joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479580
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4c5628
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov eax, dword [0x500ee4]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x3c], 0
cmp eax, 0xffffffff
je 0x4795c7
push eax
call esi
mov ebx, eax
test ebx, ebx
jne 0x4795df
call fcn.0047a2b0
mov eax, dword [0x500ee4]
cmp eax, 0xffffffff
jne 0x4795da
xor ebx, ebx
jmp 0x4795df
push eax
call esi
mov ebx, eax
mov esi, dword [esp + 0x4c]
mov edx, 1
mov edi, dword [esp + 0x48]
test esi, esi
je 0x4795f9
lea eax, [esi + 4]
mov ecx, edx
lock xadd dword [eax], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], esi
test esi, esi
je 0x47960d
lea eax, [esi + 4]
lock xadd dword [eax], edx
inc edx
mov eax, dword [esp + 0x50]
or edi, 0xffffffff
mov dword [esp + 0x20], eax
test esi, esi
je 0x479640
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x479640
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x479640
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004774b0
add esp, 0xc
push eax
lea ecx, [ebx + 0x14]
mov byte [esp + 0x40], 2
call fcn.004768f0
push eax
add eax, 0x10
lea ecx, [ebx + 0x14]
push eax
push 0
lea eax, [esp + 0x1c]
push eax
call fcn.00476c90
mov esi, dword [esp + 0x2c]
mov byte [esp + 0x3c], 1
test esi, esi
je 0x4796aa
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x4796aa
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x4796aa
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov esi, dword [esp + 0x1c]
mov byte [esp + 0x3c], 0
test esi, esi
je 0x4796db
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x4796db
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x4796db
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x3c], 0xffffffff
test esi, esi
je 0x47970e
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x47970e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x47970e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x479ff0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x500ee4]
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 0xffffffff
je 0x47a00b
push eax
call esi
test eax, eax
jne 0x47a021
call fcn.0047a2b0
mov eax, dword [0x500ee4]
cmp eax, 0xffffffff
jne 0x47a01e
xor eax, eax
jmp 0x47a021
push eax
call esi
lea esi, [eax + 0x14]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
lea eax, [esp + 8]
push eax
call fcn.00479280
push dword [esp + 8]
lea eax, [esp + 8]
mov ecx, esi
push dword [esp + 8]
push eax
call fcn.00479cc0
pop esi
add esp, 8
ret

Function at 0x47a2b0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c56f0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.00477330
mov esi, eax
mov dword [ebp - 4], 0
push 0x479c90
push 0x50858c
mov dword [ebp - 0x14], esi
call fcn.00479730
mov eax, dword [0x500ee4]
add esp, 8
cmp eax, 0xffffffff
je 0x47a310
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47a6a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x47a970
push 0xffffffffffffffff
push 0x4c57c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x500ee4]
cmp eax, 0xffffffff
jne 0x47a9a9
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x47a9b6
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x47aa1d
jmp 0x47a9ec
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x18], 0
mov edi, dword [ebp + 0xc]
jne 0x47aa5a
test edi, edi
jne 0x47aa60
push 0x479c90
push 0x50858c
call fcn.00479730
mov eax, dword [0x500ee4]
add esp, 8
cmp eax, 0xffffffff
je 0x47aa1d
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x47aa46
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x47aa46
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x47aa98
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x47aa89
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x47aa60
mov ebx, dword [ebp + 0x14]
lea eax, [ebp + 0x14]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x47a9e0
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x47aaf7
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x47aadc
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x47aaf7
jmp 0x47aad0
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x47aad0
jmp 0x47aaf7
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x47aaf5
cmp esi, dword [eax + 8]
jne 0x47aaf5
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x47aae5
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x47ab0b
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x47ab0b
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.00479d80
cmp esi, ebx
jne 0x47aab0
mov ebp, dword [esp + 0x14]
jmp 0x47a9e0
Function at 0x47a970
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x47a970
push 0xffffffffffffffff
push 0x4c57c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x500ee4]
cmp eax, 0xffffffff
jne 0x47a9a9
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x47a9b6
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x47aa1d
jmp 0x47a9ec
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x18], 0
mov edi, dword [ebp + 0xc]
jne 0x47aa5a
test edi, edi
jne 0x47aa60
push 0x479c90
push 0x50858c
call fcn.00479730
mov eax, dword [0x500ee4]
add esp, 8
cmp eax, 0xffffffff
je 0x47aa1d
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x47aa46
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x47aa46
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x47aa98
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x47aa89
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x47aa60
mov ebx, dword [ebp + 0x14]
lea eax, [ebp + 0x14]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x47a9e0
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x47aaf7
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x47aadc
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x47aaf7
jmp 0x47aad0
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x47aad0
jmp 0x47aaf7
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x47aaf5
cmp esi, dword [eax + 8]
jne 0x47aaf5
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x47aae5
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x47ab0b
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x47ab0b
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.00479d80
cmp esi, ebx
jne 0x47aab0
mov ebp, dword [esp + 0x14]
jmp 0x47a9e0
Function at 0x47ab30
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4c57f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [0x500ee4]
mov edi, dword [esp + 0x24]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edi
cmp eax, 0xffffffff
je 0x47abe1
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47abe1
lea esi, [eax + 0x14]
lea eax, [esp + 0x24]
mov ecx, esi
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0047a050
mov eax, dword [esp + 0x10]
cmp eax, dword [esi]
je 0x47abe1
lea esi, [eax + 0x14]
test esi, esi
je 0x47abe1
cmp byte [esp + 0x34], 0
je 0x47abb6
mov ecx, dword [esi]
test ecx, ecx
je 0x47abb6
mov edx, dword [esi + 8]
test edx, edx
je 0x47abb6
mov eax, dword [ecx]
push edx
call dword [eax + 4]
cmp dword [esp + 0x28], 0
mov ebx, dword [esp + 0x30]
jne 0x47abd0
test ebx, ebx
jne 0x47abd0
push edi
call fcn.00479ff0
add esp, 4
jmp 0x47ac19
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.00478cf0
mov dword [esi + 8], ebx
jmp 0x47ac19
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
test ecx, ecx
jne 0x47abf1
test eax, eax
je 0x47ac19
push eax
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x38]
mov dword [eax + 4], ecx
test ecx, ecx
je 0x47ac10
lea eax, [ecx + 4]
mov ecx, 1
lock xadd dword [eax], ecx
push edi
call fcn.00479580
add esp, 0x10
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0xffffffff
test esi, esi
je 0x47ac4f
or edi, 0xffffffff
lea ecx, [esi + 4]
mov eax, edi
lock xadd dword [ecx], eax
jne 0x47ac4f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x47ac4f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x47e2b0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4c5da8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5012c0]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
push eax
push edx
lea eax, [esp + 0x14]
push eax
call fcn.0047bf10
add esp, 0xc
push eax
push esi
lea ecx, [edi + 0x18]
mov dword [esp + 0x50], 0
call fcn.0047d1c0
mov ecx, eax
call fcn.0047d140
cmp dword [esp + 0x38], 0x10
jb 0x47e329
push dword [esp + 0x24]
call fcn.004a08c8
add esp, 4
cmp dword [esp + 0x20], 0x10
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
jb 0x47e351
push dword [esp + 0xc]
call fcn.004a08c8
add esp, 4
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004a2017
add esp, 0x40
ret 0xc
Function at 0x47f880
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4c60b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
push 0xffffffffffffffff
push 0
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
push esi
mov byte [edi], 0
call fcn.0045b210
push 0xffffffffffffffff
lea ecx, [edi + 0x18]
mov dword [esp + 0x1c], 0
lea eax, [esi + 0x18]
mov dword [ecx + 0x14], 0xf
push 0
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.0045b210
movzx eax, byte [esi + 0x30]
mov byte [edi + 0x30], al
movzx eax, byte [esi + 0x31]
mov byte [edi + 0x31], al
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
movzx eax, byte [esi + 0x38]
mov byte [edi + 0x38], al
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4881d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c7258
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5012c0]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x38]
lea ecx, [esp + 0xc]
push 0xe
push str.original_token
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.0045b410
lea eax, [esp + 0xc]
mov dword [esp + 0x30], 0
push eax
lea ecx, [esi + 0x10]
call fcn.0046a300
cmp eax, edi
je 0x488250
push 0xffffffffffffffff
push 0
push edi
mov ecx, eax
call fcn.0045b210
cmp dword [esp + 0x20], 0x10
jb 0x488263
push dword [esp + 0xc]
call fcn.004a08c8
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004a2017
add esp, 0x28
ret 4
Function at 0x488480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c7309
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x5012c0]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push esi
push edi
mov eax, dword [0x5012c0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, dword [esp + 0x88]
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], esi
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov dword [esp + 0x80], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x2c], 1
mov edx, dword [eax + 0x14]
cmp edx, 0x10
jb 0x4884fd
mov ecx, dword [eax]
jmp 0x4884ff
mov ecx, eax
mov dword [esp + 0x14], ecx
cmp edx, 0x10
jb 0x48850c
mov edx, dword [eax]
jmp 0x48850e
mov edx, eax
mov ebx, dword [eax + 0x10]
add ebx, edx
cmp ecx, ebx
je 0x48859f
jmp 0x488520
lea eax, [esp + 0x34]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
push ebx
push ecx
mov ecx, dword [esp + 0xac]
lea eax, [esp + 0x34]
push eax
call dword [esp + 0xac]
cmp eax, 2
je 0x4885f2
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x34]
cmp edi, eax
je 0x4885bf
mov edx, dword [esi + 0x14]
cmp edx, 8
jb 0x488572
mov ecx, dword [esi]
jmp 0x488574
mov ecx, esi
mov eax, dword [esi + 0x10]
add eax, eax
add ecx, eax
cmp edx, 8
jb 0x488584
mov edx, dword [esi]
jmp 0x488586
mov edx, esi
add eax, edx
lea edx, [esp + 0x34]
push edi
push edx
push ecx
push eax
mov ecx, esi
call fcn.00472dd0
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
jne 0x488520
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.004a2017
add esp, 0x74
ret
lea eax, [esp + 0x10]
mov dword [esp + 0x10], str.character_conversion_failed
push eax
lea ecx, [esp + 0x24]
call fcn.004a168d
mov dword [esp + 0x20], vtable.std::logic_error.0
lea eax, [esp + 0x20]
mov dword [esp + 0x80], 2
push eax
call fcn.004886a0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], str.character_conversion_failed
push eax
lea ecx, [esp + 0x24]
call fcn.004a168d
mov dword [esp + 0x20], vtable.std::logic_error.0
lea eax, [esp + 0x20]
mov dword [esp + 0x80], 1
push eax
call fcn.004886a0
int3
Function at 0x4bc22e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5012c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004a9814
mov dword [ebp - 0x14], eax
cmp dword [0x50bac4], esi
jne 0x4bc321
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4bc2ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4bc401
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4bc401
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4bc401
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x50bac4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x50bac8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4f09cc
push edi
mov dword [0x50bacc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x50bad4], eax
test eax, eax
je 0x4bc31e
push 0x4f09e8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x50bad0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4bc346
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4bc339
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4bc35b
push 4
pop eax
jmp 0x4bc403
cmp dword [ebp - 0x14], esi
je 0x4bc35b
push dword [0x50bac4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4bc340
mov eax, dword [0x50bad0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4bc3b9
cmp dword [0x50bad4], edi
je 0x4bc3b9
push eax
call ebx
push dword [0x50bad4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4bc3b9
test eax, eax
je 0x4bc3b9
call ecx
test eax, eax
je 0x4bc3ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4bc3ae
test byte [ebp - 8], 1
jne 0x4bc3b9
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4bc3e9
mov eax, dword [0x50bac8]
cmp eax, edi
je 0x4bc3e6
push eax
call ebx
test eax, eax
je 0x4bc3e6
call eax
mov esi, eax
test esi, esi
je 0x4bc3e6
mov eax, dword [0x50bacc]
cmp eax, edi
je 0x4bc3e6
push eax
call ebx
test eax, eax
je 0x4bc3e6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x50bac4]
call ebx
test eax, eax
je 0x4bc401
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4bc403
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a2017
mov esp, ebp
pop ebp
ret
Function at 0x401290
Capabilities:
Create process on windows
Create process suspended
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [esp + 4], 0x402000
mov dword [esp], 0x4013da
call sub.USER32.dll_EnumWindows
sub esp, 8
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_GetLocalTime
sub esp, 4
mov eax, dword [ebp - 0x28]
mov word [ebp - 0xa], ax
mov eax, dword [ebp - 0x24]
mov word [ebp - 0xc], ax
mov word [ebp - 0x28], 0x7d0
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_SetLocalTime
sub esp, 4
mov dword [0x404010], 0x44
mov dword [0x404014], 0
mov dword [0x404044], 0
mov word [0x404042], 0
mov dword [0x404018], 0
mov dword [0x40403c], 0
lea eax, [ebp - 0x38]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0x404010
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.droiyan.exe
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
mov dword [ebp - 0x3c], 0
mov dword [esp], 0x64
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov dword [esp + 4], 0x402000
mov dword [esp], 0
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x4013a6
jmp 0x401375
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_GetLocalTime
sub esp, 4
movzx eax, word [ebp - 0xa]
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0xc]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_SetLocalTime
sub esp, 4
mov eax, 0
leave
ret 0x10

Function at 0x401500
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00401a60
call fcn.00401700
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x401538
jmp 0x4015d6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x401537
cmp cl, 0x22
je 0x401590
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x4015b0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x4015b0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x401570
jmp 0x4015b0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x401590
cmp cl, 0x22
je 0x401612
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x4015d0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x4015c0
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x4015f4
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.00401290
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x4015b0
Function at 0x401410
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4727e4]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.004052f0
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.00405390
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.00435a11
add esp, 0x68
ret