joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425c72
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x425d08
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x425d05
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x425d05
lea eax, [esi - 1]
push eax
push dword [0x51b5f4]
call fcn.00409495
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x425d07
mov ecx, dword [edi + 4]
add ecx, 4
pop esi
cmp word [ecx - 2], si
jne 0x425cf5
mov edx, 0xfa01
cmp word [ecx], dx
je 0x425d00
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x425ce5
jmp 0x425d05
and dword [esp + 0x10], 0
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x425dae
push eax
call esi
test al, al
jns 0x425dae
push 0x11
call esi
test al, al
js 0x425dae
push 0x10
call esi
test al, al
js 0x425dae
push 0x12
call esi
test al, al
js 0x425dae
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x425dae
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call fcn.00428768
add esp, 0xc
test eax, eax
je 0x425d82
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call fcn.00428768
add esp, 0xc
test eax, eax
jne 0x425d99
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x425def
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call fcn.00409b44
pop ecx
pop ecx
test eax, eax
je 0x425def
test ebp, ebp
je 0x425dd2
push 0x11
call esi
test al, al
js 0x425dca
push 0x10
call esi
test al, al
js 0x425dca
push 0x12
call esi
test al, al
jns 0x425dd2
push 1
push ebp
call fcn.00425f13
test ebx, ebx
je 0x425de6
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x425def
test edi, edi
je 0x425def
mov eax, dword [edi + 8]
jmp 0x425df1
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x4275df
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0045f620
mov eax, dword [0x518f00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0042f4e8
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x427621
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x42777d
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0045f570
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x51bfc0]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.0045ee4f
mov ecx, dword [esi*4 + 0x51bfc0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x427776
cmp eax, dword [ecx + edi + 0x24]
jne 0x427776
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x427776
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0045ee4f
add esp, 0x14
test edx, edx
jl 0x427776
jg 0x4276ec
test eax, eax
jb 0x427776
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x427776
jl 0x427706
cmp dword [ebp - 0x1008], eax
ja 0x427776
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x427724
test ebx, ebx
je 0x42775d
cmp ecx, edi
jae 0x42775d
mov al, byte [ecx]
cmp al, 0xd
jne 0x42773e
lea eax, [edi - 1]
cmp ecx, eax
jae 0x42774a
cmp byte [ecx + 1], 0xa
jne 0x42774a
inc ecx
jmp 0x42774a
movzx eax, al
movsx eax, byte [eax + 0x519450]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x427724
cmp edx, ebx
jne 0x427724
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x42777b
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0042f6af
leave
ret

Function at 0x427be0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x427c18
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x427c13
xor eax, eax
cmp dword [esp + 0xc], esi
pop edi
sete al
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call fcn.004095d0
add dword [edi + 8], esi
add esp, 0xc
mov eax, 1
pop edi
pop esi
ret
Function at 0x428a20
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x518cb4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
add eax, dword [esp + 4]
ret 4

Function at 0x428a40
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
cmp dword [ebx + 0x14], 0
jne 0x428a62
push ebx
call fcn.00407ba0
mov dword [ebx + 0x14], 1
mov dword [ebx + 0xc], 0
mov ebp, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov esi, dword [esp + 0x1c]
sub ecx, ebp
add ecx, dword [ebx + 0x10]
cmp ebp, esi
jl 0x428ade
mov eax, esi
sub eax, 1
je 0x428aca
sub eax, 1
je 0x428ab4
sub eax, 2
je 0x428aa0
push esi
push ecx
push dword [esp + 0x20]
call fcn.004095d0
add esp, 0xc
mov eax, esi
sub dword [ebx + 0xc], esi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [ecx]
pop edi
mov dword [eax], ecx
mov eax, esi
sub dword [ebx + 0xc], esi
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
mov cx, word [ecx]
pop edi
mov word [eax], cx
mov eax, esi
sub dword [ebx + 0xc], esi
pop esi
pop ebp
pop ebx
ret 0xc
mov dl, byte [ecx]
mov eax, esi
mov ecx, dword [esp + 0x18]
pop edi
mov byte [ecx], dl
sub dword [ebx + 0xc], esi
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
push ebp
push ecx
push eax
call fcn.004095d0
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [ebx + 8]
add eax, ebp
mov ecx, dword [ebx]
sub esi, ebp
mov dword [esp + 0x18], eax
push 0
cmp esi, edx
jl 0x428b26
lea edx, [esp + 0x18]
push edx
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
add eax, ebp
mov dword [ebx + 0xc], 0
pop ebp
pop ebx
ret 0xc
lea eax, [esp + 0x18]
push eax
push edx
push dword [ebx + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
cmp esi, eax
jle 0x428b46
mov esi, eax
mov eax, dword [esp + 0x18]
push esi
push dword [ebx + 4]
push eax
call fcn.004095d0
sub dword [ebx + 0xc], esi
lea eax, [esi + ebp]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x428b70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push 0x1000
push 0
push dword [0x51aa3c]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x428d00
mov cl, byte [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov esi, edx
mov edi, edi
cmp ebp, 0xffffffff
je 0x428bbe
test ebp, ebp
je 0x428c66
dec ebp
cmp dword [ebx + 4], 0
lea edi, [ebx + 4]
je 0x428bda
push 1
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00428a40
mov dword [esp + 0x10], eax
jmp 0x428bf4
push 0
lea eax, [esp + 0x14]
push eax
push 1
lea eax, [esp + 0x30]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
mov cl, byte [esp + 0x24]
cmp eax, 1
jne 0x428c69
test cl, cl
je 0x428c08
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x24]
mov eax, dword [esp + 0x14]
mov edi, esi
mov edx, dword [esp + 0x1c]
dec eax
sub edi, edx
cmp edi, eax
jle 0x428c43
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x51aa3c]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x24]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [edi + edx]
test cl, cl
je 0x428c66
cmp dword [esp + 0x28], 0
jne 0x428bb0
cmp cl, 0xd
je 0x428c72
cmp cl, 0xa
jne 0x428bb0
dec esi
jmp 0x428ce3
lea edi, [ebx + 4]
cmp dword [esp + 0x28], 0
jne 0x428ce3
jmp 0x428c75
lea edi, [ebx + 4]
cmp cl, 0xa
jne 0x428c7d
dec esi
jmp 0x428ce3
cmp cl, 0xd
jne 0x428ce3
dec esi
cmp dword [edi], 0
je 0x428c9b
push 1
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00428a40
mov dword [esp + 0x10], eax
jmp 0x428cb1
push 0
lea eax, [esp + 0x14]
push eax
push 1
lea eax, [esp + 0x30]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x24], 0xa
je 0x428ce3
cmp dword [edi], 0
je 0x428cc2
inc dword [ebx + 0xc]
jmp 0x428ce3
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x30]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
xor eax, eax
pop ebx
add esp, 0x10
ret 0x10
Function at 0x428d10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push 0x1000
push 0
push dword [0x51aa3c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 8], edx
test edx, edx
je 0x428ecf
mov ax, word [esp + 0x1c]
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x1c], 0x1000
mov dword [esp + 0x18], 0x7ff
mov ecx, dword [esp + 0x30]
cmp ecx, 0xffffffff
je 0x428d69
test ecx, ecx
je 0x428e2c
dec ecx
mov dword [esp + 0x30], ecx
cmp dword [ebx + 4], 0
lea ebp, [ebx + 4]
je 0x428d85
push 2
lea eax, [esp + 0x2c]
push eax
push ebx
call fcn.00428a40
mov dword [esp + 0x10], eax
jmp 0x428d9f
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x34]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
cmp eax, 2
mov ax, word [esp + 0x28]
jne 0x428e2f
test ax, ax
je 0x428dbd
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x28]
mov edx, dword [esp + 0x14]
mov esi, edi
mov ecx, dword [esp + 0x18]
sub esi, edx
sar esi, 1
cmp esi, ecx
jle 0x428e04
mov eax, dword [esp + 0x1c]
add ecx, 0x800
add eax, 0x1000
mov dword [esp + 0x18], ecx
push eax
push edx
push 8
push dword [0x51aa3c]
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
mov ax, word [esp + 0x28]
mov dword [esp + 0x14], edx
lea edi, [edx + esi*2]
test ax, ax
je 0x428e2f
cmp dword [esp + 0x2c], 0
jne 0x428d53
cmp ax, 0xd
je 0x428e36
cmp ax, 0xa
jne 0x428d53
sub edi, 2
jmp 0x428eae
lea ebp, [ebx + 4]
cmp dword [esp + 0x2c], 0
jne 0x428eae
cmp ax, 0xa
jne 0x428e41
sub edi, 2
jmp 0x428eae
cmp ax, 0xd
jne 0x428eae
sub edi, 2
cmp dword [ebp], 0
je 0x428e63
push 2
lea eax, [esp + 0x2c]
push eax
push ebx
call fcn.00428a40
mov dword [esp + 0x10], eax
jmp 0x428e79
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x34]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x28], 0xa
je 0x428eae
cmp dword [ebp], 0
je 0x428e8d
add dword [ebx + 0xc], 2
jmp 0x428eae
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, edi
sub ecx, dword [esp + 0x14]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
pop ebx
add esp, 0x14
ret 0x10
Function at 0x428ee0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x51aa3c]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x429030
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x428f2c
test edi, edi
je 0x428f9d
dec edi
push esi
push ebp
call fcn.004603f0
mov dword [esp + 0x20], eax
test eax, eax
jne 0x428f3f
xor cl, cl
jmp 0x428f41
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x428f84
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x51aa3c]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x428f9d
test eax, eax
jne 0x428f22
cmp cl, 0xd
je 0x428fa1
cmp cl, 0xa
jne 0x428f22
dec esi
jmp 0x429013
test eax, eax
jne 0x429013
cmp cl, 0xa
jne 0x428fa9
dec esi
jmp 0x429013
cmp cl, 0xd
jne 0x429013
dec esi
cmp dword [ebp + 4], 0
je 0x428fc8
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.00428a40
mov dword [esp + 0x20], eax
jmp 0x428fdf
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x429013
cmp dword [ebp + 4], 0
je 0x428ff1
inc dword [ebp + 0xc]
jmp 0x429013
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x429040
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x10], 0
cmp dword [edi + 0x1c], 0
jne 0x429157
cmp dword [edi + 0x14], 1
push ebx
push ebp
jne 0x42908d
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x10]
push 1
neg eax
cdq
push ecx
push eax
push dword [edi]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0xc]
push esi
mov esi, dword [esp + 0x24]
cmp eax, esi
jle 0x429116
mov ecx, dword [edi + 4]
sub ecx, eax
mov eax, esi
add ecx, dword [edi + 8]
sub eax, 1
je 0x4290ff
sub eax, 1
je 0x4290e6
sub eax, 2
je 0x4290cf
push esi
push dword [esp + 0x24]
push ecx
call fcn.004095d0
add esp, 0xc
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov ax, word [eax]
mov word [ecx], ax
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov al, byte [eax]
mov byte [ecx], al
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
push edi
call fcn.00407ba0
mov eax, dword [edi + 8]
cmp esi, eax
jl 0x429145
push 0
lea eax, [esp + 0x20]
push eax
push esi
push dword [esp + 0x2c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x1c]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov ecx, dword [edi + 4]
sub ecx, dword [edi + 0xc]
push esi
push dword [esp + 0x24]
add ecx, eax
jmp 0x4290b7
xor eax, eax
pop edi
add esp, 8
ret 0xc

Function at 0x42941a
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x429d30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x94
test dword [esp + 0xa0], 0x10000
je 0x429ec2
push ebx
mov ebx, dword [esp + 0x9c]
test ebx, ebx
je 0x429ec1
mov eax, dword [ebx]
cdq
push ebp
mov ebp, dword [ebx + 4]
and edx, 7
push esi
add eax, edx
push edi
mov edi, dword [esp + 0xb4]
sar eax, 3
mov dword [esp + 0x10], eax
test edi, edi
jne 0x429d7c
mov edi, 0x511eec
mov eax, dword [esp + 0xb8]
cmp eax, 0x18
jne 0x429da0
push edi
call fcn.0040ba80
mov edi, eax
mov esi, edi
lea eax, [esi + 1]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x429d95
sub esi, eax
jmp 0x429dd9
cmp eax, 0x19
jne 0x429dc3
mov esi, edi
lea ecx, [esi + 2]
lea ebx, [ebx]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x429db0
sub esi, ecx
sar esi, 1
add esi, esi
jmp 0x429dd9
push edi
call fcn.0040bc10
mov edi, eax
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x429dd0
sub esi, ecx
push esi
push edi
cmp esi, ebp
jle 0x429e2c
mov esi, dword [esp + 0xb4]
push ebx
mov eax, dword [esi + 0xc]
call eax
mov eax, dword [esi + 0x10]
push ebx
call eax
mov esi, dword [esp + 0x10]
lea eax, [ebx + 8]
push esi
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004095d0
mov eax, ebp
sub eax, esi
push eax
lea eax, [esp + 0x24]
add eax, esi
push 0
push eax
call fcn.00401100
mov eax, dword [esp + 0xc4]
add esp, 0x18
mov eax, dword [eax + 8]
push 1
push ebx
call eax
jmp 0x429e4c
lea eax, [esp + 0x1c]
push eax
call fcn.004095d0
mov eax, ebp
sub eax, esi
push eax
lea eax, [esp + 0x24]
add eax, esi
push 0
push eax
call fcn.00401100
add esp, 0x18
push ebp
lea eax, [esp + 0x18]
push eax
lea esi, [ebx + 0x48]
push esi
call fcn.004095d0
add esp, 0xc
test ebp, ebp
jle 0x429e81
lea eax, [esp + 0x14]
mov ecx, ebp
jmp 0x429e70
xor byte [eax], 0x36
lea eax, [eax + 1]
xor byte [esi], 0x5c
lea esi, [esi + 1]
sub ecx, 1
jne 0x429e70
push ebp
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0xb4]
push ebx
mov eax, dword [eax + 0xc]
call eax
mov eax, dword [esp + 0xb8]
cmp eax, 0x18
jne 0x429eb3
push edi
call fcn.0040bb10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret 0x14
cmp eax, 0x19
je 0x429ebe
push edi
call fcn.0040bb10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret 0x14
Function at 0x429f1e
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x51bd2c], 0
push ebx
push esi
mov esi, 0x51bd34
jne 0x429f4a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x51bd4c], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x51bd2c], 1
push dword [0x51bd4c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x429fe7
push 0x14
push 8
push dword [0x51aa3c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x42a011
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x51bd30]
test eax, eax
je 0x429f8c
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x51bd30], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x42a094
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x51bd4c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x51aa3c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x42a011
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x42a550
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x518cb4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
mov dword [eax + 8], ecx
mov eax, dword [eax]
add eax, ecx
ret 4

Function at 0x42b799
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4e8e68
push 0x4e8e60
push str.FlsAlloc
push 0x1f
call fcn.0042be2d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b7cd
push dword [ebp + 8]
mov ecx, esi
call dword [0x5140b4]
call esi
jmp 0x42b7d3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42b817
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4e8e78
push 0x4e8e70
push str.FlsGetValue
push 0x21
call fcn.0042be2d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b84e
push dword [ebp + 8]
mov ecx, esi
call dword [0x5140b4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42b856
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4e8e80
push 0x4e8e78
push str.FlsSetValue
push 0x22
call fcn.0042be2d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b890
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5140b4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x433520
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [eax + 0x38]
mov bl, byte [eax + 0x34]
test esi, esi
jle 0x43355d
mov edx, dword [eax + 0x260]
push edi
movzx edi, bl
nop word [eax + eax]
mov ecx, edx
shl edx, 8
shr ecx, 0x18
xor ecx, edi
xor edx, dword [ecx*4 + 0x51a2d0]
mov dword [eax + 0x260], edx
sub esi, 1
jne 0x433540
pop edi
mov ecx, dword [eax + 0x34]
mov byte [ecx + eax + 0x58], 1
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, 1
je 0x43360c
sub ecx, 1
je 0x4335f0
sub ecx, 1
je 0x4335c8
mov byte [edx + eax + 0x54], 1
mov edx, dword [eax + 0x24]
mov ecx, dword [eax + 0x44]
mov byte [edx + ecx], bl
mov edx, dword [eax + 0x44]
inc edx
mov dword [eax + 0x44], edx
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov esi, dword [eax + 0x44]
mov dl, byte [eax + 0x38]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
inc dword [eax + 0x44]
pop esi
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
inc edx
mov dword [eax + 0x44], edx
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
inc edx
mov dword [eax + 0x44], edx
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret