joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428da0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3444
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x521104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
lea ebx, [edi + 0x3c]
xorps xmm0, xmm0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
movlpd qword [ebp - 0x1c], xmm0
push ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
call fcn.004a1e43
add esp, 4
test eax, eax
jne 0x428ed9
mov byte [ebp - 0x18], 1
push 0x48
mov dword [ebp - 4], eax
call fcn.004a38e1
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
push dword [ebp - 0x28]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00495ec0
push dword [ebp - 0x2c]
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 2
call fcn.00423440
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], 0x428ef0
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
push eax
push 0
push esi
push 0x42a2e0
push 0
push 0
call fcn.004b621c
mov edx, eax
add esp, 0x18
mov dword [ebp - 0x24], edx
test edx, edx
je 0x428ecb
mov byte [ebp - 4], 4
mov ecx, dword [edi + 0x70]
cmp ecx, dword [edi + 0x74]
je 0x428e91
mov eax, dword [ebp - 0x20]
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
mov dword [ecx], edx
mov dword [ecx + 4], eax
add dword [edi + 0x70], 8
jmp 0x428e9e
lea eax, [ebp - 0x24]
push eax
push ecx
lea ecx, [edi + 0x6c]
call fcn.00425e10
cmp dword [ebp - 0x20], 0
jne 0x428edf
push ebx
call fcn.004a1e68
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret 0xc
push 6
mov dword [ebp - 0x20], 0
call fcn.004a1578
push eax
call fcn.004a154b
call fcn.004b4a75
int3
Function at 0x43e730
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e4950
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x521104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004a38e1
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004a1174
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x445b70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e525d
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x521104]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, edx
push ecx
push 1
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
call fcn.0048d000
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], 8
push ecx
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.Cannot_query_registry_value
mov ecx, eax
call fcn.0048b6d0
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov ebx, dword [ebp - 0x28]
add esp, 4
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], 0
cmp byte [ebp - 0x30], dl
mov eax, dword [ebp - 0x34]
cmove eax, edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x34], eax
test eax, eax
je 0x445c24
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x445c21
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], 0
cmp esi, 0xb
jne 0x445c5d
mov dword [edi], ebx
mov al, 1
mov dword [edi + 4], ecx
jmp 0x445c41
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00416280
push eax
push 0xb
lea ecx, [ebp - 0x50]
call fcn.0048b650
push 0x51e050
lea eax, [ebp - 0x50]
push eax
call fcn.004a629b
int3

Function at 0x4469b0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e53e8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x521104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [ebp - 4], eax
movups xmmword [edi + 0x38], xmm0
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], 7
mov word [edi + 0x38], ax
mov dword [edi + 0x60], eax
mov dword [edi + 0x64], eax
mov dword [edi + 0x68], eax
lea esi, [edi + 0x70]
mov byte [ebp - 4], 1
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.004a38e1
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x446e40
Capabilities:
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e54d8
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
push esi
push edi
mov eax, dword [0x521104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ecx], vtable.asw::instup::State.0
lea edx, [ecx + 0x18]
xorps xmm0, xmm0
mov dword [ebp - 0x18], edx
movups xmmword [ecx + 8], xmm0
mov dword [edx], 0
xor edx, edx
mov dword [ecx + 0x1c], 7
mov word [ecx + 8], dx
mov dword [ebp - 4], edx
lea edx, [ecx + 0x30]
movups xmmword [ecx + 0x20], xmm0
mov dword [edx], 0
mov dword [ebp - 0x1c], edx
xor edx, edx
mov dword [ecx + 0x34], 7
mov word [ecx + 0x20], dx
lea edx, [ecx + 0x48]
movups xmmword [ecx + 0x38], xmm0
mov dword [edx], 0
mov dword [ebp - 0x20], edx
xor edx, edx
mov dword [ecx + 0x4c], 7
mov word [ecx + 0x38], dx
movups xmmword [ecx + 0x50], xmm0
xor eax, eax
mov dword [ecx + 0x60], edx
mov dword [ecx + 0x64], 7
mov word [ecx + 0x50], ax
lea edx, [ecx + 0x78]
movups xmmword [ecx + 0x68], xmm0
mov dword [edx], eax
mov dword [ebp - 0x24], edx
xor edx, edx
mov dword [ecx + 0x7c], 7
mov word [ecx + 0x68], dx
lea edi, [ecx + 0x80]
lea eax, [edi + 0x10]
movups xmmword [edi], xmm0
mov dword [eax], edx
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [edi + 0x14], 7
mov word [edi], ax
lea esi, [ecx + 0x98]
lea eax, [esi + 0x10]
movups xmmword [esi], xmm0
mov dword [eax], edx
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [esi + 0x14], 7
mov word [esi], ax
add ecx, 0xb0
mov byte [ebp - 4], 6
call fcn.00438b90
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x1c], 8
lea eax, [ecx + 8]
jb 0x446f65
mov eax, dword [eax]
mov edx, dword [ebp - 0x18]
mov dword [edx], 0
xor edx, edx
mov word [eax], dx
lea eax, [ecx + 0x20]
cmp dword [eax + 0x14], 8
jb 0x446f7e
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
mov dword [edx], 0
xor edx, edx
mov word [eax], dx
lea eax, [ecx + 0x38]
cmp dword [eax + 0x14], 8
jb 0x446f97
mov eax, dword [eax]
mov edx, dword [ebp - 0x20]
mov dword [edx], 0
xor edx, edx
mov word [eax], dx
lea eax, [ecx + 0x68]
cmp dword [eax + 0x14], 8
jb 0x446fb0
mov eax, dword [eax]
mov edx, dword [ebp - 0x24]
mov dword [edx], 0
xor edx, edx
mov word [eax], dx
cmp dword [edi + 0x14], 8
jb 0x446fc6
mov edi, dword [edi]
mov eax, dword [ebp - 0x28]
mov dword [eax], edx
xor eax, eax
mov word [edi], ax
cmp dword [esi + 0x14], 8
jb 0x446fd8
mov esi, dword [esi]
mov eax, dword [ebp - 0x2c]
mov dword [eax], edx
xor eax, eax
mov word [esi], ax
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x453cb0
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6743
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x521104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
xor esi, esi
mov dword [ebp - 0x2c], edi
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [ebp - 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
lea ecx, [edi + 0x10]
mov byte [ebp - 4], 1
call fcn.00454dd0
mov dword [edi + 0x88], esi
mov dword [edi + 0x8c], esi
mov dword [edi + 0x90], esi
mov dword [edi + 0x94], esi
xorps xmm0, xmm0
mov dword [edi + 0x98], esi
xor eax, eax
movups xmmword [edi + 0x9c], xmm0
mov dword [edi + 0xac], esi
mov dword [edi + 0xb0], 7
mov word [edi + 0x9c], ax
movups xmmword [edi + 0xb4], xmm0
mov dword [edi + 0xc4], eax
mov dword [edi + 0xc8], 7
mov word [edi + 0xb4], ax
movups xmmword [edi + 0xcc], xmm0
mov dword [edi + 0xdc], eax
mov dword [edi + 0xe0], 7
mov word [edi + 0xcc], ax
mov dword [edi + 0xe4], 0xfde9
mov dword [edi + 0xe8], 1
movups xmmword [edi + 0xec], xmm0
mov dword [edi + 0xfc], eax
mov dword [edi + 0x100], 7
mov word [edi + 0xec], ax
movups xmmword [edi + 0x104], xmm0
mov dword [edi + 0x114], eax
mov dword [edi + 0x118], 7
mov word [edi + 0x104], ax
mov byte [ebp - 4], 0xa
mov dword [edi + 0x11c], 0xfde9
mov dword [edi + 0x120], eax
call fcn.0048ecd0
push dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test al, al
mov ecx, 4
push 0x10000000
push 0
push 0
cmovne esi, ecx
push esi
push str.Avast_SimpleHttp_3.0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
push eax
mov ecx, edi
call fcn.004542d0
mov eax, dword [edi]
test eax, eax
je 0x453ec1
push 4
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x80
push ecx
push 0x54
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
je 0x453ee3
or dword [ebp - 0x14], 0x200
call fcn.0048ec50
test al, al
je 0x453e50
or dword [ebp - 0x14], 0x800
push 4
lea eax, [ebp - 0x14]
push eax
push 0x54
push dword [edi]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x453e6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x453ee3
push 0x3a98
push 0x3a98
push 0x7530
push 0
push dword [edi]
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
test eax, eax
jne 0x453ea2
push str.Unable_to_set_WinHTTP_timeouts_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x28]
call fcn.00491170
jmp 0x453efb
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret 0x14
push str.Unable_to_initialize_a_WinHTTP_session_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x28]
call fcn.00491170
push 0x51dce8
lea eax, [ebp - 0x28]
push eax
call fcn.004a629b
mov esi, dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push str.Unable_to_set_WinHTTP_protocols___08lx__
push eax
lea ecx, [ebp - 0x28]
call fcn.00413400
push 0x51dce8
lea eax, [ebp - 0x28]
push eax
call fcn.004a629b
int3
Function at 0x455490
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e697d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x521104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
call fcn.004a38e1
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [eax], esi
mov dword [eax + 4], 0x455ca0
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x455c30
push 0
push 0
call fcn.004b621c
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x455522
cmp dword [esi + 0x38], 0
jne 0x455530
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x18], 0
call fcn.004a1578
call fcn.004b4a75
int3
Function at 0x4558b0
Capabilities:
Read http header

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6a0e
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x521104]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov esi, dword [ebx + 8]
xorps xmm0, xmm0
mov edi, dword [ebx + 0xc]
xor eax, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], 0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x18], eax
mov eax, edi
mov dword [ebp - 0x1c], 1
jb 0x45593f
mov eax, dword [edi]
push 0
lea edx, [ebp - 0x18]
push edx
push 0
push eax
push 0xffff
push dword [ecx + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x455969
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x455a14
mov eax, dword [ebp - 0x18]
mov ecx, dword [esi + 0x10]
shr eax, 1
cmp eax, ecx
ja 0x45598a
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x45597f
mov ecx, dword [esi]
xor edx, edx
mov dword [esi + 0x10], eax
mov word [ecx + eax*2], dx
jmp 0x455996
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0040beb0
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4559a0
mov eax, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x4559a8
mov edi, dword [edi]
push 0
lea ecx, [ebp - 0x18]
push ecx
push eax
mov eax, dword [ebp - 0x20]
push edi
push 0xffff
push dword [eax + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x455a36
mov eax, dword [ebp - 0x18]
mov ecx, dword [esi + 0x10]
shr eax, 1
cmp eax, ecx
ja 0x4559e6
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x4559db
mov ecx, dword [esi]
xor edx, edx
mov dword [esi + 0x10], eax
mov word [ecx + eax*2], dx
jmp 0x4559f2
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0040beb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
push str.Unable_to_query_response_headers_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x38]
call fcn.00491170
push 0x51dce8
lea eax, [ebp - 0x38]
push eax
call fcn.004a629b
push str.Unable_to_query_response_headers_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x38]
call fcn.00491170
push 0x51dce8
lea eax, [ebp - 0x38]
push eax
call fcn.004a629b
int3
Function at 0x458690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6fa5
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x521104]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [edi + 0x88]
cmp dword [ebx], eax
jl 0x4587f2
call fcn.00458e10
sub esp, 8
mov ecx, ebx
mov eax, esp
mov dword [eax], 0x507f18
mov dword [eax + 4], 2
lea eax, [ebp - 0x38]
push eax
call fcn.0045c8f0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
lea esi, [edi + 0x44]
movlpd qword [ebp - 0x1c], xmm0
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x60]
test eax, eax
je 0x458714
lock inc dword [eax + 4]
mov eax, dword [edi + 0x5c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x60]
push esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
cmp dword [ebp - 0x24], 0x10
mov eax, dword [ebp - 0x3c]
cmovae ecx, dword [ebp - 0x38]
mov dword [ebp - 0x20], 0
test eax, eax
je 0x45874b
mov eax, dword [eax]
jmp 0x45874e
or eax, 0xffffffff
push 0
lea edx, [ebp - 0x20]
push edx
push dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x458810
mov eax, dword [edi + 0x8c]
cmp dword [ebx], eax
jl 0x458786
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x45877c
mov eax, dword [eax]
jmp 0x45877f
or eax, 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edi, dword [ebp - 0x18]
test edi, edi
je 0x4587c2
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x4587c2
mov eax, dword [edi]
mov esi, dword [eax]
mov ecx, esi
call dword [0x4ed33c]
mov ecx, edi
call esi
lock xadd dword [edi + 8], ebx
dec ebx
jne 0x4587c2
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4ed33c]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0x24]
cmp ecx, 0x10
jb 0x4587f2
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4587e8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45882c
push ecx
push edx
call fcn.004a38d3
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x50]
call fcn.004910b0
push 0x51dce8
mov eax, ecx
push eax
call fcn.004a629b
call fcn.004b013f
int3
Function at 0x45c610
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x521104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebx + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [0x521bfc]
push esi
push edi
cmp eax, 0xffffffff
jne 0x45c665
call fcn.00464ea0
test eax, eax
jne 0x45c660
mov ecx, 0x501311
jmp 0x45c676
mov dword [0x521bfc], eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
mov ecx, 0x501311
cmovne ecx, eax
mov edi, ecx
mov dword [ebp - 0xc], ecx
lea edx, [edi + 1]
nop
mov al, byte [edi]
inc edi
test al, al
jne 0x45c680
sub edi, edx
je 0x45c731
test edi, edi
je 0x45c6f1
or esi, 0xffffffff
lea eax, [edi - 1]
cmp eax, esi
cmovb esi, eax
add esi, ecx
cmp byte [esi], 0x3a
je 0x45c6af
cmp esi, ecx
je 0x45c6f1
dec esi
cmp byte [esi], 0x3a
jne 0x45c6a5
sub esi, ecx
cmp esi, 0xffffffff
je 0x45c6f1
lea edx, [esi + 1]
cmp edi, edx
jb 0x45c787
push dword [ebx + 0xc]
mov eax, edi
add ecx, edx
push dword [ebx + 8]
sub eax, edx
mov edx, 0xffffffff
cmp eax, 0xffffffff
cmovb edx, eax
call fcn.0042af90
add esp, 8
test al, al
je 0x45c6f1
mov eax, dword [ebp - 0xc]
cmp edi, esi
mov dword [ebp - 0xc], eax
cmovb esi, edi
mov edi, esi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 8]
call fcn.0045c790
mov ecx, dword [ebp - 0xc]
sub esp, 0x10
mov dword [ebp - 0x18], ecx
mov ecx, esp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], 0x45cbd0
push 9
mov dword [ecx], 0xfd
mov dword [ecx + 4], 0
mov dword [ecx + 8], eax
push 0x50815c
jmp 0x45c766
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 8]
call fcn.0045c790
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
sub esp, 0x10
mov dword [ebp - 0xc], 0x45cbd0
mov eax, esp
push 2
mov dword [eax], 0xf
mov dword [eax + 4], 0
mov dword [eax + 8], ecx
push 0x5044a0
mov esi, dword [ebp - 0x1c]
push esi
call fcn.0049cdf0
mov ecx, dword [ebp - 4]
add esp, 0x1c
mov eax, esi
xor ecx, ebp
pop edi
pop esi
call fcn.004a389b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0040c550
int3
Function at 0x466a30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7c46
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x521104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
lea eax, [esi + 0xc]
mov dword [ebp - 4], 0
push eax
mov dword [esi], vtable.asw::mi::ModuleDestructions.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
push 0x40
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.004a38e1
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x28], eax
mov byte [ebp - 4], 2
push 0x40
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
call fcn.004a38e1
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x30], eax
mov eax, esi
mov byte [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x466c10
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov eax, dword [0x521104]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
mov esi, dword [ebp + 8]
push edx
mov edx, ecx
mov dword [esp + 0x20], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00466cd0
add esp, 4
test esi, esi
je 0x466cbe
mov edx, dword [esp + 0x18]
mov ecx, 0x78
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x64], edx
shr edx, 3
mov dword [esp + 0x68], eax
and edx, 0x3f
sub ecx, edx
mov eax, 0x38
sub eax, edx
cmp edx, 0x38
mov edx, 0x5083d8
cmovae eax, ecx
lea ecx, [esp + 8]
push eax
call fcn.00466cd0
push 8
lea edx, [esp + 0x6c]
lea ecx, [esp + 0x10]
call fcn.00466cd0
movups xmm0, xmmword [esp + 0x10]
add esp, 8
movups xmmword [esi], xmm0
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
call fcn.004a389b
mov esp, ebp
pop ebp
ret