joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x140
movzx eax, byte [edx]
mov esi, ecx
mov edi, edx
call fcn.0047936b

Function at 0x47a934
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
sub esp, 0xec
lea edi, [esp + 4]
mov esi, ecx
mov ecx, edi
call fcn.00437838
cmp word [edi], 0
je 0x47a95b
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
xor eax, eax
inc eax
jmp 0x47a96f
movzx eax, word [esp + 6]
mov ecx, eax
dec ecx
cmp cx, 0x19
jae 0x47a97b
mov word [esi + 2], ax
xor eax, eax
mov word [esi], ax
add esp, 0xec
pop esi
pop edi
ret
lea ecx, [esp + 2]
mov word [ecx], ax
mov eax, fcn.004a8e30
mov dword [esp + 4], ecx
lea ecx, [esp + 0xd4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x670634
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x670636
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0x670638
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x670a08
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0x670a0a
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0x762784
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0x670a0c
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0x670a0e
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0x670a10
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], 0x670a12
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0x670a14
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], 0x670a16
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 0x670a18
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0x670a1a
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], 0x670a1c
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], 0x6665cc
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], 0x670a1e
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], 0x670a20
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], 0x670a22
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], 0x670a24
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], 0x670a26
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], 0x670a28
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x670a2a
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], 0x670a2c
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], 0x670a2e
mov dword [esp + 0xd0], eax
mov eax, 0x1a
mov dword [ecx], str.invalid_value:___expected
mov dword [ecx + 4], eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], eax
call fcn.0065931e
jmp 0x47a953
Function at 0x493c4d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x288
movzx eax, byte [edx + 4]
xor ebx, ebx
mov edi, edx
mov esi, ecx
test eax, eax
mov dword [esp + 0x1c], eax
je 0x493c88
cmp eax, 1
mov ecx, 0
je 0x493c7a
mov cl, 1
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
jmp 0x493c92
mov al, 2
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov ecx, 0x100
call fcn.0049ac8a
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
lea eax, [esp + 0x28]
push 0x126
push ebx
push eax
call fcn.0064ad90
add esp, 0xc
mov al, byte [edi + 6]
mov dword [esp + 0x18], edi
lea edi, [esp + 0x20]
mov byte [esp + 7], al
lea eax, [esp + 0x150]
push 0x12e
push edi
push eax
call fcn.0064a810
add esp, 0xc
push 0x100
push ebx
push edi
call fcn.0064ad90
add esp, 0xc
mov byte [esp + ebx + 0x20], bl
inc ebx
cmp ebx, 0x100
jne 0x493ceb
mov ecx, 0x100
lea eax, [esi + 0x1ec]
push ecx
push edi
push eax
call fcn.0064a810
add esp, 0xc
xor ebx, ebx
lea eax, [esi + 0x28]
mov dword [esi + 0x2f8], ebx
mov dword [esi + 0x2f4], ebx
mov dword [esi + 0x300], ebx
mov dword [esi + 0x2fc], ebx
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], ebx
push 0x12e
lea ecx, [esp + 0x154]
push ecx
push eax
call fcn.0064a810
add esp, 0xc
mov dh, byte [esp + 7]
mov ecx, dword [esp + 0xc]
xor edi, edi
mov dl, 1
mov eax, 4
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
dec edi
mov byte [esi + 0x156], dh
mov byte [esi + 0x157], dl
mov dword [esi + 0x158], ebx
mov dword [esi + 0x15c], eax
mov dword [esi + 0x160], ebx
mov dword [esi + 0x164], ebx
mov dword [esi + 0x168], eax
mov dword [esi + 0x16c], ebx
mov dword [esi + 0x170], ebx
mov dword [esi + 0x174], edi
mov dword [esi + 0x178], ebx
mov byte [esi + 0x17c], 0
mov byte [esi + 0x180], cl
mov ecx, dword [esp + 8]
mov dword [esi + 0x181], 0x2020201
mov byte [esi + 0x185], cl
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x188], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x18c], ecx
mov ecx, 0x100
mov dword [esi + 0x190], ecx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x194], ebx
mov word [esi + 0x198], 0
mov byte [esi + 0x19a], dh
mov byte [esi + 0x19c], dh
mov byte [esi + 0x19d], dl
mov dword [esi + 0x1a0], ecx
mov dword [esi + 0x1a4], eax
mov dword [esi + 0x1a8], ebx
mov dword [esi + 0x1ac], ebx
mov dword [esi + 0x1b0], 1
mov dword [esi + 0x1b4], ebx
mov dword [esi + 0x1b8], ebx
mov dword [esi + 0x1bc], eax
mov dword [esi + 0x1c0], ebx
mov dword [esi + 0x1c4], ebx
mov dword [esi + 0x1c8], eax
mov dword [esi + 0x1cc], ebx
mov dword [esi + 0x1d0], ebx
mov dword [esi + 0x1d4], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x1d8], ebx
mov dword [esi + 0x1dc], ebx
mov dword [esi + 0x1e0], ebx
mov dword [esi + 0x2ec], edi
mov dword [esi + 0x2f0], ebx
mov byte [esi + 0x304], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4966ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc4
mov ebx, edx
mov ebp, ecx
call fcn.004966bf
Function at 0x4a3633
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ecx + 0xc], 0
je 0x4a36f4
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, 0xcbf29ce4
mov eax, 0x84222325
mov ebp, 0xfffffffc
mov esi, 0x1b3
mov dword [esp], edx
mov dword [esp + 4], edx
movzx edi, byte [esp + ebp + 8]
imul ebx, ebx, 0x1b3
xor edi, eax
mov eax, edi
shl edi, 8
mul esi
add edi, edx
add ebx, edi
inc ebp
jne 0x4a365f
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
pcmpeqd xmm1, xmm1
mov edi, ecx
and edi, eax
shr eax, 0x19
movd xmm0, eax
xor eax, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
movdqu xmm2, xmmword [edx + edi]
movdqa xmm3, xmm2
pcmpeqb xmm3, xmm0
pmovmskb esi, xmm3
test si, si
je 0x4a36d3
lea ebx, [esi - 1]
mov ebp, edx
and ebx, esi
bsf esi, esi
add esi, edi
and esi, ecx
shl esi, 2
sub ebp, esi
mov esi, dword [esp]
cmp dword [ebp - 4], esi
mov esi, ebx
jne 0x4a36af
jmp 0x4a36ea
pcmpeqb xmm2, xmm1
pmovmskb esi, xmm2
test esi, esi
jne 0x4a36f7
lea edi, [edi + eax + 0x10]
add eax, 0x10
and edi, ecx
jmp 0x4a369e
mov al, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
ret
xor eax, eax
jmp 0x4a36ec

Function at 0x4a36fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, 0xcbf29ce4
mov ebx, 0x84222325
mov ebp, 0xfffffffc
mov esi, 0x1b3
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], edx
movzx ecx, byte [esp + ebp + 0x18]
imul edi, edi, 0x1b3
xor ecx, ebx
mov eax, ecx
shl ecx, 8
mul esi
add ecx, edx
mov ebx, eax
add edi, ecx
inc ebp
jne 0x4a3722
mov esi, dword [esp + 4]
cmp dword [esi + 8], 0
je 0x4a37fd
mov ecx, dword [esi + 4]
mov edx, dword [esi]
pcmpeqd xmm1, xmm1
mov dword [esp + 8], 0
mov dword [esp], 0
mov ebp, ecx
and ebp, ebx
shr ebx, 0x19
movd xmm0, ebx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
movdqu xmm2, xmmword [edx + ebp]
movdqa xmm3, xmm2
pcmpeqb xmm3, xmm0
pmovmskb esi, xmm3
test si, si
je 0x4a37b7
lea edi, [esi - 1]
mov eax, edx
and edi, esi
bsf esi, esi
add esi, ebp
and esi, ecx
shl esi, 2
sub eax, esi
mov esi, dword [esp + 0xc]
cmp dword [eax - 4], esi
mov esi, edi
jne 0x4a378f
jmp 0x4a384a
cmp dword [esp], 1
mov eax, 1
mov dword [esp], eax
je 0x4a37de
pmovmskb esi, xmm2
xor eax, eax
test esi, esi
setne al
bsf esi, esi
add esi, ebp
mov dword [esp], eax
and esi, ecx
mov dword [esp + 0x10], esi
pcmpeqb xmm2, xmm1
pmovmskb eax, xmm2
test eax, eax
jne 0x4a3809
mov eax, dword [esp + 8]
lea ebp, [ebp + eax + 0x10]
add eax, 0x10
mov dword [esp + 8], eax
and ebp, ecx
jmp 0x4a377e
mov ecx, esi
call fcn.00651cc8
jmp 0x4a374d
mov edi, dword [esp + 0x10]
mov al, byte [edx + edi]
test al, al
js 0x4a3822
movdqa xmm0, xmmword [edx]
pmovmskb eax, xmm0
bsf edi, eax
mov al, byte [edx + edi]
mov esi, dword [esp + 4]
and al, 1
lea ebp, [edi - 0x10]
movzx eax, al
and ebp, ecx
mov ecx, dword [esp + 0xc]
sub dword [esi + 8], eax
mov byte [edx + edi], bl
mov byte [ebp + edx + 0x10], bl
inc dword [esi + 0xc]
shl edi, 2
neg edi
mov dword [edx + edi - 4], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4a3a34
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 0xfffffff6
xor eax, eax
mov bl, byte [edx + esi + 0xa]
xor bl, byte [ecx + esi + 0xa]
or al, bl
inc esi
jne 0x4a3a3d
pop esi
pop ebx
ret
Function at 0x4aa7d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x4aa820
cmp esi, edi
ja 0x4aa888
cmp edi, dword [esp + 0x1c]
ja 0x4aa89b
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x4aa822
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x4aa810
jmp 0x4aa87f
ja 0x4aa828
cmp eax, edx
mov esi, edi
jne 0x4aa7e3
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x4aa860
mov ebp, esi
sub ecx, edx
jns 0x4aa877
jmp 0x4aa881
cmp esi, edi
je 0x4aa8b0
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x4aa881
xor al, 1
cmp ebp, edi
jne 0x4aa840
jmp 0x4aa881
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x718120
call fcn.006524b0
add esp, 4
ud2
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x718120
call fcn.00652260
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_std_src_syncmpmclist.rs
mov edx, 0x2b
push 0x718110
call fcn.006522d0
add esp, 4
ud2
Function at 0x4ae666
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
mov eax, ecx
not eax
cmp esi, 0x40
jb 0x4ae787
add edx, 0x10
xor ecx, ecx
mov edi, 0xff
cmp esi, 0xf
jbe 0x4ae7aa
movzx ebx, byte [edx - 2]
movzx ebp, byte [edx - 1]
mov dword [esp], esi
mov esi, ecx
mov ecx, eax
shr ecx, 0x18
mov ebx, dword [ebx*4 + 0x71fd20]
xor ebx, dword [ebp*4 + 0x71f920]
movzx ebp, byte [edx - 3]
xor ebx, dword [ebp*4 + 0x720120]
movzx ebp, byte [edx - 4]
xor ebx, dword [ebp*4 + 0x720520]
movzx ebp, byte [edx - 5]
xor ebx, dword [ebp*4 + 0x720920]
movzx ebp, byte [edx - 6]
xor ebx, dword [ebp*4 + 0x720d20]
movzx ebp, byte [edx - 7]
xor ebx, dword [ebp*4 + 0x721120]
movzx ebp, byte [edx - 8]
xor ebx, dword [ebp*4 + 0x721520]
movzx ebp, byte [edx - 9]
xor ebx, dword [ebp*4 + 0x721920]
movzx ebp, byte [edx - 0xa]
xor ebx, dword [ebp*4 + 0x721d20]
movzx ebp, byte [edx - 0xb]
xor ebx, dword [ebp*4 + 0x722120]
movzx ebp, byte [edx - 0xc]
xor ebx, dword [ebp*4 + 0x722520]
movzx ebp, byte [edx - 0xd]
xor ecx, ebp
mov ebp, eax
xor ebx, dword [ecx*4 + 0x722920]
movzx ecx, byte [edx - 0xe]
shr ebp, 0x10
and ebp, edi
xor ebp, ecx
movzx ecx, byte [edx - 0xf]
xor ebx, dword [ebp*4 + 0x722d20]
mov ebp, eax
and eax, edi
shr ebp, 8
and ebp, edi
xor ebp, ecx
movzx ecx, byte [edx - 0x10]
xor ebx, dword [ebp*4 + 0x723120]
mov ebp, eax
xor ebp, ecx
mov ecx, esi
mov esi, dword [esp]
mov eax, ebx
inc ecx
xor eax, dword [ebp*4 + 0x723520]
cmp ecx, 4
lea ebx, [esi - 0x10]
jne 0x4ae77a
xor ecx, ecx
cmp ebx, 0x3f
jbe 0x4ae784
add edx, 0x10
mov esi, ebx
jmp 0x4ae686
add esi, 0xfffffff0
test esi, esi
je 0x4ae7a0
mov bl, byte [edx]
inc edx
xor bl, al
shr eax, 8
movzx ecx, bl
xor eax, dword [ecx*4 + 0x71f920]
dec esi
jne 0x4ae78b
not eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0xf
mov edx, esi
push 0x71f910
call fcn.006521f0
add esp, 4
ud2
Function at 0x4ae7c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x80
jb 0x4ae974
movdqu xmm4, xmmword [edx]
not ecx
movdqu xmm3, xmmword [edx + 0x10]
movdqu xmm2, xmmword [edx + 0x20]
movdqu xmm1, xmmword [edx + 0x30]
movdqa xmm5, xmmword [0x661a60]
add edx, 0x40
add eax, 0xffffffc0
movd xmm0, ecx
pxor xmm0, xmm4
movdqa xmm4, xmmword [0x661a50]
movdqa xmm6, xmm0
movdqa xmm7, xmm0
movdqu xmm0, xmmword [edx]
add eax, 0xffffffc0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm7, xmm5, 0x11
pxor xmm0, xmm6
movdqu xmm6, xmmword [edx + 0x10]
pxor xmm0, xmm7
movdqa xmm7, xmm3
pclmulqdq xmm3, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
movdqu xmm6, xmmword [edx + 0x20]
pxor xmm3, xmm7
movdqa xmm7, xmm2
pclmulqdq xmm2, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
movdqu xmm6, xmmword [edx + 0x30]
add edx, 0x40
cmp eax, 0x3f
pxor xmm2, xmm7
movdqa xmm7, xmm1
pclmulqdq xmm1, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
pxor xmm1, xmm7
ja 0x4ae802
movdqa xmm4, xmmword [0x661a70]
movdqa xmm5, xmmword [0x661a80]
movdqa xmm6, xmm0
cmp eax, 0x10
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm3, xmm4, 0
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm2, xmm4, 0
pxor xmm0, xmm2
pxor xmm0, xmm1
jb 0x4ae90c
movdqu xmm1, xmmword [edx]
movdqa xmm2, xmm0
add eax, 0xfffffff0
pclmulqdq xmm0, xmm5, 0x11
add edx, 0x10
pclmulqdq xmm2, xmm4, 0
cmp eax, 0xf
pxor xmm2, xmm1
pxor xmm0, xmm2
ja 0x4ae8e5
movdqa xmm1, xmmword [0x661a80]
pxor xmm2, xmm2
test eax, eax
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
movss xmm2, xmm0
psrldq xmm0, 4
pclmulqdq xmm2, xmmword [0x661a90], 0
pxor xmm0, xmm2
pxor xmm2, xmm2
movss xmm2, xmm0
pclmulqdq xmm2, xmmword [0x661aa0], 0x10
pblendw xmm2, xmm1, 0xfc
pclmulqdq xmm2, xmmword [0x661ab0], 0
pxor xmm2, xmm0
pextrd ecx, xmm2, 1
not ecx
je 0x4ae97e
push eax
call fcn.004ae666
add esp, 4
ret
mov eax, ecx
ret
Function at 0x4aeb14
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [section..data]
test eax, eax
je 0x4aeba0
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4aeb3d
cmp dword [eax + 4], 0
mov edi, eax
je 0x4aeb3d
add edi, 8
jmp 0x4aeb55
mov eax, dword [section..data]
test eax, eax
je 0x4aebaf
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor edi, edi
cmp eax, 1
jne 0x4aeb5e
mov eax, edi
add esp, 8
pop esi
pop edi
pop ebx
ret
mov esi, eax
test eax, eax
jne 0x4aebc4
mov al, byte [0x803894]
mov ecx, 0xc
mov edx, 4
call fcn.004889b0
test eax, eax
je 0x4aebed
mov dword [eax], section..data
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [section..data]
test eax, eax
jne 0x4aebbb
mov ecx, section..data
call fcn.00659cf0
jmp 0x4aebbc
mov ecx, section..data
call fcn.00659cf0
jmp 0x4aeb24
mov ecx, section..data
call fcn.00659cf0
jmp 0x4aeb47
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
call fcn.00652908
mov edx, dword [esi + 4]
mov ebx, dword [esi + 8]
mov ecx, esp
lea edi, [esi + 8]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov dword [esi + 4], 1
mov dword [esi + 8], eax
call fcn.004ae9d4
jmp 0x4aeb55
mov ecx, 4
mov edx, 0xc
call fcn.00651860
ud2

Function at 0x4aebfe
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
mov eax, dword [0x802010]
test eax, eax
je 0x4aeca4
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4aec24
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x4aec9e
mov eax, dword [0x802010]
test eax, eax
je 0x4aecb3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4aec9c
mov esi, eax
test eax, eax
jne 0x4aec7e
mov al, byte [0x803894]
mov ecx, 0x10
mov edx, 8
call fcn.004889b0
test eax, eax
je 0x4aecce
mov esi, eax
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], 0x802010
mov eax, dword [0x802010]
test eax, eax
je 0x4aecc2
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
call fcn.005a6140
mov edi, dword [eax + 8]
mov ebx, dword [eax + 0xc]
lock dec dword [eax]
jne 0x4aec95
mov ecx, eax
call fcn.004e3475
mov dword [esi], edi
mov dword [esi + 4], ebx
jmp 0x4aec9e
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
ret
mov ecx, 0x802010
call fcn.00659cf0
jmp 0x4aec0f
mov ecx, 0x802010
call fcn.00659cf0
jmp 0x4aec32
mov ecx, 0x802010
call fcn.00659cf0
jmp 0x4aec76
mov ecx, 8
mov edx, 0x10
call fcn.00651860
ud2

Function at 0x4aed7c
Capabilities:
Get common file path

Disassembly:
push esi
push eax
mov esi, ecx
mov ecx, esp
xor eax, eax
mov dword [ecx], eax
push ecx
push eax
push eax
push edx
call dword [sym.imp.shell32.dll_SHGetKnownFolderPath]
test eax, eax
je 0x4aed9a
mov byte [esi + 0xc], 2
jmp 0x4aedba
push dword [esp]
call dword [sym.imp.kernel32.dll_lstrlenW]
mov edx, dword [esp]
mov ecx, esi
push eax
call fcn.005a83c0
add esp, 4
push dword [esp]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
add esp, 4
pop esi
ret
Function at 0x4b571c
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
push 2
push edx
push ecx
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov ebx, eax
xor eax, eax
cmp ebx, 0xbfffffff
jbe 0x4b5752
push edi
push esi
call dword [sym.imp.advapi32.dll_SystemFunction036]
mov ecx, eax
add ebx, 0x80000000
xor eax, eax
test cl, cl
cmove eax, ebx
pop esi
pop edi
pop ebx
ret
Function at 0x4d247c
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x13c
cmp dword [esp + 0x154], 0
call fcn.004d2493
Function at 0x4e479d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x802080]
test eax, eax
je 0x4e4871
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4e47c8
cmp dword [eax + 4], 0
mov esi, eax
jne 0x4e4862
mov eax, dword [0x802080]
test eax, eax
je 0x4e4880
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4e4867
mov esi, eax
test eax, eax
jne 0x4e4829
mov al, byte [0x803894]
mov ecx, 0x20
mov edx, 4
call fcn.004889b0
test eax, eax
je 0x4e489b
mov dword [eax], 0x802080
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x802080]
test eax, eax
je 0x4e488f
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov edi, esp
mov ecx, edi
call fcn.004e437d
movsd xmm1, qword [edi + 8]
movsd xmm0, qword [edi]
cmp dword [esi + 4], 0
movsd qword [esi + 0xc], xmm1
movsd xmm1, qword [edi + 0x10]
movsd qword [esi + 0x14], xmm1
mov eax, dword [edi + 0x18]
movsd qword [esi + 4], xmm0
mov dword [esi + 0x1c], eax
je 0x4e4862
lock dec dword [0x803238]
add esi, 4
jmp 0x4e4869
xor esi, esi
mov eax, esi
add esp, 0x1c
pop esi
pop edi
ret
mov ecx, 0x802080
call fcn.00659cf0
jmp 0x4e47b0
mov ecx, 0x802080
call fcn.00659cf0
jmp 0x4e47d6
mov ecx, 0x802080
call fcn.00659cf0
jmp 0x4e4821
mov ecx, 4
mov edx, 0x20
call fcn.00651860
ud2
Function at 0x4e6542
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [0x802090]
mov edi, ecx
test eax, eax
je 0x4e66c2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4e6574
cmp dword [eax + 4], 0
mov esi, eax
je 0x4e6574
add esi, 4
jmp 0x4e66b9
mov eax, dword [0x802090]
test eax, eax
je 0x4e66d1
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4e66b7
mov esi, eax
test eax, eax
jne 0x4e65d9
mov al, byte [0x803894]
mov ecx, 8
mov edx, 4
call fcn.004889b0
test eax, eax
je 0x4e673e
mov dword [eax], 0x802090
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x802090]
test eax, eax
je 0x4e66e0
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test edi, edi
je 0x4e65ed
mov ebx, dword [edi]
mov dword [edi], 0
test ebx, ebx
jne 0x4e66a5
lea ecx, [esp + 0x30]
xorps xmm0, xmm0
movups xmmword [ecx + 0x10], xmm0
movups xmmword [ecx], xmm0
call fcn.004e6794
test eax, eax
jne 0x4e66ef
movups xmm0, xmmword [esp + 0x30]
movups xmm1, xmmword [esp + 0x40]
mov ecx, 0x158
mov edx, 8
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm1
mov al, byte [0x803894]
call fcn.004889b0
test eax, eax
je 0x4e6732
mov ebx, eax
xor eax, eax
xor edi, edi
inc eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov eax, ebx
add eax, 8
push 0x100
push edi
push eax
call fcn.0064ad90
add esp, 0xc
movups xmm0, xmmword [esp + 0x10]
movups xmm1, xmmword [esp]
mov dword [ebx + 0x108], 0x40
mov eax, 0x10000
movups xmmword [ebx + 0x110], xmm0
movups xmmword [ebx + 0x120], xmm1
xorps xmm1, xmm1
movups xmmword [ebx + 0x130], xmm1
mov dword [ebx + 0x144], edi
mov dword [ebx + 0x140], eax
mov dword [ebx + 0x14c], edi
mov dword [ebx + 0x148], eax
mov dword [ebx + 0x150], edi
add esi, 4
mov ecx, dword [esi]
mov dword [esi], ebx
test ecx, ecx
je 0x4e66b9
call fcn.004e4f78
jmp 0x4e66b9
xor esi, esi
mov eax, esi
add esp, 0x50
pop esi
pop edi
pop ebx
ret
mov ecx, 0x802090
call fcn.00659cf0
jmp 0x4e6558
mov ecx, 0x802090
call fcn.00659cf0
jmp 0x4e6582
mov ecx, 0x802090
call fcn.00659cf0
jmp 0x4e65d1
xor edx, edx
lea ecx, [esp + 0x20]
lea esi, [esp + 0x28]
mov dword [ecx], eax
mov dword [esi], ecx
mov dword [ecx + 4], 0x766c64
lea ecx, [esp + 0x30]
inc edx
mov dword [esi + 4], 0x4e674f
mov dword [ecx], 0x766c3c
mov dword [ecx + 4], edx
mov dword [ecx + 0x10], 0
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov edx, 0x766c44
call fcn.00652150
ud2
mov ecx, 8
mov edx, 0x158
jmp 0x4e6748
mov ecx, 4
mov edx, 8
call fcn.00651860
ud2
Function at 0x53750c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [0x8020a4]
mov esi, ecx
test eax, eax
je 0x5375d0
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x53753b
cmp dword [eax + 4], 0
je 0x53753b
add eax, 8
jmp 0x5375ca
mov eax, dword [0x8020a4]
test eax, eax
je 0x5375df
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5375c8
mov edi, eax
test eax, eax
jne 0x537598
mov al, byte [0x803894]
mov ecx, 0xc
mov edx, 4
call fcn.004889b0
test eax, eax
je 0x537624
mov dword [eax], 0x8020a4
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x8020a4]
test eax, eax
je 0x5375ee
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x5375aa
mov ecx, dword [esi + 4]
cmp dword [esi], 0
mov dword [esi], 0
jne 0x5375b9
xor ecx, ecx
inc ecx
lock xadd dword [0x8020a0], ecx
test ecx, ecx
je 0x5375fa
lea eax, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
jmp 0x5375ca
xor eax, eax
add esp, 0x18
pop esi
pop edi
ret
mov ecx, 0x8020a4
call fcn.00659cf0
jmp 0x537521
mov ecx, 0x8020a4
call fcn.00659cf0
jmp 0x537549
mov ecx, 0x8020a4
call fcn.00659cf0
jmp 0x537590
mov ecx, esp
mov edx, 0x76bd70
xor eax, eax
mov dword [ecx], str.regex:_thread_ID_allocation_space_exhausted
mov dword [ecx + 4], 1
mov dword [ecx + 0x10], eax
mov dword [ecx + 8], 0x7f59e0
mov dword [ecx + 0xc], eax
call fcn.00652150
ud2
mov ecx, 4
mov edx, 0xc
call fcn.00651860
ud2