joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2d3a5c86
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4310d2
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5f220e37
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x44015a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x440168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x44014a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x440145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x440145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret
Function at 0x401370
Capabilities:
Create pipe
Create process on windows
Query environment variable
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c0c
call fcn.00409c10
mov eax, dword [0x45ad2c]
mov ecx, dword [0x45a7b8]
push ebx
shr eax, 3
push esi
push edi
test eax, eax
je 0x4014a4
mov ebx, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [0x45ad2c], 0x959
jne 0x40148e
push 0
lea eax, [ebp - 0x1408]
push eax
push 0
push 0
push 0
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push 0
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edx, [ebp - 0x1008]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0
lea eax, [ebp - 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
push 0
push str.pihonalurexotorohematabezizo
push 0
push 0
push 0
call esi
push 0
lea ecx, [ebp - 0x1c08]
push ecx
push 0
call edi
mov edx, dword [ebp - 4]
push edx
call fcn.004010e0
add dword [ebp - 4], 8
dec dword [ebp - 8]
jne 0x4013ae
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40403b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44b770]
jne 0x404045
repz ret
jmp fcn.004078cc

Function at 0x40966b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44b770]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405da8
and dword [ebp - 0x14], 0
cmp dword [0x451e30], 0
mov dword [ebp - 0x18], eax
jne 0x40971e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4097c6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4097c6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x451e30], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x451e34], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x451e38], eax
call edi
push eax
call esi
mov dword [0x451e40], eax
test eax, eax
je 0x40971e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x451e3c], eax
mov eax, dword [0x451e3c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409777
cmp dword [0x451e40], ecx
je 0x409777
push eax
call esi
push dword [0x451e40]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409777
test ebx, ebx
je 0x409777
call edi
test eax, eax
je 0x40976e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40976e
test byte [ebp - 8], 1
jne 0x409777
or dword [ebp + 0x10], 0x200000
jmp 0x4097aa
mov eax, dword [0x451e34]
cmp eax, dword [ebp - 0x18]
je 0x4097aa
push eax
call esi
test eax, eax
je 0x4097aa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4097aa
mov eax, dword [0x451e38]
cmp eax, dword [ebp - 0x18]
je 0x4097aa
push eax
call esi
test eax, eax
je 0x4097aa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x451e30]
call esi
test eax, eax
je 0x4097c6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4097c8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040403b
leave
ret
Function at 0x4029b8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404268
test esi, esi
jne 0x4029ee
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404358
jmp 0x402a0c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040286c
mov edi, eax
test esi, esi
je 0x402a0c
cmp dword [ebx], 0
je 0x402a0c
dec esi
jmp 0x4029f5
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4033a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41d00c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403438
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403418
xor eax, eax
push ebp
push 0x403411
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403454
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403418
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x41d00c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41d00c], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040ec
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41e044], 0
je 0x40414d
cmp word [0x41e218], 0xd7b2
jne 0x404115
cmp dword [0x41e220], 0
jbe 0x404115
mov eax, 0x41e214
call dword [0x41e230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41d054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404174
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41d01c], 0
jne 0x404169
push 0
push 0x41d074
push 0x41d054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405a68
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405c98
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405aeb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405c98
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405aeb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405cb4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405b74
xor eax, eax
push ebp
push 0x405b6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004058b0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405b52
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405cd4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405b52
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b74
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405c8e
cmp byte [ebp - 0xd], 0
jne 0x405bbb
cmp byte [ebp - 0x12], 0
je 0x405c8e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405bd4
dec ebx
cmp byte [ebx], 0x2e
je 0x405be3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405bd3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405c8e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405c20
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405c8e
cmp byte [ebp - 0xd], 0
je 0x405c8e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405c8e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4087d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40880d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404358
jmp 0x408816
mov eax, ebx
mov edx, esi
call fcn.004042bc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408820
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408841
mov al, byte [esp]
jmp 0x408843
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x408ec8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x408d40
mov eax, dword [0x41d87c]
cmp byte [eax], 0
je 0x408f30
mov eax, dword [0x41d6f8]
call fcn.00402d50
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407b28
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x408f78
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x408f66
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x41d6c4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x41e710]
call fcn.00405874
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x409a04
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x409a68
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044d0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407898
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a6f
lea eax, [ebp - 0xc]
call fcn.00404268
ret
Function at 0x410630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x410680
cmp esi, edi
ja 0x4106e8
cmp edi, dword [esp + 0x1c]
ja 0x4106fb
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x410682
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x410670
jmp 0x4106df
ja 0x410688
cmp eax, edx
mov esi, edi
jne 0x410643
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x4106c0
mov ebp, esi
sub ecx, edx
jns 0x4106d7
jmp 0x4106e1
cmp esi, edi
je 0x410710
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x4106e1
xor al, 1
cmp ebp, edi
jne 0x4106a0
jmp 0x4106e1
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x44b650
call fcn.00446f70
add esp, 4
ud2
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x44b650
call fcn.00446d60
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112librarycore_srcio_borrowed_buf.rs_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_alloc_srccollections_btree_navigate.rs
mov edx, 0x2b
push 0x44b640
call fcn.00446dd0
add esp, 4
ud2
Function at 0x411c9e
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, edx
mov edx, dword [esp + 0x18]
mov ebx, ecx
not ebx
cmp edx, 0x40
jb 0x411dc5
push 4
pop edi
sub edi, 1
jb 0x411cad
cmp edx, 0xf
jbe 0x411dd5
movzx ebp, byte [eax + 0xe]
movzx esi, byte [eax + 0xf]
mov ecx, ebx
mov dword [esp], edx
mov edx, 0xff
shr ecx, 0x18
mov ebp, dword [ebp*4 + 0x44c444]
xor ebp, dword [esi*4 + 0x44c044]
movzx esi, byte [eax + 0xd]
xor ebp, dword [esi*4 + 0x44c844]
movzx esi, byte [eax + 0xc]
xor ebp, dword [esi*4 + 0x44cc44]
movzx esi, byte [eax + 0xb]
xor ebp, dword [esi*4 + 0x44d044]
movzx esi, byte [eax + 0xa]
xor ebp, dword [esi*4 + 0x44d444]
movzx esi, byte [eax + 9]
xor ebp, dword [esi*4 + 0x44d844]
movzx esi, byte [eax + 8]
xor ebp, dword [esi*4 + 0x44dc44]
movzx esi, byte [eax + 7]
xor ebp, dword [esi*4 + 0x44e044]
movzx esi, byte [eax + 6]
xor ebp, dword [esi*4 + 0x44e444]
movzx esi, byte [eax + 5]
xor ebp, dword [esi*4 + 0x44e844]
movzx esi, byte [eax + 4]
xor ebp, dword [esi*4 + 0x44ec44]
movzx esi, byte [eax + 3]
xor ecx, esi
mov esi, ebx
xor ebp, dword [ecx*4 + 0x44f044]
movzx ecx, byte [eax + 2]
shr esi, 0x10
and esi, edx
xor esi, ecx
movzx ecx, byte [eax + 1]
xor ebp, dword [esi*4 + 0x44f444]
mov esi, ebx
and ebx, edx
shr esi, 8
and esi, edx
mov edx, dword [esp]
xor esi, ecx
movzx ecx, byte [eax]
xor ebp, dword [esi*4 + 0x44f844]
xor ebx, ecx
mov ecx, eax
xor ebp, dword [ebx*4 + 0x44fc44]
push 0x44c034
call fcn.0041222c
pop ecx
mov ebx, ebp
jmp 0x411cb9
mov cl, byte [eax]
inc eax
dec edx
xor cl, bl
shr ebx, 8
movzx esi, cl
xor ebx, dword [esi*4 + 0x44c044]
test edx, edx
jne 0x411db2
not ebx
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xf
pop ecx
push 0x44c024
call fcn.00446cf0
pop eax
ud2
Function at 0x41df00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x45e04c]
test eax, eax
je 0x41dfb3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x41df2c
cmp dword [eax + 4], 0
mov edi, eax
je 0x41df2c
add edi, 8
jmp 0x41dfae
mov eax, dword [0x45e04c]
test eax, eax
je 0x41dfc2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x41dfac
mov esi, eax
test eax, eax
jne 0x41df82
movzx eax, byte [0x45eaa8]
mov ecx, 0xc
call fcn.0040c700
test eax, eax
je 0x41dfdd
mov dword [eax], 0x45e04c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45e04c]
test eax, eax
je 0x41dfd1
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x41dfae
test ecx, ecx
je 0x41dfae
lock dec dword [ecx]
jne 0x41dfae
call fcn.0041dc00
jmp 0x41dfae
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x45e04c
call fcn.00447840
jmp 0x41df10
mov ecx, 0x45e04c
call fcn.00447840
jmp 0x41df3a
mov ecx, 0x45e04c
call fcn.00447840
jmp 0x41df7a
mov ecx, 4
mov edx, 0xc
call fcn.00446b30
ud2
Function at 0x41ec20
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x41ec74
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x41ec97
test eax, eax
js 0x41ec83
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x41ec8f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x454070
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0041d710
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0041d840
mov ecx, 7
int 0x29
ud2
Function at 0x41f260
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x45e03c]
test eax, eax
je 0x41f2f3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x41f286
cmp dword [eax + 4], 0
je 0x41f286
add eax, 8
pop esi
ret
mov eax, dword [0x45e03c]
test eax, eax
je 0x41f302
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x41f2ef
mov esi, eax
test eax, eax
jne 0x41f2d8
movzx eax, byte [0x45eaa8]
mov ecx, 0x10
call fcn.0040c700
test eax, eax
je 0x41f31a
mov dword [eax], 0x45e03c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45e03c]
test eax, eax
je 0x41f30e
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x45e03c
call fcn.00447840
jmp 0x41f26f
mov ecx, 0x45e03c
call fcn.00447840
jmp 0x41f290
mov ecx, 0x45e03c
call fcn.00447840
jmp 0x41f2d0
mov ecx, 4
mov edx, 0x10
call fcn.00446b30
ud2
Function at 0x421170
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x437ab0
mov dword [ebp - 0x28], ecx
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x30], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jae 0x421200
jmp 0x4211ee
jbe 0x42128c
cmp esi, 0x201
jae 0x421200
mov dword [ebp - 0x2c], 0x200
lea ebx, [ebp - 0x44c]
mov edi, esi
jmp 0x42123b
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x42122c
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
mov edx, edi
push esi
call fcn.00447ad0
add esp, 4
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x42125b
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x4212c4
cmp esi, edi
jne 0x4211e0
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4212ff
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x4211ee
jmp 0x421200
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
cmp esi, edx
ja 0x42131f
lea ecx, [ebp - 0x4c]
mov edx, ebx
push esi
call fcn.004219c0
add esp, 4
movsd xmm0, qword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
movsd xmm1, qword [ebp - 0x44]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
jmp 0x4212d7
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp - 0x28]
mov byte [ecx], 0
mov dword [ecx + 4], eax
mov byte [ecx + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4212eb
mov ecx, dword [ebp - 0x24]
mov edx, 2
call fcn.0040c730
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, str.internal_error:_entered_unreachable_code_bE
mov edx, 0x28
push 0x4547c8
call fcn.00446dd0
add esp, 4
jmp 0x42132e
mov ecx, esi
push 0x4547b8
call fcn.00446d60
add esp, 4
ud2
Function at 0x429550
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x45e06c]
test eax, eax
je 0x429603
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x42957c
cmp dword [eax + 4], 0
mov edi, eax
je 0x42957c
add edi, 8
jmp 0x4295fe
mov eax, dword [0x45e06c]
test eax, eax
je 0x429612
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4295fc
mov esi, eax
test eax, eax
jne 0x4295d2
movzx eax, byte [0x45eaa8]
mov ecx, 0xc
call fcn.0040c700
test eax, eax
je 0x42962d
mov dword [eax], 0x45e06c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45e06c]
test eax, eax
je 0x429621
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x4295fe
test ecx, ecx
je 0x4295fe
lock dec dword [ecx]
jne 0x4295fe
call fcn.00429640
jmp 0x4295fe
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x45e06c
call fcn.00447840
jmp 0x429560
mov ecx, 0x45e06c
call fcn.00447840
jmp 0x42958a
mov ecx, 0x45e06c
call fcn.00447840
jmp 0x4295ca
mov ecx, 4
mov edx, 0xc
call fcn.00446b30
ud2