joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b00a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov dword [esp + 4], edx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x98], eax
xor ebx, ebx
test ecx, ecx
je 0x4b020e
push ebx
push ebx
push ecx
mov dword [esp + 0x14], ecx
call fcn.005db234
add esp, 0xc
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x60]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x20]
push 0x51
push str....._base_files_file_util.cc
push str.ReadStreamToSpanWithMaxSize
push esi
call fcn.005613a0
add esp, 0x10
mov ecx, edi
push ebx
push esi
call fcn.005546a0
mov dword [esi + 0x30], ebx
pxor xmm0, xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
push dword [esp + 8]
call fcn.005db20d
add esp, 4
push eax
call fcn.005dc42a
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x4b0226
mov eax, dword [esp + 0x44]
xor ecx, ecx
mov edx, eax
neg edx
sbb ecx, dword [esp + 0x40]
mov edi, 0xffff
cmovl edi, eax
mov eax, dword [esp + 4]
cmp edi, eax
cmovae edi, eax
inc edi
xor eax, eax
dec eax
lea ebx, [esp + 0x18]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov ecx, dword [ebp + 0xc]
call dword [0x8072c0]
mov eax, dword [esp + 0x10]
push edi
push eax
push ebx
call ecx
add esp, 0xc
xor esi, esi
mov eax, dword [ebx]
add eax, esi
push dword [esp + 8]
push edi
push 1
push eax
call fcn.005e327f
add esp, 0x10
test eax, eax
je 0x4b01ce
mov ebx, eax
mov eax, dword [esp + 4]
sub eax, esi
cmp eax, ebx
jb 0x4b0230
add ebx, esi
push dword [esp + 8]
call fcn.005e2bf5
add esp, 4
test eax, eax
je 0x4b0238
mov esi, ebx
push dword [esp + 8]
call fcn.005e2c21
add esp, 4
test eax, eax
sete bl
mov eax, dword [ebp + 8]
mov dword [esp + 0x94], eax
mov ecx, dword [ebp + 0xc]
call dword [0x8072c0]
mov eax, dword [esp + 0x94]
lea edx, [esp + 0x10]
push esi
push eax
push edx
call ecx
add esp, 0xc
lea ecx, [esp + 0x60]
call fcn.00554710
mov ecx, dword [esp + 0x98]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 0xffff
jmp 0x4b0162
xor ebx, ebx
mov esi, dword [esp + 4]
jmp 0x4b01df
test esi, esi
mov eax, 0x10000
cmove edi, eax
lea eax, [ebx + edi]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x94], eax
mov ecx, dword [ebp + 0xc]
call dword [0x8072c0]
mov eax, dword [esp + 0x94]
lea esi, [esp + 0x10]
push dword [esp + 0xc]
push eax
push esi
call ecx
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
mov esi, ebx
jmp 0x4b0198
Function at 0x4b9df0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.004b9f70
mov eax, dword [edi]
mov dword [0x8105bc], eax
mov bl, 1
test al, 1
jne 0x4b9e2c
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x815498]
test eax, eax
je 0x4b9e56
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x815498], 0
cmp dword [0x81549c], 0
jne 0x4b9e56
and byte [0x8105bc], 0xfe
mov eax, dword [edi + 0x18]
test eax, eax
je 0x4b9e73
movsx ecx, byte [edi + 0xf]
test ecx, ecx
jns 0x4b9e68
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x4b9ede
mov dword [0x815498], eax
jmp 0x4b9e18
movsx eax, byte [edi + 0xf]
test eax, eax
jns 0x4b9e7e
mov eax, dword [edi + 8]
test eax, eax
je 0x4b9f1f
lea esi, [edi + 4]
mov ecx, dword [0x81549c]
test ecx, ecx
jne 0x4b9eb2
push 0xc
call fcn.005c8b59
add esp, 4
mov ecx, eax
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [0x81549c], eax
push esi
call fcn.00536be0
cmp dword [edi + 0x14], 0
jne 0x4b9ed2
mov eax, dword [0x81549c]
cmp byte [eax + 0xb], 0
jns 0x4b9ecb
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00646560
mov ebx, eax
jmp 0x4b9e18
lea eax, [ebp - 0x24]
push 0x232
push str....._baselogging.cc
push str.BaseInitLoggingImpl_built_with_NDEBUG
push eax
call fcn.005613a0
add esp, 0x10
lea esi, [ebp - 0x14]
lea eax, [ebp - 0x24]
push eax
push 0x7f
push str.settings.log_file_path.empty__
push esi
call fcn.00649430
add esp, 0x10
mov ecx, esi
call fcn.00649690
mov eax, dword [edi + 0x18]
jmp 0x4b9e6c
lea ebx, [ebp - 0x24]
push 0x238
push str....._baselogging.cc
push str.BaseInitLoggingImpl_built_with_NDEBUG
push ebx
call fcn.005613a0
add esp, 0x10
lea esi, [ebp - 0x28]
push ebx
push 0x7f
push str._settings.log_file_path.empty__
push esi
call fcn.00649430
add esp, 0x10
mov ecx, esi
push str.LOG_TO_FILE_set_but_no_log_file_path_
call fcn.00646530
mov ecx, esi
call fcn.00649690
jmp 0x4b9e86
Function at 0x4bc5c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10010
call fcn.005ca340
mov esi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1001c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
push edx
push ecx
push ebx
call fcn.00557150
add esp, 0xc
test esi, esi
je 0x4bc679
lea edi, [ebp - 0x1000e]
push 0xfffe
push 0xff
push edi
call fcn.005cced0
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x4bc625
mov ebx, dword [ebp - 0x1001c]
push 0x7fff
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
je 0x4bc64b
cmp eax, 0x7fff
jae 0x4bc6a2
push esi
push eax
push edi
call fcn.004b5460
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x4bc662
push dword [ebp - 0x1001c]
call fcn.005c8b90
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0x10010
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp - 0x10011], 0
js 0x4bc68a
lea eax, [ebp - 0x1001c]
jmp 0x4bc690
mov eax, dword [ebp - 0x1001c]
xor ecx, ecx
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
jmp 0x4bc64b
int3

Function at 0x4bcc20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x81553c]
test ebx, ebx
jne 0x4bcca4
push 0x28
call fcn.005c8b59
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.005c8b59
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x4bccae
mov dword [eax + 8], edi
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x81553c], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x4bccae
mov edi, eax
push eax
call fcn.005e54a4
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.004bccb0
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x4c2860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0x30
ja 0x4c2999
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [ebp - 0x44], eax
call dword [0x8072c0]
lea eax, [ebp - 0x40]
push esi
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x8072c0]
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x8072c0]
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
test ebx, ebx
je 0x4c2931
xor eax, eax
mov cl, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp ebx, eax
jne 0x4c2925
push 1
call fcn.00581ca0
add esp, 4
bt eax, 0x19
jae 0x4c29cc
not eax
test eax, 0x12000000
lea edi, [ebp - 0x20]
mov ebx, dword [ebp - 0x44]
jne 0x4c299d
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403290
add esp, 0xc
mov eax, 0x401cd0
mov ecx, 0x401140
mov dword [esi + 0xf4], ecx
mov dword [esi + 0xf8], eax
movups xmm0, xmmword [edi]
movups xmmword [ebx], xmm0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x4c2985
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00402f80
jmp 0x4c2963
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.0064a290
add esp, 0xc
mov eax, 0x64ae20
mov ecx, 0x64a1a0
jmp 0x4c29eb
bt eax, 9
jae 0x4c29ae
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00404020
add esp, 0xc
xor eax, eax
mov ecx, 0x4040d0
lea edi, [ebp - 0x20]
mov ebx, dword [ebp - 0x44]
jmp 0x4c2970
Function at 0x4d25d0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb4
mov esi, ecx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x4d25f2
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4d2627
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4d2640
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov ecx, esi
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004d2700
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x4d26f6
call fcn.00646ae0
lea ecx, [ebp - 0xb4]
push eax
push 2
push 0x265
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.00646c90
lea eax, [ebp - 0xac]
push 0x10
push str.CreateDirectory
push eax
call fcn.00535510
add esp, 0xc
mov edi, eax
movsx eax, byte [esi + 0xb]
test eax, eax
jns 0x4d2694
mov eax, dword [esi + 4]
mov esi, dword [esi]
test eax, eax
js 0x4d26fd
sete cl
test esi, esi
setne dl
or dl, cl
je 0x4d26fd
lea ebx, [ebp - 0xc0]
push eax
push esi
push ebx
call fcn.00557560
add esp, 0xc
movsx eax, byte [ebx + 0xb]
test eax, eax
jns 0x4d26c9
mov eax, dword [ebp - 0xbc]
mov ebx, dword [ebp - 0xc0]
push eax
push ebx
push edi
call fcn.00535510
add esp, 0xc
cmp byte [ebp - 0xb5], 0
jns 0x4d26eb
push dword [ebp - 0xc0]
call fcn.005c8b90
add esp, 4
lea ecx, [ebp - 0xb4]
call fcn.00646cf0
xor ebx, ebx
jmp 0x4d2629
ud2

Function at 0x4d2700
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov esi, ecx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x4d2722
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4d27ad
mov bl, 1
test al, 0x10
je 0x4d274b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x4d27a9
lea edi, [ebp - 0xb4]
mov ecx, edi
push 2
push 0x255
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.004ba0e0
lea eax, [ebp - 0xac]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00535510
add esp, 0xc
push esi
push eax
call fcn.00647a40
add esp, 8
push 0x11
push str.:_not_a_directory
push eax
call fcn.00535510
add esp, 0xc
mov ecx, edi
call fcn.004ba5c0
xor ebx, ebx
jmp 0x4d2734
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x4d27a9
call fcn.00646ae0
lea edi, [ebp - 0xb4]
mov ecx, edi
push eax
push 2
push 0x251
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.00646c90
lea eax, [ebp - 0xac]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00535510
add esp, 0xc
push esi
push eax
call fcn.00647a40
add esp, 8
mov ecx, edi
call fcn.00646cf0
jmp 0x4d27a9
Function at 0x4d3850
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.004d2890
mov eax, dword [esi]
test eax, eax
je 0x4d38a3
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x4d38aa
lea ecx, [ebp - 0x14]
call fcn.004d3170
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x4d3885
cmp dword [ebx + 0x50], 0
jne 0x4d38c9
cmp byte [ebx + 0x1b], 0
js 0x4d38bb
lea eax, [ebx + 0x10]
jmp 0x4d38be
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x4d38ce
add ebx, 0x58
jmp 0x4d3881
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jae 0x4d38f4
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.006b01b0
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x4d38c9
mov ecx, dword [ebp + 8]
push ebx
call fcn.006b0080
mov ecx, eax
jmp 0x4d38ec

Function at 0x4d3910
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.004d2890
mov eax, dword [esi]
test eax, eax
je 0x4d3963
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x4d396a
lea ecx, [ebp - 0x14]
call fcn.004d3170
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x4d3945
cmp dword [ebx + 0x50], 2
jne 0x4d3989
cmp byte [ebx + 0x1b], 0
js 0x4d397b
lea eax, [ebx + 0x10]
jmp 0x4d397e
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x4d398e
add ebx, 0x58
jmp 0x4d3941
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jae 0x4d39b4
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.006b01b0
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x4d3989
mov ecx, dword [ebp + 8]
push ebx
call fcn.006b0080
mov ecx, eax
jmp 0x4d39ac
Function at 0x4d4b20
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
jns 0x4d4b39
mov ecx, dword [ecx]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x14], edx
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, dword [esi]
cmp ebx, eax
je 0x4d4b7f
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4d4bd9
lea eax, [edi + 1]
cmp eax, 2
jb 0x4d4b76
mov dword [esi], edi
call fcn.005613d0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [esi]
lea eax, [ebx + 1]
cmp eax, 2
jae 0x4d4b93
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov esi, dword [ebp - 0x10]
mov eax, esi
add eax, 1
mov edx, dword [ebp - 0x14]
mov ecx, edx
adc ecx, 0x80000000
cmp eax, 2
sbb ecx, 0
jae 0x4d4bb9
xor eax, eax
test edx, edx
setns al
neg eax
jmp 0x4d4bc7
push 0
push 0x3e8
push edx
push esi
call fcn.005f5430
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
sete al
jmp 0x4d4b89
call fcn.005613d0
push dword [esi]
call fcn.0054cbb0
add esp, 4
mov dword [esi], 0
jmp 0x4d4b67

Function at 0x4da090
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x4da169
cmp dword [esi], 0
jne 0x4da169
cmp dword [esi + 0xc], 0
jne 0x4da169
xor eax, eax
cmp dword [esi + 4], 0
jne 0x4da169
mov ebx, dword [edi]
cmp eax, ebx
je 0x4da0f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4da139
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4da0e9
mov dword [esi], ebx
call fcn.005613d0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x4da126
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x4da150
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4da11c
mov dword [esi + 4], ebx
call fcn.005613d0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005613d0
push dword [esi]
call fcn.0054cbb0
add esp, 4
mov dword [esi], 0
jmp 0x4da0da
call fcn.005613d0
push dword [esi + 4]
call fcn.0054cbb0
add esp, 4
mov dword [esi + 4], 0
jmp 0x4da10c
mov ecx, esi
call fcn.006b81a0
mov eax, dword [esi]
jmp 0x4da0c4
Function at 0x4e7a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [ecx + 0x15bc]
mov ebx, dword [ecx + 0x15c0]
add ebx, eax
mov eax, dword [ecx + 0x15b4]
mov ecx, ebx
sub ecx, eax
cmp ecx, 0x40000001
jb 0x4e7a76
push dword [ebp + 8]
call fcn.0050fb00
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [esp + 0xc]
test eax, eax
mov ecx, 0x40000000
mov edi, 0xaf000000
cmove edi, ecx
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x54], 0x343677
mov dword [esp + 0x50], 0x6f777369
lea eax, [esp + 0x50]
push eax
call fcn.00410a30
add esp, 4
cmp ebx, edi
jbe 0x4e7ad6
push ebx
call fcn.0050fb30
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x44], 0x657a69
mov dword [esp + 0x40], 0x735f6176
lea eax, [esp + 0x40]
push eax
call fcn.00410a30
add esp, 4
mov eax, dword [esi + 0x15c4]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x34], 0x20200063
mov dword [esp + 0x30], 0x6f6c6c61
lea eax, [esp + 0x30]
push eax
call fcn.00410a30
add esp, 4
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov eax, dword [esi + 0x15b4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0x20007469
mov dword [esp + 0x10], 0x6d6d6f63
lea eax, [esp + 0x10]
push eax
call fcn.00410a30
add esp, 4
mov esi, dword [ebp + 8]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0x20202000
mov dword [esp + 0x20], 0x657a6973
lea eax, [esp + 0x20]
push eax
call fcn.00410a30
add esp, 4
mov ecx, dword [0x824e38]
test ecx, ecx
je 0x4e7ba9
call dword [0x8072c0]
push esi
call ecx
add esp, 4
push esi
call fcn.004d7400
int3
Function at 0x4ef1c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x80e040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x4ef1f0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x4ef300
push 0
push eax
push 0x4ef150
push 0x822300
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x4ef2f8
cmp dword [0x822304], 0
jne 0x4ef1dc
push dword [0x822308]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4ef1dc
mov esi, eax
mov eax, 0x82230c
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x822310]
mov ebx, dword [0x822314]
mov eax, dword [0x822318]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x82231c]
mov dword [ebp - 0x20], eax
mov eax, dword [0x822320]
mov dword [ebp - 0x24], eax
mov eax, 0x82230c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
jne 0x4ef2de
test ebx, ebx
jne 0x4ef2cb
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x4ef296
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
jne 0x4ef2a7
test ebx, ebx
jne 0x4ef2b8
push esi
call fcn.004bf4d0
add esp, 4
jmp 0x4ef1dc
mov edi, dword [esi + 8]
call dword [0x8072c0]
push edi
call ecx
add esp, 4
jmp 0x4ef27a
mov edi, dword [esi + 0xc]
call dword [0x8072c0]
push edi
call ecx
add esp, 4
jmp 0x4ef284
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [0x8072c0]
push edi
call ebx
add esp, 4
jmp 0x4ef288
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [0x8072c0]
push edi
call ebx
add esp, 4
jmp 0x4ef273
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [0x8072c0]
push dword [ebp - 0x18]
call edi
add esp, 4
jmp 0x4ef26f
call fcn.005de1d9
int3