joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425736
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0x2c]
mov eax, dword [ebp + 8]
mov ecx, dword [0x5ce440]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov dword [edx], 0xffffffff
mov esi, 5
cmp eax, 3
jne 0x4257d7
mov edx, dword [ebp + 0x28]
mov esi, dword [ebp + 0x10]
cmp dword [esi + 0x14], 8
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
jb 0x42577a
mov esi, dword [esi]
mov ebx, dword [ebx]
push 0
push edx
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
je 0x4257c4
mov esi, eax
lea eax, [ebp - 0x14]
mov dword [eax], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
push 3
push edi
push edi
lea ecx, [ebp - 0x14]
push ecx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb edi, edi
lea eax, [ebp - 0x14]
or edi, dword [eax]
jmp 0x4257c7
xor edi, edi
dec edi
mov eax, dword [ebp + 0x2c]
mov dword [eax], edi
xor eax, eax
cmp edi, 0xffffffff
sete al
lea esi, [eax + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005051b5
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4268e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov ebx, ecx
mov al, byte [ebp + 8]
mov ecx, dword [0x5ce440]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
test al, al
je 0x426930
xor edi, edi
inc edi
mov esi, 0x57a192
mov ecx, ebx
push 0
push 0x437000
push edi
push str.NtMapViewOfSection
push esi
call fcn.004260e6
mov ecx, ebx
push edi
push 0x437240
push edi
push str.NtUnmapViewOfSection
push esi
call fcn.004260e6
jmp 0x42693a
cmp dword [ebx + 8], 0
je 0x426aae
mov eax, dword [ebx]
mov edi, dword [eax]
sub esp, 0x14
movdqa xmm0, xmmword [0x57a120]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov esi, dword [ebx + 8]
shl esi, 6
lea eax, [esi + 0x50]
mov dword [ebp - 0x70], eax
push eax
call fcn.00425cf0
add esp, 4
mov dword [ebp - 0x74], ebx
mov ebx, eax
mov ecx, 0xfffff000
and eax, ecx
add eax, dword [ebp - 0x6c]
and ebx, 0xfff
add esi, 0x104f
and esi, ecx
push 0x40
push 0x1000
push esi
push eax
mov dword [ebp - 0x6c], edi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test eax, eax
jne 0x4269cf
lea esi, [ebp - 0x60]
push str.thunk_base
push 0x183
push str....._sandboxwin_srcinterception.cc
push esi
call fcn.00407bc0
add esp, 0x10
mov ecx, esi
call fcn.00407cf0
mov ecx, esi
call fcn.00407d00
add edi, ebx
pcmpeqd xmm0, xmm0
lea esi, [ebp - 0x60]
movdqu xmmword [esi + 8], xmm0
xor eax, eax
dec eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], eax
movdqu xmmword [esi + 0x38], xmm0
movdqu xmmword [esi + 0x28], xmm0
movdqu xmmword [esi + 0x18], xmm0
mov eax, dword [ebp - 0x70]
mov dword [esi], eax
mov dword [esi + 0xc], 0
mov dword [esi + 4], 0x10
pxor xmm0, xmm0
movdqu xmmword [0x5d9f34], xmm0
movdqu xmmword [0x5d9f44], xmm0
movdqu xmmword [0x5d9f54], xmm0
movdqu xmmword [0x5d9f64], xmm0
movdqu xmmword [0x5d9f74], xmm0
movdqu xmmword [0x5d9f84], xmm0
movdqu xmmword [0x5d9f90], xmm0
mov ecx, dword [ebp - 0x74]
push esi
push eax
push edi
call fcn.00426d26
mov ebx, eax
test eax, eax
jne 0x426ab0
lea eax, [ebp - 0x64]
mov dword [eax], 0xffffffff
push eax
push 0x10
push esi
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, 0x2a
test eax, eax
je 0x426ab0
cmp dword [ebp - 0x64], 0x10
jne 0x426ab0
lea eax, [ebp - 0x68]
mov dword [eax], 0xffffffff
push eax
push 0x20
push dword [ebp - 0x70]
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push 0x6c
push 0x5d9f34
push str.g_originals
call fcn.004111a4
mov ebx, eax
jmp 0x426ab0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005051b5
mov eax, ebx
add esp, 0x68
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x427830
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x5ce440]
xor ecx, ebp
mov dword [ebp - 8], ecx
test eax, eax
je 0x42787c
push eax
push dword [ebp + 8]
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x42787c
lea esi, [ebp - 0xc]
push 0x57a31a
push 0x20
push str....._base_rand_util_win.cc
push esi
call fcn.00407bc0
add esp, 0x10
mov ecx, esi
call fcn.00407cf0
mov ecx, esi
call fcn.00407d00
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005051b5
add esp, 8
pop esi
pop ebp
ret
Function at 0x42ccbc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x42cdd9
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx + 0x74], 0
je 0x42cdd9
cmp word [eax + edx + 0x14], 0x68
jb 0x42cdd9
mov eax, dword [eax + edx + 0x78]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
mov esi, ecx
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x57244c]
mov dword [ebp - 0x14], esi
mov ecx, esi
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x42cdd9
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
cmp ecx, 0xffff
jbe 0x42ce1b
mov ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp - 0x14]
mov esi, eax
mov eax, dword [edi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [0x57244c]
mov ecx, edi
push dword [ebp - 0x10]
call ebx
mov ecx, eax
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x18]
test eax, eax
je 0x42cdd9
lea edi, [ecx + eax*4]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov edx, ecx
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x2c], edi
sub edi, edx
mov eax, edi
sar eax, 2
shr edi, 0x1f
add edi, eax
and edi, 0xfffffffe
mov dword [ebp - 0x18], edx
mov eax, dword [edx + edi*2]
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [0x57244c]
mov ecx, esi
push dword [ebp - 0x10]
call ebx
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x42cdaf
mov edx, dword [ebp - 0x28]
cmp cl, byte [eax]
jne 0x42cdb1
inc eax
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x42cda3
xor ecx, ecx
mov edx, dword [ebp - 0x18]
lea edi, [edx + edi*2]
movzx eax, byte [eax]
cmp cl, al
je 0x42cde5
movzx ecx, cl
cmp ecx, eax
lea eax, [edi + 4]
cmovg edx, eax
mov eax, dword [ebp - 0x2c]
cmovs eax, edi
mov edi, eax
xor eax, eax
cmp edx, edi
jne 0x42cd68
jmp 0x42cddb
xor eax, eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x14]
mov eax, dword [esi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [0x57244c]
mov ecx, esi
push dword [ebp - 0x10]
call ebx
sub edi, dword [ebp - 0x24]
sar edi, 1
movzx eax, word [eax + edi]
mov ecx, dword [ebp - 0x1c]
add ax, word [ecx + 0x10]
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x20]
mov word [ebx], ax
mov al, 1
jmp 0x42cddb

Function at 0x42dbb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042dbc0
Function at 0x42fe70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x290
mov eax, dword [0x5ce440]
xor eax, ebp
mov dword [esp + 0x288], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x270], xmm0
movdqa xmmword [esp + 0x260], xmm0
movdqa xmmword [esp + 0x250], xmm0
movdqa xmmword [esp + 0x240], xmm0
lea ebx, [esp + 0x38]
push 0x3bb
push str....._base_files_file_util_win.cc
push 0x57a98e
push ebx
call fcn.00407310
add esp, 0x10
lea ecx, [esp + 0x240]
push 0
push ebx
call fcn.0041d330
lea eax, [esp + 0x3a]
push 0x206
push 0xff
push eax
call fcn.005083f0
add esp, 0xc
mov word [esp + 0x38], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
add esi, 0xfffffefb
cmp esi, 0xfffffefc
jb 0x42ff53
push ebx
call fcn.005102e1
add esp, 4
lea edi, [esp + 8]
mov ecx, edi
push eax
push ebx
call fcn.004054f0
lea ebx, [esp + 0x20]
mov ecx, edi
push ebx
call fcn.004064d0
mov ecx, dword [ebp + 8]
push ebx
call fcn.00405640
mov ecx, ebx
call fcn.004055e0
mov ecx, edi
call fcn.004055e0
cmp esi, 0xfffffefc
setae bl
lea ecx, [esp + 0x240]
call fcn.0041d350
mov ecx, dword [esp + 0x288]
xor ecx, ebp
call fcn.005051b5
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x42ff80
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x5ce440]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov ebx, esp
push 0x3cb
push str....._base_files_file_util_win.cc
push 0x57a9a3
push ebx
call fcn.00407310
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.0041d330
cmp dword [edi + 0x14], 8
jb 0x42ffe6
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov ecx, esi
call fcn.0041d350
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005051b5
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x430b70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x140c
call fcn.005057a0
mov eax, dword [0x5ce440]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x5ce038]
cmp eax, 0xffffffff
je 0x430cdb
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x430cdb
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.00507e70
add esp, 0xc
mov ecx, dword [0x5ce038]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.00443ff0
add esp, 8
test ebx, ebx
je 0x430beb
push ebx
call fcn.0050578f
add esp, 4
mov eax, dword [0x5dabbc]
mov ecx, dword [0x5dc534]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x430cfc
mov esi, dword [0x5dabb8]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x430cf0
lea eax, [ebp - 0x1410]
push 0xc00
push 0x5d9fb8
push eax
call fcn.00507e70
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ecx, 0x101
jmp 0x430c59
mov ecx, dword [ebp - 0x1418]
dec ecx
je 0x430ccb
test al, 1
je 0x430ccb
mov dword [ebp - 0x1418], ecx
mov ebx, 8
xor eax, eax
lea edi, [ebp - 0x810]
jmp 0x430c8e
add ebx, 0xc
add edi, 8
cmp ebx, 0xc08
je 0x430c50
mov esi, dword [edi]
test esi, esi
je 0x430c80
cmp dword [ebp + ebx - 0x1418], 0
je 0x430c80
mov ecx, dword [edi + 4]
cmp ecx, dword [ebp + ebx - 0x1410]
jne 0x430c80
mov ecx, dword [ebp + ebx - 0x1414]
test ecx, ecx
je 0x430c80
mov dword [edi], 0
call dword [0x57244c]
push esi
call ecx
add esp, 4
mov al, 1
jmp 0x430c80
push 2
push dword [ebp - 0x1414]
call fcn.00443ff0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005051b5
add esp, 0x140c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.00419c10
jmp 0x430c21
push 0x5dabbc
call fcn.00505151
add esp, 4
cmp dword [0x5dabbc], 0xffffffff
jne 0x430c0c
push 4
call fcn.00504e46
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.00419c00
mov dword [0x5dabb8], esi
push 0x5dabbc
call fcn.00505100
add esp, 4
jmp 0x430c0c

Function at 0x430d50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5ce038]
cmp eax, 0xffffffff
je 0x430d70
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x430d80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [0x5ce440]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x5ce038]
cmp eax, 0xffffffff
je 0x430daa
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x430daf
call fcn.00430f40
mov eax, dword [0x5dabbc]
mov ecx, dword [0x5dc534]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x430ee9
mov edi, dword [0x5dabb8]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x430edd
mov ecx, dword [0x5d9fb4]
inc ecx
mov edx, 0x100
nop word cs:[eax + eax]
movzx ebx, cl
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x5d9fb8], 0
je 0x430e2d
lea eax, [ecx + 1]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x5d9fb8], 0
je 0x430e2d
add ecx, 2
add edx, 0xfffffffe
jne 0x430e00
jmp 0x430e5d
lea ecx, [eax*4 + 0x5d9fb8]
mov dword [ecx], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x5d9fbc], ecx
mov dword [0x5d9fb4], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x5d9fc0]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov dword [ebp - 0x14], 0xffffffff
mov esi, dword [esi]
cmp esi, 0x100
jb 0x430ec9
push 0x100
call fcn.00411700
add esp, 4
mov edi, eax
push esi
call fcn.00411700
add esp, 4
lea esi, [ebp - 0x14]
mov ecx, esi
push edi
push eax
push str.slot____kThreadLocalStorageSize
call fcn.00411b90
cmp dword [ebp - 0x14], 0
je 0x430ec9
lea edi, [ebp - 0x18]
push esi
push 0x1c7
push str....._base_threading_thread_local_storage.cc
push edi
call fcn.00407c20
add esp, 0x10
mov ecx, edi
call fcn.00407cf0
mov ecx, edi
call fcn.00407d00
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005051b5
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ecx, edi
call fcn.00419c10
jmp 0x430de5
push 0x5dabbc
call fcn.00505151
add esp, 4
cmp dword [0x5dabbc], 0xffffffff
jne 0x430dd0
push 4
call fcn.00504e46
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.00419c00
mov dword [0x5dabb8], edi
push 0x5dabbc
call fcn.00505100
add esp, 4
jmp 0x430dd0
Function at 0x430f40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x80c
mov eax, dword [0x5ce440]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x5ce038]
mov dword [ebp - 0x810], eax
cmp eax, 0xffffffff
jne 0x43102e
lea edi, [ebp - 0x810]
push edi
call fcn.00443fc0
add esp, 4
test al, al
jne 0x430fa8
lea esi, [ebp - 0x80c]
push str.PlatformThreadLocalStorage::AllocTLS_key_
push 0x101
push str....._base_threading_thread_local_storage.cc
push esi
call fcn.00407bc0
add esp, 0x10
mov ecx, esi
call fcn.00407cf0
mov ecx, esi
call fcn.00407d00
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x431005
push edi
call fcn.00443fc0
add esp, 4
test al, al
je 0x430fc9
cmp dword [ebp - 0x810], 0xffffffff
jne 0x430ff5
lea esi, [ebp - 0x80c]
push str.PlatformThreadLocalStorage::AllocTLS_key___key___PlatformThreadLocalStorage::TLS_KEY_OUT_OF_INDEXES
push 0x10b
push str....._base_threading_thread_local_storage.cc
push esi
call fcn.00407bc0
add esp, 0x10
mov ecx, esi
call fcn.00407cf0
mov ecx, esi
call fcn.00407d00
push 0xffffffffffffffff
call fcn.00443fe0
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x5ce038], ecx
mov eax, dword [ebp - 0x810]
je 0x43102e
push eax
call fcn.00443fe0
add esp, 4
mov eax, dword [0x5ce038]
mov dword [ebp - 0x810], eax
mov dword [ebp - 0x80c], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
and esi, 3
je 0x4310a0
push 0
call fcn.00411630
add esp, 4
mov edi, eax
push esi
call fcn.00411630
add esp, 4
lea esi, [ebp - 0x80c]
mov ecx, esi
push edi
push eax
push str.GetTlsVectorStateAndValue_key___TlsVectorState::kUninitialized
call fcn.00411b90
cmp dword [ebp - 0x80c], 0
je 0x4310a0
lea edi, [ebp - 0x814]
push esi
push 0x11d
push str....._base_threading_thread_local_storage.cc
push edi
call fcn.00407c20
add esp, 0x10
mov ecx, edi
call fcn.00407cf0
mov ecx, edi
call fcn.00407d00
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.005083f0
add esp, 0xc
lea eax, [ebp - 0x809]
push eax
push dword [ebp - 0x810]
call fcn.00443ff0
add esp, 8
push 0x800
call fcn.00505794
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.00507e70
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x810]
call fcn.00443ff0
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005051b5
mov eax, esi
add esp, 0x80c
pop esi
pop edi
pop ebp
ret

Function at 0x433b40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5dac10]
mov ecx, dword [0x5dc534]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x433b6b
mov ecx, 0x5dac08
pop ebp
jmp fcn.00431120
push 0x5dac10
call fcn.00505151
add esp, 4
cmp dword [0x5dac10], 0xffffffff
jne 0x433b60
mov dword [0x5dac0c], 0
mov dword [0x5dac08], 0
mov ecx, 0x5dac08
push 0
call fcn.00431190
push 0x5dac10
call fcn.00505100
add esp, 4
jmp 0x433b60
Function at 0x43adc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x5ce440]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov edi, dword [eax]
mov dword [ebp - 0x28], 0
movsd xmm0, qword [0x578450]
movsd qword [ebp - 0x18], xmm0
mov byte [ebp - 0x28], 0
push edi
call fcn.0050b6a0
add esp, 4
mov esi, eax
cmp eax, 0xf
jbe 0x43ae1c
sub esp, 0xc
mov al, byte [ebp - 0x2c]
mov byte [esp + 4], al
mov dword [esp + 8], edi
mov dword [esp], esi
lea ecx, [ebp - 0x28]
call fcn.00407350
jmp 0x43ae32
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x28]
push esi
push edi
push eax
call fcn.00507e70
add esp, 0xc
mov byte [ebp + esi - 0x28], 0
mov eax, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea esi, [ebp - 0x28]
mov dword [ebp - 0x30], eax
cmovae esi, eax
test ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ecx
je 0x43ae67
lea edx, [ebx - 1]
mov ecx, ebx
and ecx, 3
cmp edx, 3
jae 0x43ae6e
mov edx, 0x811c9dc5
xor edi, edi
jmp 0x43aeba
mov edx, 0x811c9dc5
jmp 0x43aee1
and ebx, 0xfffffffc
mov edx, 0x811c9dc5
xor edi, edi
nop dword [eax + eax]
movzx eax, byte [esi + edi]
xor eax, edx
imul eax, eax, 0x1000193
movzx edx, byte [esi + edi + 1]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + edi + 2]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + edi + 3]
xor edx, eax
imul edx, edx, 0x1000193
add edi, 4
cmp ebx, edi
jne 0x43ae80
test ecx, ecx
je 0x43aee1
add edi, esi
xor ebx, ebx
nop word cs:[eax + eax]
movzx eax, byte [edi + ebx]
xor eax, edx
imul edx, eax, 0x1000193
inc ebx
cmp ecx, ebx
jne 0x43aed0
mov eax, dword [ebp + 8]
and edx, dword [eax + 0x18]
mov ecx, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edx*8 + 4]
mov dword [ebp - 0x34], ecx
cmp edi, ecx
mov ecx, dword [ebp - 0x38]
je 0x43af47
add edx, edx
mov ebx, dword [eax + edx*4]
cmp ecx, dword [edi + 0x18]
jne 0x43af35
nop word cs:[eax + eax]
cmp dword [edi + 0x1c], 0x10
jb 0x43af20
mov eax, dword [edi + 8]
jmp 0x43af23
lea eax, [edi + 8]
push ecx
push eax
push esi
call fcn.005067ed
mov ecx, dword [ebp - 0x38]
add esp, 0xc
test eax, eax
je 0x43af43
cmp edi, ebx
je 0x43af47
mov edi, dword [edi + 4]
cmp ecx, dword [edi + 0x18]
je 0x43af10
jmp 0x43af35
test edi, edi
jne 0x43af4a
mov edi, dword [ebp - 0x34]
mov edx, dword [ebp - 0x3c]
cmp edx, 0x10
jb 0x43af81
lea ecx, [edx + 1]
cmp ecx, 0x1000
jb 0x43af74
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, eax
cmp ecx, 0x20
jae 0x43af9b
add edx, 0x24
mov ecx, edx
jmp 0x43af77
mov eax, dword [ebp - 0x30]
push ecx
push eax
call fcn.00504e76
add esp, 8
cmp edi, dword [ebp - 0x34]
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005051b5
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0050b58a
Function at 0x440610
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, dword [0x5ce440]
xor eax, ebp
mov dword [esp + 0x48], eax
cmp ebx, 0xffffffff
je 0x440732
mov esi, ecx
mov eax, dword [ecx + 0x20]
cmp dword [eax], 0
je 0x44065a
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
test ecx, ecx
jle 0x44065a
dec ecx
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
lea edx, [ecx + 1]
mov dword [eax], edx
mov byte [ecx], bl
jmp 0x440774
cmp dword [esi + 0x4c], 0
je 0x440736
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0x3c]
cmp dword [eax], ecx
jne 0x440682
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov edi, dword [esi + 0x38]
test edi, edi
je 0x44073d
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov byte [esp + 0x1f], bl
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
lea eax, [esi + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [edi]
mov ecx, dword [eax + 0x1c]
mov dword [esp + 0xc], ecx
call dword [0x57244c]
lea eax, [esp + 0x20]
lea edx, [esp + 0x1f]
mov ecx, edi
mov edi, edx
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x44]
push edx
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x30]
push eax
push edi
push dword [esp + 0x28]
call dword [esp + 0x28]
mov ecx, 0xffffffff
cmp eax, 2
jae 0x440754
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x20]
sub edi, eax
je 0x44071f
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00514839
mov ecx, 0xffffffff
add esp, 0x10
cmp edi, eax
jne 0x440772
mov byte [esi + 0x3d], 1
lea eax, [esp + 0x1f]
cmp dword [esp + 0x18], eax
mov eax, 0xffffffff
jmp 0x44076d
xor ebx, ebx
jmp 0x440774
mov ebx, 0xffffffff
jmp 0x440774
movsx eax, bl
push dword [esi + 0x4c]
push eax
call fcn.005148c5
add esp, 8
cmp eax, 0xffffffff
cmove ebx, eax
jmp 0x440774
cmp eax, 3
jne 0x440772
movsx eax, byte [esp + 0x1f]
push dword [esi + 0x4c]
push eax
call fcn.005148c5
add esp, 8
cmp eax, 0xffffffff
cmove ebx, eax
mov ecx, ebx
mov ebx, ecx
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005051b5
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4