joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10044f30
Capabilities:
Get thread local storage value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x100c7608]
call esi
test eax, eax
je 0x1004507b
mov ecx, dword [eax + 0x1fc44]
push 0
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push dword [eax + 0x1fc40]
push dword [eax + 0x18380]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10044f7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x100c7608]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10044fb4
push 0
lea ecx, [ebp - 0xc]
push ecx
push 1
lea ecx, [ebp - 1]
push ecx
push dword [eax + 0x18380]
call edi
test eax, eax
je 0x10044fb4
cmp dword [ebp - 0xc], 0
je 0x10044fb4
movzx ebx, byte [ebp - 1]
mov dword [ebp - 8], ebx
jmp 0x10044fbb
mov dword [ebp - 8], 0xffffffff
push dword [0x100c7608]
call esi
test eax, eax
je 0x10044fee
push 0
lea ecx, [ebp - 0xc]
push ecx
push 1
lea ecx, [ebp - 1]
push ecx
push dword [eax + 0x18380]
call edi
test eax, eax
je 0x10044fee
cmp dword [ebp - 0xc], 0
je 0x10044fee
movzx ebx, byte [ebp - 1]
mov dword [ebp - 0xc], ebx
jmp 0x10044ff5
mov dword [ebp - 0xc], 0xffffffff
push dword [0x100c7608]
call esi
test eax, eax
je 0x10045025
push 0
lea ecx, [ebp - 0x10]
push ecx
push 1
lea ecx, [ebp - 1]
push ecx
push dword [eax + 0x18380]
call edi
test eax, eax
je 0x10045025
cmp dword [ebp - 0x10], 0
je 0x10045025
movzx ebx, byte [ebp - 1]
jmp 0x10045028
or ebx, 0xffffffff
push dword [0x100c7608]
call esi
test eax, eax
je 0x10045058
push 0
lea ecx, [ebp - 0x10]
push ecx
push 1
lea ecx, [ebp - 1]
push ecx
push dword [eax + 0x18380]
call edi
test eax, eax
je 0x10045058
cmp dword [ebp - 0x10], 0
je 0x10045058
movzx ecx, byte [ebp - 1]
jmp 0x1004505b
or ecx, 0xffffffff
cmp byte [ebp - 8], 0x50
jne 0x1004507b
cmp byte [ebp - 0xc], 0x4b
jne 0x1004507b
cmp bl, 1
jne 0x1004507b
xor eax, eax
cmp cl, 2
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10045ad0
Capabilities:
Get thread local storage value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push esi
push dword [0x100c7608]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10045c0b
push edi
movzx edi, word [esi + 0x7172]
cmp edi, 0x7ff
jbe 0x10045b05
mov edi, 0x7ff
push 0x801
lea eax, [ebp - 0x808]
push 0
push eax
call fcn.1007cff0
add esp, 0xc
lea eax, [ebp - 4]
push 0
push eax
push edi
lea eax, [ebp - 0x808]
push eax
push dword [esi + 0x18380]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10045c0a
mov eax, dword [ebp - 4]
cmp eax, edi
jne 0x10045c0a
mov ecx, 0x800
mov byte [ebp + eax - 0x808], 0
test word [esi + 0x715e], cx
mov ecx, 0xfde9
jne 0x10045b66
movzx ecx, word [esi]
push 0x7ff
lea edi, [esi + 0x1a404]
push edi
push eax
lea eax, [ebp - 0x808]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
mov word [esi + eax*2 + 0x1a404], cx
mov ecx, edi
mov edx, dword [esi + 0x824e]
shr edx, 4
and edx, 1
call fcn.10044d40
test byte [esi + 0x824e], 8
je 0x10045bdc
push 0x2e
push edi
call fcn.1007c926
add esp, 8
test eax, eax
je 0x10045bd3
push ebx
mov ebx, 0x20
mov edi, edi
push 0x2e
push edi
mov word [eax], bx
call fcn.1007c926
add esp, 8
test eax, eax
jne 0x10045bc0
pop ebx
xor eax, eax
mov word [esi + 0x1a41a], ax
test byte [esi + 0x824e], 0x10
je 0x10045c0a
mov ecx, edi
call fcn.10050770
test eax, eax
jne 0x10045c0a
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x7ff
jge 0x10045c0a
push 0x100b0dec
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10045c10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
push ebx
mov ebx, ecx
xor ecx, ecx
mov dword [ebx + 0x7176], eax
mov dword [ebx + 0x717a], eax
mov dword [ebx + 0x717e], eax
push esi
mov dword [ebx + 0x7182], eax
mov esi, edx
mov dword [ebx + 0x7186], eax
mov dword [ebx + 0x718a], eax
mov dword [ebx + 0x718e], eax
mov dword [ebx + 0x7192], eax
lea eax, [ebx + 0x7196]
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 8], cx
mov dword [ebp - 0xc], eax
mov byte [eax + 0xa], cl
push edi
lea edi, [ebx + 0x7176]
cmp esi, 4
jle 0x10045d87
push esi
call fcn.1008680d
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
je 0x10045d7e
push 0
lea ecx, [ebp - 0x10]
push ecx
push esi
push eax
push dword [ebx + 0x18380]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10045d4f
cmp dword [ebp - 0x10], esi
jne 0x10045d4f
lea eax, [esi - 4]
xor ebx, ebx
movzx eax, ax
xor esi, esi
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov edi, edi
test ebx, ebx
jne 0x10045cff
cmp si, ax
ja 0x10045cff
movzx ecx, si
add ecx, edx
movzx eax, word [ecx + 2]
add eax, 4
cmp word [ecx], 1
jne 0x10045cf8
movzx eax, ax
mov ebx, 1
cmp eax, 0x20
ja 0x10045d4f
push eax
push ecx
push edi
call fcn.1007d410
mov eax, dword [ebp - 4]
add esp, 0xc
jmp 0x10045cbb
add esi, eax
mov eax, dword [ebp - 4]
jmp 0x10045cc0
xor edi, edi
xor esi, esi
test edi, edi
jne 0x10045d65
cmp si, ax
ja 0x10045d65
movzx ecx, si
mov ebx, 0x9901
add ecx, edx
cmp word [ecx], bx
movzx eax, word [ecx + 2]
mov ebx, dword [ebp - 0xc]
jne 0x10045d45
add eax, 4
mov edi, 1
movzx eax, ax
cmp eax, 0xb
ja 0x10045d4f
push eax
push ecx
push ebx
call fcn.1007d410
mov edx, dword [ebp - 8]
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10045d03
add eax, 4
add esi, eax
mov eax, dword [ebp - 4]
jmp 0x10045d03
push dword [ebp - 8]
xor esi, esi
call fcn.10086818
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
mov esi, 1
call fcn.10086818
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10045da0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x100c7608]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10045e1a
cmp dword [esi + 0x28], 0
jne 0x10045e1a
mov eax, dword [esi + 0x18380]
cmp eax, 0xffffffff
je 0x10045e1a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x38
lea eax, [esi + 0x1a388]
mov dword [esi + 0x18380], 0xffffffff
push 0
push eax
mov dword [esi + 0x1b418], 0
mov dword [esi + 0x1b41c], 0
mov dword [esi + 0x1fc40], 0
mov dword [esi + 0x1fc44], 0
mov dword [esi + 0x1fc48], 0
call fcn.1007cff0
add esp, 0xc
pop esi
ret
Function at 0x10045e20
Capabilities:
Get thread local storage value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a1e70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
push dword [0x100c7608]
mov ebx, 5
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10045e72
cmp dword [esi + 0x34], 0
je 0x10045e86
mov dword [esi + 0x1b418], 0
mov dword [esi + 0x1b41c], 0
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x28], 0
jne 0x10045e91
call fcn.10045da0
mov eax, dword [esi + 0x18380]
cmp eax, 0xffffffff
jne 0x10045fe1
test ebx, ebx
jle 0x10045fe1
lea eax, [esi + 0x18384]
mov dword [esi + 0x1b418], 0
push 0x104
push eax
lea ecx, [ebp - 0x28]
mov dword [esi + 0x1b41c], 0
call fcn.1004d280
mov edi, dword [ebp - 0x24]
mov eax, edi
test edi, edi
jne 0x10045edc
mov eax, dword [ebp - 0x28]
push 0
push 0x10000080
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 4], 0
test edi, edi
je 0x10045f12
push edi
call fcn.10086818
add esp, 4
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x18380], ebx
cmp ebx, 0xffffffff
jne 0x10045f30
mov ebx, dword [ebp - 0x14]
dec ebx
mov dword [ebp - 0x14], ebx
jmp 0x10045fd2
push 0
lea eax, [ebp - 0x1c]
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10045f71
mov ax, word [ebp - 0x10]
cmp al, 0x4d
jne 0x10045f71
cmp ah, 0x5a
jne 0x10045f71
mov ecx, dword [esi + 0x18380]
lea edx, [esi + 0x1fc48]
call fcn.1004ce20
mov dword [esi + 0x1fc40], eax
mov dword [esi + 0x1fc44], edx
mov eax, dword [esi + 0x1fc44]
push 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x1fc40]
push dword [esi + 0x18380]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10045f9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi + 0x1fc48]
lea edx, [esi + 0x1a388]
lea ecx, [esi + 0x18384]
call fcn.1004c860
mov eax, dword [esi + 0x1a3a0]
add esp, 4
mov ecx, dword [esi + 0x1a3a4]
mov ebx, dword [ebp - 0x14]
mov dword [esi + 0x1b418], eax
mov dword [esi + 0x1b41c], ecx
mov eax, dword [esi + 0x18380]
cmp eax, 0xffffffff
je 0x10045ea0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10046000
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
push dword [0x100c7608]
mov dword [ebp - 8], edx
mov ebx, ecx
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
xor eax, eax
test edi, edi
je 0x10046195
push esi
lea esi, [edi + 0x1a404]
mov word [esi], ax
cmp ebx, dword [edi + 0x829c]
jae 0x1004618f
mov eax, dword [edi + 0x8298]
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x1004618f
movzx edx, word [edi + 0x8244]
add eax, 0x2e
cmp edx, 0x7ff
jae 0x10046186
mov ecx, 0x800
test word [edi + 0x8230], cx
mov ecx, 0xfde9
jne 0x1004607f
movzx ecx, word [edi]
push 0x7ff
push esi
push edx
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
mov word [esi + eax*2], cx
mov ecx, esi
mov edx, dword [edi + 0x824e]
shr edx, 4
and edx, 1
call fcn.10044d40
cmp word [esi], 0
jne 0x100460b8
mov dword [ebp - 4], 0
jmp 0x100460e6
test byte [edi + 0x824e], 0x10
je 0x100460e6
mov ecx, esi
call fcn.10050770
test eax, eax
jne 0x100460e6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x7ff
jge 0x100460e6
push 0x100b0dec
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [ebp - 8], 0
je 0x1004617c
mov eax, dword [edi + 0x82a4]
test eax, eax
je 0x1004617c
cmp dword [eax + 0x28], 0
je 0x1004617c
lea edi, [eax + 0x24]
mov dword [ebp - 8], ebx
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10062120
mov edx, dword [ebp - 0xc]
cmp byte [edx + 0xd], 0
jne 0x1004617c
cmp ebx, dword [edx + 0x10]
jl 0x1004617c
cmp edx, dword [edi]
je 0x1004617c
add edx, 0x14
cmp dword [edx + 0x14], 7
jbe 0x10046136
mov edx, dword [edx]
mov ecx, 0x800
sub edx, esi
lea ecx, [ecx]
lea eax, [ecx + 0x7ffff7fe]
test eax, eax
je 0x10046177
movzx eax, word [edx + esi]
test ax, ax
je 0x10046170
mov word [esi], ax
add esi, 2
sub ecx, 1
jne 0x10046140
sub esi, 2
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x10046177
sub esi, 2
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10046750
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push dword [0x100c7608]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x10046777
mov dword [edi + 0x18], eax
mov dword [edi + 0x8c], eax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret
lea ecx, [esi + 0x90]
mov dword [esi + 0x60f8], 0
call fcn.1004b630
mov ebx, eax
test ebx, ebx
je 0x100467cb
mov ecx, dword [edi + 0x14]
mov edx, 2
shr ecx, 1
and ecx, 1
push ecx
lea ecx, [edx + 0x64]
call fcn.1004f5b0
mov edx, eax
mov ecx, ebx
call fcn.10044c90
add esp, 4
mov dword [edi + 0x18], 0
mov dword [edi + 0x8c], 0
mov eax, ebx
pop edi
pop esi
pop ebx
ret
xor ecx, ecx
call fcn.1004b840
mov dword [esi + 0x60f4], eax
mov dword [esi + 0x60e8], 0
mov dword [esi + 0x60ec], 0
test eax, eax
je 0x10046829
mov eax, dword [edi + 0x14]
mov edx, 2
shr eax, 1
and eax, 1
mov dword [edi + 0x18], 0
push eax
lea ecx, [edx + 0x65]
mov dword [edi + 0x8c], 0
call fcn.1004f5b0
mov ecx, dword [esi + 0x60f4]
mov edx, eax
call fcn.10044c90
add esp, 4
jmp 0x1004683e
mov eax, dword [esi + 0x81f2]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x82a8]
mov dword [edi + 0x8c], eax
mov eax, dword [esi + 0x18368]
mov dword [esi + 0x60ec], 0
mov dword [esi + 0x60e8], 0
test eax, eax
je 0x1004686f
push eax
call fcn.10086818
add esp, 4
mov dword [esi + 0x18368], 0
mov eax, dword [esi + 0x1a3f8]
test eax, eax
je 0x1004688c
push eax
call fcn.10086818
add esp, 4
mov dword [esi + 0x1a3f8], 0
mov eax, dword [esi + 0x60f4]
pop edi
pop esi
pop ebx
ret

Function at 0x100468a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.1009d950
push ebx
push esi
push edi
push dword [0x100c7608]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x100468d1
mov dword [esi + 0x18], eax
mov eax, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 8]
mov dword [eax + 0x1f558], ecx
add eax, 0x90
je 0x10046980
cmp word [eax], 0
je 0x10046980
test ecx, ecx
je 0x10046980
mov ecx, esi
call fcn.10046750
test eax, eax
jne 0x100469aa
cmp dword [esi + 0x18], eax
jne 0x10046912
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1048]
mov ecx, esi
xor ebx, ebx
mov dword [esi + 0x88], eax
call fcn.100478f0
mov edi, eax
test edi, edi
jne 0x1004693e
lea ecx, [ecx]
mov ecx, esi
inc ebx
call fcn.100478f0
mov edi, eax
test edi, edi
je 0x10046930
cmp edi, 0x30
je 0x1004696a
mov ecx, esi
cmp edi, 2
jne 0x10046965
call fcn.10046750
mov edi, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x88], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10046750
mov dword [esi + 0x18], ebx
mov eax, edi
mov dword [esi + 0x88], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x14]
mov edx, 2
shr eax, 1
and eax, 1
push eax
lea ecx, [edx + 0x66]
call fcn.1004f5b0
mov edx, eax
mov ecx, 0xb
call fcn.10044c90
add esp, 4
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100478f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [0x100c7608]
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x10047917
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x1f558], 0
je 0x10047952
mov eax, dword [ebx + 0x88]
mov dword [ebp - 4], eax
test eax, eax
jne 0x1004795e
mov eax, dword [ebx + 0x14]
mov edx, 2
shr eax, 1
and eax, 1
push eax
lea ecx, [edx + 0x68]
call fcn.1004f5b0
mov edx, eax
mov ecx, 0x2f
call fcn.10044c90
add esp, 4
mov eax, 0x2f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
mov ecx, ebx
call fcn.10047630
mov dword [ebp - 8], eax
test eax, eax
jne 0x10047991
test byte [edi + 0x824e], 8
jne 0x1004795e
push ecx
push dword [ebp - 4]
mov ecx, dword [edi + 0x1f558]
push ebx
call fcn.10050b10
movzx esi, al
test al, al
je 0x10047960
mov eax, dword [ebp - 8]
neg esi
pop edi
sbb esi, esi
not esi
and eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004a040
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a1e70
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x100c7608]
mov edi, ecx
call esi
mov ebx, eax
test ebx, ebx
jne 0x1004a0a1
call fcn.10044a20
test eax, eax
je 0x1004a08b
push dword [0x100c7608]
call esi
mov ebx, eax
test ebx, ebx
jne 0x1004a0a1
pop edi
pop esi
mov eax, 4
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x8c], 0
mov dword [ebx + 0x1fc4c], 0
mov dword [ebx + 0x1fc50], 0
je 0x1004a0ec
mov eax, dword [edi + 0x14]
mov edx, 2
shr eax, 1
and eax, 1
push eax
lea ecx, [edx + 0x72]
call fcn.1004f5b0
mov edx, eax
mov ecx, 0x2d
call fcn.10044c90
add esp, 4
mov dword [ebp - 0x14], 0x2d
jmp 0x1004a10c
mov edx, edi
mov dword [ebx + 0x8c], 1
mov ecx, ebx
call fcn.10048f80
mov dword [ebp - 0x14], eax
mov dword [ebx + 0x8c], 0
mov esi, dword [ebx + 0x1fc4c]
test esi, esi
je 0x1004a1c5
lea ebx, [ebx]
mov eax, dword [esi]
lea ecx, [ebp - 0x24]
push 0x104
push dword [esi + 4]
mov dword [ebp - 0x18], eax
call fcn.1004d280
mov edi, dword [ebp - 0x20]
mov eax, edi
test edi, edi
jne 0x1004a141
mov eax, dword [ebp - 0x24]
push 0
push 0x2000000
push 3
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
test edi, edi
je 0x1004a17d
push edi
call fcn.10086818
mov ecx, dword [ebp - 0x10]
add esp, 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xffffffff
je 0x1004a1a3
lea eax, [esi + 0x10]
push eax
push 0
lea eax, [esi + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.10086818
mov eax, dword [ebp - 0x18]
add esp, 4
mov esi, eax
test eax, eax
jne 0x1004a120
mov dword [ebx + 0x1fc4c], eax
mov dword [ebx + 0x1fc50], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1004a1e0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x100c7608]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1004a1fc
mov dword [eax + 0x28], 0
jmp fcn.10045da0
ret
Function at 0x1004b630
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push dword [0x100c7608]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x1004b832
cmp dword [ebx + 0x88], 0
jne 0x1004b7e7
xor eax, eax
mov dword [ebx + 0x1a400], 0
mov word [ebx + 0x6124], ax
lea eax, [ebx + 0x18384]
push esi
push eax
mov dword [ebx + 0x6108], 0
mov dword [ebx + 0x6100], 0
mov dword [ebx + 0x60d8], 0
mov dword [ebx + 0x60dc], 0
mov dword [ebx + 0x6118], 0
mov dword [ebx + 0x611c], 0
mov dword [ebx + 0x6120], 0
mov dword [ebx + 0x18370], 0
mov dword [ebx + 0x18374], 0
mov dword [ebx + 0x18378], 0
mov byte [ebx + 0x1837c], 0
mov dword [ebx + 0x1b404], 0
mov dword [ebx + 0x1b408], 0
mov dword [ebx + 0x1b410], 0
mov dword [ebx + 0x60f0], 0
mov dword [ebx + 0x60f4], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
call fcn.10045e20
cmp eax, 0xffffffff
jne 0x1004b72f
cmp dword [ebx + 0x34], 0
jne 0x1004b73e
mov eax, 9
pop edi
pop esi
pop ebx
ret
cmp dword [ebx + 0x34], 0
jne 0x1004b73e
cmp dword [ebx + 0x82a8], 0
je 0x1004b751
lea esi, [ebx + 0x1a388]
mov ecx, 0xe
lea edi, [ebx + 0x1a3c0]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x18384]
push eax
lea esi, [ebx + 0x19384]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1004b7a1
mov eax, dword [ebx + 0x1a3a0]
cmp eax, dword [ebx + 0x1a3d8]
jne 0x1004b7a1
mov eax, dword [ebx + 0x1a3a4]
cmp eax, dword [ebx + 0x1a3dc]
jne 0x1004b7a1
mov eax, dword [ebx + 0x1a3b0]
cmp eax, dword [ebx + 0x1a3e8]
jne 0x1004b7a1
mov eax, dword [ebx + 0x1a3b4]
cmp eax, dword [ebx + 0x1a3ec]
je 0x1004b7e7
mov ecx, ebx
mov dword [ebx + 0x81bc], 0
call fcn.100471a0
xor eax, eax
mov dword [ebx + 0x8224], 0
push 0x38
push eax
mov word [esi], ax
lea eax, [ebx + 0x1a3c0]
push eax
mov dword [ebx + 0x60e8], 0
mov dword [ebx + 0x60ec], 0
call fcn.1007cff0
add esp, 0xc
mov eax, dword [ebx + 0x80]
add eax, 4
push eax
call fcn.1008680d
mov dword [ebx + 0x18368], eax
add esp, 4
mov eax, dword [ebx + 0x84]
inc eax
push eax
call fcn.1008680d
add esp, 4
mov dword [ebx + 0x1a3f8], eax
cmp dword [ebx + 0x18368], 0
mov dword [ebx + 0x1a400], eax
je 0x1004b832
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
mov eax, 4
pop ebx
ret
Function at 0x1004be00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2028
call fcn.1009d950
push ebx
push esi
push edi
push dword [0x100c7608]
mov edi, edx
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x1004be34
mov eax, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
lea ecx, [edx + 0xd]
call fcn.1004f5b0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push eax
lea eax, [ebp - 0x101c]
push eax
call esi
mov ebx, dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x2024], ax
mov word [ebp - 0x1024], ax
mov word [ebp - 0x1c], ax
mov eax, dword [ebp - 8]
jmp dword [eax*4 + 0x1004c1d8]
Function at 0x1004cc70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x8252]
cmp edi, 0xffffffff
je 0x1004cc8a
xor ebx, ebx
jmp 0x1004cccf
movzx eax, word [esi + 0x8258]
add eax, 0xfffffff8
cmp eax, 0x14
ja case.0x1004cca0.9
movzx eax, byte [eax + 0x1004ce08]
jmp dword [eax*4 + 0x1004cdf8]
mov edi, dword [esi + 0x825a]
mov ebx, dword [esi + 0x825e]
jmp 0x1004cccf
mov edi, dword [esi + 0x8262]
mov ebx, dword [esi + 0x8266]
jmp 0x1004cccf
mov edi, dword [esi + 0x826a]
mov ebx, dword [esi + 0x826e]
mov ecx, edi
mov eax, ebx
add ecx, dword [esi + 0x1fc40]
push 0
adc eax, dword [esi + 0x1fc44]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ecx
push dword [esi + 0x18380]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x1004cd07
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1004cd28
mov eax, dword [ebp - 4]
xor ecx, ecx
sub ecx, dword [esi + 0x1fc40]
cdq
mov edx, dword [esi + 0x1fc44]
sbb eax, edx
add ecx, dword [ebp - 8]
adc eax, 0
and ecx, eax
cmp ecx, 0xffffffff
jne 0x1004cd31
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x1fc40]
test edx, edx
jne 0x1004cd43
test eax, eax
je 0x1004cdec
cmp ebx, edx
jb 0x1004cdec
ja 0x1004cd55
cmp edi, eax
jb 0x1004cdec
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x18380]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1004cd9f
cmp dword [ebp - 8], 4
jne 0x1004cd9f
cmp dword [ebp - 0xc], 0x4034b50
jne 0x1004cd9f
push 0xffffffffffffffff
push 0xfffffffffffffffc
mov edx, 1
mov ecx, esi
call fcn.100506d0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push edi
push dword [esi + 0x18380]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1004cdca
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1004cd28
mov eax, dword [ebp - 4]
xor ecx, ecx
sub ecx, dword [esi + 0x1fc40]
cdq
sbb eax, dword [esi + 0x1fc44]
add ecx, edi
adc eax, 0
and ecx, eax
cmp ecx, 0xffffffff
je 0x1004cd28
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret