joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e010
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edx, dword [ecx + 0x20]
cmp edx, dword [ebp + 0x20]
jne 0x46e0a3
test edx, edx
je 0x46e0aa
lea esi, [edx - 0x21]
cmp esi, 0xffffffe0
jb 0x46e119
xor ebx, ebx
cmp edx, 8
mov esi, 0
jb 0x46e121
xor ebx, ebx
cmp edx, 0x10
jae 0x46e0b1
mov edi, esi
mov esi, edx
movzx ebx, bl
and esi, 0xfffffff8
movd xmm0, ebx
nop dword [eax]
movq xmm1, qword [ecx + edi]
movq xmm2, qword [ebp + edi]
add edi, 8
cmp esi, edi
pxor xmm2, xmm1
por xmm0, xmm2
jne 0x46e060
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd ebx, xmm1
jmp 0x46e11d
xor eax, eax
jmp 0x46e133
mov al, 1
jmp 0x46e133
mov esi, edx
pxor xmm0, xmm0
xor edi, edi
and esi, 0xfffffff0
nop dword [eax]
movdqu xmm1, xmmword [ecx + edi]
movdqu xmm2, xmmword [ebp + edi]
add edi, 0x10
cmp esi, edi
pxor xmm2, xmm1
por xmm0, xmm2
jne 0x46e0c0
pshufd xmm1, xmm0, 0xee
cmp edx, esi
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm1, 0x10
por xmm1, xmm0
movdqa xmm0, xmm1
psrlw xmm0, 8
por xmm0, xmm1
movd ebx, xmm0
je 0x46e12e
test dl, 8
jne 0x46e04f
jmp 0x46e121
ud2
cmp edx, esi
je 0x46e12e
movzx eax, byte [ebp + esi]
xor al, byte [ecx + esi]
inc esi
or bl, al
jmp 0x46e11d
test bl, bl
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x473df0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
cmp word [eax + 0x1c], 0xb
jne 0x473e9c
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
lea ebx, [esp + 8]
lea edi, [esp + 0x24]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
push ebx
push edi
call fcn.00473b90
add esp, 8
movzx ebp, word [esp + 0x30]
cmp bp, 0xb
jne 0x473e43
mov edi, dword [esp + 0x50]
jmp 0x473e94
mov eax, dword [esp + 0x28]
movzx edx, word [esp + 0x36]
mov ecx, dword [esp + 0x32]
mov esi, dword [esp + 0x24]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov word [esp + 0x20], dx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x38], eax
push ebx
push edi
call fcn.004508d0
add esp, 8
movzx eax, word [esp + 0x30]
cmp ax, 0xe
jne 0x473eac
mov edi, dword [esp + 0x50]
test esi, esi
je 0x473e94
push 1
push esi
push dword [esp + 8]
call fcn.0040dc90
add esp, 0xc
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0xc]
mov word [edi + 0x1c], 0xb
mov eax, edi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
movzx edi, word [esp + 0x32]
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov word [esp + 6], di
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x14], edi
movzx edi, word [esp + 0x20]
mov word [esp + 0x18], di
mov edi, dword [esp + 0x10]
cmp edi, dword [esp + 0xc]
jae 0x473f0b
mov edi, ecx
test esi, esi
je 0x473ef3
push 1
push esi
push dword [esp + 8]
call fcn.0040dc90
add esp, 0xc
mov eax, edi
test edi, edi
mov edi, dword [esp + 0x50]
je 0x473e9c
push 1
push eax
push ebx
call fcn.0040dc90
add esp, 0xc
jmp 0x473e9c
mov edi, dword [esp + 0x50]
mov dword [edi], ecx
mov dword [edi + 4], ebx
mov dword [edi + 8], edx
movzx ebx, word [esp + 6]
mov edx, dword [esp]
mov word [edi + 0xc], ax
movzx ecx, word [esp + 0x18]
mov word [edi + 0xe], bx
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], edx
mov esi, dword [esp + 0x38]
mov edx, dword [esp + 0x14]
mov dword [edi + 0x18], esi
mov dword [edi + 0x1e], edx
mov word [edi + 0x22], cx
mov word [edi + 0x1c], bp
jmp 0x473ea2
Function at 0x480520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
movzx eax, byte [0x574a24]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
movzx eax, al
push eax
call fcn.00478240
add esp, 4
cmp al, 2
jne 0x4806b4
movsd xmm1, qword [edi + 8]
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x78], 0
movsd xmm2, qword [edi + 0x10]
movsd xmm0, qword [edi]
mov eax, esi
movsd qword [esi + 0x88], xmm1
movsd xmm1, qword [edi + 0x18]
movsd qword [esi + 0x90], xmm2
movsd xmm2, qword [edi + 0x20]
movsd qword [esi + 0x80], xmm0
movsd qword [esi + 0x98], xmm1
movsd xmm1, qword [edi + 0x28]
movsd qword [esi + 0xa0], xmm2
movsd xmm2, qword [edi + 0x30]
movsd qword [esi + 0xa8], xmm1
movsd xmm1, qword [edi + 0x38]
movsd qword [esi + 0xb0], xmm2
movsd qword [esi + 0xb8], xmm1
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xc8], edi
mov dword [esi + 0xd0], 0
pop esi
pop edi
ret
mov ecx, 0x574a24
call fcn.00504f00
jmp 0x480545
Function at 0x483670
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x24]
push dword [eax + 4]
push dword [eax]
call fcn.0043caf0
add esp, 8
mov ecx, eax
test edx, edx
mov al, 1
je 0x483784
test ecx, ecx
je 0x483784
mov esi, dword [esp + 0x28]
mov ah, byte [ecx]
mov edi, dword [esi + 8]
movzx ebx, byte [edi]
not bl
test ah, bl
jne 0x483784
mov ebx, dword [esi + 4]
test ebx, ebx
je 0x48378c
mov esi, dword [esi]
mov ebp, 1
xor byte [esi], ah
cmp ebx, 1
je 0x48377f
mov dword [esp + 0xc], ebx
add ebx, 0xfffffffe
mov dword [esp + 8], esi
lea edi, [esi + 1]
lea esi, [edx - 1]
cmp esi, ebx
mov dword [esp], ebx
cmovb ebx, esi
inc ebx
cmp ebx, 0x10
mov dword [esp + 4], ebx
jbe 0x48375a
mov ebx, dword [esp]
cmp esi, ebx
cmovb ebx, esi
lea esi, [ecx + ebx + 2]
cmp edi, esi
jae 0x483711
mov esi, dword [esp + 8]
lea esi, [esi + ebx + 2]
mov ebx, ecx
inc ebx
cmp ebx, esi
jb 0x48375a
mov esi, dword [esp + 4]
mov ebx, dword [esp + 4]
mov ebp, 0x10
and esi, 0xf
cmovne ebp, esi
sub ebx, ebp
neg ebp
lea esi, [edi + ebx]
mov dword [esp], esi
mov esi, dword [esp + 4]
lea ebp, [esi + ebp + 1]
xor esi, esi
nop dword [eax + eax]
movups xmm0, xmmword [ecx + esi + 1]
movups xmm1, xmmword [edi + esi]
xorps xmm1, xmm0
movups xmmword [edi + esi], xmm1
add esi, 0x10
cmp ebx, esi
jne 0x483740
mov edi, dword [esp]
mov esi, dword [esp + 8]
add esi, dword [esp + 0xc]
nop word cs:[eax + eax]
nop dword [eax]
cmp edx, ebp
je 0x483784
mov ah, byte [ecx + ebp]
inc ebp
xor byte [edi], ah
inc edi
cmp edi, esi
jne 0x483770
cmp ebp, edx
setne al
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x4934c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
movups xmm2, xmmword [eax]
mov ecx, dword [edx + 0xf0]
mov eax, dword [esp + 8]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
lea edx, [edx + 0x20]
xorps xmm2, xmm0
aesenc xmm2, xmm1
dec ecx
movups xmm1, xmmword [edx]
lea edx, [edx + 0x10]
jne 0x4934e2
aesenclast xmm2, xmm1
pxor xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [eax], xmm2
pxor xmm2, xmm2
ret
Function at 0x494860
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [eax + 0xc]
test esi, esi
je 0x494901
xor ebx, ebx
cmp esi, 0x20000000
setb al
jae 0x4948fa
mov bl, al
lea ebp, [esi*4]
shl ebx, 2
test ebp, ebp
js 0x4948fa
je 0x4948e8
push ebx
push ebp
call fcn.0040dcd0
add esp, 8
mov edi, eax
test edi, edi
je 0x4948ee
mov eax, dword [esp + 0x14]
mov ebp, dword [eax + 8]
xor eax, eax
cmp esi, 8
jb 0x494905
mov eax, esi
xor ecx, ecx
pcmpeqd xmm0, xmm0
and eax, 0xfffffff8
nop dword [eax + eax]
movdqu xmm1, xmmword [ebp + ecx*4]
movdqu xmm2, xmmword [ebp + ecx*4 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [edi + ecx*4], xmm1
movdqu xmmword [edi + ecx*4 + 0x10], xmm2
add ecx, 8
cmp eax, ecx
jne 0x4948c0
jmp 0x49490f
mov edi, ebx
test edi, edi
jne 0x4948a2
push ebx
push ebp
call fcn.005062c0
add esp, 8
ud2
call fcn.004ccfb0
ud2
ud2
mov ecx, dword [ebp + eax*4]
not ecx
mov dword [edi + eax*4], ecx
inc eax
cmp esi, eax
jne 0x494905
mov eax, dword [esp + 0x14]
mov ecx, esi
or byte [edi], 1
mov ebx, esi
shl ecx, 5
sub ecx, dword [eax + 0x10]
je 0x494960
mov eax, dword [edi + esi*4 - 4]
mov ebx, 1
shl eax, cl
shr eax, cl
cmp ecx, 2
cmovae ebx, ecx
mov dword [edi + esi*4 - 4], eax
nop dword [eax]
push esi
push ebp
push edi
push edi
call fcn.004e4c50
add esp, 0x10
dec ebx
jne 0x494940
mov ebx, esi
nop word cs:[eax + eax]
nop dword [eax + eax]
push esi
push ebp
push edi
push edi
call fcn.004e4c50
add esp, 0x10
dec ebx
jne 0x494960
push esi
mov ebx, dword [esp + 0x18]
push ebx
push ebp
push edi
push edi
push edi
call fcn.004950c0
add esp, 0x18
push esi
push ebx
push ebp
push edi
push edi
push edi
call fcn.004950c0
add esp, 0x18
push esi
push ebx
push ebp
push edi
push edi
push edi
call fcn.004950c0
add esp, 0x18
push esi
push ebx
push ebp
push edi
push edi
push edi
call fcn.004950c0
add esp, 0x18
push esi
push ebx
push ebp
push edi
push edi
push edi
call fcn.004950c0
add esp, 0x18
mov eax, edi
mov edx, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x497c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
test esi, esi
je 0x497df9
setns al
js 0x497e13
movzx ebx, al
push ebx
push esi
call fcn.0040dc80
add esp, 8
test eax, eax
je 0x497e1a
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
mov dword [edi + 4], eax
mov ebx, 0xe7037ed1
mov edx, 0xa0b428db
mov ebp, 0xa0761d64
mov edi, 0x78bd642f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov esi, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x30]
jmp 0x497cfe
mov esi, dword [esp + 4]
mov dword [esp], ebx
mov ebx, 0xe7037ed1
mov ebp, 0xa0761d64
mov edi, 0x78bd642f
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov byte [ecx + edx], al
mov ecx, dword [esp + 0x14]
inc edx
mov dword [esp + 0xc], edx
mov edx, 0xa0b428db
test ecx, ecx
je 0x497de0
dec ecx
add esi, edi
mov dword [esp + 0x14], ecx
mov ecx, dword [esp]
mov dword [esp + 4], esi
adc ecx, ebp
mov ebp, esi
xor ebp, edx
mov edi, ecx
mov eax, ebp
xor edi, ebx
mul esi
mov dword [esp], eax
mov eax, edi
mov dword [esp + 8], edx
mul esi
mov ebx, eax
mov esi, edx
mov eax, ebp
add ebx, dword [esp + 8]
adc esi, 0
mul ecx
add eax, ebx
mov ebx, ecx
adc edx, esi
imul edi, ecx
add edi, edx
mov edx, 0x3e
xor edi, dword [esp]
mov eax, edi
lea ecx, [edi + edi]
shl edi, 6
sub edi, ecx
mul edx
cmp edi, 3
ja 0x497cc0
mov esi, dword [esp + 4]
mov eax, 0x78bd642f
add esi, eax
mov eax, 0xa0761d64
adc ebx, eax
mov eax, 0xe7037ed1
mov ecx, esi
mov dword [esp], ebx
mov ebx, dword [esp]
xor ebx, eax
mov eax, 0xa0b428db
xor ecx, eax
mov eax, ecx
mul esi
mov dword [esp + 4], eax
mov eax, ebx
mov dword [esp + 8], edx
mul esi
mov edi, eax
mov ebp, edx
mov eax, ecx
add edi, dword [esp + 8]
adc ebp, 0
mul dword [esp]
add eax, edi
mov eax, ebx
mov ebx, dword [esp]
mov ecx, edx
adc ecx, ebp
mul ebx
add eax, ecx
xor eax, dword [esp + 4]
mov edx, eax
shl edx, 6
sub edx, eax
sub edx, eax
cmp edx, 4
jb 0x497d60
mov ecx, 0x3e
mov ebx, 0xe7037ed1
mov ebp, 0xa0761d64
mov edi, 0x78bd642f
mul ecx
jmp 0x497cd6
mov eax, dword [esp + 0x34]
mov ecx, dword [esp]
mov edi, dword [esp + 0x2c]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax], esi
mov dword [edi + 8], ecx
jmp 0x497e09
mov dword [edi], esi
mov dword [edi + 4], 1
mov dword [edi + 8], 0
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004ccfb0
ud2
push ebx
push esi
call fcn.005062c0
add esp, 8
ud2
Function at 0x49af40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov edi, dword [ebp + 8]
mov eax, dword [edi]
test eax, eax
je 0x49af70
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x49af85
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x49af85
add eax, 8
jmp 0x49b056
push edi
call fcn.00505af0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x49af61
mov eax, dword [edi]
test eax, eax
je 0x49b03b
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x49b054
mov esi, eax
test eax, eax
jne 0x49afdf
push 8
push 0x18
call fcn.0040dc80
add esp, 8
test eax, eax
je 0x49b06b
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x10], edi
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x49b05d
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x49b000
mov edi, dword [eax]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
mov dword [eax], 0
or edi, dword [eax + 4]
mov dword [eax + 4], 0
jne 0x49b023
mov eax, esp
push eax
call fcn.0049abc0
add esp, 4
cmp dword [esp], 0
mov ecx, 0xef6f79e
mov edx, 0xd30ba75a
cmovne ecx, dword [esp + 0xc]
cmovne edx, dword [esp + 8]
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov dword [esi], 1
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
jmp 0x49b056
push edi
call fcn.00505af0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x49afa0
xor eax, eax
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
push edi
call fcn.00505af0
add esp, 4
jmp 0x49afd7
push 8
push 0x18
call fcn.005062c0
add esp, 8
ud2
Function at 0x4a04e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x24]
cmp ebp, dword [esp + 0x2c]
jne 0x4a0684
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
lea eax, [esi + ebp]
add ebp, edx
mov dword [esp + 8], eax
mov dword [esp], ebp
nop dword [eax]
cmp esi, dword [esp + 8]
mov al, 1
je 0x4a0686
movzx ebx, byte [esi]
test bl, bl
js 0x4a0540
inc esi
cmp edx, ebp
jne 0x4a05c0
jmp 0x4a0686
movzx ebp, byte [esi + 1]
mov ecx, ebx
and ecx, 0x1f
and ebp, 0x3f
cmp bl, 0xdf
jbe 0x4a0591
movzx edi, byte [esi + 2]
shl ebp, 6
and edi, 0x3f
or edi, ebp
cmp bl, 0xf0
jb 0x4a05a7
movzx ebx, byte [esi + 3]
and ecx, 7
shl edi, 6
mov ebp, dword [esp]
shl ecx, 0x12
and ebx, 0x3f
or ebx, edi
or ebx, ecx
cmp ebx, 0x110000
je 0x4a0686
add esi, 4
cmp edx, ebp
jne 0x4a05c0
jmp 0x4a0686
shl ecx, 6
add esi, 2
or ecx, ebp
mov ebp, dword [esp]
mov ebx, ecx
cmp edx, ebp
jne 0x4a05c0
jmp 0x4a0686
mov ebp, dword [esp]
shl ecx, 0xc
add esi, 3
or edi, ecx
mov ebx, edi
cmp edx, ebp
je 0x4a0686
nop dword [eax]
movzx ecx, byte [edx]
test cl, cl
js 0x4a05e0
inc edx
cmp ebx, 0x110000
jne 0x4a0665
jmp 0x4a0686
mov dword [esp + 4], esi
mov esi, edx
movzx edx, byte [edx + 1]
mov edi, ecx
and edi, 0x1f
and edx, 0x3f
cmp cl, 0xdf
jbe 0x4a063c
movzx ebp, byte [esi + 2]
shl edx, 6
and ebp, 0x3f
or ebp, edx
cmp cl, 0xf0
jb 0x4a0648
movzx ecx, byte [esi + 3]
and edi, 7
shl ebp, 6
mov al, 1
shl edi, 0x12
and ecx, 0x3f
or ecx, ebp
or ecx, edi
cmp ecx, 0x110000
je 0x4a0686
mov ebp, dword [esp]
mov edx, esi
add edx, 4
mov esi, dword [esp + 4]
cmp ebx, 0x110000
jne 0x4a0665
jmp 0x4a0686
shl edi, 6
add esi, 2
or edi, edx
mov ecx, edi
jmp 0x4a0655
shl edi, 0xc
add esi, 3
or ebp, edi
mov ecx, ebp
mov ebp, dword [esp]
mov al, 1
mov edx, esi
mov esi, dword [esp + 4]
cmp ebx, 0x110000
je 0x4a0686
cmp ebx, 0x7f
ja 0x4a0684
mov edi, ebx
mov eax, edx
lea edx, [ebx - 0x41]
xor edi, 0x20
cmp edx, 0x1a
mov edx, eax
cmovae edi, ebx
cmp edi, ecx
je 0x4a0510
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b0200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x108
mov ebp, dword [esp + 0x120]
call fcn.004b0216
Function at 0x4b5e30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x4b5e55
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4b5e6a
cmp dword [eax], 0
mov esi, eax
je 0x4b5e6a
mov eax, esi
pop esi
pop edi
ret
push edi
call fcn.00505af0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x4b5e49
mov eax, dword [edi]
test eax, eax
je 0x4b5ebf
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4b5ed4
mov esi, eax
test eax, eax
jne 0x4b5ead
push 4
push 8
call fcn.0040dc80
add esp, 8
test eax, eax
je 0x4b5ee6
mov dword [eax], 0
mov dword [eax + 4], edi
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x4b5edb
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 0x10]
push esi
call fcn.004b5fd0
add esp, 8
mov eax, esi
pop esi
pop edi
ret
push edi
call fcn.00505af0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x4b5e7d
xor esi, esi
mov eax, esi
pop esi
pop edi
ret
push edi
call fcn.00505af0
add esp, 4
jmp 0x4b5ea5
push 4
push 8
call fcn.005062c0
add esp, 8
ud2

Function at 0x4b6130
Capabilities:
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
mov edi, dword [eax]
mov esi, dword [edi + 4]
mov eax, dword [esi]
test eax, eax
je 0x4b618c
dec eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [edi]
test eax, eax
je 0x4b616a
dec dword [eax]
jne 0x4b616a
dec dword [eax + 4]
jne 0x4b616a
push 8
push 0x158
push eax
call fcn.0040dc90
add esp, 0xc
push 4
push 8
push edi
call fcn.0040dc90
add esp, 0xc
mov eax, dword [esi]
test eax, eax
je 0x4b6197
dec eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
pop esi
pop edi
ret
push esi
call fcn.00505af0
add esp, 4
jmp 0x4b6142
push esi
call fcn.00505af0
add esp, 4
jmp 0x4b617e

Function at 0x4b6720
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x18]
xor esi, esi
test ebx, ebx
je 0x4b675c
mov ebp, dword [esp + 0x14]
push 2
push ebx
push ebp
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x4b675c
mov edi, eax
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
add edi, 0x80000000
xor esi, esi
test al, al
cmove esi, edi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b6c30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
call 0x4b6c4a
pop eax
mov dword [esp + 0x3c], eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004bc1d0
add esp, 8
lea edi, [esp + 0x88]
mov dword [esp + 4], eax
push edi
call fcn.004bbc20
add esp, 4
lea eax, [esp + 4]
mov dword [esp + 0x1c], 0
push eax
call fcn.004bc150
add esp, 4
push eax
call fcn.0041db40
add esp, 4
mov ecx, dword [ebx]
lea ebx, [esp + 0x1c]
mov edx, dword [ecx]
push 0
push ebx
push edi
push 0
push eax
push ecx
call dword [edx + 0x10]
test eax, eax
js 0x4b6cdb
lea eax, [esp + 0x20]
push edi
push eax
call fcn.004b73c0
add esp, 8
mov eax, dword [esp + 0x20]
or eax, dword [esp + 0x24]
je 0x4b6d16
movsd xmm0, qword [esp + 0x28]
movsd xmm1, qword [esp + 0x30]
movsd qword [esp + 0x60], xmm1
movsd qword [esp + 0x58], xmm0
jmp 0x4b6d75
push eax
call fcn.004bbed0
add esp, 4
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x24], edx
push eax
call fcn.0048e540
add esp, 4
cmp dword [esp + 0x24], 0
mov dword [esi + 0xc], eax
mov byte [esi + 8], 0
je 0x4b6d7f
lea eax, [esp + 0x24]
push eax
call fcn.004bbc80
add esp, 4
jmp 0x4b6d7f
movsd xmm0, qword [esp + 0x28]
movsd xmm1, qword [esp + 0x30]
lea eax, [esp + 0x68]
lea ecx, [esp + 0x40]
movsd qword [esp + 0x60], xmm1
movsd qword [esp + 0x58], xmm0
movsd qword [esp + 0x68], xmm0
movsd qword [esp + 0x70], xmm1
push dword [esp + 0x1c]
push eax
push ecx
call fcn.004b7650
add esp, 0xc
mov eax, dword [esp + 0x40]
or eax, dword [esp + 0x44]
je 0x4b6da3
movsd xmm0, qword [esp + 0x48]
movsd xmm1, qword [esp + 0x50]
movsd qword [esp + 0x80], xmm1
movsd qword [esp + 0x78], xmm0
movsd qword [esi + 0x10], xmm1
movsd qword [esi + 8], xmm0
mov dword [esi + 4], 0
mov dword [esi], 1
lea edi, [esp + 4]
push edi
call fcn.004bc170
add esp, 4
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [esp + 0x48]
movsd xmm1, qword [esp + 0x50]
movsd qword [esp + 8], xmm0
movsd qword [esp + 0x10], xmm1
push edi
call dword [sym.imp.oleaut32.dll_VariantClear]
test eax, eax
js 0x4b6df0
movsd xmm0, qword [esp + 8]
movsd xmm1, qword [esp + 0x10]
lea eax, [esp + 4]
movsd qword [esi + 0x10], xmm1
movsd qword [esi + 8], xmm0
mov dword [esi + 4], 0
mov dword [esi], 0
push eax
jmp 0x4b6d91
push eax
call fcn.004bbed0
add esp, 4
lea ecx, [esi + 8]
push edx
push eax
push ecx
call fcn.004b71b0
add esp, 0xc
movzx eax, byte [esp + 8]
mov dword [esi + 4], 0
mov dword [esi], 1
cmp eax, 0xf
ja 0x4b6e3f
mov ecx, dword [esp + 0x3c]
lea edi, [esp + 4]
add ecx, dword [eax*4 + 0x4b6e94]
jmp ecx
lea eax, [esp + 0xc]
push eax
call fcn.004bbc80
add esp, 4
jmp 0x4b6d8c