joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44cf30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x550014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x44cf10
push 0
push eax
push 0x44cd70
push 0x565aa4
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x44d003
mov esi, dword [ebp + 0xc]
cmp dword [0x565aa8], 0
jne 0x44d011
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x565aac]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x44cfc6
push 0x14
call fcn.00479fb0
add esp, 4
test eax, eax
je 0x44d011
mov edi, eax
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
push eax
push dword [0x565aac]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x44d008
mov ebx, dword [ebp + 8]
mov esi, 0x565ab0
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x565ab4], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b033
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004ac810
push edi
call fcn.00479fe0
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x44cfef
Function at 0x44faf0
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
xor eax, eax
xor ecx, ecx
cpuid
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x44fbed
xor eax, eax
inc eax
xor ecx, ecx
cpuid
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov edi, eax
cmp dword [ebp - 0x10], 7
jb 0x44fc18
mov eax, 7
xor ecx, ecx
cpuid
and ebx, 0x20
shr cl, 3
and cl, 1
mov dword [ebp - 0x10], ecx
mov dword [esi], edi
mov eax, edi
and eax, 0xf
mov dword [esi + 8], eax
shr edi, 0xc
and edi, 3
mov dword [esi + 4], edi
mov ecx, dword [ebp - 0x18]
mov eax, ecx
shr eax, 0x17
and al, 1
mov byte [esi + 0xc], al
mov eax, ecx
shr eax, 0x19
and al, 1
mov byte [esi + 0xd], al
shr ecx, 0x1a
and cl, 1
mov byte [esi + 0xe], cl
mov ecx, dword [ebp - 0x14]
mov eax, ecx
and al, 1
mov byte [esi + 0xf], al
mov eax, ecx
shr eax, 9
and al, 1
mov byte [esi + 0x10], al
mov eax, ecx
shr eax, 0x13
and al, 1
mov byte [esi + 0x11], al
mov eax, ecx
shr eax, 0x14
and al, 1
mov byte [esi + 0x12], al
mov eax, ecx
shr eax, 0x17
and al, 1
mov byte [esi + 0x13], al
mov eax, ecx
shr eax, 0x1f
mov byte [esi + 0x1a], al
mov eax, ecx
not eax
test eax, 0x1c000000
jne 0x44fc26
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [esi + 0x14], al
mov edx, dword [ebp - 0x14]
mov ecx, edx
shr ecx, 0x19
and cl, 1
mov byte [esi + 0x17], cl
shr edx, 0xc
and dl, 1
mov byte [esi + 0x15], dl
test al, al
setne al
test ebx, ebx
setne cl
and cl, al
mov byte [esi + 0x16], cl
mov eax, dword [ebp - 0x10]
mov byte [esi + 0x18], al
mov eax, 0x80000000
xor ecx, ecx
cpuid
cmp eax, 0x80000006
jle 0x44fc2a
mov eax, 0x80000007
xor ecx, ecx
cpuid
and dh, 1
mov byte [esi + 0x19], dh
test dh, dh
je 0x44fc2f
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
xor ebx, ebx
jmp 0x44fb3a
xor eax, eax
jmp 0x44fbbe
mov dh, byte [esi + 0x19]
jmp 0x44fc0c
cmp byte [esi + 0x1a], 0
je 0x44fc10
mov eax, 0x40000000
xor ecx, ecx
cpuid
cmp ebx, 0x7263694d
jne 0x44fc10
cmp ecx, 0x666f736f
jne 0x44fc10
cmp edx, 0x76482074
jne 0x44fc10
mov byte [esi + 0x19], 1
jmp 0x44fc10
Function at 0x45e5b0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x45e5c7
mov edx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x45e5ca
and edx, 0x7f
mov ecx, edx
cmp edx, 4
jb 0x45e606
nop word cs:[eax + eax]
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x45e5e0
cmp edx, 1
je 0x45e627
cmp edx, 2
je 0x45e61e
cmp edx, 3
jne 0x45e632
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x4610d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm4
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x46119e
movdqa xmm4, xmmword [0x538230]
movdqa xmm5, xmmword [0x538240]
nop word cs:[eax + eax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm6
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
movdqu xmm6, xmmword [ecx]
pxor xmm0, xmm6
movdqu xmm6, xmmword [ecx + 0x10]
pxor xmm3, xmm6
movdqu xmm6, xmmword [ecx + 0x20]
pxor xmm2, xmm6
movdqu xmm6, xmmword [ecx + 0x30]
pxor xmm1, xmm6
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x461120
movdqa xmm4, xmmword [0x538250]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x538260]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp eax, 0x10
jb 0x461222
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add ecx, 0x10
add eax, 0xfffffff0
cmp eax, 0xf
ja 0x4611fb
movdqa xmm1, xmmword [0x538260]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm2, xmm2
pxor xmm1, xmm1
pblendw xmm1, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x538270], 0
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm1, 3
pclmulqdq xmm0, xmmword [0x538280], 0x10
pblendw xmm0, xmm2, 0xfc
pclmulqdq xmm0, xmmword [0x538290], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop ebp
ret
Function at 0x4644d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x464505
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x46450c
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4644fe
mov dword [esi], ebx
call fcn.00465200
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00465200
push dword [esi]
call fcn.00468130
add esp, 4
mov dword [esi], 0
jmp 0x4644ef
Function at 0x467c30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x550014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x5b
push str....._base_files_file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.004651d0
add esp, 0x10
mov ecx, edi
push 0
push ebx
mov ebx, dword [ebp + 0xc]
call fcn.0046afb0
test ebx, ebx
js 0x467cf6
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.00469a60
test al, al
jne 0x467cfb
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push 0
push eax
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x467d0f
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x467d21
lea ecx, [esp + 0x10]
call fcn.00469b00
lea ecx, [esp + 0x20]
call fcn.0046b030
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0049b033
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
dec ebx
jmp 0x467cd6
lea ecx, [esp + 0x10]
push 0
push ebx
push esi
push str.File::ReadAtCurrentPos
call fcn.004de910
jmp 0x467caa
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x467ccd
int3

Function at 0x467d30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x467d6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x467d82
lea eax, [ebx + 1]
cmp eax, 2
jb 0x467d64
mov dword [esi], ebx
call fcn.00465200
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x467d99
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00465200
push dword [esi]
call fcn.00468130
add esp, 4
mov dword [esi], 0
jmp 0x467d55
int3
Function at 0x467dd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov ecx, dword [ebp + 8]
mov edi, dword [ecx]
mov dword [ecx], 0
lea ebx, [edi + 1]
cmp ebx, 2
jae 0x467e36
cmp dword [esi], edi
je 0x467e18
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x467e40
cmp ebx, 2
jb 0x467e0e
mov dword [esi], edi
mov edi, eax
call fcn.00465200
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
mov al, byte [ecx + 4]
mov byte [esi + 4], al
mov byte [ecx + 4], 0
mov eax, dword [ecx]
inc eax
cmp eax, 2
jae 0x467e5d
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00465200
mov ecx, dword [ebp + 8]
jmp 0x467dec
mov dword [ebp - 0x10], eax
call fcn.00465200
push dword [esi]
call fcn.00468130
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
jmp 0x467dfe
mov edi, ecx
call fcn.00465200
push dword [edi]
call fcn.00468130
add esp, 4
mov dword [edi], 0
jmp 0x467e2a

Function at 0x467ea0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x467f1e
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x467f07
lea eax, [edi + 1]
cmp eax, 2
jb 0x467eeb
mov dword [esi], edi
call fcn.00465200
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 1
inc eax
cmp eax, 1
jbe 0x467f22
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.00465200
push dword [esi]
call fcn.00468130
add esp, 4
mov dword [esi], 0
jmp 0x467edc
mov byte [esi + 4], 1
int3
Function at 0x46bd40
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x550014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x5601d4]
mov ecx, dword [0x553e30]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x46bd8d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b033
mov eax, 0x5601d0
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5601d4
call fcn.0049a5e7
add esp, 4
cmp dword [0x5601d4], 0xffffffff
jne 0x46bd73
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.0049dcc0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.0049a541
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x560204]
mov ecx, dword [0x553e30]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x46be36
mov ecx, esi
push ebx
push 0x5601e0
push edi
call fcn.004303d0
mov dword [0x5601d0], esi
push 0x5601d4
call fcn.0049a65d
add esp, 4
jmp 0x46bd73
push 0x560204
call fcn.0049a5e7
add esp, 4
cmp dword [0x560204], 0xffffffff
jne 0x46be10
xorps xmm0, xmm0
movups xmmword [0x5601f0], xmm0
movups xmmword [0x5601e0], xmm0
mov dword [0x560200], 0
push 0x5601e0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x560204
call fcn.0049a65d
add esp, 4
jmp 0x46be10
Function at 0x46be90
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x550014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x5601d4]
mov ecx, dword [0x553e30]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x46bee0
mov esi, dword [0x5601d0]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b033
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5601d4
call fcn.0049a5e7
add esp, 4
cmp dword [0x5601d4], 0xffffffff
jne 0x46bec3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.0049dcc0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.0049a541
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x560204]
mov ecx, dword [0x553e30]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x46bf89
mov ecx, esi
push ebx
push 0x5601e0
push edi
call fcn.004303d0
mov dword [0x5601d0], esi
push 0x5601d4
call fcn.0049a65d
add esp, 4
jmp 0x46bec3
push 0x560204
call fcn.0049a5e7
add esp, 4
cmp dword [0x560204], 0xffffffff
jne 0x46bf63
xorps xmm0, xmm0
movups xmmword [0x5601f0], xmm0
movups xmmword [0x5601e0], xmm0
mov dword [0x560200], 0
push 0x5601e0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x560204
call fcn.0049a65d
add esp, 4
jmp 0x46bf63
Function at 0x473df0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x140c
call fcn.0049b950
mov eax, dword [0x550014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x553d24]
cmp eax, 0xffffffff
je 0x473f43
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x473f43
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.0049d740
add esp, 0xc
mov ecx, dword [0x553d24]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.004449b0
add esp, 8
test ebx, ebx
je 0x473e6b
push ebx
call fcn.0049a5ac
add esp, 4
mov eax, dword [0x5641ec]
mov ecx, dword [0x553e30]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x473f58
mov esi, dword [0x5641e8]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x473f9d
lea eax, [ebp - 0x1410]
push 0xc00
push 0x5635e8
push eax
call fcn.0049d740
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ecx, 0x101
test al, 1
je 0x473f33
mov dword [ebp - 0x1418], ecx
xor ebx, ebx
lea edi, [ebp - 0x1408]
xor eax, eax
jmp 0x473eec
inc ebx
add edi, 0xc
cmp ebx, 0x100
je 0x473f2a
mov esi, dword [ebp + ebx*8 - 0x810]
test esi, esi
je 0x473ee0
cmp dword [edi - 8], 0
je 0x473ee0
mov ecx, dword [ebp + ebx*8 - 0x80c]
cmp ecx, dword [edi]
jne 0x473ee0
mov ecx, dword [edi - 4]
test ecx, ecx
je 0x473ee0
mov dword [ebp + ebx*8 - 0x810], 0
call dword [section..00cfg]
push esi
call ecx
add esp, 4
mov al, 1
jmp 0x473ee0
mov ecx, dword [ebp - 0x1418]
dec ecx
jne 0x473ec8
push 2
push dword [ebp - 0x1414]
call fcn.004449b0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b033
add esp, 0x140c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5641ec
call fcn.0049a5e7
add esp, 4
cmp dword [0x5641ec], 0xffffffff
jne 0x473e8c
push 4
call fcn.0049a541
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.00468b60
mov dword [0x5641e8], esi
push 0x5641ec
call fcn.0049a65d
add esp, 4
jmp 0x473e8c
mov ecx, esi
call fcn.00468b70
jmp 0x473ea1
Function at 0x475510
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dl, byte [0x5642bc]
test dl, 1
je 0x47552f
call fcn.0047c640
pop ebp
jmp fcn.004784e0
test ecx, ecx
je 0x47553e
push ecx
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x475540
pop ebp
ret
int3

Function at 0x4782b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp edx, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
cmovb eax, edx
test eax, eax
je 0x478355
xor edi, edi
xor esi, esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebx + esi*4]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + esi*4]
mov ebx, ecx
xor ebx, eax
mov edx, ecx
sub edx, eax
lea eax, [ebx - 1]
xor edx, ecx
or edx, ebx
not ebx
and eax, ebx
mov ebx, dword [ebp + 8]
sar eax, 0x1f
xor edx, ecx
sar edx, 0x1f
mov ecx, edx
not edx
and edx, 1
or edx, ecx
mov ecx, eax
and ecx, edi
not eax
and eax, edx
or eax, ecx
mov ecx, dword [ebp - 0x18]
inc esi
mov edi, eax
cmp dword [ebp - 0x1c], esi
jne 0x4782dc
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
cmp edx, esi
jb 0x478335
ja 0x478359
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
or ecx, dword [ebx + edx*4]
inc edx
cmp esi, edx
jne 0x478337
mov edx, ecx
not edx
dec ecx
and ecx, edx
sar ecx, 0x1f
mov edx, ecx
and edx, eax
not ecx
or ecx, edx
mov eax, ecx
jmp 0x47832d
xor eax, eax
jmp 0x478321
mov esi, ecx
xor edx, edx
mov ecx, dword [ebp - 0x10]
or edx, dword [esi + ecx*4]
inc ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x14], ecx
jne 0x47835d
mov ecx, edx
not ecx
dec edx
and edx, ecx
sar edx, 0x1f
mov ecx, edx
and ecx, eax
not edx
and edx, 1
or edx, ecx
mov eax, edx
jmp 0x47832d
Function at 0x478e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, dword [0x550014]
xor eax, ebp
mov dword [esp + 0x48], eax
cmp ebx, 0x30
ja 0x478f9d
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [esp + 0x30]
movdqa xmmword [eax], xmm0
movdqa xmmword [eax - 0x10], xmm0
movdqa xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [esp + 0xc], eax
call dword [section..00cfg]
lea eax, [esp + 0x10]
push esi
push eax
push dword [esp + 0x14]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x14]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x14]
call ecx
add esp, 0xc
test ebx, ebx
je 0x478f3d
xor eax, eax
mov cl, byte [edi + eax]
xor byte [esp + eax + 0x10], cl
inc eax
cmp ebx, eax
jne 0x478f31
lea edi, [esi + 0xf4]
mov eax, dword [0x565a1c]
bt eax, 0x19
jae 0x478fa1
push esi
push 0x100
lea eax, [esp + 0x18]
push eax
call fcn.00403380
add esp, 0xc
mov ecx, section..text
mov eax, 0x401b90
test edi, edi
je 0x478f71
mov dword [edi], ecx
mov dword [esi + 0xf8], eax
lea eax, [esp + 0x30]
movups xmm0, xmmword [eax]
mov eax, dword [esp + 0xc]
movups xmmword [eax], xmm0
xor esi, esi
inc esi
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0049b033
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x478f88
bt eax, 9
jae 0x478fc3
push esi
push 0x100
lea eax, [esp + 0x18]
push eax
call fcn.00403ea0
add esp, 0xc
xor eax, eax
mov ecx, 0x403f50
jmp 0x478f6b
push esi
push 0x100
lea eax, [esp + 0x18]
push eax
call fcn.004ee640
add esp, 0xc
mov ecx, 0x4ee540
mov eax, 0x4eedd0
jmp 0x478f6b
Function at 0x47a0f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x47a126
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
nop word [eax + eax]
movzx eax, byte [ecx + esi]
xor al, byte [edx + esi]
or bl, al
inc esi
cmp edi, esi
jne 0x47a110
movzx eax, bl
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x47a121
Function at 0x483190
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x565a88]
mov ecx, dword [0x553e30]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4831bb
mov ecx, 0x565a80
pop ebp
jmp fcn.00473fb0
push 0x565a88
call fcn.0049a5e7
add esp, 4
cmp dword [0x565a88], 0xffffffff
jne 0x4831b0
xor eax, eax
mov dword [0x565a84], eax
mov dword [0x565a80], eax
mov ecx, 0x565a80
push eax
call fcn.00437870
push 0x565a88
call fcn.0049a65d
add esp, 4
jmp 0x4831b0

Function at 0x483e60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x550014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x44cf10
lea eax, [ebp - 0x14]
push 0
push eax
push 0x44cd70
push 0x565aa4
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x483eda
xor esi, esi
cmp dword [0x565aa8], 0
jne 0x483ec6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x565aac]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x483ec6
mov eax, dword [ebp + 8]
mov esi, dword [edi + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b033
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004ac810
int3

Function at 0x4872e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x487318
mov edx, dword [ebp + 0xc]
xor esi, esi
nop word cs:[eax + eax]
movzx edi, al
movzx ebx, byte [edx + esi]
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x546a74]
inc esi
cmp ecx, esi
jne 0x487300
pop esi
pop edi
pop ebx
pop ebp
ret