joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421306
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x2e
mov esi, edi
mov ebx, eax
call fcn.0040143c
test eax, eax
jg 0x421328
mov al, 1
jmp 0x421496
lea ecx, [ebp - 8]
push ecx
mov esi, edi
call fcn.004014a5
mov eax, dword [0x429570]
mov esi, 0x429570
mov ecx, esi
call dword [eax + 0xc]
push dword [ebp - 8]
add eax, 0x10
push dword [edi]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push dword [eax]
lea eax, [ebp - 0x10]
push str.__verbose___log_file__s____remove_pack_file___s____s_
push eax
call fcn.0040382d
add esp, 0x14
cmp dword [ebx + 0x10], 0
je 0x421372
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
push edi
call dword [eax + 0x10]
push 0
push 0x8000008
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
call fcn.00404f7c
add esp, 0x14
lea ecx, [ebp - 8]
mov byte [ebp - 1], 1
call fcn.0040cbfd
test al, al
je 0x4213aa
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x421461
mov eax, dword [0x429570]
mov ecx, esi
call dword [eax + 0xc]
push dword [ebp + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
call fcn.004054a9
mov eax, dword [0x429570]
pop ecx
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
push 0xca
lea ecx, [ebp - 0x18]
mov dword [ebp - 0xc], eax
call fcn.00401000
mov esi, dword [ebp - 8]
mov edi, dword [esi - 0xc]
push 0x5c
mov eax, esi
call fcn.004015e9
test eax, eax
pop ecx
pop ecx
jne 0x4213fd
or ecx, 0xffffffff
jmp 0x421401
sub eax, esi
mov ecx, eax
mov eax, edi
sub eax, ecx
lea ecx, [ebp - 0x1c]
push ecx
lea esi, [ebp - 8]
call fcn.00401456
mov esi, dword [ebp - 0x14]
push esi
push dword [eax]
lea eax, [ebp - 0xc]
push dword [ebp - 0x18]
push eax
call fcn.0040382d
mov eax, dword [ebp - 0x1c]
add esp, 0x10
add eax, 0xfffffff0
call fcn.0040175b
push 0
lea edi, [ebp - 0xc]
call fcn.00408a82
mov eax, dword [ebp - 0x18]
pop ecx
add eax, 0xfffffff0
mov byte [ebp - 1], 0
call fcn.0040175b
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.0040175b
lea eax, [esi - 0x10]
call fcn.0040175b
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebx + 0x10], 0
je 0x42147d
mov ebx, dword [ebx + 0x10]
mov eax, dword [ebx]
push edi
mov ecx, ebx
call dword [eax + 0x14]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040175b
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.0040175b
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4219b5
Capabilities:
Create thread

Disassembly:
mov dword [esi + 0xc], eax
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push esi
push 0x4219eb
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
xor eax, eax
ret
Function at 0x4225c1
Capabilities:
Terminate process

Disassembly:
push 0x11c
push 0x424670
call fcn.00423068
mov eax, dword [0x429060]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x4296ac]
test eax, eax
je 0x422604
and dword [ebp - 4], 0
push ecx
push dword [ebp + 8]
call eax
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x42270e
mov eax, dword [ebp + 8]
dec eax
je 0x422620
mov ebx, str.Unknown_security_failure_detected_
mov dword [ebp - 0x12c], str.A_security_error_of_unknown_cause_has_been_detected_which_has_ncorrupted_the_programs_internal_state.__The_program_cannot_safely_ncontinue_execution_and_must_now_be_terminated._n
mov edi, 0xd4
jmp 0x422634
mov ebx, str.Buffer_overrun_detected_
mov dword [ebp - 0x12c], str.A_buffer_overrun_has_been_detected_which_has_corrupted_the_programs_ninternal_state.__The_program_cannot_safely_continue_execution_and_must_nnow_be_terminated._n
mov edi, 0xb9
mov byte [ebp - 0x20], 0
push 0x104
lea eax, [ebp - 0x124]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x422663
push str._program_name_unknown_
lea eax, [ebp - 0x124]
push eax
call fcn.004231c0
pop ecx
pop ecx
lea eax, [ebp - 0x124]
mov dword [ebp - 0x128], eax
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
add eax, 0xb
cmp eax, 0x3c
jbe 0x4226aa
lea eax, [ebp - 0x124]
push eax
call esi
lea ecx, [ebp - 0x124]
sub ecx, 0x31
add eax, ecx
mov dword [ebp - 0x128], eax
push 3
push 0x4244bc
push eax
call fcn.00422780
add esp, 0xc
push dword [ebp - 0x128]
call esi
lea eax, [eax + edi + 0xc]
add eax, 3
and eax, 0xfffffffc
call fcn.004232c0
mov dword [ebp - 0x18], esp
mov edi, esp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, 0x4244b8
push ebx
push edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
push str.Program:
push edi
call esi
push dword [ebp - 0x128]
push edi
call esi
push ebx
push edi
call esi
push dword [ebp - 0x12c]
push edi
call esi
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 3
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x422f85
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004232c0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x423020
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x429684]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x423020
cmp eax, 1
je 0x423041
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x423020
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x422fed
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x42301c
xor eax, eax
inc eax
jmp 0x423060
cmp edi, eax
jae 0x423024
xor eax, eax
jmp 0x423060
cmp eax, esi
jae 0x42302b
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x429684]
jmp 0x423044
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4233ee
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x42341c
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x423423
cmp ebx, dword [eax + 4]
jae 0x423423
xor eax, eax
jmp 0x423613
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x423434
xor eax, eax
inc eax
jmp 0x423612
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x42344a
cmp ecx, edx
jae 0x42358f
cmp dword [eax + 4], 0
je 0x423453
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x42343b
cmp dword [ebp + 8], 0
je 0x423475
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x42358f
cmp eax, esi
jae 0x42358f
mov eax, dword [0x4296b0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x42349a
cmp dword [esi*4 + 0x4296b8], edi
je 0x423593
inc esi
cmp esi, eax
jl 0x423488
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42360f
cmp dword [ebp - 8], 0x1000000
jne 0x42360f
test byte [ebp - 0xc], 0xcc
je 0x423518
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x42360f
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x42360f
cmp word [eax + 0x18], 0x10b
jne 0x42360f
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x42360f
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x423518
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x423518
test byte [ecx + 0x27], 0x80
jne 0x42358f
push 1
push 0x4296f8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x42342c
mov ecx, dword [0x4296b0]
test ecx, ecx
mov edx, ecx
jle 0x42354c
lea eax, [ecx*4 + 0x4296b4]
cmp dword [eax], edi
je 0x42354c
dec edx
sub eax, 4
test edx, edx
jg 0x423540
test edx, edx
jne 0x42357d
push 0xf
pop ebx
cmp ecx, ebx
jg 0x423559
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x423571
lea eax, [edx*4 + 0x4296b8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x42355f
cmp ecx, 0x10
jge 0x42357d
inc ecx
mov dword [0x4296b0], ecx
push 0
push 0x4296f8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x42342c
xor eax, eax
jmp 0x423612
test esi, esi
jle 0x42342c
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x4296f8
call ebx
test eax, eax
jne 0x42342c
cmp dword [esi*4 + 0x4296b8], edi
je 0x4235e9
mov eax, dword [0x4296b0]
lea esi, [eax - 1]
test esi, esi
jl 0x4235d7
cmp dword [esi*4 + 0x4296b8], edi
je 0x4235d3
dec esi
jns 0x4235c7
test esi, esi
jge 0x4235e7
cmp eax, 0x10
jge 0x4235e2
inc eax
mov dword [0x4296b0], eax
lea esi, [eax - 1]
jmp 0x4235e9
je 0x423601
xor ecx, ecx
test esi, esi
jl 0x423601
lea eax, [ecx*4 + 0x4296b8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4235ef
push 0
push 0x4296f8
call ebx
jmp 0x42342c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [edx + 8]
mov edi, dword [edx + 4]
mov esi, ecx
mov cl, 1
lea ebx, [eax + 1]
cmp ebx, edi
mov dword [edx + 8], ebx
jae 0x40a51d
mov ecx, dword [edx]
movzx ecx, byte [ecx + ebx]
cmp ecx, 0x2b
je 0x40a513
cmp ecx, 0x2d
mov cl, 1
jne 0x40a51d
xor ecx, ecx
jmp 0x40a515
mov cl, 1
add eax, 2
mov ebx, eax
mov dword [edx + 8], eax
cmp ebx, edi
jae 0x40a6ae
mov eax, dword [edx]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], esi
mov esi, edx
lea edx, [ebx + 1]
mov dword [ebp - 0x14], esi
movzx ecx, byte [eax + ebx]
mov dword [esi + 8], edx
add cl, 0xd0
cmp cl, 0xa
jae 0x40a6cc
mov esi, dword [ebp + 0xc]
cmp edx, edi
mov dword [ebp - 0x28], esi
movzx esi, cl
jae 0x40a5b8
mov edx, dword [ebp - 0x14]
neg edi
add ebx, 2
jmp 0x40a573
movzx ecx, cl
lea esi, [esi + esi*4]
lea esi, [ecx + esi*2]
lea ecx, [edi + ebx + 1]
inc ebx
cmp ecx, 1
je 0x40a5bb
movzx ecx, byte [eax + ebx - 1]
add cl, 0xd0
cmp cl, 0xa
jae 0x40a5bb
cmp esi, 0xccccccc
mov dword [edx + 8], ebx
jl 0x40a560
jne 0x40a592
cmp cl, 7
jbe 0x40a560
mov ecx, dword [ebp - 0x28]
xor eax, eax
movzx esi, byte [ebp - 0x18]
movzx edi, byte [ebp + 8]
or ecx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
sete al
push esi
push eax
push edi
call fcn.0040af20
add esp, 0x28
jmp 0x40a69d
mov edx, dword [ebp - 0x14]
mov edi, dword [ebp + 0x14]
cmp byte [ebp - 0x18], 0
je 0x40a5d3
lea eax, [edi + esi]
sar eax, 0x1f
add eax, 0x80000000
add edi, esi
jmp 0x40a5e1
xor eax, eax
cmp edi, esi
setns al
add eax, 0x7fffffff
sub edi, esi
cmovo edi, eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x10]
movd xmm0, eax
movd xmm1, ecx
mov eax, edi
punpckldq xmm1, xmm0
neg eax
punpckldq xmm1, xmmword [0x505300]
cmovs eax, edi
cmp eax, 0x135
subpd xmm1, xmmword [0x505310]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
jb 0x40a658
movsd xmm2, qword [0x505320]
xorpd xmm1, xmm1
nop
ucomisd xmm0, xmm1
jne 0x40a638
jnp 0x40a683
test edi, edi
jns 0x40a6ec
divsd xmm0, xmm2
add edi, 0x134
mov eax, edi
neg eax
cmovs eax, edi
cmp eax, 0x135
jae 0x40a630
mov ecx, dword [0x56bbf4]
test edi, edi
movsd xmm1, qword [ecx + eax*8]
js 0x40a6a2
mulsd xmm0, xmm1
ucomisd xmm0, qword [0x505328]
jae 0x40a6ec
movsd xmm1, qword [0x505330]
ucomisd xmm1, xmm0
jae 0x40a6ec
cmp byte [ebp + 8], 0
jne 0x40a691
xorpd xmm0, xmmword [0x505340]
movsd qword [esi + 8], xmm0
xor eax, eax
mov dword [esi], eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
divsd xmm0, xmm1
cmp byte [ebp + 8], 0
je 0x40a689
jmp 0x40a691
lea eax, [ebp - 0x24]
mov ecx, edx
mov dword [ebp - 0x24], 5
mov edx, eax
call fcn.0040afb0
mov dword [esi + 4], eax
mov dword [esi], 1
jmp 0x40a69a
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0xc
call fcn.0040afb0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov dword [ecx], 1
jmp 0x40a69a
lea eax, [ebp - 0x24]
mov ecx, edx
mov dword [ebp - 0x24], 0xd
mov edx, eax
call fcn.0040afb0
mov dword [esi + 4], eax
mov eax, 1
jmp 0x40a698
Function at 0x40cd20
Capabilities:
Manipulate boot configuration
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x480
call fcn.0040cd34
Function at 0x419ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x419bf8
lea edi, [edx + eax*2]
xor ebx, ebx
movzx esi, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea eax, [ebx + esi]
jne 0x419bf0
cmp eax, ebx
jb 0x419c72
cmp eax, dword [ebp + 0x10]
ja 0x419c83
add ebx, dword [ebp + 0xc]
nop word cs:[eax + eax]
nop
test esi, esi
je 0x419bf2
dec esi
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x419be0
jmp 0x419c4f
ja 0x419bf8
cmp edx, edi
mov ebx, eax
jne 0x419bb2
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x419c53
mov esi, dword [ebp + 0x14]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x419c30
mov esi, edi
sub ecx, ebx
jns 0x419c47
jmp 0x419c55
cmp edi, edx
je 0x419c5c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x419c55
xor al, 1
cmp esi, edx
jne 0x419c10
jmp 0x419c55
xor eax, eax
jmp 0x419c55
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x50efa4
push 0x2b
push 0x50e47d
call fcn.00414ad0
add esp, 0xc
ud2
push 0x50ef94
push eax
push ebx
call fcn.00417fa0
add esp, 0xc
ud2
push 0x50ef94
push dword [ebp + 0x10]
push eax
call fcn.00417f20
add esp, 0xc
ud2
Function at 0x42dab0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, dword [ebp + 8]
movzx ebx, byte [esi + 0x68]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
lea edx, [esi + 0x28]
shld ecx, eax, 9
shl eax, 9
lea edi, [ebx*8]
mov byte [esi + ebx + 0x28], pe_nt_image_headers32
or edi, eax
mov eax, ebx
xor eax, 0x3f
je 0x42db06
mov dword [esp], ecx
lea ecx, [ebx + edx + 1]
push eax
push 0
push ecx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
add esp, 0xc
not ebx
bswap edi
bswap ecx
test bl, 0x38
jne 0x42db5b
lea ebx, [esi + 8]
push 1
push edx
push ebx
mov dword [esp + 0xc], ecx
call fcn.004a52d0
add esp, 0xc
mov eax, dword [esp]
xorps xmm0, xmm0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], eax
lea eax, [esp + 0x20]
push 1
push eax
push ebx
jmp 0x42db68
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], edi
lea eax, [esi + 8]
push 1
push edx
push eax
call fcn.004a52d0
add esp, 0xc
movdqu xmm0, xmmword [esi + 8]
movups xmm1, xmmword [esi + 0x18]
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0x6a09e667
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0x3c6ef372
mov dword [esi + 0x14], 0xa54ff53a
mov dword [esi + 0x18], 0x510e527f
mov dword [esi + 0x1c], 0x9b05688c
mov dword [esi + 0x20], 0x1f83d9ab
mov dword [esi + 0x24], 0x5be0cd19
mov byte [esi + 0x68], 0
mov esi, dword [0x56bbf8]
movdqa xmmword [esp], xmm0
movaps xmmword [esp + 0x10], xmm1
mov eax, dword [esi]
test eax, eax
jne 0x42dbe3
call sub.kernel32.dll_GetProcessHeap
test eax, eax
je 0x42dc5e
mov dword [esi], eax
push 0x20
push 0
push eax
call sub.kernel32.dll_HeapAlloc
test eax, eax
je 0x42dc5e
movdqa xmm2, xmmword [esp + 0x10]
pxor xmm0, xmm0
movdqa xmm3, xmmword [esp]
mov edx, 0x20
movdqa xmm1, xmm2
punpcklbw xmm2, xmm0
punpckhbw xmm1, xmm0
pshuflw xmm2, xmm2, 0x1b
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm2, xmm2, 0x1b
pshufhw xmm1, xmm1, 0x1b
packuswb xmm2, xmm1
movdqa xmm1, xmm3
punpcklbw xmm3, xmm0
punpckhbw xmm1, xmm0
pshuflw xmm0, xmm3, 0x1b
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm0, xmm0, 0x1b
pshufhw xmm1, xmm1, 0x1b
packuswb xmm0, xmm1
movdqu xmmword [eax], xmm0
movdqu xmmword [eax + 0x10], xmm2
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
push 0x20
call fcn.004085f0
add esp, 8
ud2
Function at 0x44df00
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
xorps xmm0, xmm0
mov esi, edx
mov edi, ecx
mov eax, esp
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
push 2
push 0x20
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x44df80
mov ebx, eax
mov eax, dword [0x56bbf8]
mov eax, dword [eax]
test eax, eax
jne 0x44df53
call sub.kernel32.dll_GetProcessHeap
test eax, eax
je 0x44dfd8
mov ecx, dword [0x56bbf8]
mov dword [ecx], eax
push 4
push 0
push eax
call sub.kernel32.dll_HeapAlloc
test eax, eax
je 0x44dfd8
add ebx, 0x80000000
mov dword [eax], ebx
push eax
push 0
mov eax, dword [0x56bbf8]
push dword [eax]
call sub.kernel32.dll_HeapFree
mov eax, dword [edi + 0x30]
mov ecx, dword [edi + 0x34]
jmp 0x44dfb2
movaps xmm0, xmmword [esp]
movaps xmm1, xmmword [esp + 0x10]
mov eax, dword [edi + 0x30]
mov ecx, dword [edi + 0x34]
movups xmmword [edi], xmm0
movups xmmword [edi + 0x10], xmm1
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x28], 0
add eax, 0xffffff00
mov dword [edi + 0x40], 0
mov edx, esi
adc ecx, 0xffffffff
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], ecx
mov ecx, edi
call fcn.0044cb70
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 4
push 4
call fcn.004085f0
add esp, 8
ud2
Function at 0x457ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
cmp dword [ecx + 0x3c], 3
mov esi, ecx
jne 0x457af3
mov ecx, dword [esi + 0x18]
imul edi, dword [esi + 0x20], 0x78
lea eax, [esi + 0x18]
mov dword [ebp - 0x10], eax
nop
test edi, edi
je 0x457b13
lea ebx, [ecx + 0x78]
add edi, 0xffffff88
call fcn.00455e20
mov ecx, ebx
jmp 0x457ae0
mov ecx, dword [esi + 0x18]
imul edi, dword [esi + 0x20], 0x78
nop word [eax + eax]
test edi, edi
je 0x457b1e
lea ebx, [ecx + 0x78]
add edi, 0xffffff88
call fcn.00455e20
mov ecx, ebx
jmp 0x457b00
cmp dword [esi + 0x1c], 0
mov esi, dword [ebp - 0x10]
jne 0x457b61
jmp 0x457b71
cmp dword [esi + 0x1c], 0
je 0x457b35
mov eax, dword [0x56bbf8]
push dword [esi + 0x18]
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x457b56
cmp eax, 1
cmp dword [esi + 0x5c], 0
je 0x457b56
mov eax, dword [0x56bbf8]
push dword [esi + 0x58]
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov ecx, dword [esi + 0x68]
add esi, 0x68
call fcn.00455e20
mov eax, dword [0x56bbf8]
push dword [esi]
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x471370
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x503018]
test eax, eax
je 0x47138a
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x4713a2
jmp 0x4713ad
push 0x503018
call fcn.004cb880
add esp, 4
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x4713ad
cmp dword [eax], 0
je 0x4713ad
add eax, 4
pop esi
pop ebp
ret
mov eax, dword [0x503018]
test eax, eax
je 0x47145f
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x47147b
mov esi, eax
test eax, eax
jne 0x471428
mov esi, dword [0x56bbf8]
mov eax, dword [esi]
test eax, eax
jne 0x4713ea
call sub.kernel32.dll_GetProcessHeap
test eax, eax
je 0x471480
mov dword [esi], eax
push 0xc
push 0
push eax
call sub.kernel32.dll_HeapAlloc
test eax, eax
je 0x471480
mov dword [eax], 0
mov dword [eax + 8], 0x503018
mov esi, eax
mov eax, dword [0x503018]
test eax, eax
jne 0x471421
push 0x503018
call fcn.004cb880
add esp, 4
push esi
push eax
call sub.kernel32.dll_TlsSetValue
mov eax, dword [ebp + 8]
test eax, eax
je 0x47143f
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [eax], 0
cmp edx, 1
je 0x471450
mov ecx, 1
lock xadd dword [0x503014], ecx
test ecx, ecx
je 0x47148e
mov dword [esi], 1
lea eax, [esi + 4]
mov dword [esi + 4], ecx
pop esi
pop ebp
ret
push 0x503018
call fcn.004cb880
add esp, 4
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jne 0x4713c9
xor eax, eax
pop esi
pop ebp
ret
push 4
push 0xc
call fcn.004085f0
add esp, 8
ud2
mov ecx, 0x51b94c
mov edx, 0x2b
push 0x51b978
call fcn.00454820
add esp, 4
ud2

Function at 0x474430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
cmp dword [ecx + 0x3c], 3
mov esi, ecx
jne 0x474463
mov ecx, dword [esi + 0x18]
imul edi, dword [esi + 0x20], 0x78
lea eax, [esi + 0x18]
mov dword [ebp - 0x10], eax
nop
test edi, edi
je 0x474483
lea ebx, [ecx + 0x78]
add edi, 0xffffff88
call fcn.00473440
mov ecx, ebx
jmp 0x474450
mov ecx, dword [esi + 0x18]
imul edi, dword [esi + 0x20], 0x78
nop word [eax + eax]
test edi, edi
je 0x47448e
lea ebx, [ecx + 0x78]
add edi, 0xffffff88
call fcn.00473440
mov ecx, ebx
jmp 0x474470
cmp dword [esi + 0x1c], 0
mov esi, dword [ebp - 0x10]
jne 0x4744d1
jmp 0x4744e1
cmp dword [esi + 0x1c], 0
je 0x4744a5
mov eax, dword [0x56bbf8]
push dword [esi + 0x18]
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4744c6
cmp eax, 1
cmp dword [esi + 0x5c], 0
je 0x4744c6
mov eax, dword [0x56bbf8]
push dword [esi + 0x58]
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov ecx, dword [esi + 0x68]
add esi, 0x68
call fcn.00473440
mov eax, dword [0x56bbf8]
push dword [esi]
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret