joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b80d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
cmp byte [0x5399bc], 0
je 0x4b8110
mov eax, dword [0xa57078]
test eax, eax
je 0x4b812d
mov dword [esp + 4], 0
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0xa57078]
mov byte [eax + 0x38], 0
sub esp, 8
add esp, 0x1c
ret
mov dword [esp + 4], str.glutHideWindow
mov dword [esp], 0x569898
call fcn.004bbb50
mov eax, dword [0xa57078]
test eax, eax
jne 0x4b80e5
cmp dword [0x539a14], 2
je 0x4b80e5
mov dword [esp + 4], str.glutHideWindow
mov dword [esp], 0x569944
call fcn.004bbb50
mov eax, dword [0xa57078]
jmp 0x4b80e5

Function at 0x4b8160
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
cmp byte [0x5399bc], 0
je 0x4b81a0
mov eax, dword [0xa57078]
test eax, eax
je 0x4b81bd
mov byte [eax + 0x39], 0
mov dword [esp + 4], 6
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0xa57078]
mov byte [eax + 0x38], 0
sub esp, 8
add esp, 0x1c
ret
mov dword [esp + 4], str.glutIconifyWindow
mov dword [esp], 0x569898
call fcn.004bbb50
mov eax, dword [0xa57078]
test eax, eax
jne 0x4b8175
cmp dword [0x539a14], 2
je 0x4b8175
mov dword [esp + 4], str.glutIconifyWindow
mov dword [esp], 0x569944
call fcn.004bbb50
mov eax, dword [0xa57078]
jmp 0x4b8175

Function at 0x4bb950
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, 1
push ebx
sub esp, 0x14
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [esp], 0xa0
call ebx
sub esp, 4
test ax, ax
js 0x4bb983
mov dword [esp], 0xa1
call ebx
movsx esi, ax
sub esp, 4
shr esi, 0x1f
mov dword [esp], 0xa2
call ebx
mov edx, 2
sub esp, 4
test ax, ax
js 0x4bb9ad
mov dword [esp], 0xa3
call ebx
mov edx, eax
sub esp, 4
shr edx, 0xe
and edx, 2
or esi, edx
mov dword [esp], 0xa4
call ebx
mov edx, 4
sub esp, 4
test ax, ax
js 0x4bb9d9
mov dword [esp], 0xa5
call ebx
mov edx, eax
sub esp, 4
shr edx, 0xd
and edx, 4
mov eax, esi
add esp, 0x14
or eax, edx
pop ebx
pop esi
ret

Function at 0x4bbb50
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x539a48]
test ebx, ebx
je 0x4bbb78
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [0x539a48]
add esp, 0x18
pop ebx
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea ebx, [esp + 0x24]
mov dword [esp + 8], 9
mov dword [esp + 4], 1
mov dword [esp], str.freeglut
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [0x539a1c]
test eax, eax
je 0x4bbbc9
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.__s_:
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], 0xa
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
cmp byte [0x5399bc], 0
jne 0x4bbc12
mov dword [esp], 1
call sub.msvcrt.dll_exit
call fcn.004b5a50
jmp 0x4bbc06
Function at 0x4bbc20
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [0x539a4c]
test eax, eax
je 0x4bbc47
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [0x539a4c]
add esp, 0x18
pop ebx
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea ebx, [esp + 0x24]
mov dword [esp + 8], 9
mov dword [esp + 4], 1
mov dword [esp], str.freeglut
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [0x539a1c]
test eax, eax
je 0x4bbc98
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.__s_:
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], 0xa
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
add esp, 0x18
pop ebx
ret

Function at 0x4bd9f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
movzx edx, byte [esp + 0x68]
mov dword [esp + 4], 1
mov ebp, dword [esp + 0x60]
mov dword [esp], 0xe8
movzx esi, byte [esp + 0x74]
movzx edi, byte [esp + 0x80]
mov byte [esp + 0x3f], dl
movzx ebx, byte [esp + 0x84]
call sub.msvcrt.dll_calloc
xor edx, edx
test eax, eax
je 0x4bda43
mov dword [eax + edx*4 + 0x54], 0
add edx, 1
cmp edx, 0x1c
jne 0x4bda33
mov edx, dword [0xa57088]
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
add edx, 1
test ebp, ebp
mov dword [0xa57088], edx
mov dword [eax + 8], edx
je 0x4bdb17
mov edx, dword [ebp + 0xe0]
test edx, edx
je 0x4bdb36
mov dword [edx], eax
mov dword [eax + 4], edx
mov dword [eax], 0
mov dword [ebp + 0xe0], eax
mov dword [eax + 0xd8], ebp
xor edx, edx
test ebp, ebp
setne dl
and edi, 0xff
mov byte [eax + 0xe4], bl
movzx ebx, byte [esp + 0x3f]
and esi, 0xff
mov dword [eax + 0x3c], 0x64
mov byte [eax + 0x50], 0
mov byte [eax + 0x51], 0
mov byte [eax + 0x53], 0
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x78]
mov dword [esp], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x6c]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x64]
mov dword [esp + 4], edx
call fcn.004b7830
mov eax, dword [esp + 0x38]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [0xa57064]
test edx, edx
je 0x4bdb48
mov dword [edx], eax
mov dword [eax + 4], edx
mov dword [eax], 0
mov dword [0xa57064], eax
jmp 0x4bda96
mov dword [eax + 4], 0
mov dword [ebp + 0xdc], eax
jmp 0x4bda84
mov dword [eax + 4], 0
mov dword [0xa57060], eax
jmp 0x4bdb26
Function at 0x4bea20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x4c
test eax, eax
mov byte [esp + 0x2c], dl
je 0x4bea60
lea edx, [esp + 0x3c]
mov dword [esp + 0xc], edx
lea edx, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 1
mov dword [esp + 4], edx
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
add esp, 0x4c
ret
xor eax, eax
add esp, 0x4c
ret
Function at 0x4bec80
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
cmp byte [0x539a28], 0
je 0x4bec90
ret
sub esp, 0x7c
mov dword [esp], str.GLUT_DIALS_SERIAL
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], ebp
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4bee20
lea ebp, [esp + 0x44]
xor edx, edx
mov dword [ebp + edx], 0
add edx, 4
cmp edx, 0x1c
jb 0x4becbd
mov dword [esp + 0x44], 0x1c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
test eax, eax
mov esi, eax
je 0x4beeaa
mov dword [esp], 0x34
call sub.msvcrt.dll_malloc
mov ecx, 0xd
mov ebx, eax
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [ebx + 0x18]
mov dword [ebx], esi
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetCommState]
lea eax, [ebx + 4]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetCommTimeouts]
sub esp, 8
mov dword [esp + 0x44], 0x1c
mov dword [esp + 4], ebp
mov dword [esp], str.96_n_8_1
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
sub esp, 8
mov dword [esp + 4], ebp
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetCommState]
sub esp, 8
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 1
mov dword [esp + 0x40], 1
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov eax, dword [ebx]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, 0x20
mov eax, ebx
mov dword [0xa570a0], ebx
sub esp, 4
call fcn.004bea20
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4bead0
mov dword [esp], 0xa
call fcn.004ba1f0
mov byte [0x539a28], 1
mov ebx, dword [esp + 0x6c]
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x74]
mov ebp, dword [esp + 0x78]
add esp, 0x7c
ret
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], 0x100
mov dword [esp + 0x28], 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.SOFTWAREFreeGLUT
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
sub esp, 0xc
test eax, eax
jne 0x4bee07
lea eax, [esp + 0x24]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], 0xa570c0
mov dword [esp + 8], 0
mov dword [esp + 4], str.DialboxSerialPort
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x4beeb9
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xa570c0
sub esp, 4
jmp 0x4becb7
mov dword [0xa570a0], 0
jmp 0x4bee07
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
jmp 0x4bee07
Function at 0x4bef80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x26c
mov dword [esp + 0x264], edi
mov edi, eax
mov dword [esp + 0x25c], ebx
mov dword [esp + 0x260], esi
mov dword [esp + 0x268], ebp
cmp byte [eax + 0x1d0], 0
je 0x4befd2
xor eax, eax
mov ebx, dword [esp + 0x25c]
mov esi, dword [esp + 0x260]
mov edi, dword [esp + 0x264]
mov ebp, dword [esp + 0x268]
add esp, 0x26c
ret
lea ebx, [esp + 0x50]
mov esi, dword [sym.imp.msvcrt.dll__snprintf]
lea eax, [eax + 0x70]
mov dword [esp + 0x14], str.CurrentJoystickSettings
lea ebp, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.SystemCurrentControlSetControlMediaResourcesJoystick
mov dword [esp + 8], str._s_s_s
mov dword [esp + 4], 0x100
mov dword [esp], ebx
mov dword [esp + 0x2c], edx
call esi
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
mov dword [esp + 0x3c], eax
call eax
sub esp, 0x14
test eax, eax
jne 0x4befad
mov dword [esp + 0x10], str.OEMName
mov eax, dword [edi + 0x1c8]
mov dword [esp + 0x4c], 0x100
mov dword [esp + 8], str.Joystick_d_s
mov dword [esp + 4], 0x100
add eax, 1
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call esi
lea eax, [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x150]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp + 0x38], eax
call eax
sub esp, 0x18
mov edi, eax
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x34], eax
call eax
sub esp, 4
test edi, edi
mov ecx, dword [esp + 0x30]
jne 0x4befad
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.SystemCurrentControlSetControlMediaPropertiesPrivatePropertiesJoystickOEM
mov dword [esp + 8], str._s_s
mov dword [esp + 4], 0x100
mov dword [esp], ebx
call esi
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
call dword [esp + 0x3c]
sub esp, 0x14
test eax, eax
mov edx, dword [esp + 0x2c]
jne 0x4befad
lea eax, [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], edx
mov dword [esp + 0x4c], pe_nt_image_headers32
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.OEMName
mov dword [esp], eax
call dword [esp + 0x38]
sub esp, 0x18
mov ebx, eax
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call dword [esp + 0x34]
xor eax, eax
sub esp, 4
test ebx, ebx
sete al
jmp 0x4befaf
Function at 0x4c86d0
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
cmp word [edx], 0x5a4d
je 0x4c86e0
repz ret
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x4c86dd
xor eax, eax
cmp word [edx + 0x18], 0x10b
sete al
ret

Function at 0x4c8700
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4c8738
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x4c872e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x4c873a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4c8720
xor eax, eax
pop ebx
pop esi
ret

Function at 0x4c8c80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0xa575a4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0xa575bc]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 4
test ebx, ebx
je 0x4c8cd5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4c8cce
test esi, esi
je 0x4c8cce
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4c8cb0
mov dword [esp], 0xa575a4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4c8f60
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4c8f94
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0xa575c4], eax
call fcn.004d91a0
test eax, eax
sete al
movzx eax, al
mov dword [0x53bbb4], eax
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4c8f83

Function at 0x4c9030
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov dword [esp + 4], eax
mov eax, dword [0xa575c4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x4c9050
add esp, 0x1c
ret
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
jmp eax
Function at 0x4c90b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x2c
mov eax, dword [0x53bbb4]
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
test eax, eax
mov dword [esp + 0x28], ebp
js 0x4c9160
test eax, eax
jne 0x4c9100
mov eax, dword [0xa575c8]
mov dword [0xa575c8], ebx
mov dword [ebx], eax
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
add esp, 0x2c
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [0xa575c4]
call esi
mov dword [esp], ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebp, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0xa575c4]
mov dword [ebx], ebp
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4c90e5
mov edx, esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
add esp, 0x2c
jmp edx
call fcn.004c8fa0
mov eax, dword [0x53bbb4]
jmp 0x4c90d4

Function at 0x4c9170
Capabilities:
Set thread local storage value

Disassembly:
push ebx
sub esp, 8
mov edx, dword [0x53bbb4]
mov eax, dword [esp + 0x10]
test edx, edx
mov ebx, dword [eax]
js 0x4c91a0
test edx, edx
jne 0x4c9193
mov dword [0xa575c8], ebx
add esp, 8
pop ebx
ret
add esp, 8
mov eax, ebx
pop ebx
jmp fcn.004c9030
call fcn.004c8fa0
mov edx, dword [0x53bbb4]
jmp 0x4c9184

Function at 0x4c93a0
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [0x53bbb4]
mov edi, dword [esp + 0x40]
test eax, eax
js 0x4c9483
test eax, eax
mov esi, dword [0xa575c8]
jne 0x4c9421
test esi, esi
mov dword [esp + 0x2c], esi
je 0x4c9415
mov ecx, esi
lea ebx, [esp + 0x2c]
nop
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x4c9407
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [esp + 4], 1
mov dword [esp], 1
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call eax
cmp eax, 6
je 0x4c9450
cmp eax, 8
jne 0x4c9477
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
test ecx, ecx
mov dword [esp + 0x2c], ecx
jne 0x4c93d0
mov eax, 5
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov esi, dword [0xa575c4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x4c93c1
mov eax, dword [esp + 0x2c]
mov edx, ebx
mov dword [edi + 0xc], 0
mov dword [esp + 0x2c], esi
mov dword [edi + 0x10], eax
mov eax, edi
call fcn.004c8ec0
cmp eax, 7
jne 0x4c941a
mov eax, ebx
call fcn.004c9060
add esp, 0x30
mov eax, 3
pop ebx
pop esi
pop edi
ret
call fcn.004c8fa0
mov eax, dword [0x53bbb4]
jmp 0x4c93b7
Function at 0x4c9550
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edx, dword [0x53bbb4]
mov ebx, dword [esp + 0x30]
test edx, edx
js 0x4c95cb
test edx, edx
mov esi, dword [0xa575c8]
jne 0x4c95a5
mov ecx, dword [ebx + 0xc]
mov eax, ebx
mov dword [esp + 0x1c], esi
lea esi, [esp + 0x1c]
mov edx, esi
test ecx, ecx
jne 0x4c9595
call fcn.004c8ec0
cmp eax, 7
je 0x4c959c
nop
lea esi, [esi]
call sub.msvcrt.dll_abort
call fcn.004c91b0
jmp 0x4c9586
mov eax, esi
nop
call fcn.004c9060
mov esi, dword [0xa575c4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
jmp 0x4c956e
call fcn.004c8fa0
mov edx, dword [0x53bbb4]
jmp 0x4c9564

Function at 0x4c95e0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4c9612
mov dword [esp], ebx
call fcn.004c93a0
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esp, 0x2c
ret
mov edx, dword [0x53bbb4]
test edx, edx
js 0x4c9680
test edx, edx
mov esi, dword [0xa575c8]
jne 0x4c9650
lea edx, [esp + 0x1c]
mov eax, ebx
mov dword [esp + 0x1c], esi
call fcn.004c91b0
cmp eax, 7
je 0x4c9640
call sub.msvcrt.dll_abort
nop
lea eax, [esp + 0x1c]
call fcn.004c9060
lea esi, [esi]
mov esi, dword [0xa575c4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x4c9626
call fcn.004c8fa0
mov edx, dword [0x53bbb4]
jmp 0x4c961c

Function at 0x4c9bd0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
add esp, 0x1c
ret

Function at 0x4c9c10
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x4c9c35
xor eax, eax
add esp, 0x1c
ret
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
jmp eax
Function at 0x100046e4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10004723
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10004723
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10004723
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10004723
cmp dword [ecx + 0x74], 0xe
jbe 0x10004723
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100073ed
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000748a
push ebx
push esi
call fcn.100073b6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000734a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10007437
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10007489
push edi
push eax
call fcn.1000542d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10007457
call fcn.10005e92
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10007488
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000734a
add esp, 0x20
test eax, eax
jne 0x10007476
push edi
call fcn.10005e92
jmp 0x1000747e
push ebx
call fcn.10005e92
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100076f7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e580
push 0x1000e578
push str.FlsAlloc
push 0x1f
call fcn.10007613
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000772b
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000d134]
call esi
jmp 0x10007731
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10007775
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e590
push 0x1000e588
push str.FlsGetValue
push 0x21
call fcn.10007613
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100077ac
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000d134]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100077b4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e598
push 0x1000e590
push str.FlsSetValue
push 0x22
call fcn.10007613
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100077ee
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000d134]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000cd90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000cdbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000cdbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret