joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422c40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x575c14]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x422dc4
mov cl, byte [esp + 3]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov esi, edx
mov edi, edi
cmp ebp, 0xffffffff
je 0x422c8e
test ebp, ebp
je 0x422d30
dec ebp
cmp dword [ebx + 4], 0
je 0x422ca7
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.00422b20
mov dword [esp + 0x14], eax
jmp 0x422cc1
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x13]
cmp eax, 1
jne 0x422d30
test cl, cl
je 0x422cd5
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x13]
mov eax, dword [esp + 0x18]
mov edi, esi
mov edx, dword [esp + 0x20]
dec eax
sub edi, edx
cmp edi, eax
jle 0x422d10
mov eax, dword [esp + 0x18]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x575c14]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x20], edx
lea esi, [edi + edx]
test cl, cl
je 0x422d30
cmp dword [esp + 0x2c], 0
jne 0x422c80
cmp cl, 0xd
je 0x422d37
cmp cl, 0xa
jne 0x422c80
dec esi
jmp 0x422da7
cmp dword [esp + 0x2c], 0
jne 0x422da7
cmp cl, 0xa
jne 0x422d3f
dec esi
jmp 0x422da7
cmp cl, 0xd
jne 0x422da7
dec esi
cmp dword [ebx + 4], 0
je 0x422d5e
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.00422b20
mov dword [esp + 0x14], eax
jmp 0x422d74
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x422da7
cmp dword [ebx + 4], 0
je 0x422d86
inc dword [ebx + 0xc]
jmp 0x422da7
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x20]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x422dd0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push 0x1000
push 0
push dword [0x575c14]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 8], ecx
test ecx, ecx
je 0x422f7d
mov ax, word [esp]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x1c], 0x7ff
cmp ebp, 0xffffffff
je 0x422e24
test ebp, ebp
je 0x422edd
dec ebp
cmp dword [ebx + 4], 0
je 0x422e3d
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00422b20
mov dword [esp + 0x14], eax
jmp 0x422e57
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp eax, 2
mov ax, word [esp + 0x10]
jne 0x422edd
test ax, ax
je 0x422e71
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, edi
mov edx, dword [esp + 0x1c]
sub esi, ecx
sar esi, 1
cmp esi, edx
jle 0x422eb8
mov eax, dword [esp + 0x20]
add edx, 0x800
add eax, 0x1000
mov dword [esp + 0x1c], edx
push eax
push ecx
push 8
push dword [0x575c14]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
mov ax, word [esp + 0x10]
mov dword [esp + 0x18], ecx
lea edi, [ecx + esi*2]
test ax, ax
je 0x422edd
cmp dword [esp + 0x30], 0
jne 0x422e16
cmp ax, 0xd
je 0x422ee4
cmp ax, 0xa
jne 0x422e16
sub edi, 2
jmp 0x422f5c
cmp dword [esp + 0x30], 0
jne 0x422f5c
cmp ax, 0xa
jne 0x422eef
sub edi, 2
jmp 0x422f5c
cmp ax, 0xd
jne 0x422f5c
sub edi, 2
cmp dword [ebx + 4], 0
je 0x422f11
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00422b20
mov dword [esp + 0x14], eax
jmp 0x422f27
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x10], 0xa
je 0x422f5c
cmp dword [ebx + 4], 0
je 0x422f3b
add dword [ebx + 0xc], 2
jmp 0x422f5c
push 1
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x38]
mov ecx, edi
sub ecx, dword [esp + 0x18]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
xor eax, eax
add esp, 0x18
ret 0x10
Function at 0x422f90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x575c14]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x4230e0
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x422fdc
test edi, edi
je 0x42304d
dec edi
push esi
push ebp
call fcn.00423160
mov dword [esp + 0x20], eax
test eax, eax
jne 0x422fef
xor cl, cl
jmp 0x422ff1
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x423034
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x575c14]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x42304d
test eax, eax
jne 0x422fd2
cmp cl, 0xd
je 0x423051
cmp cl, 0xa
jne 0x422fd2
dec esi
jmp 0x4230c3
test eax, eax
jne 0x4230c3
cmp cl, 0xa
jne 0x423059
dec esi
jmp 0x4230c3
cmp cl, 0xd
jne 0x4230c3
dec esi
cmp dword [ebp + 4], 0
je 0x423078
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.00422b20
mov dword [esp + 0x20], eax
jmp 0x42308f
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x4230c3
cmp dword [ebp + 4], 0
je 0x4230a1
inc dword [ebp + 0xc]
jmp 0x4230c3
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x423160
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x423187
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00422b20
mov dword [esp + 4], eax
jmp 0x4231a1
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
je 0x4231ad
xor eax, eax
pop edi
pop ecx
ret 8
mov cl, byte [esp + 0xc]
test cl, cl
js 0x4231c9
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x4231d9
mov esi, 2
jmp 0x4231f5
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x4231e8
mov esi, 3
jmp 0x4231f5
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x423252
mov esi, 4
mov edx, dword [esp + 0x14]
mov byte [edx], cl
cmp dword [edi + 4], 0
je 0x423224
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push edi
call fcn.00422b20
mov edx, eax
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 8]
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8

Function at 0x4249e9
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x425a01
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, ebx
test esi, esi
je 0x425a5e
push esi
call dword [esi + 0x58]
mov ecx, dword [esi + 0x80]
mov edi, eax
mov dword [esi + 0x94], ecx
mov ecx, dword [esi + 0x84]
mov dword [esi + 0x98], ecx
test edi, edi
jne 0x425a5e
mov eax, dword [esi + 0x70]
test eax, eax
je 0x425a3d
push ebx
push esi
call eax
push esi
push ebx
push dword [0x575c14]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [0x5774cc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x5774d0], ebx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x425b5f
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0x5774cc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi + 0xac]
je 0x425b87
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [ebp + 0x14]
mov eax, dword [esi + 0x90]
push dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [ebp + 8]
push eax
push esi
call dword [esi + 4]
pop esi
pop ebp
ret 0x14
Function at 0x425baa
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [0x5774cc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov ecx, dword [ebx + 0x74]
cmp ecx, 2
je 0x425bd7
cmp ecx, 3
je 0x425bd7
cmp ecx, 8
je 0x425bd7
cmp ecx, 0xc
jne 0x425cbf
fldz
fld dword [ebp + 8]
fcom st(1)
fnstsw ax
test ah, 5
jp 0x425be9
fstp st(0)
jmp 0x425bf8
fstp st(1)
fld1
fcom st(1)
fnstsw ax
test ah, 5
jp 0x425c00
fstp st(1)
fstp dword [ebp + 8]
fld dword [ebp + 8]
jmp 0x425c02
fstp st(0)
push esi
mov esi, dword [ebx + 0xbc]
push edi
xor edi, edi
jmp 0x425c2c
fld dword [esi + 4]
fld st(1)
fucompp
fnstsw ax
test ah, 0x44
jnp 0x425c7d
fld dword [esi + 4]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x425c53
mov edi, esi
mov esi, dword [esi]
test esi, esi
jne 0x425c0e
fstp st(0)
push 0x18
push 0
push dword [0x575c14]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x425cbd
and dword [edx], 0
test edi, edi
je 0x425c87
mov dword [edi], edx
jmp 0x425c8d
push 0x18
push 0
push dword [0x575c14]
fstp st(0)
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x425c32
mov dword [edx], esi
test edi, edi
je 0x425c75
mov dword [edi], edx
jmp 0x425c81
mov dword [ebx + 0xbc], edx
jmp 0x425c81
fstp st(0)
mov edx, esi
test edx, edx
jne 0x425c8d
jmp 0x425c32
mov dword [ebx + 0xbc], edx
mov ecx, dword [ebp + 0xc]
mov esi, 0xff
fld dword [ebp + 8]
movzx eax, cl
mov dword [edx + 8], eax
mov eax, ecx
sar eax, 8
and eax, esi
mov dword [edx + 0xc], eax
mov eax, ecx
sar eax, 0x10
and eax, esi
sar ecx, 0x18
and ecx, esi
mov dword [edx + 0x10], eax
fstp dword [edx + 4]
mov dword [edx + 0x14], ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x425f0f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x5774cc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [esp + 0x14]
mov edi, eax
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov edx, dword [edi + 0x8c]
add esi, edx
mov ecx, dword [edi + 0x90]
add ebx, edx
mov edx, dword [esp + 0x20]
add ebp, ecx
mov eax, dword [edi + 0x74]
add edx, ecx
mov dword [esp + 0x20], edx
cmp eax, 2
je 0x425f64
cmp eax, 3
je 0x425f64
cmp eax, 8
je 0x425f64
cmp eax, 0xc
jne 0x426131
mov dword [edi + 0x124], edx
mov eax, ebx
sub edx, ebp
mov dword [edi + 0x118], esi
sub eax, esi
mov dword [edi + 0x11c], ebp
mov ecx, edx
mov dword [esp + 0x14], eax
imul ecx, edx
imul eax, eax
mov dword [edi + 0x120], ebx
mov dword [esp + 0x1c], edx
add ecx, eax
mov dword [esp + 0x18], ecx
fild dword [esp + 0x18]
push ecx
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp]
call fcn.00426138
mov eax, dword [esp + 0x24]
fstp dword [edi + 0x128]
pop ecx
cmp ebp, eax
jne 0x425fde
cmp esi, ebx
jg 0x425fcf
mov dword [edi + 0xb4], 0x425e0b
jmp 0x426131
mov dword [edi + 0xb4], 0x425e4c
jmp 0x426131
cmp esi, ebx
jne 0x426004
cmp ebp, eax
jg 0x425ff5
mov dword [edi + 0xb4], 0x425e8d
jmp 0x426131
mov dword [edi + 0xb4], 0x425ece
jmp 0x426131
push dword [esp + 0x1c]
call sub.MSVCRT.dll_abs
push dword [esp + 0x18]
mov esi, eax
call sub.MSVCRT.dll_abs
xor edx, edx
pop ecx
inc edx
pop ecx
cmp eax, esi
jl 0x42602a
and dword [edi + 0x130], 0
jmp 0x426078
mov eax, dword [edi + 0x11c]
xor dword [edi + 0x118], eax
mov eax, dword [edi + 0x118]
xor dword [edi + 0x11c], eax
mov eax, dword [edi + 0x11c]
xor dword [edi + 0x118], eax
mov eax, dword [edi + 0x124]
xor dword [edi + 0x120], eax
mov eax, dword [edi + 0x120]
xor dword [edi + 0x124], eax
mov eax, dword [edi + 0x124]
xor dword [edi + 0x120], eax
mov dword [edi + 0x130], edx
mov ecx, dword [edi + 0x118]
mov eax, dword [edi + 0x120]
cmp ecx, eax
jge 0x426091
and dword [edi + 0x12c], 0
jmp 0x4260d5
xor eax, ecx
mov dword [edi + 0x12c], edx
xor dword [edi + 0x120], eax
mov dword [edi + 0x118], eax
mov eax, dword [edi + 0x120]
xor dword [edi + 0x118], eax
mov eax, dword [edi + 0x124]
xor dword [edi + 0x11c], eax
mov eax, dword [edi + 0x11c]
xor dword [edi + 0x124], eax
mov eax, dword [edi + 0x124]
xor dword [edi + 0x11c], eax
mov eax, dword [edi + 0x124]
sub eax, dword [edi + 0x11c]
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
mov eax, dword [edi + 0x120]
sub eax, dword [edi + 0x118]
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
fstp dword [esp + 0x20]
fdiv dword [esp + 0x20]
mov dword [edi + 0xb4], 0x425cf6
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
fst dword [edi + 0x134]
fdivr qword [0x471ab0]
fstp dword [edi + 0x138]
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x426152
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x5774cc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
add eax, dword [esi + 0x90]
add ebp, dword [esi + 0x8c]
mov dword [esp + 0x18], eax
test edi, edi
jns 0x426188
add ebp, edi
neg edi
mov ebx, dword [esp + 0x20]
test ebx, ebx
jns 0x426198
add eax, ebx
neg ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
add eax, eax
cmp eax, edi
jle 0x4261ad
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
add ecx, ecx
cmp ecx, ebx
jle 0x4261c2
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0xa4]
cmp eax, dword [esi + 0xac]
je 0x4261db
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
push edi
push dword [esp + 0x28]
push ebp
push esi
call dword [esi + 8]
pop edi
pop esi
pop ebp
pop ebx
ret 0x18

Function at 0x4261f5
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x5774cc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [esi + 0xa4]
cmp eax, dword [esi + 0xac]
je 0x42621d
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [esp + 0x14]
mov eax, dword [esi + 0x90]
push dword [esp + 0x14]
add eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [esp + 0x14]
push eax
push esi
call dword [esi + 4]
pop esi
ret 0x10

Function at 0x426243
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x5774cc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
mov ecx, dword [edx + 0x74]
cmp ecx, 2
je 0x426268
cmp ecx, 3
je 0x426268
cmp ecx, 8
je 0x426268
cmp ecx, 0xc
jne 0x426276
mov eax, dword [esp + 4]
test eax, eax
je 0x426276
mov dword [edx + 0xb8], eax
ret 4

Function at 0x426279
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x5774cc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x90]
add ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 0x8c]
add ecx, dword [esp + 0xc]
push ecx
push dword [esp + 0xc]
push eax
call dword [eax + 0x24]
ret 0xc
Function at 0x4262a6
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x5774cc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
add eax, dword [edi + 0x90]
add ebp, dword [edi + 0x8c]
mov dword [esp + 0x18], eax
test esi, esi
jns 0x4262dc
add ebp, esi
neg esi
mov ebx, dword [esp + 0x20]
test ebx, ebx
jns 0x4262ec
add eax, ebx
neg ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
add eax, eax
cmp eax, esi
jle 0x426301
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
add ecx, ecx
cmp ecx, ebx
jle 0x426316
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
cmp eax, dword [edi + 0xac]
je 0x42632d
push eax
push edi
mov dword [edi + 0xac], eax
call dword [edi + 0x40]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
push esi
push dword [esp + 0x28]
push ebp
push edi
call dword [edi + 8]
pop edi
pop esi
pop ebp
pop ebx
ret 0x1c

Function at 0x4274ee
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x10c
push 8
push dword [0x575c14]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x5774cc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x5774d0], esi
mov eax, esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 1
mov dword [esi + 0x78], 7
mov dword [esi], 0x426593
mov dword [esi + 4], 0x4265b3
mov dword [esi + 8], 0x4272ea
mov dword [esi + 0xc], 0x42664b
mov dword [esi + 0x10], 0x426b68
mov dword [esi + 0x14], 0x426afa
mov dword [esi + 0x18], 0x426b38
mov dword [esi + 0x1c], 0x426b50
mov dword [esi + 0x20], fcn.00426bc4
mov dword [esi + 0x24], 0x4269c9
mov dword [esi + 0x28], fcn.00426817
mov dword [esi + 0x2c], 0x42672e
mov dword [esi + 0x30], 0x426a90
mov dword [esi + 0x34], 0x4269e5
mov dword [esi + 0x38], 0x426c41
mov dword [esi + 0x3c], 0x426d52
mov dword [esi + 0x40], 0x426df6
mov dword [esi + 0x44], 0x426e8d
mov dword [esi + 0x48], 0x426f8b
mov dword [esi + 0x4c], 0x42716c
mov dword [esi + 0x50], 0x426fdc
mov dword [esi + 0x54], 0x42722e
mov dword [esi + 0x58], 0x427329
mov dword [esi + 0x5c], 0x4273e4
mov dword [esi + 0x60], 0x42745c
mov dword [esi + 0x64], 0x4274a2
pop esi
ret

Function at 0x42a190
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x42a1c2
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42a1bd
cmp dword [esp + 0xc], esi
je 0x42a1d9
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret
Function at 0x42ab2f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, dword [esp + 0x3c]
xor ebx, ebx
cmp esi, 1
je 0x42ab5f
cmp esi, 2
je 0x42ab5f
cmp esi, 4
je 0x42ab5f
cmp esi, 8
je 0x42ab5f
cmp esi, 0x18
je 0x42ab5f
cmp esi, 0x20
je 0x42ab5f
xor eax, eax
jmp 0x42ad29
mov ecx, dword [0x576ddc]
push ebp
push edi
xor edi, edi
mov dword [esp + 0x10], edi
test ecx, ecx
jle 0x42ad25
mov edx, dword [esp + 0x28]
mov eax, dword [edi*4 + 0x57755c]
cmp dword [eax], edx
je 0x42ab92
inc edi
mov dword [esp + 0x10], edi
cmp edi, ecx
jl 0x42ab79
jmp 0x42ad25
cmp dword [esp + 0x38], 0x20
jne 0x42acfc
mov eax, dword [eax + 8]
test eax, eax
je 0x42abd2
cmp esi, 0x20
je 0x42abae
cmp esi, 0xffffffff
jne 0x42abd2
push esi
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call eax
jmp 0x42ad23
mov eax, dword [esp + 0x2c]
inc eax
imul ebp, eax, 3
and ebp, 0xfffffffc
mov eax, ebp
mov dword [esp + 0x14], ebp
imul eax, dword [esp + 0x30]
push eax
push 0
push dword [0x575c14]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x42ad25
mov ebx, dword [esp + 0x30]
test ebx, ebx
jle 0x42acc7
mov edx, dword [esp + 0x24]
mov ecx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ecx
mov esi, edx
test eax, eax
jle 0x42aca7
mov ebp, ecx
mov edi, eax
mov ecx, 0xff
movzx eax, byte [esi + 2]
sub eax, ecx
movzx ecx, byte [esi + 3]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebp + 2], al
movzx eax, byte [esi + 1]
sub eax, ecx
movzx ecx, byte [esi + 3]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebp + 1], al
movzx eax, byte [esi]
lea esi, [esi + 4]
sub eax, ecx
movzx ecx, byte [esi - 1]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebp], al
lea ebp, [ebp + 3]
dec edi
jne 0x42ac38
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
add edx, dword [esp + 0x34]
add ecx, ebp
dec dword [esp + 0x24]
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], ecx
jne 0x42ac25
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x10]
mov eax, dword [edi*4 + 0x57755c]
push esi
push dword [esp + 0x44]
mov esi, dword [esp + 0x20]
push dword [esp + 0x44]
push ebp
push ebx
push dword [esp + 0x40]
push esi
push dword [esp + 0x3c]
call dword [eax + 4]
push esi
push 0
push dword [0x575c14]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x42ad25
cmp dword [esp + 0x38], 0x18
jne 0x42ad25
push esi
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call dword [eax + 4]
mov ebx, eax
pop edi
mov eax, ebx
pop ebp
pop esi
pop ebx
add esp, 0xc
ret 0x28