joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492705
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x49279d
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x49279a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x49279a
lea eax, [esi - 1]
push eax
push dword [0x11c0880]
call fcn.004a5f30
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x49279c
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x492791
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x492884
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x492777
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x492843
push eax
call esi
test al, al
jns 0x492843
push 0x11
call esi
test al, al
js 0x492843
push 0x10
call esi
test al, al
js 0x492843
push 0x12
call esi
test al, al
js 0x492843
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x492843
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x492817
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x49282e
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x49288e
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x49288e
test ebp, ebp
je 0x492867
push 0x11
call esi
test al, al
js 0x49285f
push 0x10
call esi
test al, al
js 0x49285f
push 0x12
call esi
test al, al
jns 0x492867
push 1
push ebp
call fcn.0049289a
test ebx, ebx
je 0x49287b
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x49288e
test edi, edi
je 0x49288e
mov eax, dword [edi + 8]
jmp 0x492890
and dword [esp + 0x14], 0
jmp 0x49279c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x492a78
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x492aa1
test byte [esp + 8], 2
je 0x492a95
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x492aa3
xor eax, eax
ret 8
Function at 0x492ab4
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x492bfc
xor ecx, ecx
cmp word [eax], cx
je 0x492bfc
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x492b0d
cmp eax, 3
jne 0x492b47
cmp word [esp + 0xa], 0x3a
jne 0x492b47
cmp eax, 2
jne 0x492b2b
lea eax, [esp + 8]
push 0x51c3c0
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x492bfc
push 0xfffffffffffffffe
pop edi
jmp 0x492bfc
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x492b5c
cmp ax, bx
jne 0x492b66
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x492b4f
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x492ba5
test byte [esp + 0x21c], 0x10
je 0x492b8c
push 0xfffffffffffffffe
pop edi
jmp 0x492b9c
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x492bfa
cmp word [esp + 0x10], bp
jne 0x492bb3
cmp word [esp + 0x12], bp
je 0x492bd2
cmp word [esp + 0x10], bx
jne 0x492bc1
cmp word [esp + 0x12], bx
je 0x492bd2
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x492bfa
cmp word [esp + 0x12], ax
jne 0x492bfa
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x492be7
test al, 0x10
je 0x492bfa
jmp 0x492bf7
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x492bfa
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x492c3d
Capabilities:
Copy file

Disassembly:
cmp dword [esp + 4], 0
je 0x492c5d
cmp dword [esp + 8], 0
je 0x492c5d
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x492c5f
xor eax, eax
ret 8
Function at 0x493079
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x4930f1
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x4930d2
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x4930cf
cmp ecx, 0x5c
je 0x4930cf
cmp ecx, 0x2f
jne 0x4930dc
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x4930bc
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4930f3
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4931ab
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0x11c0040]
push esi
test eax, eax
jne 0x4931d0
push fcn.004932d8
push 0x10
push 0x258
call fcn.004a6003
mov dword [0x11c0040], eax
push dword [esp + 0xc]
push eax
call fcn.004a5f6f
mov esi, eax
test esi, esi
je 0x4932d1
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x4931f2
mov edi, 0x5050b0
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x493202
xor eax, eax
cmp word [ebx], ax
jne 0x493207
mov ebx, 0x51c3f4
push edi
call sub.MSVCRT.dll_wcslen
push ebx
mov dword [esp + 0x24], eax
call sub.MSVCRT.dll_wcslen
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x1146d80]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x4932b8
push edi
push eax
call sub.MSVCRT.dll_wcscpy
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x493268
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x49326c
push 0x51c3c0
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
jmp 0x49326c
mov edi, dword [esp + 0x18]
push ebx
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x493290
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x4932a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4932a4
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0x1146d80]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x4932cf
cmp dword [esp + 0x14], 0xffffffff
je 0x4932c3
mov esi, dword [esp + 0x14]
push esi
push dword [0x11c0040]
call fcn.004a5ee1
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc
Function at 0x49367c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x493692
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x493695
or eax, 0xffffffff
ret 4

Function at 0x493698
Capabilities:
Set file attributes

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
je 0x4936a6
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 8

Function at 0x493780
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x4937bc
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x493c90
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x493cf5
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x493ced
push dword [esp + 0x10]
push dword [0x11c0c98]
call fcn.004a5f30
test eax, eax
je 0x493ce3
cmp dword [eax + 4], 0
je 0x493cd2
push edi
push esi
push eax
call fcn.00494290
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc

Function at 0x493d00
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x11c0c98]
call fcn.004a5f30
mov esi, eax
test esi, esi
je 0x493d7f
cmp dword [esi + 4], 0
je 0x493d50
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.004943a0
test eax, eax
je 0x493d44
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x493d8a
cmp dword [esp + 8], 0
je 0x493d8a
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4
Function at 0x493f50
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x494058
cmp word [edx], 0
je 0x494058
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x493f7e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x493fdd
cmp dword [esi + 4], 0
mov ecx, edx
lea edi, [ecx + 2]
je 0x493fb0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x493f90
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00494290
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x493fb0
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x14]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.00494970
mov edi, eax
test edi, edi
je 0x493fd3
cmp dword [esi + 4], 0
je 0x49402b
push dword [esp + 0x14]
push edi
push esi
call fcn.00494290
push edi
push 0
push dword [0x1146d80]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x1146d80]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc

Function at 0x494060
Capabilities:
Write file on windows

Disassembly:
push dword [esp + 4]
push dword [0x11c0c98]
call fcn.004a5f30
test eax, eax
je 0x49407c
mov dword [esp + 4], eax
jmp fcn.00493f50
xor eax, eax
ret 0xc

Function at 0x494130
Capabilities:
Read file on windows

Disassembly:
push ecx
push dword [esp + 8]
mov byte [esp + 7], 0
push dword [0x11c0c98]
call fcn.004a5f30
test eax, eax
je 0x49417b
cmp dword [eax + 4], 0
je 0x494165
push 1
lea ecx, [esp + 7]
push ecx
push eax
call fcn.004943a0
movzx eax, byte [esp + 3]
pop ecx
ret 4
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
lea ecx, [esp + 0xf]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, byte [esp + 3]
pop ecx
ret 4
Function at 0x4944c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x1146d80]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x494644
mov cl, byte [esp + 3]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov esi, edx
mov edi, edi
cmp ebp, 0xffffffff
je 0x49450e
test ebp, ebp
je 0x4945b0
dec ebp
cmp dword [ebx + 4], 0
je 0x494527
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004943a0
mov dword [esp + 0x14], eax
jmp 0x494541
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x13]
cmp eax, 1
jne 0x4945b0
test cl, cl
je 0x494555
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x13]
mov eax, dword [esp + 0x18]
mov edi, esi
mov edx, dword [esp + 0x20]
dec eax
sub edi, edx
cmp edi, eax
jle 0x494590
mov eax, dword [esp + 0x18]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x1146d80]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x20], edx
lea esi, [edi + edx]
test cl, cl
je 0x4945b0
cmp dword [esp + 0x2c], 0
jne 0x494500
cmp cl, 0xd
je 0x4945b7
cmp cl, 0xa
jne 0x494500
dec esi
jmp 0x494627
cmp dword [esp + 0x2c], 0
jne 0x494627
cmp cl, 0xa
jne 0x4945bf
dec esi
jmp 0x494627
cmp cl, 0xd
jne 0x494627
dec esi
cmp dword [ebx + 4], 0
je 0x4945de
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004943a0
mov dword [esp + 0x14], eax
jmp 0x4945f4
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x494627
cmp dword [ebx + 4], 0
je 0x494606
inc dword [ebx + 0xc]
jmp 0x494627
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x20]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x494650
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push 0x1000
push 0
push dword [0x1146d80]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 8], ecx
test ecx, ecx
je 0x4947fd
mov ax, word [esp]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x1c], 0x7ff
cmp ebp, 0xffffffff
je 0x4946a4
test ebp, ebp
je 0x49475d
dec ebp
cmp dword [ebx + 4], 0
je 0x4946bd
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004943a0
mov dword [esp + 0x14], eax
jmp 0x4946d7
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp eax, 2
mov ax, word [esp + 0x10]
jne 0x49475d
test ax, ax
je 0x4946f1
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, edi
mov edx, dword [esp + 0x1c]
sub esi, ecx
sar esi, 1
cmp esi, edx
jle 0x494738
mov eax, dword [esp + 0x20]
add edx, 0x800
add eax, 0x1000
mov dword [esp + 0x1c], edx
push eax
push ecx
push 8
push dword [0x1146d80]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
mov ax, word [esp + 0x10]
mov dword [esp + 0x18], ecx
lea edi, [ecx + esi*2]
test ax, ax
je 0x49475d
cmp dword [esp + 0x30], 0
jne 0x494696
cmp ax, 0xd
je 0x494764
cmp ax, 0xa
jne 0x494696
sub edi, 2
jmp 0x4947dc
cmp dword [esp + 0x30], 0
jne 0x4947dc
cmp ax, 0xa
jne 0x49476f
sub edi, 2
jmp 0x4947dc
cmp ax, 0xd
jne 0x4947dc
sub edi, 2
cmp dword [ebx + 4], 0
je 0x494791
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004943a0
mov dword [esp + 0x14], eax
jmp 0x4947a7
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x10], 0xa
je 0x4947dc
cmp dword [ebx + 4], 0
je 0x4947bb
add dword [ebx + 0xc], 2
jmp 0x4947dc
push 1
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x38]
mov ecx, edi
sub ecx, dword [esp + 0x18]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
xor eax, eax
add esp, 0x18
ret 0x10
Function at 0x494810
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x1146d80]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x494960
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x49485c
test edi, edi
je 0x4948cd
dec edi
push esi
push ebp
call fcn.004949e0
mov dword [esp + 0x20], eax
test eax, eax
jne 0x49486f
xor cl, cl
jmp 0x494871
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x4948b4
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x1146d80]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x4948cd
test eax, eax
jne 0x494852
cmp cl, 0xd
je 0x4948d1
cmp cl, 0xa
jne 0x494852
dec esi
jmp 0x494943
test eax, eax
jne 0x494943
cmp cl, 0xa
jne 0x4948d9
dec esi
jmp 0x494943
cmp cl, 0xd
jne 0x494943
dec esi
cmp dword [ebp + 4], 0
je 0x4948f8
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.004943a0
mov dword [esp + 0x20], eax
jmp 0x49490f
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x494943
cmp dword [ebp + 4], 0
je 0x494921
inc dword [ebp + 0xc]
jmp 0x494943
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x49d6ab
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, ebx
test esi, esi
je 0x49d708
push esi
call dword [esi + 0x58]
mov ecx, dword [esi + 0x80]
mov edi, eax
mov dword [esi + 0x94], ecx
mov ecx, dword [esi + 0x84]
mov dword [esi + 0x98], ecx
test edi, edi
jne 0x49d708
mov eax, dword [esi + 0x70]
test eax, eax
je 0x49d6e7
push ebx
push esi
call eax
push esi
push ebx
push dword [0x1146d80]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [0x11c0ccc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x11c0cd0], ebx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x49d710
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x11c0ccc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x90]
add ecx, dword [esp + 8]
push ecx
mov ecx, dword [eax + 0x8c]
add ecx, dword [esp + 8]
push ecx
push eax
call dword [eax + 0x54]
ret 8

Function at 0x49d761
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x11c0ccc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [esp + 0xc]
mov ecx, dword [eax + 0x90]
add ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 0x8c]
add ecx, dword [esp + 0xc]
push ecx
push eax
call dword [eax + 0x50]
ret 0xc

Function at 0x49d831
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0x11c0ccc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi + 0xac]
je 0x49d859
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [ebp + 0x14]
mov eax, dword [esi + 0x90]
push dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [ebp + 8]
push eax
push esi
call dword [esi + 4]
pop esi
pop ebp
ret 0x14
Function at 0x49d87c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [0x11c0ccc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov ecx, dword [ebx + 0x74]
cmp ecx, 2
je 0x49d8a9
cmp ecx, 3
je 0x49d8a9
cmp ecx, 8
je 0x49d8a9
cmp ecx, 0xc
jne 0x49d991
fldz
fld dword [ebp + 8]
fcom st(1)
fnstsw ax
test ah, 5
jp 0x49d8bb
fstp st(0)
jmp 0x49d8ca
fstp st(1)
fld1
fcom st(1)
fnstsw ax
test ah, 5
jp 0x49d8d2
fstp st(1)
fstp dword [ebp + 8]
fld dword [ebp + 8]
jmp 0x49d8d4
fstp st(0)
push esi
mov esi, dword [ebx + 0xbc]
push edi
xor edi, edi
jmp 0x49d8fe
fld dword [esi + 4]
fld st(1)
fucompp
fnstsw ax
test ah, 0x44
jnp 0x49d94f
fld dword [esi + 4]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x49d925
mov edi, esi
mov esi, dword [esi]
test esi, esi
jne 0x49d8e0
fstp st(0)
push 0x18
push 0
push dword [0x1146d80]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x49d98f
and dword [edx], 0
test edi, edi
je 0x49d959
mov dword [edi], edx
jmp 0x49d95f
push 0x18
push 0
push dword [0x1146d80]
fstp st(0)
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x49d904
mov dword [edx], esi
test edi, edi
je 0x49d947
mov dword [edi], edx
jmp 0x49d953
mov dword [ebx + 0xbc], edx
jmp 0x49d953
fstp st(0)
mov edx, esi
test edx, edx
jne 0x49d95f
jmp 0x49d904
mov dword [ebx + 0xbc], edx
mov ecx, dword [ebp + 0xc]
mov esi, 0xff
fld dword [ebp + 8]
movzx eax, cl
mov dword [edx + 8], eax
mov eax, ecx
sar eax, 8
and eax, esi
mov dword [edx + 0xc], eax
mov eax, ecx
sar eax, 0x10
and eax, esi
sar ecx, 0x18
and ecx, esi
mov dword [edx + 0x10], eax
fstp dword [edx + 4]
mov dword [edx + 0x14], ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8