8
xor ecx, eax
shr edx, 8
xor ebx, dword [ecx*8 + 0x6b1b10]
xor edx, dword [ecx*8 + 0x6b1b14]
dec edi
jne 0x4ea206
pop edi
not ebx
not edx
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x4feb30
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4feb50
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4feb50
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4feb50
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]