joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e328a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x4e32cd
call fcn.004ea64b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4e32cd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4e32e8
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.004e23ef
test ebx, ebx
mov esi, eax
je 0x4e32e6
test edi, edi
je 0x4e32e6
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4e3c79
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x4fa6ad
call fcn.004d1c1c
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x4e3c93
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4e3cdf
call fcn.004df219
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004011d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4e45eb
Capabilities:
Get disk information

Disassembly:
mov eax, 0x4fa6d4
call fcn.004d1c1c
sub esp, 0x150
mov eax, dword [0x52bd18]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x154]
push eax
push edi
mov esi, 0x104
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
xor ebx, ebx
cmp eax, ebx
jne 0x4e4633
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x4e4637
cmp eax, esi
jb 0x4e463e
xor eax, eax
jmp 0x4e4713
call fcn.004df219
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push edi
mov dword [ebp - 4], ebx
call fcn.004e45a9
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
test eax, eax
jne 0x4e4703
push ebx
push ebx
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x15c]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4e4692
xor esi, esi
jmp 0x4e4706
test byte [ebp - 0x158], 2
jne 0x4e46a2
push edi
call dword [sym.imp.USER32.dll_CharUpperA]
test byte [ebp - 0x158], 4
jne 0x4e4703
lea eax, [ebp - 0x150]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4e4703
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x154], ebx
je 0x4e468e
cmp dword [ebp - 0x154], edi
jbe 0x4e468e
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, edi
add eax, dword [ebp - 0x154]
cmp eax, esi
jge 0x4e468e
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x154]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor esi, esi
inc esi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004011d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.004ce183
leave
ret 8
Function at 0x4e48bf
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x128
xor ebx, ebx
push ebx
push esi
mov edi, ecx
call fcn.004d1df0
add esp, 0xc
push 0x104
push dword [edi + 0xc]
lea eax, [esi + 0x22]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [edi + 4]
cmp eax, dword [0x50f5c8]
je 0x4e49c6
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x4e492f
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
jne 0x4e4936
cmp ebx, ebx
jne 0x4e4936
xor eax, eax
jmp 0x4e49c9
mov edi, dword [edi + 0xc]
cmp dword [edi - 0xc], ebx
jne 0x4e4943
mov byte [esi + 0x20], bl
jmp 0x4e4957
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
sete cl
dec cl
and ecx, eax
mov byte [esi + 0x20], cl
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.004780e0
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.004780e0
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x14], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.004780e0
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi]
or ecx, dword [esi + 4]
jne 0x4e49b2
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x4e49c6
mov eax, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4e7688
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x52bd18]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov eax, 0x100
cmp esi, eax
ja 0x4e76d7
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x4e76d7
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4e76e3
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.004ce183
leave
ret 8
Function at 0x4e81d4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x52bd18]
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
mov dword [ebp - 4], eax
je 0x4e8221
push dword [ebp + 8]
call fcn.004ea776
mov esi, eax
test esi, esi
je 0x4e8249
push edi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
jmp 0x4e8249
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0x503568
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.004ce183
leave
ret 0xc

Function at 0x4e9941
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [ebp + 0xc], 0x800
mov eax, dword [0x52bd18]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
jne 0x4e999f
push 0x50ff74
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.004d2195
add esp, 0x10
cmp eax, 0xffffffff
je 0x4e99b3
cmp eax, esi
jae 0x4e99b3
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x4e99b5
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x4e996a
jmp 0x4e99b6
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.004ce183
leave
ret
Function at 0x4e99d6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x52bd18]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4e9a78
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x4e9b7a
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x4e9b28
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocStringLen
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e9b7b
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4e9b1d
cmp dword [ebp - 0x24], 1
jne 0x4e9b1d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x50ff78
push eax
call fcn.004d050f
add esp, 0xc
cmp eax, 1
jne 0x4e9b1d
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4e9b7b
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x4e9b7b
lea ecx, [ebp - 0x18]
push ecx
push 0x4e99c0
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x4e9b7b
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x4e9ba1
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.004e9941
cmp eax, ebx
pop ecx
pop ecx
jne 0x4e9ba3
inc edi
cmp edi, esi
jl 0x4e9b8a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004ce183
leave
ret 4
Function at 0x4e9bb2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x52b068
je 0x4e9c6e
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e9c56
mov esi, dword [ebx + 4]
jmp 0x4e9c50
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4e9c40
cmp dword [ebp - 0xc], 4
jne 0x4e9c40
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x4e9c38
or dword [eax + 0x9c], ecx
jmp 0x4e9c40
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x4e9c04
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x4e9be7
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x4ea05c
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4fa804
call fcn.004d1c1c
sub esp, 0x11c
mov eax, dword [0x52bd18]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x4ea155
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x4ea129
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00401fd0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.004ea05c
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004011d0
test bl, bl
jne 0x4ea129
or dword [ebp - 4], 0xffffffff
jmp 0x4ea09a
cmp esi, 0x103
je 0x4ea139
cmp esi, 0x3f2
jne 0x4ea149
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.004ce183
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4eca46
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x4eca7b
cmp edi, dword [esi + 0xc]
jge 0x4eca7b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4eca7b
cmp edi, dword [eax + 8]
jge 0x4eca7b
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x4eca7d
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x4ecb81
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4ecbb5
jmp fcn.004dce9f
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x4ecc26
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x4ecd1f
cmp eax, dword [edi + 0xc]
jge 0x4ecd1f
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x4ecc77
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x4ecd08
cmp dword [ebp + 0xc], ebx
je 0x4ecd08
jmp 0x4ecca1
push 0x10
call fcn.004ec912
cmp eax, ebx
je 0x4ecc8d
mov ecx, eax
call fcn.004ecb78
mov esi, eax
jmp 0x4ecc8f
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x4eccb8
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x4eccc8
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x4eccda
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.004dce9f
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.004d1df0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x4ecd1a
cmp ecx, dword [esi + 8]
jge 0x4ecd1a
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x4ecd20
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4ecdde
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4ece0c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4ece2a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004ecd48
jmp 0x4ece2a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4ece2a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004ecd48
test edi, edi
mov eax, edi
jne 0x4ece14
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x530724]
test ecx, ecx
je 0x4ecedd
jmp 0x4ecddd
ret 8
Function at 0x5d77d0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x5c1b7e
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x5c1b9a
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x5c1b86
jmp 0x5c1ba5
ret
lea esp, [esp + 4]
call fcn.005d778f
jmp 0x5c1b73

Function at 0x5ecb39
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], ecx
xchg byte [esp + 1], al
lea ebx, [edi + ebp]
jmp 0x5ecb65

Function at 0x5eceda
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x5ecf1a
and edx, ebp
jmp 0x5ecf64
lea esp, [esp + 0x30]
movzx edi, byte [edi*4 + 0x5c9f84]
xor ecx, edi
sub esp, 0x1c
mov word [esp + 0x16], bx
jmp 0x5ecee5
xor ecx, edx
not di
lea esp, [esp + 0x1c]
xor ecx, dword [ebx]
jmp 0x5ecf49

Function at 0x5ecff8
Capabilities:
Encrypt data using aes

Disassembly:
bsr ax, cx
jmp 0x5ecdda
mov dword [ecx + 0x14], ebx
push ebx
mov ebx, ecx
jmp 0x5ece21
xor eax, ebx
sub esp, 0x10
clc
sub esp, 0x1c
mov byte [esp + 0xa], dh
jmp 0x5ecd4b
sub esp, 0x18
mov eax, dword [ecx + 8]
sub esp, 4
push dword [esp + 2]
jmp 0x5ecd66
mov edx, dword [eax + 0xc]
clc
setg ch
jmp 0x5ecdbd
mov eax, edi
bsr dx, bp
xor cx, 0x6734
xchg di, cx
clc
jmp 0x5ecd91
mov ecx, edx
dec di
bsf di, si
jmp 0x5ece05
bsr dx, bp
dec eax
xor dl, ch
jmp 0x5ecdac
mov dword [ecx + 0x1c], edx
lea esp, [esp + 0x64]
call fcn.005d6a3e
jmp 0x5bf65d
shr ecx, 8
mov di, word [esp]
jmp 0x5ece4d
lea ebx, [ebx + 0x18]
mov dword [ebx], eax
pop ebx
xor edx, eax
jmp 0x5ecdf4
and ecx, esi
mov ecx, dword [ecx*4 + 0x5c9f84]
sub esp, 6
mov byte [esp + 1], ch
jmp 0x5ece60
mov edi, edx
pushal
mov word [esp + 0x18], bx
pop word [esp + 9]
lea esp, [esp + 2]
jmp 0x5ece2b
lea esp, [esp + 2]
jmp 0x5ecf81
mov dword [esp + 0x11], esi
add esp, 1
pop word [esp + 4]
lea esp, [esp + 3]
mov dword [edi], eax
jmp 0x5ecd82
xor ecx, edi
clc
neg edi
mov di, word [esp]
jmp 0x5ecf3d
and edi, 0xff000000
jmp 0x5ece8d
mov edi, dword [edi*4 + 0x5c9f84]
pushal
lea esp, [esp + 0x40]
and ecx, 0xff0000
jmp 0x5ecea4
mov edi, edx
push esp
push dword [esp + 2]
call fcn.005ecf16
mov di, 0xe03d
lea edi, [eax + 0x10]
bswap edx
mov dh, byte [esp]
bsf dx, si
jmp 0x5ecfc7
shr edi, 0x10
and edi, esi
clc
clc
jmp 0x5ecebc
mov esi, edi
mov dword [esi], ecx
pop esi
setp dh
setno dh
call fcn.005ecfd8
and ah, byte [edx + 0x11a25730]
pushal
out 0x77, eax
adc ah, cl
push ecx
lcall 0xc383, 0x7e17e4f5
add al, 0x56
add ebx, 4
push esi
jmp 0x5ecf8d
mov edx, dword [esp]
xor ecx, dword [eax]
mov dx, 0x3351
lea edx, [esp + ebp]
setg dh
jmp 0x5ecfae
clc
xor ebx, eax
sub esp, 0x1a
jmp 0x5ece76

Function at 0x5ed0b7
Capabilities:
Encrypt data using aes

Disassembly:
pushal
lea esp, [esp + 1]
lea esp, [esp + 0x20]
jne 0x5bf65d
bswap eax
jmp 0x5ed0bd
lea esp, [esp + 3]
jmp 0x5ed098
setp ah
lea ebp, [esi + 0x5f20e0e5]
mov esi, dword [esp]
jmp 0x5ed10d
push 0xa
mov ebp, eax
mov bx, di
pop eax
jmp 0x5ed0e5
Function at 0x5ed648
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp + 0xb], eax
add esp, 1
mov dword [esp + 0x14], eax
lea esp, [esp + 3]
jmp 0x5ed66e
mov ebx, dword [ebx*4 + 0x5c9f84]
pushal
jmp 0x5ed62b
and ebx, ecx
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + 0x5ca784]
call fcn.005ed652
add esp, 1
lea esp, [esp + 2]
and edx, ecx
stc
push esp
jmp 0x5ed70b
xor edi, dword [edx*4 + 0x5caf84]
mov edx, dword [esi + 4]
cmc
call 0x5ed6c2
mov edx, 0x1246488
push dword [esp]
jmp 0x5ed6e5
and edx, ecx
push edx
clc
lea esp, [esp + 4]
jmp 0x5ed6b1
mov dword [esi], edi
lea edi, [esi + 0x55]
mov ebx, dword [ebx*4 + 0x5c9f84]
cmc
jmp 0x5ed751
shr edi, 0x18
jmp 0x5ed72f
lea esp, [esp + 3]
cmc
lea esp, [esp + 1]
mov edx, dword [edx*4 + 0x5c9f84]
jmp 0x5ed6db
mov edi, dword [edi*4 + 0x5c9f84]
and edi, ecx
clc
call fcn.005ed75b
xchg ebp, eax
push ss
test bl, ah
push ds
scasb al, byte es:[edi]
add eax, 0x8d7e1b8b
cmp byte [ebp + 0x34c5a22c], ch
mov bh, byte [ecx + 0x3c8d4f66]
das
dec di
lea edi, [edi + ebp]
push edx
mov edi, edx
jmp 0x5ed6f4

Function at 0x5ed928
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop word [esp]
push word [esp + 1]
add esp, 3
jmp 0x5ed96b
lea esp, [esp + 1]
shr edi, 0x18
push eax
jmp 0x5ed94d

Function at 0x5edbf4
Capabilities:
Encrypt data using aes

Disassembly:
pushal
btr ebx, edi
push esp
lea esp, [esp + 0x24]
movzx ebx, byte [esi + 0xe]
call fcn.005edbcb
and ebx, ecx
jmp 0x5edc48
xor edi, dword [ebx*4 + 0x5ca784]
cmc
sub esp, 0x10
mov word [esp + 0xc], sp
jmp 0x5edc74
pushal
lea esp, [esp + 5]
and al, 5
lea esp, [esp + 7]
pop dword [esp]
lea esp, [esp + 0x30]
jmp 0x5edc31
and edx, ecx
call 0x5edc5a
lea ebx, [eax]
mov gs, ecx
sbb byte [esi - 0x731a8a13], ch
jg 0x5edc4a
in al, 0x17
jle 0x5edcd4
and ebx, ecx
lea esp, [esp + 0x4c]
xor edi, dword [ebx*4 + 0x5cab84]
neg bx
jmp 0x5edbe2
and al, 1
lea esp, [esp + 0x14]
pop edi
mov bl, byte [esp]
call fcn.005edd09
scasd eax, dword es:[edi]
aaa
cmpsd dword [esi], dword es:[edi]
ret 0x8d31

Function at 0x5edca0
Capabilities:
Encrypt data using aes

Disassembly:
movzx ebx, byte [esi + 0x11]
lea edx, [ecx*4]
setnp dh
jmp 0x5ed4f2
pushal
lea esp, [esp + 0xb]
jmp 0x5edcd2
neg di
mov ebx, dword [ebx*4 + 0x5c9f84]
inc edx
bswap edi
jmp 0x5ed61c
add esi, 0x10
rcr dh, 7
not dh
mov edx, dword [esi]
jmp 0x5ed541
lea esp, [esp + 3]
push ecx
jmp 0x5edcab
mov ecx, esi
lea ecx, [ecx + 0xc]
mov dword [ecx], edi
pop ecx
jmp 0x5edcf8
push edx
lea esp, [esp + 8]
jne 0x5bfcc4
je 0x5bfcdb

Function at 0x5f266e
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 4]
mov dword [eax + 4], 0
call fcn.005f26bf
add bl, byte [ecx + 0x269b6809]
cli
push 0x5b48fa0f
mov dl, 0x66
push dword [esp + 1]

Function at 0x5f383b
Capabilities:
Encode data using xor

Disassembly:
add esp, 1
push edx
add esp, 4
jmp 0x5f387f
movzx ecx, byte [ecx]
sub esp, 0x1c
pop dword [esp]
push esp
push dword [esp + 0x14]
jmp 0x5f3869
lea esp, [esp + 3]
jmp 0x5f3844