joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov ebx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 8], ebx
jne 0x45c690
mov esi, edx
mov edx, dword [ebp + 0x18]
mov eax, dword [ecx]
mov edi, dword [ebp + 0x14]
mov dword [esp + 0xc], ecx
cmp edx, 0x10
mov dword [esp + 4], eax
jb 0x45c5a8
mov dword [esp + 8], esi
lea ebx, [esi + 0x10]
mov esi, edx
nop word [eax + eax]
movsd xmm0, qword [edi]
movsd xmm1, qword [edi + 8]
movsd qword [esp + 0x18], xmm1
movsd qword [esp + 0x10], xmm0
movups xmm0, xmmword [ebx]
xorps xmm0, xmmword [esp + 0x10]
movups xmmword [ebx], xmm0
push dword [ebp + 8]
push ebx
push ebx
call dword [esp + 0x10]
add esp, 0xc
add esi, 0xfffffff0
add edi, 0x10
cmp esi, 0xf
ja 0x45c560
mov edx, dword [ebp + 0x18]
mov esi, dword [esp + 8]
mov ebx, dword [ebp + 0x10]
mov ecx, dword [esp + 0xc]
and edx, 0xf
test edx, edx
je 0x45c643
xor eax, eax
cmp edx, 0x1f
ja 0x45c5bf
mov ebx, edx
mov edx, dword [esp + 4]
jmp 0x45c622
mov ebx, edx
lea ecx, [esi + 0x10]
lea edx, [edi + edx]
cmp edx, ecx
mov edx, dword [esp + 4]
jbe 0x45c5d7
lea ecx, [esi + ebx + 0x10]
cmp edi, ecx
jb 0x45c622
mov eax, ebx
xor ecx, ecx
mov dword [esp + 8], ebx
and eax, 0xffffffe0
nop word cs:[eax + eax]
nop dword [eax]
movups xmm0, xmmword [edi + ecx]
movups xmm2, xmmword [esi + ecx + 0x10]
movups xmm1, xmmword [edi + ecx + 0x10]
movups xmm3, xmmword [esi + ecx + 0x20]
xorps xmm2, xmm0
xorps xmm3, xmm1
movups xmmword [esi + ecx + 0x10], xmm2
movups xmmword [esi + ecx + 0x20], xmm3
add ecx, 0x20
cmp eax, ecx
jne 0x45c5f0
mov ebx, dword [esp + 8]
cmp ebx, eax
je 0x45c62f
movzx ecx, byte [edi + eax]
xor byte [esi + eax + 0x10], cl
inc eax
cmp ebx, eax
jne 0x45c622
lea eax, [esi + 0x10]
push dword [ebp + 8]
push eax
push eax
call edx
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov ebx, dword [ebp + 0x10]
cmp dword [ecx + 0xc], 0
je 0x45c65a
lea eax, [esi + 0xf]
xor edx, edx
nop
mov byte [eax], 0
inc edx
dec eax
cmp edx, dword [ecx + 0xc]
jb 0x45c650
lea eax, [esp + 0x10]
push dword [ebp + 8]
push eax
push esi
call dword [esp + 0x10]
add esp, 0xc
movups xmm0, xmmword [esi + 0x10]
test ebx, ebx
xorps xmm0, xmmword [esp + 0x10]
movups xmmword [esi + 0x10], xmm0
je 0x45c68b
add esi, 0x10
push ebx
push esi
push dword [ebp + 0xc]
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45f650
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov ecx, dword [esp + 0x4c]
xor eax, eax
cmp ecx, 0x30
ja 0x45f797
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
test ecx, ecx
movsd xmm0, qword [eax + 0x28]
movsd qword [esp + 0x28], xmm0
movsd xmm0, qword [eax + 0x20]
movsd qword [esp + 0x20], xmm0
movsd xmm0, qword [eax + 0x18]
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0x10], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
movsd qword [esp + 8], xmm1
movsd qword [esp], xmm0
je 0x45f70c
mov eax, dword [esp + 0x48]
xor edx, edx
cmp ecx, 0x1f
jbe 0x45f700
mov edx, ecx
xor edi, edi
and edx, 0xffffffe0
nop word cs:[eax + eax]
nop dword [eax]
movups xmm0, xmmword [eax + edi]
movups xmm2, xmmword [esp + edi]
movups xmm1, xmmword [eax + edi + 0x10]
movups xmm3, xmmword [esp + edi + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm1
movups xmmword [esp + edi], xmm2
movups xmmword [esp + edi + 0x10], xmm3
add edi, 0x20
cmp edx, edi
jne 0x45f6d0
cmp edx, ecx
je 0x45f70c
nop dword [eax]
movzx ebx, byte [eax + edx]
xor byte [esp + edx], bl
inc edx
cmp ecx, edx
jne 0x45f700
movups xmm0, xmmword [esp]
movups xmm1, xmmword [esp + 0x10]
mov eax, esp
xorps xmm0, xmmword [0x525770]
xorps xmm1, xmmword [0x525780]
movups xmmword [esp], xmm0
movups xmmword [esp + 0x10], xmm1
movups xmm0, xmmword [esp + 0x20]
xorps xmm0, xmmword [0x525790]
movups xmmword [esp + 0x20], xmm0
push esi
push 0x100
push eax
call sym.fastboot.exe_AES_set_encrypt_key
add esp, 0xc
mov dword [esi + 0xf4], sym.fastboot.exe_AES_encrypt
mov dword [esi + 0xf8], 0
mov eax, 1
movsd xmm0, qword [esp + 0x20]
movsd xmm1, qword [esp + 0x28]
movsd qword [esi + 0x104], xmm1
movsd qword [esi + 0xfc], xmm0
mov dword [esi + 0x114], 0
mov dword [esi + 0x110], 1
add esp, 0x30
pop esi
pop edi
pop ebx
ret
Function at 0x45f7a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ecx, dword [esp + 0x80]
mov esi, dword [esp + 0x78]
test ecx, ecx
je 0x45f86c
xor eax, eax
cmp ecx, 0x30
ja 0x45f96e
movsd xmm0, qword [esi + 0x28]
mov eax, dword [esp + 0x7c]
xor edx, edx
cmp ecx, 0x20
movsd qword [esp + 0x28], xmm0
movsd xmm0, qword [esi + 0x20]
movsd qword [esp + 0x20], xmm0
movsd xmm0, qword [esi + 0x18]
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [esi + 0x10]
movsd qword [esp + 0x10], xmm0
movsd xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
movsd qword [esp + 8], xmm1
movsd qword [esp], xmm0
jb 0x45f850
mov edx, ecx
xor esi, esi
and edx, 0xffffffe0
nop word [eax + eax]
movups xmm0, xmmword [eax + esi]
movups xmm2, xmmword [esp + esi]
movups xmm1, xmmword [eax + esi + 0x10]
movups xmm3, xmmword [esp + esi + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm1
movups xmmword [esp + esi], xmm2
movups xmmword [esp + esi + 0x10], xmm3
add esi, 0x20
cmp edx, esi
jne 0x45f820
cmp edx, ecx
jne 0x45f850
mov esi, esp
jmp 0x45f86c
mov esi, esp
nop word cs:[eax + eax]
nop dword [eax]
movzx ebx, byte [eax + edx]
xor byte [esp + edx], bl
inc edx
cmp ecx, edx
jne 0x45f860
mov edi, dword [esp + 0x74]
lea ebx, [esp + 0x30]
mov eax, dword [edi + 0x108]
lea ebp, [edi + 0xfc]
bswap eax
inc eax
bswap eax
mov dword [edi + 0x108], eax
push edi
push ebx
push ebp
call dword [edi + 0xf4]
add esp, 0xc
mov eax, dword [edi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [edi + 0x108], eax
lea eax, [esp + 0x40]
push edi
push eax
push ebp
call dword [edi + 0xf4]
add esp, 0xc
mov eax, dword [edi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [edi + 0x108], eax
lea eax, [esp + 0x50]
sub esp, 0xc
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebp
call dword [edi + 0xf4]
add esp, 0xc
movups xmm0, xmmword [esi]
movups xmm1, xmmword [esp + 0x30]
xorps xmm1, xmm0
movups xmm0, xmmword [esp + 0x40]
movups xmmword [esp + 0x30], xmm1
movups xmm1, xmmword [esi + 0x10]
xorps xmm1, xmm0
movups xmmword [esp + 0x40], xmm1
movups xmm0, xmmword [esi + 0x20]
movups xmm1, xmmword [esp + 0x50]
xorps xmm1, xmm0
movups xmmword [esp + 0x50], xmm1
push edi
push 0x100
push ebx
call sym.fastboot.exe_AES_set_encrypt_key
add esp, 0xc
mov dword [edi + 0xf4], sym.fastboot.exe_AES_encrypt
mov dword [edi + 0xf8], 0
mov eax, 1
movsd xmm0, qword [esp + 0x50]
movsd xmm1, qword [esp + 0x58]
movsd qword [edi + 0x104], xmm1
movsd qword [edi + 0xfc], xmm0
mov dword [edi + 0x114], 0
mov dword [edi + 0x110], 1
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45f980
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebp, dword [esp + 0x44]
xor eax, eax
cmp ebp, 0x30
ja 0x45fa9e
mov eax, dword [ecx + 0x108]
mov edi, edx
mov esi, ecx
lea ebx, [ecx + 0xfc]
bswap eax
inc eax
bswap eax
mov dword [ecx + 0x108], eax
mov eax, esp
push ecx
push eax
push ebx
call dword [ecx + 0xf4]
add esp, 0xc
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esp + 0x10]
push esi
push eax
push ebx
call dword [esi + 0xf4]
add esp, 0xc
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esp + 0x20]
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [esi + 0xf4]
add esp, 0xc
test ebp, ebp
je 0x45fa5c
xor eax, eax
cmp ebp, 0x1f
jbe 0x45fa50
mov eax, ebp
xor ecx, ecx
and eax, 0xffffffe0
nop
movups xmm0, xmmword [edi + ecx]
movups xmm2, xmmword [esp + ecx]
movups xmm1, xmmword [edi + ecx + 0x10]
movups xmm3, xmmword [esp + ecx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm1
movups xmmword [esp + ecx], xmm2
movups xmmword [esp + ecx + 0x10], xmm3
add ecx, 0x20
cmp eax, ecx
jne 0x45fa20
cmp eax, ebp
je 0x45fa5c
nop dword [eax]
movzx ecx, byte [edi + eax]
xor byte [esp + eax], cl
inc eax
cmp ebp, eax
jne 0x45fa50
push esi
push 0x100
lea eax, [esp + 8]
push eax
call sym.fastboot.exe_AES_set_encrypt_key
add esp, 0xc
mov dword [esi + 0xf4], sym.fastboot.exe_AES_encrypt
mov dword [esi + 0xf8], 0
lea eax, [esp + 0x20]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov eax, 1
movsd qword [ebx], xmm0
movsd qword [ebx + 8], xmm1
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x476a60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x476b33
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
xor edi, edi
cmp ecx, 7
mov eax, 0
jbe 0x476b20
movdqa xmm2, xmmword [0x52c770]
mov edi, ecx
pxor xmm0, xmm0
xor eax, eax
pxor xmm1, xmm1
and edi, 0xfffffff8
nop
movd xmm3, dword [esi + eax]
movd xmm4, dword [esi + eax + 4]
movd xmm5, dword [edx + eax]
movd xmm6, dword [edx + eax + 4]
add eax, 8
cmp edi, eax
punpcklbw xmm3, xmm0
punpcklbw xmm4, xmm0
punpcklbw xmm5, xmm0
punpcklbw xmm6, xmm0
punpcklwd xmm3, xmm0
punpcklwd xmm5, xmm0
punpcklwd xmm4, xmm0
punpcklwd xmm6, xmm0
pxor xmm5, xmm3
pxor xmm6, xmm4
pand xmm5, xmm2
pand xmm6, xmm2
por xmm0, xmm5
por xmm1, xmm6
jne 0x476aa0
por xmm1, xmm0
cmp edi, ecx
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd eax, xmm1
je 0x476b35
nop word cs:[eax + eax]
nop dword [eax]
movzx ebx, byte [edx + edi]
xor bl, byte [esi + edi]
inc edi
movzx ebx, bl
or eax, ebx
cmp ecx, edi
jne 0x476b20
jmp 0x476b35
xor eax, eax
pop esi
pop edi
pop ebx
ret

Function at 0x476b40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x476b71
mov edx, dword [esp + 8]
mov eax, 0x811c9dc5
nop word cs:[eax + eax]
nop dword [eax]
movzx esi, byte [edx]
inc edx
xor esi, eax
imul eax, esi, 0x1000193
dec ecx
jne 0x476b60
pop esi
ret
mov eax, 0x811c9dc5
pop esi
ret

Function at 0x478460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x18]
test edi, edi
je 0x47850b
cmp dword [edi + 4], 0
je 0x47850b
push 0
call sym.fastboot.exe_CRYPTO_get_thread_local
add esp, 4
mov esi, eax
test eax, eax
je 0x478517
cmp dword [edi + 4], 0
je 0x478554
xor ebx, ebx
xor ebp, ebp
mov dword [esp], edi
mov edi, dword [edi]
push dword [esi + ebx + 4]
call sym.fastboot.exe_OPENSSL_free
add esp, 4
mov dword [esi + ebx + 4], 0
mov dword [esi + ebx], 0
mov dword [esi + ebx + 0xc], 0
mov dword [esi + ebx + 8], 0
mov eax, dword [edi + ebx]
mov dword [esi + ebx], eax
mov eax, dword [edi + ebx + 4]
test eax, eax
je 0x4784e8
push eax
call sym.fastboot.exe_OPENSSL_strdup
add esp, 4
mov dword [esi + ebx + 4], eax
mov eax, dword [edi + ebx + 8]
inc ebp
mov dword [esi + ebx + 8], eax
movzx eax, word [edi + ebx + 0xc]
mov edi, dword [esp]
mov word [esi + ebx + 0xc], ax
add ebx, 0x10
mov eax, dword [edi + 4]
cmp ebp, eax
jb 0x4784a0
dec eax
jmp 0x478559
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp sym.fastboot.exe_ERR_clear_error
push 0x10c
call sym.fastboot.exe_OPENSSL_malloc
add esp, 4
test eax, eax
je 0x478569
mov esi, eax
push 0x10c
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x478580
push esi
push 0
call sym.fastboot.exe_CRYPTO_set_thread_local
add esp, 0xc
test eax, eax
jne 0x47848f
jmp 0x478569
mov eax, 0xffffffff
mov dword [esi + 0x100], eax
mov dword [esi + 0x104], 0xf
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b5673
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
jne 0x4b5686
jmp 0x4b57ba
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004b4e9c
cmp eax, 1
jne 0x4b57b2
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea edx, [ebp - 0x4f]
mov ebx, 0x43
mov eax, 0
mov ecx, edx
and ecx, 1
test ecx, ecx
je 0x4b56fe
mov byte [edx], al
add edx, 1
sub ebx, 1
mov ecx, edx
and ecx, 2
test ecx, ecx
je 0x4b5710
mov word [edx], ax
add edx, 2
sub ebx, 2
mov ecx, ebx
shr ecx, 2
mov edi, edx
rep stosd dword es:[edi], eax
mov edx, edi
mov ecx, ebx
and ecx, 2
test ecx, ecx
je 0x4b572a
mov word [edx], ax
add edx, 2
and ebx, 1
mov ecx, ebx
test ecx, ecx
je 0x4b5738
mov byte [edx], al
add edx, 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x4b5768
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x4b577f
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x4b5764
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x4b579d
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.msvcrt.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x4b6746
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x4b65bb
mov dword [esp], 0x540628
call fcn.004b5d0d
mov eax, dword [0x519388]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4b678d
mov eax, dword [ebp - 0x20]
jmp 0x4b68d8
call fcn.004b557c
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x4b67a4
cmp dword [ebp - 0x20], 0
jne 0x4b67ae
mov eax, 0
jmp 0x4b68d8
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004b5673
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x4b6880
call sub.msvcrt.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x519388]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x4b68d5
call sub.msvcrt.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4b699c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.004b6746
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.004b65de
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x4b69f5
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_longjmp
mov eax, dword [0x519388]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4b6b1f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x4b6a87
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4b6a44
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004b5490
mov dword [ebp - 0x10], 0
mov eax, dword [0x519388]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x4b6b1f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4b6ab7
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x4b6b1f
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004b5490
mov dword [ebp - 0x10], 0
mov eax, dword [0x519388]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__endthreadex]
call eax
Function at 0x4b9b30
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004d11e0
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004d11e0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4b9b90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x5409e0]
test eax, eax
jle 0x4b9ca0
mov edx, dword [0x5409e4]
xor ebx, ebx
mov ecx, dword [edx + 0xc]
cmp ecx, esi
ja 0x4b9bc1
mov edi, dword [edx + 0x10]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x4b9c3a
add ebx, 1
add edx, 0x14
cmp ebx, eax
jne 0x4b9bb0
mov dword [esp], esi
call fcn.004ba440
test eax, eax
mov edi, eax
je 0x4b9cc7
lea esi, [ebx + ebx*4]
mov ebx, dword [0x5409e4]
shl esi, 2
add ebx, esi
mov dword [ebx + 0x10], eax
mov dword [ebx], 0
call fcn.004ba530
add eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x5409e4]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4b9ca7
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x4b9c42
add dword [0x5409e0], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x4b9c33
cmp eax, 0x80
je 0x4b9c33
cmp eax, 8
je 0x4b9c33
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
add esi, dword [0x5409e4]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4b9c33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004b9b30
nop
lea esi, [esi]
xor ebx, ebx
jmp 0x4b9bcb
mov eax, dword [0x5409e4]
mov eax, dword [eax + esi + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004b9b30
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004b9b30
mov esi, esi
lea edi, [edi]

Function at 0x4ba360
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4ba398
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x4ba38e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x4ba39a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4ba380
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4bc6a0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], 1
mov dword [esp + 8], ebx
pop ebx
jmp fcn.004bc070