joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ccad0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [0x54aa4c]
test eax, eax
je 0x4ccaf7
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [0x54aa4c]
add esp, 0x18
pop ebx
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea ebx, [esp + 0x24]
mov dword [esp + 8], 9
mov dword [esp + 4], 1
mov dword [esp], str.freeglut
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [0x54aa1c]
test eax, eax
je 0x4ccb48
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.__s_:
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], 0xa
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
add esp, 0x18
pop ebx
ret

Function at 0x4ce8a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
movzx edx, byte [esp + 0x68]
mov dword [esp + 4], 1
mov ebp, dword [esp + 0x60]
mov dword [esp], 0xe8
movzx esi, byte [esp + 0x74]
movzx edi, byte [esp + 0x80]
mov byte [esp + 0x3f], dl
movzx ebx, byte [esp + 0x84]
call sub.msvcrt.dll_calloc
xor edx, edx
test eax, eax
je 0x4ce8f3
mov dword [eax + edx*4 + 0x54], 0
add edx, 1
cmp edx, 0x1c
jne 0x4ce8e3
mov edx, dword [0xa69388]
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
add edx, 1
test ebp, ebp
mov dword [0xa69388], edx
mov dword [eax + 8], edx
je 0x4ce9c7
mov edx, dword [ebp + 0xe0]
test edx, edx
je 0x4ce9e6
mov dword [edx], eax
mov dword [eax + 4], edx
mov dword [eax], 0
mov dword [ebp + 0xe0], eax
mov dword [eax + 0xd8], ebp
xor edx, edx
test ebp, ebp
setne dl
and edi, 0xff
mov byte [eax + 0xe4], bl
movzx ebx, byte [esp + 0x3f]
and esi, 0xff
mov dword [eax + 0x3c], 0x64
mov byte [eax + 0x50], 0
mov byte [eax + 0x51], 0
mov byte [eax + 0x53], 0
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x78]
mov dword [esp], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x6c]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x64]
mov dword [esp + 4], edx
call fcn.004c86e0
mov eax, dword [esp + 0x38]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [0xa69364]
test edx, edx
je 0x4ce9f8
mov dword [edx], eax
mov dword [eax + 4], edx
mov dword [eax], 0
mov dword [0xa69364], eax
jmp 0x4ce946
mov dword [eax + 4], 0
mov dword [ebp + 0xdc], eax
jmp 0x4ce934
mov dword [eax + 4], 0
mov dword [0xa69360], eax
jmp 0x4ce9d6
Function at 0x4cf8d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x4c
test eax, eax
mov byte [esp + 0x2c], dl
je 0x4cf910
lea edx, [esp + 0x3c]
mov dword [esp + 0xc], edx
lea edx, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 1
mov dword [esp + 4], edx
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
add esp, 0x4c
ret
xor eax, eax
add esp, 0x4c
ret
Function at 0x4cfb30
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
cmp byte [0x54aa28], 0
je 0x4cfb40
ret
sub esp, 0x7c
mov dword [esp], str.GLUT_DIALS_SERIAL
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], ebp
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4cfcd0
lea ebp, [esp + 0x44]
xor edx, edx
mov dword [ebp + edx], 0
add edx, 4
cmp edx, 0x1c
jb 0x4cfb6d
mov dword [esp + 0x44], 0x1c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
test eax, eax
mov esi, eax
je 0x4cfd5a
mov dword [esp], 0x34
call sub.msvcrt.dll_malloc
mov ecx, 0xd
mov ebx, eax
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [ebx + 0x18]
mov dword [ebx], esi
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetCommState]
lea eax, [ebx + 4]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetCommTimeouts]
sub esp, 8
mov dword [esp + 0x44], 0x1c
mov dword [esp + 4], ebp
mov dword [esp], str.96_n_8_1
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
sub esp, 8
mov dword [esp + 4], ebp
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetCommState]
sub esp, 8
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 1
mov dword [esp + 0x40], 1
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov eax, dword [ebx]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, 0x20
mov eax, ebx
mov dword [0xa693a0], ebx
sub esp, 4
call fcn.004cf8d0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4cf980
mov dword [esp], 0xa
call fcn.004cb0a0
mov byte [0x54aa28], 1
mov ebx, dword [esp + 0x6c]
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x74]
mov ebp, dword [esp + 0x78]
add esp, 0x7c
ret
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], 0x100
mov dword [esp + 0x28], 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.SOFTWAREFreeGLUT
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
sub esp, 0xc
test eax, eax
jne 0x4cfcb7
lea eax, [esp + 0x24]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], 0xa693c0
mov dword [esp + 8], 0
mov dword [esp + 4], str.DialboxSerialPort
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x4cfd69
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xa693c0
sub esp, 4
jmp 0x4cfb67
mov dword [0xa693a0], 0
jmp 0x4cfcb7
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
jmp 0x4cfcb7
Function at 0x4cfe30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x26c
mov dword [esp + 0x264], edi
mov edi, eax
mov dword [esp + 0x25c], ebx
mov dword [esp + 0x260], esi
mov dword [esp + 0x268], ebp
cmp byte [eax + 0x1d0], 0
je 0x4cfe82
xor eax, eax
mov ebx, dword [esp + 0x25c]
mov esi, dword [esp + 0x260]
mov edi, dword [esp + 0x264]
mov ebp, dword [esp + 0x268]
add esp, 0x26c
ret
lea ebx, [esp + 0x50]
mov esi, dword [sym.imp.msvcrt.dll__snprintf]
lea eax, [eax + 0x70]
mov dword [esp + 0x14], str.CurrentJoystickSettings
lea ebp, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.SystemCurrentControlSetControlMediaResourcesJoystick
mov dword [esp + 8], str._s_s_s
mov dword [esp + 4], 0x100
mov dword [esp], ebx
mov dword [esp + 0x2c], edx
call esi
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
mov dword [esp + 0x3c], eax
call eax
sub esp, 0x14
test eax, eax
jne 0x4cfe5d
mov dword [esp + 0x10], str.OEMName
mov eax, dword [edi + 0x1c8]
mov dword [esp + 0x4c], 0x100
mov dword [esp + 8], str.Joystick_d_s
mov dword [esp + 4], 0x100
add eax, 1
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call esi
lea eax, [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x150]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp + 0x38], eax
call eax
sub esp, 0x18
mov edi, eax
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x34], eax
call eax
sub esp, 4
test edi, edi
mov ecx, dword [esp + 0x30]
jne 0x4cfe5d
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.SystemCurrentControlSetControlMediaPropertiesPrivatePropertiesJoystickOEM
mov dword [esp + 8], str._s_s
mov dword [esp + 4], 0x100
mov dword [esp], ebx
call esi
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
call dword [esp + 0x3c]
sub esp, 0x14
test eax, eax
mov edx, dword [esp + 0x2c]
jne 0x4cfe5d
lea eax, [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], edx
mov dword [esp + 0x4c], pe_nt_image_headers32
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.OEMName
mov dword [esp], eax
call dword [esp + 0x38]
sub esp, 0x18
mov ebx, eax
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call dword [esp + 0x34]
xor eax, eax
sub esp, 4
test ebx, ebx
sete al
jmp 0x4cfe5f
Function at 0x4d9580
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
cmp word [edx], 0x5a4d
je 0x4d9590
repz ret
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x4d958d
xor eax, eax
cmp word [edx + 0x18], 0x10b
sete al
ret

Function at 0x4d95b0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4d95e8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x4d95de
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x4d95ea
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4d95d0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x4d9b30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0xa698a4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0xa698bc]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 4
test ebx, ebx
je 0x4d9b85
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4d9b7e
test esi, esi
je 0x4d9b7e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4d9b60
mov dword [esp], 0xa698a4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4d9e10
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4d9e44
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0xa698c4], eax
call fcn.004ea050
test eax, eax
sete al
movzx eax, al
mov dword [0x54cbb4], eax
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4d9e33

Function at 0x4d9ee0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov dword [esp + 4], eax
mov eax, dword [0xa698c4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x4d9f00
add esp, 0x1c
ret
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
jmp eax
Function at 0x4d9f60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x2c
mov eax, dword [0x54cbb4]
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
test eax, eax
mov dword [esp + 0x28], ebp
js 0x4da010
test eax, eax
jne 0x4d9fb0
mov eax, dword [0xa698c8]
mov dword [0xa698c8], ebx
mov dword [ebx], eax
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
add esp, 0x2c
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [0xa698c4]
call esi
mov dword [esp], ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebp, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0xa698c4]
mov dword [ebx], ebp
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4d9f95
mov edx, esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
add esp, 0x2c
jmp edx
call fcn.004d9e50
mov eax, dword [0x54cbb4]
jmp 0x4d9f84

Function at 0x4da020
Capabilities:
Set thread local storage value

Disassembly:
push ebx
sub esp, 8
mov edx, dword [0x54cbb4]
mov eax, dword [esp + 0x10]
test edx, edx
mov ebx, dword [eax]
js 0x4da050
test edx, edx
jne 0x4da043
mov dword [0xa698c8], ebx
add esp, 8
pop ebx
ret
add esp, 8
mov eax, ebx
pop ebx
jmp fcn.004d9ee0
call fcn.004d9e50
mov edx, dword [0x54cbb4]
jmp 0x4da034

Function at 0x4da250
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [0x54cbb4]
mov edi, dword [esp + 0x40]
test eax, eax
js 0x4da333
test eax, eax
mov esi, dword [0xa698c8]
jne 0x4da2d1
test esi, esi
mov dword [esp + 0x2c], esi
je 0x4da2c5
mov ecx, esi
lea ebx, [esp + 0x2c]
nop
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x4da2b7
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [esp + 4], 1
mov dword [esp], 1
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call eax
cmp eax, 6
je 0x4da300
cmp eax, 8
jne 0x4da327
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
test ecx, ecx
mov dword [esp + 0x2c], ecx
jne 0x4da280
mov eax, 5
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov esi, dword [0xa698c4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x4da271
mov eax, dword [esp + 0x2c]
mov edx, ebx
mov dword [edi + 0xc], 0
mov dword [esp + 0x2c], esi
mov dword [edi + 0x10], eax
mov eax, edi
call fcn.004d9d70
cmp eax, 7
jne 0x4da2ca
mov eax, ebx
call fcn.004d9f10
add esp, 0x30
mov eax, 3
pop ebx
pop esi
pop edi
ret
call fcn.004d9e50
mov eax, dword [0x54cbb4]
jmp 0x4da267
Function at 0x4da400
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edx, dword [0x54cbb4]
mov ebx, dword [esp + 0x30]
test edx, edx
js 0x4da47b
test edx, edx
mov esi, dword [0xa698c8]
jne 0x4da455
mov ecx, dword [ebx + 0xc]
mov eax, ebx
mov dword [esp + 0x1c], esi
lea esi, [esp + 0x1c]
mov edx, esi
test ecx, ecx
jne 0x4da445
call fcn.004d9d70
cmp eax, 7
je 0x4da44c
nop
lea esi, [esi]
call sub.msvcrt.dll_abort
call fcn.004da060
jmp 0x4da436
mov eax, esi
nop
call fcn.004d9f10
mov esi, dword [0xa698c4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
jmp 0x4da41e
call fcn.004d9e50
mov edx, dword [0x54cbb4]
jmp 0x4da414

Function at 0x4da490
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4da4c2
mov dword [esp], ebx
call fcn.004da250
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esp, 0x2c
ret
mov edx, dword [0x54cbb4]
test edx, edx
js 0x4da530
test edx, edx
mov esi, dword [0xa698c8]
jne 0x4da500
lea edx, [esp + 0x1c]
mov eax, ebx
mov dword [esp + 0x1c], esi
call fcn.004da060
cmp eax, 7
je 0x4da4f0
call sub.msvcrt.dll_abort
nop
lea eax, [esp + 0x1c]
call fcn.004d9f10
lea esi, [esi]
mov esi, dword [0xa698c4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x4da4d6
call fcn.004d9e50
mov edx, dword [0x54cbb4]
jmp 0x4da4cc

Function at 0x4daa80
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
add esp, 0x1c
ret

Function at 0x4daac0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x4daae5
xor eax, eax
add esp, 0x1c
ret
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
jmp eax
Function at 0x4423da
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x34]
push edi
push 0x488154
push eax
mov dword [ebp - 4], fcn.00414a46
call fcn.004149c2
mov edi, eax
add esp, 8
mov dword [ebp - 8], edi
test edi, edi
jne 0x44242e
push eax
push 0xdeadbeef
push 0x1f
push esi
call fcn.004422cb
mov bl, al
lea eax, [ebp - 8]
push eax
call fcn.00431848
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp + 8], 1
jmp 0x44243a
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 8]
push ecx
push 0x400
lea edx, [ebp - 0x408]
push edx
push eax
call dword [0x482748]
test eax, eax
je 0x4424ac
mov eax, dword [ebp + 8]
test eax, eax
je 0x442480
push edi
push 1
push eax
lea ecx, [ebp - 0x408]
push ecx
call fcn.004142b6
mov eax, dword [ebp + 8]
add esp, 0x10
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
test eax, eax
jne 0x44243a
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x4424d1
push eax
push 0xdeadbeef
invalid

Function at 0x442e0c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4a7f10], 0
push esi
push edi
mov esi, 0x4a7540
jne 0x442e2c
push 0
call fcn.004148b3
push eax
call fcn.00432281
add esp, 8
mov dword [0x49205c], 0x270
mov dword [0x4a753c], esi
mov edx, 0xe3
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi + 0x634]
add esi, 4
xor edi, eax
dec edx
mov dword [esi - 4], edi
jne 0x442e41
mov edx, 0x18c
lea esp, [esp]
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi - 0x38c]
add esi, 4
xor edi, eax
dec edx
mov dword [esi - 4], edi
jne 0x442e7c
mov ecx, dword [0x4a7540]
mov dl, cl
and dl, 1
movzx eax, dl
mov edx, dword [esi]
neg eax
sbb eax, eax
xor edx, ecx
and edx, 0x7ffffffe
xor edx, dword [esi]
and eax, 0x9908b0df
shr edx, 1
xor edx, dword [esi - 0x38c]
pop edi
xor edx, eax
mov dword [esi], edx
pop esi
ret

Function at 0x444af8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
lea ecx, [eax + 4]
push edi
mov edi, dword [eax + edx]
mov dword [esi], ecx
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004115d7
mov ebx, eax
lea eax, [edi + edi]
push eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
push eax
push ebx
call fcn.00410e60
lea eax, [edi + edi]
add dword [esi], eax
xor ecx, ecx
mov word [eax + ebx], cx
add esp, 0x10
xor eax, eax
test edi, edi
jle 0x444b56
xor word [ebx + eax*2], di
inc eax
cmp eax, edi
jl 0x444b4d
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
Function at 0x44afef
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0xdc]
push eax
call fcn.00442c5a
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0xdc]
push edx
call fcn.00442bb4
xor esi, esi
test edi, edi
je 0x44b037
lea eax, [ebp - 0xdc]
push eax
call fcn.00442c29
xor byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x44b023
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46f3c1
Capabilities:
Encode data using xor

Disassembly:
or byte [edi + 0x33], cl
rol byte [eax], 0xf
mov word [ebx - 0x3e548dad], ds
clc
inc esi
mov ebx, dword [ebx + 0x1ffe4]
inc ecx
and al, 0x48
push eax
test byte [eax + 0x56], dl
call dword [0x408b56f6]
add byte [edi + 0x74], dl
or al, 0x74
or byte [esi - 0x75], dl
xor byte [eax + edx*2 + 0x3715ff56], al
push esi
mov ecx, dword [ebx + 0x4544d956]
add byte [eax], ah
rol byte [esi + 0x3b], 0xf3
jl 0x46f3d8
pop edi
pop esi
mov al, 1
lea esi, [edi + 0xf014eb6]
int3

Function at 0x47dcbb
Capabilities:
Encode data using xor

Disassembly:
add byte [esp - 0x15], dh
movsb byte es:[edi], byte [esi]
push 1
pushfd
fiadd dword [esp + edi*2]
xor bl, byte [eax + ebp*8]
mov ecx, edi
lea eax, [esi + 0x1c500f54]
cmp al, 0xb2
call dword [ebp - 0x75]
or al, 0xe
add byte [esi + 0x48], cl
add al, ch
int3
xor ebx, ebx
sub edx, dword [0x482564]
push dword [esp + ebp + 0x48]
jb 0x47dc25
cmp dword [esi + 0x40], 0x50
push eax
mov word [eax + ebx*4], fs
push es
add byte [eax], al
scasb al, byte es:[edi]
mov esi, 0x8df633d7
test dword [eax], ecx
invalid
push eax
jge 0x47dca6
movsb byte es:[edi], byte [esi]
push 1
pushfd
fiadd dword [eax]
add byte [ebx + 0x4d8dcf], cl
add byte [ebx + ecx*4], ah
or al, 0xb2
call dword [ebp - 0x75]
push ecx
inc edi
fsubr st(0)
push ecx
call 0x3b8de290
and al, 0x98
sbb al, 0x72
jb 0x47dc97
inc esp
je 0x47dc49
jb 0x47dc97
inc esp
je 0x47dc49
push eax
call fcn.00402250
call 0x455c6821
movsb byte es:[edi], byte [esi]
add byte [eax], al
add byte [ebx], al
push esi
mov eax, dword [eax - 0x2c]
shr eax, 9
xor esi, 0x56
mov esi, dword [eax]
test byte [eax + 0x56], dl
call dword [0x60327cf6]
aas
jl 0x47dcd0
dec esp
push ss
sub al, 0x75
inc esp
inc ebp
add cl, bl
inc esp
inc ebp
add byte [eax], cl
rcr byte [esi + 0x5d], 0xc2
sub esp, 0x24
add byte [eax], al
add byte [ebp - 0x2b8adbb4], cl
inc dword [ecx + ebp*4]
and eax, 0x4570004
pop es
jmp [edx + 0x69]