joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409944
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4099f8
jmp 0x4099ed
cmp dword [esi + 0x10], 0x1000
jne 0x4099d9
test byte [esi + 0x15], 1
jne 0x4099d9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409998
cmp eax, 2
je 0x409998
cmp eax, 0x10
je 0x409998
cmp eax, 0x20
jne 0x4099ad
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4099ad
mov bl, 1
xor ebp, ebp
jmp 0x4099be
mov eax, dword [esi]
add eax, ebp
call fcn.0040993c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x4099b1
test bl, bl
je 0x4099d9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4099f8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409970
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x5ccb2fe2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x5a0f2271
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x2a30dd20
Capabilities:
Terminate thread

Disassembly:
push 0xc
mov eax, 0x2a353dc6
call fcn.2a302657
mov ebx, ecx
xor ecx, ecx
cmp dword [ebx], 0xb
mov edi, ecx
mov dword [ebp - 0x14], edi
jne 0x2a30de11
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
or dword [ebx + 0x1a0], 0xffffffff
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
lea esi, [eax + 0x12c]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, esi
jae 0x2a30ddca
mov edi, esi
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebx + 0x2d8]
mov esi, dword [ebx]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
cmp esi, 0xb
jne 0x2a30ddc7
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, edi
jb 0x2a30dd8e
mov edi, dword [ebp - 0x14]
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp dword [ebx], 0xb
jne 0x2a30ddf1
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_TerminateThread]
xor edi, edi
inc edi
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ecx, ecx
mov dword [ebx + 0x2d8], ecx
cmp dword [ebx + 0x18], 0
lea esi, [ebx + 0x1a0]
mov dword [esi], ecx
je 0x2a30de46
test di, di
jne 0x2a30de43
push esi
push dword [ebx + 0x18]
call fcn.2a318568
xor ecx, ecx
cmp dword [esi], ecx
jne 0x2a30de46
push esi
push dword [ebx + 0x14]
mov dword [ebx + 0x18], ecx
call fcn.2a318568
xor ecx, ecx
jmp 0x2a30de46
mov dword [ebx + 0x18], ecx
cmp word [ebx + 0x144], cx
je 0x2a30decd
push ecx
push ecx
lea ecx, [ebp - 0x18]
call fcn.2a318568
mov edi, dword [0x2a36bb18]
xor eax, eax
push eax
mov dword [ebp - 4], eax
lea eax, [ebx + 0x40]
push eax
mov eax, dword [0x2a36bb0c]
push str.Cstring
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x2a35835c]
call esi
mov esi, dword [edi + 0xd0]
pop ecx
movzx eax, ax
mov ecx, esi
push eax
push 0
call dword [0x2a35835c]
call esi
add esp, 0x10
lea ecx, [ebp - 0x18]
push 0
push eax
call fcn.2a318568
cmp dword [ebp - 0x14], 0
je 0x2a30debf
lea ecx, [ebp - 0x18]
call fcn.2a318568
test al, al
je 0x2a30debf
lea ecx, [ebp - 0x18]
call fcn.2a33ed32
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.2a318568
xor ecx, ecx
cmp dword [ebx + 0x34], 0
je 0x2a30def1
mov eax, dword [0x2a36b7ac]
push dword [ebx + 0x34]
mov esi, dword [eax + 0x284]
mov ecx, esi
call dword [0x2a35835c]
call esi
pop ecx
xor ecx, ecx
mov dword [ebx + 0x34], ecx
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x2a30df25
push eax
mov eax, dword [0x2a36bb38]
cmp word [ebx + 0x196], cx
je 0x2a30df0f
mov esi, dword [eax + 0x124]
jmp 0x2a30df15
mov esi, dword [eax + 0x11c]
mov ecx, esi
call dword [0x2a35835c]
call esi
xor eax, eax
pop ecx
mov dword [ebx + 0x20], eax
mov dword [ebx], 2
call fcn.2a302bc2
ret
Function at 0x2a318568
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x2a318577
pop dword [ebp - 0x2c]
mov eax, 0xc2e39d1e
add eax, 0x674de859
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xc6eb86a8
sub dword [ebp - 0x3c], 0x7899415d
mov dword [ebp - 0x38], 0xb9745814
sub dword [ebp - 0x38], 0x87410bcf
mov dword [ebp - 0x34], 0x32ad8e1d
add dword [ebp - 0x34], 0x199eb611
mov dword [ebp - 0x30], 0xca44b8f1
add dword [ebp - 0x30], 0x35bb470f
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x19f4061d
sub eax, 0xefbe8599
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xdfb33ce9
add dword [ebp - 0x3c], 0x94bf2c6d
mov dword [ebp - 0x38], 0x6044203c
sub dword [ebp - 0x38], 0x1ed7bec7
mov dword [ebp - 0x34], 0x8f789d4a
sub dword [ebp - 0x34], 0x2c0930de
mov dword [ebp - 0x30], 0xdbc4052e
sub dword [ebp - 0x30], 0xdbc4052e
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x48857
push 0
call eax
mov ecx, 0x214ce45b
add ecx, 0xdeb35bf0
xor ebx, ebx
add ebx, eax
mov esi, 0x729cc7bd
sub esi, 0x4864d1bd
add esi, dword [ebp - 0x2c]
mov edi, 0x9e33e4f6
mov edx, dword [esi]
sub dword [ebp - 0x20], 0x1e4dd6e8
add edx, edi
mov dword [ebp - 0x14], 0x4d967604
mov dword [ebx], edx
xor dword [ebp - 0x18], edi
add ebx, 4
add esi, 0x633203
add esi, 0xff9cce01
loop 0x2a318690
add eax, 0x9459671f
add eax, 0x6ba78ce0
mov ebx, eax
add eax, 5
mov ecx, 0x8b26a18e
add ecx, 0x9f095e72
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x2a32caab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x2a35572a
call fcn.2a304215
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x2a32cccc
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2a318568
add esp, 0x10
test eax, eax
js 0x2a32ccc6
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x2a32cb4f
push edi
call fcn.2a32df9a
pop ecx
test al, al
je 0x2a32cb4f
mov eax, edi
call fcn.2a352aa0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2a32cb61
push edi
lea ecx, [ebp - 0x424]
call fcn.2a318568
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2a318568
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x2a32ccc6
push 0x60
push ebx
push eax
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x2a32cbb9
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x2a32cbb9
call fcn.2a32b317
mov ebx, eax
jmp 0x2a32cc95
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x2a32cbe0
call fcn.2a32b317
jmp 0x2a32cc88
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x2a32cbd6
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x2a32cc13
mov ebx, 0x8007000e
jmp 0x2a32cc8a
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2a318568
jmp 0x2a32cc39
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x2a32cc0c
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2a318568
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2a318568
mov ebx, eax
test edi, edi
je 0x2a32cc95
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a32ccae
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccbe
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32ccb4
mov eax, ebx
jmp 0x2a32ccfa
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x2a32cce1
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccf1
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32cce7
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.2a30424f
ret 0x10
Function at 0x1000431f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1000432e
pop dword [ebp - 0x38]
mov eax, 0xa2d9a542
sub eax, 0x92d96214
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x295399cb
add dword [ebp - 0x48], 0x24feab80
mov dword [ebp - 0x44], 0x3b7e456f
sub dword [ebp - 0x44], 0x94af92a
mov dword [ebp - 0x40], 0x4c139d6e
add dword [ebp - 0x40], 0x38a6c0
mov dword [ebp - 0x3c], 0x1d6d5d38
add dword [ebp - 0x3c], 0xe292a2c8
lea eax, [ebp - 0x48]
push eax
mov eax, 0x374449b6
sub eax, 0x2743c95a
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xb15f0926
sub dword [ebp - 0x48], 0x3cec9fd0
mov dword [ebp - 0x44], 0x24377212
sub dword [ebp - 0x44], 0xe2cb109d
mov dword [ebp - 0x40], 0x525c8a24
add dword [ebp - 0x40], 0x1112e248
mov dword [ebp - 0x3c], 0x99b4c51c
sub dword [ebp - 0x3c], 0x99b4c51c
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x2aa72a9b
sub eax, 0x1aa6aa33
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x36528
push 0
call eax
mov ecx, 0x4306
xor esi, esi
add esi, eax
mov edi, 0xc6fbdaad
add edi, 0x49050153
add edi, dword [ebp - 0x38]
mov edx, 0xc860de34
sub edx, 0xc6e05507
mov ebx, dword [edi]
xor ebx, edx
sub dword [ebp - 0x1c], edi
mov dword [esi], ebx
sub dword [ebp - 0x10], 0x432ed9f
add esi, 0xd4bd0145
sub esi, 0xd4bd0141
add edi, 0x18b3a6a9
add edi, 0xe74c595b
loop 0x1000444c
add eax, 0x7cf975f4
add eax, 0x830788f7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x10005e4e
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x10007a20
call fcn.100078a2
cmp byte [0x1000b945], 0
je 0x10005e6d
mov eax, dword [0x1000b948]
jmp 0x10005f43
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesMicrosoftSecurity
mov dword [ebp - 4], esi
push 0x80000001
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10005ebd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
push 0x1000b948
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005ebd
cmp dword [ebp - 0x14], 4
je 0x10005f16
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], esi
test eax, eax
je 0x10005ece
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSecurity
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10005f1e
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
push 0x1000b948
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005f1e
cmp dword [ebp - 0x14], 4
jne 0x10005f1e
mov esi, dword [0x1000b948]
jmp 0x10005f24
mov dword [0x1000b948], esi
mov byte [0x1000b945], 1
mov dword [ebp - 4], 3
cmp dword [ebp - 0x10], 0
je 0x10005f41
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.10007880
ret

Function at 0x403382
Capabilities:
Encode data using xor

Disassembly:
or dword [eax + 0x26ca118], 0x41
add byte [ebp - 0x74e68b40], al
adc eax, 0x410ba8
add al, byte [ecx]
test eax, eax
je 0x4033a2
mov edx, dword [0x410ba8]
push eax
mov eax, dword [0xc44117f0]
push eax
push eax
push edx
adc al, 0x60
in al, 0x40
add bh, bh
salc
cmp esp, 0x14
mov eax, dword [0x440268]
test eax, eax
je 0x40337d
mov eax, dword [0x4189b0]
mov ecx, dword [0x410ba8]
push eax
mov eax, dword [0xa5e176d]
invalid
Function at 0x40ae20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x434
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x413260
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
lea eax, [ebp - 0x440]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [0x45d3a4]
mov ebx, 0x200
xor esi, esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0
cmp ebx, 0x201
jae 0x40aea2
jmp 0x40aee0
cmp edi, ebx
mov ebx, edi
jb 0x40af36
cmp ebx, 0x201
jb 0x40aee0
mov ecx, dword [ebp - 0x30]
mov eax, ebx
sub eax, esi
sub ecx, esi
cmp ecx, eax
jae 0x40aed0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
mov edx, esi
push eax
call fcn.00459ad0
add esp, 4
mov eax, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov edi, dword [ebp - 0x20]
mov esi, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
jmp 0x40aeed
lea edi, [ebp - 0x440]
mov dword [ebp - 0x28], 0x200
mov dword [ebp - 0x24], edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push edi
push ebx
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x40af10
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x40af74
cmp edi, ebx
jne 0x40ae90
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40ae90
add ebx, ebx
cmp ebx, 0x201
jb 0x40aee0
jmp 0x40aea2
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0
cmp edi, eax
ja 0x40afc3
lea eax, [ebp - 0x40]
push edi
push dword [ebp - 0x24]
push eax
call fcn.0040cc90
add esp, 0xc
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp - 0x40]
mov dword [esi + 0xc], eax
movsd qword [esi + 4], xmm0
xor eax, eax
mov dword [esi], eax
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x40af95
jmp 0x40afad
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, 1
mov dword [esi + 4], 0
mov dword [esi], eax
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x40afad
cmp dword [ebp - 0x20], 0
je 0x40afad
add eax, eax
je 0x40afad
push 2
push eax
push dword [ebp - 0x20]
call fcn.00407d00
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x434
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x45e834
push eax
push edi
call fcn.00458700
add esp, 0xc
ud2
Function at 0x40f020
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4133a0
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x4951d0
call dword [sym.imp.kernel32.dll_AcquireSRWLockExclusive]
mov dword [ebp - 0x24], 0x4951d0
mov esi, dword [edi]
test esi, esi
jne 0x40f0c5
mov ebx, dword [edi + 4]
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40f0e1
mov esi, eax
test ebx, ebx
je 0x40f0bd
push 4
push 0xc
call fcn.00407d10
add esp, 8
test eax, eax
je 0x40f17e
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 0
mov ecx, eax
mov eax, dword [0x4951f0]
nop word cs:[eax + eax]
nop dword [eax]
mov dword [ecx + 8], eax
lock cmpxchg dword [0x4951f0], ecx
jne 0x40f0b0
mov eax, esi
test esi, esi
xchg dword [edi], eax
je 0x40f0fe
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x45e75c
push 0x2e
push 0x45e6fc
call fcn.004585e0
add esp, 0xc
ud2
lea eax, [ebp - 0x64]
mov dword [ebp - 0x4c], 0x45de14
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x64], 0x45de40
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x54], 0x45d160
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x30], fcn.00417bc0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x38], 1
push eax
push ecx
call fcn.0040c5b0
add esp, 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
call fcn.00409430
mov ecx, 7
int 0x29
ud2
push 4
push 0xc
call fcn.004580e0
add esp, 8
ud2
Function at 0x410e10
Capabilities:
Generate random numbers via rtlgenrandom
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x413430
lea eax, [esi + 0x50]
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
mov eax, dword [0x495014]
test eax, eax
je 0x410e5c
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x410e75
jmp 0x410e85
push 0x495014
call fcn.0040f020
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x410e85
mov edi, eax
mov eax, dword [eax]
xor eax, 1
or eax, dword [edi + 4]
je 0x410f1c
mov eax, dword [0x495014]
test eax, eax
je 0x410f21
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x410f3e
mov edi, eax
test eax, eax
jne 0x410ef0
push 8
push 0x20
call fcn.00407d10
add esp, 8
test eax, eax
je 0x410fac
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x495014
mov edi, eax
mov eax, dword [0x495014]
test eax, eax
jne 0x410ee8
push 0x495014
call fcn.0040f020
add esp, 4
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xorps xmm0, xmm0
lea eax, [esi + 0x30]
movaps xmmword [esi + 0x30], xmm0
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x410f53
movaps xmm0, xmmword [esi + 0x30]
mov dword [edi + 4], 0
mov dword [edi], 1
movups xmmword [edi + 8], xmm0
add edi, 8
jmp 0x410f40
push 0x495014
call fcn.0040f020
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x410ea2
xor edi, edi
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 0xc], eax
lea eax, [esi + 8]
mov dword [esi + 0x18], 0x45e6c0
mov dword [esi + 0x1c], 1
mov dword [esi + 8], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x10], eax
lea eax, [esi + 0x10]
mov dword [esi + 0x14], 0x40b6f0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 1
lea eax, [esi + 0x18]
push 0x45e6ec
push eax
call fcn.00459e60
add esp, 8
ud2
push 8
push 0x20
call fcn.004580e0
add esp, 8
ud2
Function at 0x411340
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x49501c]
test eax, eax
je 0x411359
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x411372
jmp 0x411381
push 0x49501c
call fcn.0040f020
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x411381
cmp dword [eax], 1
mov edi, eax
jne 0x411381
add edi, 4
mov eax, edi
pop esi
pop edi
ret
mov eax, dword [0x49501c]
test eax, eax
je 0x4113a0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4113b8
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x41137c
jmp 0x4113f5
push 0x49501c
call fcn.0040f020
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x411395
push 4
push 0xc
call fcn.00407d10
add esp, 8
test eax, eax
je 0x41142c
mov dword [eax], 0
mov dword [eax + 8], 0x49501c
mov esi, eax
mov eax, dword [0x49501c]
test eax, eax
jne 0x4113ed
push 0x49501c
call fcn.0040f020
add esp, 4
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 4]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
je 0x41137c
test ecx, ecx
je 0x41137c
lock dec dword [ecx]
jne 0x41137c
call fcn.0040a590
mov eax, edi
pop esi
pop edi
ret
push 4
push 0xc
call fcn.004580e0
add esp, 8
ud2

Function at 0x411500
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x495024]
test eax, eax
je 0x411519
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x411532
jmp 0x411541
push 0x495024
call fcn.0040f020
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x411541
cmp dword [eax], 1
mov edi, eax
jne 0x411541
add edi, 4
mov eax, edi
pop esi
pop edi
ret
mov eax, dword [0x495024]
test eax, eax
je 0x411560
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x411578
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x41153c
jmp 0x4115b5
push 0x495024
call fcn.0040f020
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x411555
push 4
push 0x10
call fcn.00407d10
add esp, 8
test eax, eax
je 0x4115f3
mov dword [eax], 0
mov dword [eax + 0xc], 0x495024
mov esi, eax
mov eax, dword [0x495024]
test eax, eax
jne 0x4115ad
push 0x495024
call fcn.0040f020
add esp, 4
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
je 0x41153c
test ecx, ecx
je 0x41153c
lock dec dword [ecx]
jne 0x41153c
call fcn.0040a550
mov eax, edi
pop esi
pop edi
ret
push 4
push 0x10
call fcn.004580e0
add esp, 8
ud2