joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025f1a
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10025f47
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x2897
push 0x478d
push 1
push dword [ebp - 4]
call fcn.10025f82
add esp, 0x10
jmp 0x10025f7e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10025f69
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x10025f7e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0xfffffffc
mov esp, ebp
pop ebp
ret

Function at 0x1002ed5d
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002edbe
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002eda0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x1002edbc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1002edbc
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x1002edea
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push 1
push 0x770c
push 0x3305
push 0x4597
push 0x6f9a
push 0x3efb
call fcn.1002eb37
add esp, 0x1c
mov esp, ebp
pop ebp
ret

Function at 0x100304ab
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10030510
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100304e2
push 0xdd
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x1003050e
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x18]
push dword [eax]
mov eax, dword [ebp - 0x1c]
push dword [eax]
call fcn.10033c9d
add esp, 0xc
jmp 0x10030541
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10030530
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x10030541
push 0x25f6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esp, ebp
pop ebp
ret
Function at 0x1003055f
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100305e6
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1003058f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x100305e4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100305b1
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jg 0x100305e4
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100305e2
push 0x19bc
push 0
push 0x581c
push 0
push 1
push 0x2673
call fcn.1002dc98
add esp, 0x18
jmp 0x100305a6
jmp 0x10030621
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push 0x3db8
push 0x156e
push 0
push 0x77be
push 0x51c8
push dword [ebp - 0x18]
push 0x667e
push 0x5ef3
push 0x2c6c
push 0x55fe
call fcn.10027aeb
add esp, 0x28
mov esp, ebp
pop ebp
ret

Function at 0x1003074b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10030783
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10030777
push 0x23e5
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10030781
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1003079b
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x2ec0
push 1
call fcn.1002d8f4
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10030ea1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10030f06
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10030edd
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10030edb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x10030f04
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10030f04
push 0x25f6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x10030f30
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0
push dword [ebp - 0x20]
push 0x72fc
call fcn.1002d753
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x10033b50
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10033b7c
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp - 8]
push 1
call fcn.10033be4
add esp, 0xc
jmp 0x10033be0
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10033bd6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10033bd4
push 0x5f24
push 0x45b0
push 0x7a5d
push 1
push 0x20c
push 0x4f37
push 0x1593
push 1
push 0
call fcn.10037d64
add esp, 0x24
jmp 0x10033be0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret

Function at 0x10035a67
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10035aa6
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push 0x3470
push 0x7970
push dword [ebp - 8]
push dword [ebp - 0xc]
push 1
push dword [ebp - 0x10]
call fcn.10035b1d
add esp, 0x18
jmp 0x10035b19
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10035b0f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10035af0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10035b0d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.1002185c
mov dword [eax], 0xca631852
jmp 0x10035ae5
jmp 0x10035b19
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret
Function at 0x10037be7
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10037c59
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10037c37
mov byte [ebp - 1], 0
push 0x73c1
push 0x3429
push 1
push 0x3f27
push 0
push 0x1f24
lea eax, [ebp - 1]
push eax
push 1
call fcn.100376ec
add esp, 0x20
jmp 0x10037c57
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10037c57
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x10037c75
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0
call fcn.1003c671
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10037c93
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10037d14
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10037cf6
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10037cf4
push 0x1f8e
push 0xe06
push 1
push 1
push 0x202b
push 0x785e
push 0xb93
push 0xda6
push 1
push 0x7ee1
call fcn.10032805
add esp, 0x28
jmp 0x10037d12
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10037d12
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x10037d36
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
push 0
push 0x3f7a
push dword [ebp - 0x18]
push 0x6f04
push 0x2ba9
call fcn.1002df5f
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1003f4cb
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003f54a
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003f524
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003f522
push 0x4c3f
push 0
push 0x6e44
push 1
push 0x6d9f
push 0x3745
push 0x3664
push 0
call fcn.1003f4cb
add esp, 0x20
jmp 0x1003f545
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1003f545
push 0
push 1
call fcn.1003f433
pop ecx
pop ecx
jmp 0x1003f5e4
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1003f5da
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
push 1
mov ecx, dword [ebp - 0x48]
call fcn.1002185c
mov ecx, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jle 0x1003f5cc
mov dword [ebp - 0xc], 1
jmp 0x1003f5d0
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
jmp 0x1003f5e4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret
Function at 0x10042e1a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10042e93
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10042e6d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10042e6b
push 0x25f6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x10042e91
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push 2
mov ecx, dword [ebp - 0x20]
call fcn.1002185c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x10042eb9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push 0x5fe6
push 0x195a
push dword [ebp - 0x28]
push 1
call fcn.100426ef
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x10044e33
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10044e5b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push 0x5201
push dword [ebp - 8]
push 0
call fcn.10047d6d
add esp, 0xc
jmp 0x10044ece
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10044ec4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10044ea5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x10044ec2
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.1002185c
mov dword [eax], 0x3dfad5be
jmp 0x10044e9a
jmp 0x10044ece
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret
Function at 0x10047ea9
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10047f6f
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10047f4a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
push dword [eax]
mov eax, dword [ebp - 0x38]
push dword [eax]
lea eax, [ebp - 0x70]
push eax
call fcn.100436ff
add esp, 0x10
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
call fcn.1004caae
lea ecx, [ebp - 0x70]
call fcn.1002167a
jmp 0x10047f6a
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x10047f6a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x10048002
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x10047ff0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10047fa7
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x14
je 0x10047fee
mov dword [ebp - 4], 5
cmp dword [ebp - 4], 0
je 0x10047fbe
jmp 0x10047fee
mov dword [ebp - 4], 0
jmp 0x10047fce
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jg 0x10047fec
push 0x745f
push 0x4e1c
push 1
push 1
call fcn.10043b98
add esp, 0x10
jmp 0x10047fc7
jmp 0x10047f9c
jmp 0x10048002
push 0x14c
push 0x16d7
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
mov esp, ebp
pop ebp
ret
Function at 0x10048797
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10048857
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1004882f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0xffffffe3
jmp 0x100487f9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x13
je 0x1004882d
push 0x6b20
push 0x75f5
push 1
push 0x71f0
push 0x4d16
push 1
push 0x1306
push dword [ebp - 0x1c]
push 1
call fcn.10046ddc
add esp, 0x24
jmp 0x100487ee
jmp 0x10048855
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10048855
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x100488b2
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 1
push dword [ebp - 0x4c]
call fcn.100437d0
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x10048f5c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10048fe9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10048fa5
mov byte [ebp - 1], 0
push 0x4eda
push 1
push 0x768d
push 1
lea eax, [ebp - 1]
push eax
push 0xe28
call fcn.10047d8f
add esp, 0x18
jmp 0x10048fe7
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffee
jmp 0x10048fc7
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x17
jge 0x10048fe7
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x10048fe5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x10048fbc
jmp 0x10049001
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
push 0x762e
push 0
push dword [ebp - 0x18]
call fcn.10043654
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10049823
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1004989a
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1004988e
mov byte [ebp - 1], 0
push 0x8f5
push 0x20b4
push 0x62d4
push 0x5564
push 0x6147
lea eax, [ebp - 1]
push eax
push 0x72fc
push 0x588c
push 1
push 0x797f
push 0x1ebf
push 0x9aa
push 0x6dd0
push 0
call fcn.10048797
add esp, 0x38
jmp 0x10049898
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x100498bb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push 0x3778
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.10047c5a
add esp, 0x10
mov esp, ebp
pop ebp
ret