joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488018
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x488046
mov eax, ebx
call fcn.00488abc
cmp dword [ebx + 0x3c], 0
je 0x48803f
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4880b7
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x4880a9
cmp dword [ebx + 8], 0
je 0x488068
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x48807a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4880a9
cmp dword [ebx + 8], 0
je 0x48805b
cmp eax, 3
je 0x48808d
dec eax
jne 0x48805b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x48805b
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x48805b
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4880d5
cmp dword [ebx + 0x10], 0xcc
je 0x4880d5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004880e0
pop ebx
ret

Function at 0x4924e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x4c02ac
test esi, esi
jne 0x4924fe
xor eax, eax
jmp 0x492600
cmp dword [ebp], 0
jne 0x492509
call fcn.00492474
xor ebx, 0xffffffff
cmp edi, 8
jb 0x4925d9
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x492515
test edi, edi
jbe 0x4925fb
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x4925dd
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a1bb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a1ca8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004a1b78
mov dword [ebx + 4], edi
mov eax, dword [ebp - 4]
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x10]
mov edx, dword [ebp + 0xc]
call fcn.004030a8
lea eax, [ebx + 0x110]
mov edx, dword [ebp + 8]
call fcn.004030a8
call sub.KERNEL32.DLL_GetTickCount
mov esi, eax
sub esi, dword [ebx + 0xccb4]
mov dword [ebx + 8], esi
or eax, 0xffffffff
sub eax, esi
cmp esi, eax
jbe 0x4a1c22
or eax, 0xffffffff
sub eax, dword [ebx + 8]
mov dword [ebx + 8], eax
push 0x4a1cc0
lea ecx, [ebp - 0xc]
mov edx, 8
mov eax, dword [ebp - 4]
call fcn.00408c60
push dword [ebp - 0xc]
push 0x4a1cd4
lea eax, [ebp - 0x10]
mov edx, dword [ebp + 0xc]
call fcn.00404900
push dword [ebp - 0x10]
push 0x4a1ce0
lea eax, [ebp - 0x14]
mov edx, dword [ebp + 8]
call fcn.00404900
push dword [ebp - 0x14]
push 0x4a1cec
lea edx, [ebp - 0x18]
mov eax, edi
call fcn.00408b4c
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 8
call fcn.00404a1c
mov eax, dword [ebp - 8]
call fcn.00404b5c
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1caf
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.004046c0
ret
Function at 0x4ae39c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ae50d
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ae4e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404884
lea eax, [ebp - 0x118]
mov edx, 0x4ae524
call fcn.00404964
mov eax, dword [ebp - 0x118]
call fcn.00404b5c
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x4ae45a
lea eax, [ebp - 0x111]
call fcn.0040972c
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.0040478c
jmp 0x4ae461
mov eax, esi
call fcn.0040469c
cmp bl, 0x61
jae 0x4ae482
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040d5f4
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.004046f0
jmp 0x4ae49c
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040d568
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.004046f0
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4ae530
call fcn.00409e24
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.004046f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae4ef
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
Function at 0x4b2f28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b30f3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x40], 0
je 0x4b2f63
cmp byte [ebx + 0x41], 0
jne 0x4b2f63
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x4b2f8f
cmp byte [ebx + 0x41], 1
jne 0x4b2f7d
lea eax, [ebp - 0x24]
push eax
push 0x12
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004b1c28
jmp 0x4b2f8f
lea eax, [ebp - 0x24]
push eax
push 0x11
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004b1c28
xor edx, edx
push ebp
push 0x4b30ce
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebx + 0x48]
mov edx, 0x104
call fcn.00404ce8
mov eax, dword [ebx + 0x48]
call fcn.00404b5c
mov dword [ebp - 0x20], eax
cmp dword [ebx + 0x44], 0
je 0x4b2fc8
mov eax, dword [ebx + 0x44]
call fcn.00404b5c
mov dword [ebp - 0x1c], eax
jmp 0x4b2fcd
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp byte [ebx + 0x41], 1
jne 0x4b2fdc
mov dword [ebp - 0x18], 0x1000
jmp 0x4b2fe3
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x14], 0x4b2b50
mov dword [ebp - 0x10], ebx
mov eax, dword [0x4becf4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.004b3104
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x4b30b3
xor eax, eax
push ebp
push 0x4b30ac
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x41], 0
jne 0x4b3079
lea eax, [ebp - 0x12d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
call fcn.0040df38
lea edx, [ebp - 0x138]
lea eax, [ebp - 0x12d]
call fcn.00409934
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004b325c
mov edx, dword [ebp - 0x134]
lea eax, [ebx + 0x50]
call fcn.004046f0
jmp 0x4b3084
lea eax, [ebx + 0x50]
mov edx, dword [ebx + 0x48]
call fcn.004046f0
lea eax, [ebx + 0x4c]
mov edx, dword [ebx + 0x50]
call fcn.004046f0
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x54], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b30b3
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b30d5
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4b30cd
push eax
call sub.ole32.dll_CoTaskMemFree
ret

Function at 0x4b32bc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x4b330d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404b5c
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4b32f1
test al, 0x10
jne 0x4b32f5
xor ebx, ebx
jmp 0x4b32f7
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3314
lea eax, [ebp - 4]
call fcn.0040469c
ret
Function at 0x4b33ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x320], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b35ae
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.ole32.dll_CoInitialize
xor eax, eax
push ebp
push 0x4b357e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00405fec
push eax
mov eax, dword [0x4bee88]
push eax
push 5
push 0
mov eax, dword [0x4be9e0]
push eax
call sub.ole32.dll_CoCreateInstance
call fcn.004b1c28
xor eax, eax
push ebp
push 0x4b3564
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00405fec
push eax
push 0x4be8c0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax]
call fcn.004b1c28
xor eax, eax
push ebp
push 0x4b3547
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push edi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004b1c28
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
push 0x4b35c4
push esi
push 0x4b35d0
lea eax, [ebp - 0x320]
mov edx, 3
call fcn.00404a1c
mov eax, dword [ebp - 0x320]
call fcn.00404b5c
mov edx, eax
lea eax, [ebp - 0x111]
call fcn.00409808
mov eax, ebx
call fcn.00404b5c
mov esi, eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
push 0
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
push 0x104
lea eax, [ebp - 0x31c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x111]
push eax
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 0xffffffffffffffff
lea eax, [ebp - 0x31c]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.004b1c28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b354e
lea eax, [ebp - 8]
call fcn.00405fec
ret

Function at 0x4b3610
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x4b36d0
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
dec ecx
je 0x4b3682
dec ecx
jne 0x4b36c9
cmp eax, 4
jg 0x4b3650
mov eax, dword [0x4be8e4]
jmp 0x4b36d5
cmp eax, 5
jne 0x4b3660
test edx, edx
jne 0x4b3660
mov eax, dword [0x4be8e8]
jmp 0x4b36d5
cmp eax, 5
jne 0x4b366f
dec edx
jne 0x4b366f
mov eax, dword [0x4be8ec]
jmp 0x4b36d5
cmp eax, 6
jne 0x4b367b
mov eax, dword [0x4be8f0]
jmp 0x4b36d5
mov eax, dword [0x4be8d0]
jmp 0x4b36d5
cmp eax, 4
jne 0x4b3692
test edx, edx
jne 0x4b3692
mov eax, dword [0x4be8d4]
jmp 0x4b36d5
cmp eax, 4
jne 0x4b36b1
cmp edx, 0xa
jne 0x4b36b1
cmp byte [esp + 0x15], 0x41
jne 0x4b36aa
mov eax, dword [0x4be8dc]
jmp 0x4b36d5
mov eax, dword [0x4be8d8]
jmp 0x4b36d5
cmp eax, 4
jne 0x4b36c2
cmp edx, 0x5a
jne 0x4b36c2
mov eax, dword [0x4be8e0]
jmp 0x4b36d5
mov eax, dword [0x4be8d0]
jmp 0x4b36d5
mov eax, dword [0x4be8d0]
jmp 0x4b36d5
mov eax, dword [0x4be8d0]
add esp, 0x94
ret
Function at 0x4b3ca0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebx
push esi
push ecx
mov esi, eax
push esp
push 0x26
mov eax, dword [0x4c1a18]
call fcn.004488f0
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, 0xff
call fcn.00402734
mov ebx, eax
push ebx
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, esi
mov edx, ebx
call fcn.00404894
mov eax, ebx
call fcn.00402754
pop edx
pop esi
pop ebx
ret

Function at 0x4b3ce4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x105
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00409934
add esp, 0x108
pop ebx
ret

Function at 0x4b3d10
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.00409934
add esp, 0x108
pop ebx
ret

Function at 0x4b418c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
xor edx, edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x4b4288
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004b1c28
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.0040490c
cmp dword [ebp - 0xc], 0
je 0x4b425a
mov eax, dword [ebp - 0xc]
call fcn.0040495c
mov edx, dword [ebp - 0xc]
cmp byte [edx + eax - 1], 0x5c
je 0x4b4219
lea eax, [ebp - 0xc]
mov edx, 0x4b429c
call fcn.00404964
push dword [ebp - 0xc]
lea edx, [ebp - 0x11c]
mov eax, 0x4b42a8
call fcn.004ac1e0
push dword [ebp - 0x11c]
push 0x4b42b8
push dword [ebp - 4]
push 0x4b42c4
lea eax, [ebp - 0x118]
mov edx, 5
call fcn.00404a1c
mov eax, dword [ebp - 0x118]
call fcn.00409348
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b428f
lea eax, [ebp - 0x11c]
mov edx, 2
call fcn.004046c0
lea eax, [ebp - 0xc]
call fcn.0040469c
lea eax, [ebp - 4]
call fcn.0040469c
ret
Function at 0x4b4604
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
xor edx, edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x4b47cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 2
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004b1c28
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.0040490c
cmp dword [ebp - 0xc], 0
je 0x4b479f
mov eax, dword [ebp - 0xc]
call fcn.0040495c
mov edx, dword [ebp - 0xc]
cmp byte [edx + eax - 1], 0x5c
je 0x4b46b3
lea eax, [ebp - 0xc]
mov edx, 0x4b47e0
call fcn.00404964
push dword [ebp - 0xc]
push dword [ebp - 4]
push 0x4b47e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a1c
push dword [ebp - 0xc]
lea edx, [ebp - 0x11c]
mov eax, 0x4b47ec
call fcn.004ac1e0
push dword [ebp - 0x11c]
push 0x4b47fc
push dword [ebp - 4]
push 0x4b4808
lea eax, [ebp - 0x118]
mov edx, 5
call fcn.00404a1c
mov eax, dword [ebp - 0x118]
call fcn.00409348
push dword [ebp - 0xc]
lea edx, [ebp - 0x124]
mov eax, 0x4b4818
call fcn.004ac1e0
push dword [ebp - 0x124]
push 0x4b4808
lea eax, [ebp - 0x120]
mov edx, 3
call fcn.00404a1c
mov eax, dword [ebp - 0x120]
call fcn.00409348
push dword [ebp - 0xc]
lea edx, [ebp - 0x12c]
mov eax, 0x4b4828
call fcn.004ac1e0
push dword [ebp - 0x12c]
push 0x4b47fc
push dword [ebp - 4]
push 0x4b4808
lea eax, [ebp - 0x128]
mov edx, 5
call fcn.00404a1c
mov eax, dword [ebp - 0x128]
call fcn.00409348
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 0xc]
call fcn.004094a8
mov eax, dword [ebp - 0x130]
call fcn.00409714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b47d4
lea eax, [ebp - 0x130]
mov edx, 7
call fcn.004046c0
lea eax, [ebp - 0xc]
call fcn.0040469c
lea eax, [ebp - 4]
call fcn.0040469c
ret
Function at 0x4b7338
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4b7405
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, 2
call fcn.00402bdc
mov eax, dword [ebp - 4]
call fcn.00404b5c
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404894
mov eax, dword [ebp - 8]
call fcn.00409348
mov eax, dword [ebp - 4]
call fcn.00409138
test al, al
jne 0x4b735d
push 4
push 0
lea edx, [ebp - 0xc]
mov eax, dword [0x4becf4]
mov eax, dword [eax]
call fcn.00461f8c
mov eax, dword [ebp - 0xc]
call fcn.00404b5c
push eax
call sub.KERNEL32.DLL_MoveFileExA
call fcn.00402b7c
cmp eax, 4
jne 0x4b73ea
push 0x40
lea edx, [ebp - 0x10]
mov eax, 3
call fcn.00402bdc
mov eax, dword [ebp - 0x10]
call fcn.00404b5c
push eax
lea edx, [ebp - 0x14]
mov eax, 4
call fcn.00402bdc
mov eax, dword [ebp - 0x14]
call fcn.00404b5c
mov edx, eax
mov eax, dword [0x4becf4]
mov eax, dword [eax]
pop ecx
call fcn.00461b0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b740c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004046c0
ret
Function at 0x10001280
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x100924f0
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x1009250a
add ecx, 0x10
call fcn.100041e7
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x1009254d
push dword [0x101a8b10]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1009253c
mov edx, dword [eax + 4]
test edx, edx
je 0x1009253c
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x10092550
inc ecx
cmp ecx, 6
jl 0x10092530
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x60]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x100016a4
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x100554c0
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x100554da
add ecx, 8
call fcn.10003c2e
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x1005551d
push dword [0x101a8b10]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1005550c
mov edx, dword [eax + 4]
test edx, edx
je 0x1005550c
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x10055520
inc ecx
cmp ecx, 6
jl 0x10055500
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x98]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x10001a19
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x10092470
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
je 0x10092481
mov dword [esi + 8], 0
mov edi, dword [esi + 4]
test edi, edi
je 0x100924be
push dword [0x101a8b10]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100924ad
mov edx, dword [eax + 4]
test edx, edx
je 0x100924ad
xor ecx, ecx
cmp dword [edx + ecx*4], 0
je 0x100924c1
inc ecx
cmp ecx, 2
jl 0x100924a1
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [esi + 4], 0
pop edi
pop esi
ret
mov al, byte [edi + 0x2c]
mov byte [edi], al
mov dword [edx + ecx*4], edi
pop edi
mov dword [esi + 4], 0
pop esi
ret

Function at 0x10001f55
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x10055420
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x1005543a
add ecx, 8
call fcn.10002ab3
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x1005547d
push dword [0x101a8b10]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1005546c
mov edx, dword [eax + 4]
test edx, edx
je 0x1005546c
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x10055480
inc ecx
cmp ecx, 6
jl 0x10055460
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x90]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
Function at 0x100029a0
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x10092580
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x100925b1
mov ecx, dword [eax + 0x3c]
lea esi, [eax + 0x18]
test ecx, ecx
je 0x100925aa
mov edx, dword [ecx]
cmp ecx, esi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [esi + 0x24], 0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x100925f1
push dword [0x101a8b10]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100925e0
mov edx, dword [eax + 4]
test edx, edx
je 0x100925e0
mov eax, 4
cmp dword [edx + eax*4], 0
je 0x100925f4
inc eax
cmp eax, 6
jl 0x100925d4
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov cl, byte [esi + 0x58]
mov byte [esi], cl
mov dword [edx + eax*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x10002a4f
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x10092630
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x1009264a
add ecx, 0x18
call fcn.100041e7
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x1009268d
push dword [0x101a8b10]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1009267c
mov edx, dword [eax + 4]
test edx, edx
je 0x1009267c
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x10092690
inc ecx
cmp ecx, 6
jl 0x10092670
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x68]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x10002e73
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x10092a90
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x10092aaa
add ecx, 8
call fcn.10003f17
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x10092aed
push dword [0x101a8b10]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10092adc
mov edx, dword [eax + 4]
test edx, edx
je 0x10092adc
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x10092af0
inc ecx
cmp ecx, 6
jl 0x10092ad0
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x88]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret