joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454330
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov byte [ecx + 0x10], 1
push 0x20
call fcn.00562f65
add esp, 4
mov edi, eax
mov dword [eax + 4], 0
mov dword [eax], 0x621e2c
sub esp, 0x10
movaps xmm0, xmmword [0x639590]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [edi + 8], eax
test eax, eax
je 0x45441c
movsd xmm0, qword [ebp + 8]
movsd qword [edi + 0x10], xmm0
mov dword [edi + 0x18], esi
mov ebx, dword [esi + 0xc]
mov dword [esi + 0xc], edi
test ebx, ebx
je 0x4543b5
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x45445c
push ebx
call fcn.00562f60
add esp, 4
mov edi, dword [esi + 0xc]
xor eax, eax
push eax
push eax
push edi
push 0x4f4ff0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 4], eax
test eax, eax
je 0x4543e2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea edi, [ebp - 0x24]
push 0x1b
push str.thread_win.cc
push str.Start
push edi
call fcn.0050b5e0
add esp, 0x10
lea esi, [ebp - 0x14]
push edi
push esi
call fcn.005bb200
add esp, 8
mov ecx, esi
push 0x637650
call fcn.005d7b80
mov ecx, esi
call fcn.005907d0
jmp 0x4543ce
lea eax, [ebp - 0x24]
push 0x1e
push str.semaphore_win.cc
push 0x63b03f
push eax
call fcn.0050b5e0
add esp, 0x10
lea ebx, [ebp - 0x14]
lea eax, [ebp - 0x24]
push eax
push ebx
call fcn.005bb200
add esp, 8
mov ecx, ebx
push str.CreateSemaphore
call fcn.005d7b80
mov ecx, ebx
call fcn.005907d0
jmp 0x454381
lea eax, [ebp - 0x24]
push 0x22
push str.semaphore_win.cc
push str.Semaphore
push eax
call fcn.0050b5e0
add esp, 0x10
lea edi, [ebp - 0x14]
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.005bb200
add esp, 8
mov ecx, edi
call fcn.005907d0
jmp 0x4543a9
Function at 0x456fb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x644040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x456fe0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x425350
push 0
push eax
push 0x425330
push 0x657bc4
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x4570db
cmp dword [0x657bc8], 0
jne 0x456fcc
push dword [0x657bcc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x456fcc
mov esi, eax
mov eax, 0x657bd0
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x657bd4]
mov ebx, dword [0x657bd8]
mov eax, dword [0x657bdc]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x657be0]
mov dword [ebp - 0x20], eax
mov eax, dword [0x657be4]
mov dword [ebp - 0x24], eax
mov eax, 0x657bd0
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x457074
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [0x63e19c]
push dword [ebp - 0x18]
call edi
add esp, 4
test ebx, ebx
je 0x457089
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [0x63e19c]
push edi
call ebx
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x45709f
mov edi, dword [esi + 8]
call dword [0x63e19c]
push edi
call ecx
add esp, 4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
je 0x4570b8
mov edi, dword [esi + 0xc]
call dword [0x63e19c]
push edi
call ecx
add esp, 4
test ebx, ebx
je 0x4570cd
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [0x63e19c]
push edi
call ebx
add esp, 4
push esi
call fcn.005551f0
add esp, 4
jmp 0x456fcc
call fcn.0057778c
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ecx], 0x620684
cmp byte [ecx + 0x13], 0
js 0x45710b
test edi, edi
je 0x457103
push esi
call fcn.00562f60
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebp
ret 4
push dword [esi + 8]
call fcn.00562f60
add esp, 4
jmp 0x4570f6
Function at 0x458720
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x649648]
mov ecx, dword [0x64784c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x458751
movzx eax, word [0x649624]
cmp eax, 9
jne 0x45879c
xor eax, eax
inc eax
pop ebp
ret
push 0x649648
call fcn.00562fa8
add esp, 4
cmp dword [0x649648], 0xffffffff
jne 0x458740
xorps xmm0, xmm0
movups xmmword [0x649634], xmm0
movups xmmword [0x649624], xmm0
mov dword [0x649644], 0
push 0x649624
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x649648
call fcn.00562ff7
add esp, 4
jmp 0x458740
test eax, eax
je 0x45874f
cmp eax, 6
jne 0x4587ac
mov eax, 2
jmp 0x45874f
cmp eax, 0xc
jne 0x4587b8
mov eax, 3
jmp 0x45874f
mov eax, 4
jmp 0x45874f

Function at 0x458900
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 1
je 0x458953
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x458979
cmp byte [ebp + 0xc], 0
jne 0x45895b
mov ecx, esi
mov edx, edi
call fcn.0043a9d0
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x458920
cmp byte [esi + 4], 1
je 0x458965
mov eax, dword [esi]
jmp 0x45896b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x458932
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 1
je 0x458989
mov eax, dword [esi]
jmp 0x45898f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4589a3
xor ebx, ebx
jmp 0x45893d
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 1
je 0x4589b4
mov eax, dword [esi]
jmp 0x4589ba
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x458932
mov edi, dword [ebp - 0x14]
jmp 0x458932
Function at 0x458d80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
mov ebx, esp
push 0x97
push str.file_win.cc
push str.WriteAtCurrentPos
push ebx
call fcn.0050b5e0
add esp, 0x10
xor eax, eax
mov ecx, edi
push eax
push eax
call fcn.005224f0
mov dword [esp + 0x4c], 0xa
mov al, byte [0x649456]
test al, al
jne 0x458e32
mov ecx, dword [ebp + 0xc]
test ecx, ecx
js 0x458e2d
mov eax, dword [ebp + 8]
mov dword [esp], 0xffffffff
push 0
push ebx
push ecx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [esp]
lea ecx, [esp + 0x10]
call fcn.005403a0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00566245
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor esi, esi
dec esi
jmp 0x458e0d
movzx ecx, al
lea eax, [esp + 0x54]
mov dword [eax], ebx
lea edi, [esp + 0x50]
mov dword [edi], str.ScopedBlockingCall
lea edx, [esp + 0x4c]
push eax
push edi
call fcn.005b5f10
add esp, 8
jmp 0x458de5
Function at 0x458e60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x235
push str.file_util_win.cc
push str.PathHasAccess
push ebx
call fcn.0050b5e0
add esp, 0x10
xor eax, eax
mov ecx, edi
push eax
push eax
call fcn.005224f0
mov dword [esp + 0x5c], 0xa
mov al, byte [0x649456]
test al, al
jne 0x458fd1
cmp byte [esi + 0xb], 0
jns 0x458ed3
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
je 0x458fc7
test al, 0x10
mov ecx, 0x40000000
mov eax, 2
cmove eax, ecx
mov ecx, 0x80
mov edx, 0x2000000
cmove edx, ecx
push ebx
push edx
push 3
push ebx
push 7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x458f31
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x458f87
call fcn.005018d0
mov ebx, esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
setne al
mov dword [esp + 0xc], eax
lea eax, [ebx + 1]
cmp eax, 2
jb 0x458f67
call fcn.005018d0
cmp dword [0x655038], 0
je 0x458f8b
mov esi, dword [0x655038]
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, edi
call dword [0x63e19c]
mov ecx, esi
push ebx
call edi
lea ecx, [esp + 0x20]
call fcn.005403a0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.00566245
mov eax, dword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x458f2a
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x631a0d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x458ff7
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x458fc1
call dword [0x63e19c]
call ecx
push 0
push eax
call fcn.0042a0c0
add esp, 8
jmp 0x458f50
push 1
push 0
jmp 0x458fb7
mov dword [esp + 0xc], 0
jmp 0x458f67
movzx ecx, al
lea eax, [esp + 0x64]
mov dword [eax], ebx
lea edi, [esp + 0x60]
mov dword [edi], str.ScopedBlockingCall
lea edx, [esp + 0x5c]
push eax
push edi
call fcn.005b5f10
add esp, 8
jmp 0x458ecb
xor eax, eax
push eax
jmp 0x458fb6
Function at 0x45c180
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov byte [esi], cl
mov byte [esi + 4], cl
cmp byte [eax + 4], 1
jne 0x45c1e6
test esi, esi
je 0x45c267
xor ecx, ecx
mov dword [esi], ecx
mov ebx, dword [eax]
mov dword [eax], ecx
lea edi, [ebx + 1]
cmp edi, 2
jb 0x45c1b8
call fcn.005018d0
cmp dword [esi], ebx
je 0x45c1e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x45c1f2
cmp edi, 2
jb 0x45c1d9
mov dword [esi], ebx
call fcn.005018d0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005018d0
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x45c22b
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e19c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x45c1cd
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x631a0d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45c26a
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x45c261
call dword [0x63e19c]
call ecx
push 0
push eax
call fcn.0042a0c0
add esp, 8
jmp 0x45c205
push 1
push 0
jmp 0x45c257
int3
xor eax, eax
push eax
jmp 0x45c256

Function at 0x45e2f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.0044c550
mov eax, dword [esi]
test eax, eax
je 0x45e343
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x45e34a
lea ecx, [ebp - 0x14]
call fcn.0044bd20
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x45e325
cmp dword [ebx + 0x50], 2
jne 0x45e369
cmp byte [ebx + 0x1b], 0
js 0x45e35b
lea eax, [ebx + 0x10]
jmp 0x45e35e
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x45e36e
add ebx, 0x58
jmp 0x45e321
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jae 0x45e394
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.005d43d0
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x45e369
mov ecx, dword [ebp + 8]
push ebx
call fcn.005d42c0
mov ecx, eax
jmp 0x45e38c

Function at 0x4e9bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.004e9bd7

Function at 0x4ecec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.004eced7
Function at 0x4f1c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4f1ce3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x4f1ccd
cmp dword [ebp - 0x18], 4
jne 0x4f1ccd
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x4f1ccd

Function at 0x4f1cf0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push eax
mov eax, dword [ebp + 8]
mov edx, dword [0x644040]
xor edx, ebp
mov dword [ebp - 8], edx
mov edx, 4
lea esi, [ebp + 0xc]
push edx
push esi
push edx
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00566245
mov eax, esi
add esp, 4
pop esi
pop ebp
ret 8

Function at 0x4f1d30
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x644040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, 0x20019
or ecx, dword [ebp + 0xc]
push esi
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4f1dcd
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ecx, dword [esi]
sub esp, 0x30
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x4f1dd5
mov eax, dword [ebp - 0x1c]
sub eax, 1
setb dl
mov dword [esi + 4], eax
mov ecx, dword [esi]
test ecx, ecx
sete dh
or dh, dl
je 0x4f1ddf
mov word [esi + 8], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi], 0
jmp 0x4f1db5
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4f1dcd
lea ebx, [esi + 8]
lea edx, [ebp - 0x14]
mov dword [edx], 0x104
xor edx, edx
dec edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
xor edx, edx
push edi
push edx
push edx
push edx
lea edx, [ebp - 0x14]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4f1db5
jmp 0x4f1dbb
Function at 0x4f3550
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xa34], 0x8000
jne 0x4f363f
movzx eax, word [0x646160]
shl eax, 5
cmp dword [esi + eax + 0x54], 0x200
jne 0x4f3642
push 0x646120
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4f3648
cmp byte [0x6551f8], 0
jne 0x4f35d2
cmp dword [0x657cdc], 0
jne 0x4f3657
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4f365a
mov dword [0x6551a4], eax
mov dword [0x657ce0], eax
mov dword [0x657cdc], 0x444990
mov byte [0x6551f8], 1
push 0x646120
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor eax, eax
lock cmpxchg dword [0x6551fc], esi
jne 0x4f3645
add esi, 0x48
mov dword [0x657ce4], 0x4f3660
mov eax, 0xffffffb0
jmp 0x4f360f
mov cl, 0x40
jmp 0x4f3603
mov cl, 0x80
mov byte [eax + 0x6551f8], cl
add esi, 0x20
inc eax
je 0x4f3638
cmp dword [esi], 0
je 0x4f363b
mov ecx, dword [esi + 0xc]
cmp ecx, 0x81
jb 0x4f3601
cmp ecx, 0x101
jb 0x4f35fd
cmp ecx, 0x201
setb cl
shl cl, 4
add cl, 0x10
jmp 0x4f3603
pop esi
pop ebp
ret
xor ecx, ecx
jmp 0x4f3603
int3
int3
int3
mov ecx, 0x646120
call fcn.00521520
jmp 0x4f3592
int3
int3
Function at 0x4f4940
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x4f4957
test eax, eax
je 0x4f4957
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
sete al
mov ecx, dword [0x657ce4]
test ecx, ecx
setne dl
and dl, al
cmp dl, 1
je 0x4f49aa
cmp dword [0x657cdc], 0
je 0x4f4951
mov esi, dword [0x657ce0]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x4f49b4
test esi, esi
je 0x4f4951
mov ecx, dword [0x657cdc]
call dword [0x63e19c]
push esi
call ecx
add esp, 4
jmp 0x4f4951
call dword [0x63e19c]
call ecx
jmp 0x4f496e
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4f4992
Function at 0x5017f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ecx], 0
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x501819
call fcn.005018d0
cmp dword [esi], ebx
je 0x501843
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x50184f
cmp edi, 2
jb 0x50183a
mov dword [esi], ebx
call fcn.005018d0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005018d0
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x501888
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e19c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x50182e
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x631a0d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5018c4
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x5018be
call dword [0x63e19c]
call ecx
push 0
push eax
call fcn.0042a0c0
add esp, 8
jmp 0x501862
push 1
push 0
jmp 0x5018b4
xor eax, eax
push eax
jmp 0x5018b3
Function at 0x5281e0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x6496ec]
mov ecx, dword [0x64784c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x528224
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, dword [0x6496e8]
test ecx, ecx
je 0x52826c
call dword [0x63e19c]
push edi
push esi
call ecx
test eax, eax
je 0x528269
pop esi
pop edi
pop ebp
ret
push 0x6496ec
call fcn.00562fa8
add esp, 4
cmp dword [0x6496ec], 0xffffffff
jne 0x528202
push str.bcryptprimitives.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x52827e
push str.ProcessPrng
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6496e8], eax
push 0x6496ec
call fcn.00562ff7
add esp, 4
jmp 0x528202
int3
test edi, edi
je 0x528220
push edi
push esi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x528220
int3
int3
Function at 0x532210
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
push 0x14
call fcn.00562f65
add esp, 4
mov esi, eax
mov ecx, eax
push 4
call fcn.0052b4d0
mov edi, dword [esi]
mov edx, dword [esi + 4]
mov eax, edx
sub eax, edi
sar eax, 2
lea ecx, [eax - 1]
cmp ecx, 2
jb 0x5322bf
add eax, 0xfffffffd
movd xmm0, eax
por xmm0, xmmword [0x626540]
subsd xmm0, qword [0x626550]
xor edx, edx
inc edx
movq xmm1, qword [0x626550]
movsd xmm2, qword [0x615998]
nop dword [eax]
mov edi, dword [esi]
mov ebx, dword [esi + 4]
sub ebx, edi
sar ebx, 2
cmp ebx, edx
jbe 0x53238d
movd xmm3, eax
por xmm3, xmm1
subsd xmm3, xmm1
lea ebx, [edx - 1]
movd xmm4, ebx
por xmm4, xmm1
subsd xmm4, xmm1
addsd xmm4, xmm4
addsd xmm4, xmm3
divsd xmm4, xmm0
addsd xmm4, xmm2
cvttsd2si ebx, xmm4
mov dword [edi + edx*4], ebx
dec eax
inc edx
cmp edx, ecx
jne 0x532270
mov edi, dword [esi]
mov edx, dword [esi + 4]
cmp edx, edi
je 0x53238d
mov dword [edx - 4], 0x7fffffff
mov edi, dword [esi]
mov eax, dword [esi + 4]
mov ebx, eax
sub ebx, edi
je 0x53239c
js 0x5323a0
mov ecx, ebx
shr ecx, 2
mov edx, edi
and ebx, 3
jne 0x53235f
sub edi, eax
cmp edi, 0xfffffffc
ja 0x532352
nop word cs:[eax + eax]
movzx edi, cl
movzx ebx, byte [edx]
xor ebx, edi
shr ecx, 8
xor ecx, dword [ebx*4 + 0x62fe80]
movzx edi, cl
movzx ebx, byte [edx + 1]
xor ebx, edi
shr ecx, 8
xor ecx, dword [ebx*4 + 0x62fe80]
movzx edi, cl
movzx ebx, byte [edx + 2]
xor ebx, edi
shr ecx, 8
xor ecx, dword [ebx*4 + 0x62fe80]
movzx edi, cl
movzx ebx, byte [edx + 3]
xor ebx, edi
shr ecx, 8
xor ecx, dword [ebx*4 + 0x62fe80]
add edx, 4
cmp edx, eax
jne 0x532300
mov dword [esi + 0xc], ecx
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x14], edi
movzx edi, cl
mov dword [ebp - 0x18], edi
movzx edi, byte [edx]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x18]
xor dword [ebp - 0x10], edi
shr ecx, 8
mov edi, dword [ebp - 0x10]
xor ecx, dword [edi*4 + 0x62fe80]
mov edi, dword [ebp - 0x14]
inc edx
dec ebx
jne 0x532362
jmp 0x5322ef
push str....._third_partylibc_srcinclude_vector:1411:_assertion___n___size___failed:_vector___index_out_of_bounds_n
push 0x622e92
call fcn.00590170
xor ecx, ecx
jmp 0x532352
int3
Function at 0x534a20
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00534a30

Function at 0x535110
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x5351fa
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x535185
lea eax, [edi + 1]
cmp eax, 2
jb 0x535162
mov dword [esi], edi
call fcn.005018d0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 0
inc eax
cmp eax, 1
jbe 0x5351fe
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.005018d0
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x5351be
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e19c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x535153
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x631a0d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x535201
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x5351f4
call dword [0x63e19c]
call ecx
push 0
push eax
call fcn.0042a0c0
add esp, 8
jmp 0x535198
push 1
push 0
jmp 0x5351ea
mov byte [esi + 4], 0
int3
xor eax, eax
push eax
jmp 0x5351e9