joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4385b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x43ac50
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
cmp eax, 3
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
je 0x4385ee
test eax, eax
jne 0x43876a
mov ebx, dword [0x6ae1a4]
test ebx, ebx
je 0x43876a
mov dword [ebp - 0x20], 0
jmp 0x438617
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x438648
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4387bb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x438610
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x438610
test byte [ebp - 0x20], 1
je 0x43876a
mov ebx, dword [0x6ae1a4]
test ebx, ebx
je 0x43876a
mov dword [ebp - 0x20], 0
jmp 0x438677
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4386a8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4387bb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x438670
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x438670
test byte [ebp - 0x20], 1
je 0x43876a
mov ebx, dword [0x6ae1a4]
test ebx, ebx
je 0x43876a
mov dword [ebp - 0x20], 0
jmp 0x4386d7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x438708
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4387bb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4386d0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4386d0
test byte [ebp - 0x20], 1
je 0x43876a
mov ebx, dword [0x6ae1a4]
test ebx, ebx
je 0x43876a
mov dword [ebp - 0x20], 0
jmp 0x438737
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x438764
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4387bb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x438730
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x438730
test byte [ebp - 0x20], 1
jne 0x438784
movzx eax, byte [0x6a9900]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x6ae1a4]
jmp 0x43878f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x43876a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4387bb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43878c
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x43878c
mov dword [ebp - 0x10], 0
push 0x6a3e20
push 0x2b
push 0x6a1ea0
call fcn.0044a690
add esp, 0xc
ud2
Function at 0x43a060
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x6ae03c]
mov esi, ecx
test eax, eax
je 0x43a086
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x43a09f
cmp dword [eax + 4], 0
je 0x43a09f
add eax, 8
pop esi
pop edi
ret
push 0x6ae03c
call fcn.00449a30
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x43a07a
mov eax, dword [0x6ae03c]
test eax, eax
je 0x43a136
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x43a153
mov edi, eax
test eax, eax
jne 0x43a0ff
movzx eax, byte [0x6ae109]
push 4
push 0x10
call fcn.0040b480
add esp, 8
test eax, eax
je 0x43a167
mov dword [eax], 0x6ae03c
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x6ae03c]
test eax, eax
je 0x43a158
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x43a11f
mov eax, dword [esi]
xor ecx, ecx
mov edx, 0
mov dword [esi], 0
cmp eax, 1
jne 0x43a123
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x43a123
xor ecx, ecx
xor edx, edx
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
lea eax, [edi + 8]
mov byte [edi + 0xc], dl
pop esi
pop edi
ret
push 0x6ae03c
call fcn.00449a30
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x43a0bd
xor eax, eax
pop esi
pop edi
ret
push 0x6ae03c
call fcn.00449a30
add esp, 4
jmp 0x43a0f7
push 0x10
push 4
call fcn.0044a490
add esp, 8
ud2
Function at 0x43a180
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x43ace0
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x6ae04c]
test eax, eax
je 0x43a1d5
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x43a1ee
cmp dword [eax + 4], 0
mov ebx, eax
je 0x43a1ee
add ebx, 8
jmp 0x43a2b8
push 0x6ae04c
call fcn.00449a30
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x43a1c5
mov eax, dword [0x6ae04c]
test eax, eax
je 0x43a299
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x43a2b6
mov edi, eax
test eax, eax
jne 0x43a252
movzx eax, byte [0x6ae109]
push 4
push 0x10
call fcn.0040b480
add esp, 8
test eax, eax
je 0x43a2dd
mov dword [eax], 0x6ae04c
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x6ae04c]
test eax, eax
je 0x43a2cb
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x43a26c
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
mov edx, eax
je 0x43a270
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x43a270
xor eax, eax
xor edx, edx
mov ecx, dword [edi + 0xc]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
je 0x43a2b8
test ecx, ecx
je 0x43a2b8
lock dec dword [ecx]
jne 0x43a2b8
call fcn.004286d0
jmp 0x43a2b8
push 0x6ae04c
call fcn.00449a30
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x43a20c
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x6ae04c
call fcn.00449a30
add esp, 4
jmp 0x43a24a
mov dword [ebp - 0x10], 0
push 0x10
push 4
call fcn.0044a490
add esp, 8
ud2
Function at 0x43a320
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x6ae05c]
mov esi, ecx
test eax, eax
je 0x43a346
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x43a35f
cmp byte [eax + 4], 0
je 0x43a35f
add eax, 5
pop esi
pop edi
ret
push 0x6ae05c
call fcn.00449a30
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x43a33a
mov eax, dword [0x6ae05c]
test eax, eax
je 0x43a3d2
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x43a3eb
mov edi, eax
test eax, eax
jne 0x43a3b0
movzx eax, byte [0x6ae109]
push 4
push 8
call fcn.0040b480
add esp, 8
test eax, eax
je 0x43a3ff
mov dword [eax], 0x6ae05c
mov byte [eax + 4], 0
mov edi, eax
mov eax, dword [0x6ae05c]
test eax, eax
je 0x43a3f0
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test esi, esi
je 0x43a3c5
cmp byte [esi], 0
mov byte [esi], 0
movzx eax, byte [esi + 1]
cmove eax, ecx
mov ecx, eax
mov byte [edi + 4], 1
lea eax, [edi + 5]
mov byte [edi + 5], cl
pop esi
pop edi
ret
push 0x6ae05c
call fcn.00449a30
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x43a375
xor eax, eax
pop esi
pop edi
ret
push 0x6ae05c
call fcn.00449a30
add esp, 4
jmp 0x43a3a8
push 8
push 4
call fcn.0044a490
add esp, 8
ud2
Function at 0x43a410
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x43acf0
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x6ae06c]
test eax, eax
je 0x43a465
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x43a47e
cmp dword [eax + 4], 0
mov ebx, eax
je 0x43a47e
add ebx, 8
jmp 0x43a53a
push 0x6ae06c
call fcn.00449a30
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x43a455
mov eax, dword [0x6ae06c]
test eax, eax
je 0x43a51b
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x43a538
mov edi, eax
test eax, eax
jne 0x43a4de
movzx eax, byte [0x6ae109]
push 4
push 0xc
call fcn.0040b480
add esp, 8
test eax, eax
je 0x43a55f
mov dword [eax], 0x6ae06c
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x6ae06c]
test eax, eax
je 0x43a54d
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x43a4f3
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x43a4f5
mov eax, dword [esi + 4]
jmp 0x43a4f5
xor eax, eax
mov ecx, dword [edi + 8]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x43a53a
test ecx, ecx
je 0x43a53a
lock dec dword [ecx]
jne 0x43a53a
call fcn.00428730
jmp 0x43a53a
push 0x6ae06c
call fcn.00449a30
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x43a49c
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x6ae06c
call fcn.00449a30
add esp, 4
jmp 0x43a4d6
mov dword [ebp - 0x10], 0
push 0xc
push 4
call fcn.0044a490
add esp, 8
ud2
Function at 0x43a5a0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x6ae07c]
test eax, eax
je 0x43a69f
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x43a5d1
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x43a69a
mov eax, dword [0x6ae07c]
test eax, eax
je 0x43a6c1
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x43a6de
mov esi, eax
test eax, eax
jne 0x43a63c
movzx eax, byte [0x6ae109]
push 8
push 0x20
call fcn.0040b480
add esp, 8
test eax, eax
je 0x43a6fa
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x6ae07c
mov esi, eax
mov eax, dword [0x6ae07c]
test eax, eax
je 0x43a6e8
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp + 8]
test eax, eax
je 0x43a65b
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
cmp ecx, 1
je 0x43a689
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x43a67b
movaps xmm0, xmmword [esp]
jmp 0x43a689
lea ecx, [esp + 0x10]
call fcn.004377f0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x43a6e0
push 0x6ae07c
call fcn.00449a30
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x43a5c4
jmp 0x43a5d1
push 0x6ae07c
call fcn.00449a30
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x43a5ef
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x6ae07c
call fcn.00449a30
add esp, 4
jmp 0x43a634
push 0x20
push 8
call fcn.0044a490
add esp, 8
ud2
Function at 0x446280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4462d8
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x4462d0
cmp ebp, ebx
jb 0x446352
cmp ebp, dword [esp + 0x1c]
ja 0x446363
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x4462d2
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x4462c0
jmp 0x44632f
ja 0x4462d8
cmp edx, edi
mov ebx, ebp
jne 0x446295
mov edx, dword [esp + 0x24]
test edx, edx
je 0x446333
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x446310
mov esi, edi
sub ecx, ebx
jns 0x446327
jmp 0x446335
cmp edi, edx
je 0x44633c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x446335
xor al, 1
cmp esi, edx
jne 0x4462f0
jmp 0x446335
xor eax, eax
jmp 0x446335
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x6a5b28
push 0x2b
push str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
call fcn.0044a690
add esp, 0xc
ud2
push 0x6a5b18
push ebp
push ebx
call fcn.0044aa90
add esp, 0xc
ud2
push 0x6a5b18
push dword [esp + 0x20]
push ebp
call fcn.0044aa20
add esp, 0xc
ud2

Function at 0x447eb7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x447ef6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x447ef6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x447ef6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x447ef6
cmp dword [ecx + 0x74], 0xe
jbe 0x447ef6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x449a30
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x449aaa
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x449ae5
cmp dword [esp + 4], 0
je 0x449acc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x449b08
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x6ae1a4]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x6ae1a4], edi
jne 0x449a90
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
jmp 0x449adc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x449b4f
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x449ad0
mov esi, dword [esp]
jmp 0x449adc
mov esi, dword [edi]
jmp 0x449adb
mov esi, eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x6a3d9c
push 0x6a3dd0
push eax
call fcn.00449420
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
mov dword [esp + 8], 0x6a3df4
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], str._rustc_8ede3aae28fe6e4d52b38157d7bfe0d3bceef225librarycore_src_sliceiter.rs
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
push 0x6a3dfc
push eax
call fcn.0044a5d0
add esp, 8
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x6a3df4
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], str._rustc_8ede3aae28fe6e4d52b38157d7bfe0d3bceef225librarycore_src_sliceiter.rs
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00449480
ud2
Function at 0x44a7b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x68
movzx eax, byte [esp + 0x78]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
test eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
je 0x44a801
cmp eax, 1
jne 0x44a878
mov dword [esp], 0x6a5519
jmp 0x44a808
mov dword [esp], 0x6a551b
mov edx, 2
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
jne 0x44a894
mov ecx, esp
lea edx, [esp + 8]
lea esi, [esp + 0x10]
mov dword [esp + 0x38], 0x6a557c
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x4471e0
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x24], 0x447160
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x447160
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 3
jmp 0x44a91a
mov edx, 7
mov dword [esp], 0x6a5512
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
je 0x44a81d
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov edx, esp
lea esi, [esp + 8]
mov dword [esp + 0x38], 0x6a5558
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], edx
lea edx, [esp + 0x10]
mov dword [esp + 0x1c], 0x4471e0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x447160
lea esi, [esp + 0x50]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], 0x447160
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0x443e90
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 4
movsd qword [esp + 0x60], xmm0
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.0044a5d0
add esp, 8
ud2
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x404a36
Capabilities:
Create pipe
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1284
call fcn.00413df0
mov eax, dword [0x88efdc]
mov ecx, dword [0x86817c]
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x404b3d
mov ebx, ecx
mov dword [ebp - 8], eax
cmp dword [0x88efdc], 0x959
jne 0x404b2b
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
push esi
push esi
lea eax, [ebp - 0xa80]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
lea eax, [ebp - 0x280]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0x4040d8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x404128
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0x1280]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
call fcn.0040483f
add ebx, 8
dec dword [ebp - 8]
jne 0x404a63
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40717b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b728]
jne 0x407185
repz ret
jmp fcn.0040ed1c

Function at 0x410a97
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040894d
and dword [ebp - 4], 0
cmp dword [0x42da30], 0
mov ebx, eax
jne 0x410b48
push 0x40380c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x410bf9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403800
push edi
call esi
test eax, eax
je 0x410bf9
push eax
call fcn.004088db
mov dword [esp], 0x4037f0
push edi
mov dword [0x42da30], eax
call esi
push eax
call fcn.004088db
mov dword [esp], 0x4037dc
push edi
mov dword [0x42da34], eax
call esi
push eax
call fcn.004088db
mov dword [esp], 0x4037c0
push edi
mov dword [0x42da38], eax
call esi
push eax
call fcn.004088db
pop ecx
mov dword [0x42da40], eax
test eax, eax
je 0x410b48
push 0x4037a8
push edi
call esi
push eax
call fcn.004088db
pop ecx
mov dword [0x42da3c], eax
mov eax, dword [0x42da3c]
cmp eax, ebx
je 0x410ba0
cmp dword [0x42da40], ebx
je 0x410ba0
push eax
call fcn.00408956
push dword [0x42da40]
mov esi, eax
call fcn.00408956
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x410ba0
test edi, edi
je 0x410ba0
call esi
test eax, eax
je 0x410b97
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x410b97
test byte [ebp - 0xc], 1
jne 0x410ba0
or dword [ebp + 0x10], 0x200000
jmp 0x410bd9
mov eax, dword [0x42da34]
cmp eax, ebx
je 0x410bd9
push eax
call fcn.00408956
pop ecx
test eax, eax
je 0x410bd9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x410bd9
mov eax, dword [0x42da38]
cmp eax, ebx
je 0x410bd9
push eax
call fcn.00408956
pop ecx
test eax, eax
je 0x410bd9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42da30]
call fcn.00408956
pop ecx
test eax, eax
je 0x410bf9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410bfb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret