joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409905
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040768b
and dword [ebp - 4], 0
cmp dword [0x42e9b4], 0
mov ebx, eax
jne 0x4099b6
push 0x401a4c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409a67
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401a40
push edi
call esi
test eax, eax
je 0x409a67
push eax
call fcn.00407619
mov dword [esp], 0x401a30
push edi
mov dword [0x42e9b4], eax
call esi
push eax
call fcn.00407619
mov dword [esp], 0x401a1c
push edi
mov dword [0x42e9b8], eax
call esi
push eax
call fcn.00407619
mov dword [esp], 0x401a00
push edi
mov dword [0x42e9bc], eax
call esi
push eax
call fcn.00407619
pop ecx
mov dword [0x42e9c4], eax
test eax, eax
je 0x4099b6
push 0x4019e8
push edi
call esi
push eax
call fcn.00407619
pop ecx
mov dword [0x42e9c0], eax
mov eax, dword [0x42e9c0]
cmp eax, ebx
je 0x409a0e
cmp dword [0x42e9c4], ebx
je 0x409a0e
push eax
call fcn.00407694
push dword [0x42e9c4]
mov esi, eax
call fcn.00407694
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409a0e
test edi, edi
je 0x409a0e
call esi
test eax, eax
je 0x409a05
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409a05
test byte [ebp - 0xc], 1
jne 0x409a0e
or dword [ebp + 0x10], 0x200000
jmp 0x409a47
mov eax, dword [0x42e9b8]
cmp eax, ebx
je 0x409a47
push eax
call fcn.00407694
pop ecx
test eax, eax
je 0x409a47
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409a47
mov eax, dword [0x42e9bc]
cmp eax, ebx
je 0x409a47
push eax
call fcn.00407694
pop ecx
test eax, eax
je 0x409a47
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42e9b4]
call fcn.00407694
pop ecx
test eax, eax
je 0x409a67
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409a69
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b050
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40a015
lea edi, [esi - 0x9015]
push edi
jmp 0x40b06a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40b071
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40b060
mov eax, 1
add ebx, ebx
jne 0x40b083
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40b094
jne 0x40b0a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40b0a4
dec eax
add ebx, ebx
jne 0x40b0a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x40b078
xor ecx, ecx
sub eax, 3
jb 0x40b0bc
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40b12e
sar eax, 1
mov ebp, eax
jmp 0x40b0c7
add ebx, ebx
jne 0x40b0c7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40b0d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40b0f8
inc ecx
add ebx, ebx
jne 0x40b0e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40b0d9
jne 0x40b0f5
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40b0d9
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40b118
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40b109
jmp 0x40b066
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40b118
add edi, ecx
jmp 0x40b066
pop esi
mov edi, esi
mov ecx, 0xa1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40b136
cmp byte [edi], 4
jne 0x40b136
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40b13b
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x40b1aa
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40b168
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb054]
or eax, eax
je 0x40b1a4
mov dword [ebx], eax
add ebx, 4
jmp 0x40b185
call dword [esi + 0xb064]
mov ebp, dword [esi + 0xb058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40b1de
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x40d2c6
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
add dword [eax + 0x7c], esi
xor byte [edi + 0x30], bl
pop ds
fst qword [ebp + 0xb3c0b]
sbb eax, 0x258adffc
cld
fisttp word [edx - 0x4f9d6edb]
xor dword [eax - 0x5a], ebp
pop ds
cld
fisttp word [edx - 0x4f9d6edb]
xor dword [eax - 0x5a], ebp
pop ds
in eax, dx
pop esp
mov ebx, 0x2ef0a1c8
xchg edi, eax
mov esp, 0x208bf036
mov esp, dword [eax]
rol dword [ecx - 0x3a698210], 0x1e
xor eax, 0x1ec5967d
rcl dword [ecx - 0x59e4a1e0]
lodsd eax, dword [esi]
sbb byte ds:[esi - 0x46], bh
or eax, 0x20c0214
adc byte [eax + 0x68], cl
sub byte [edi + ebx*4 - 0x47], 0xd3
jo 0x40d2df
bound ecx, qword [esi]
std
xor esi, 0xffffff9e
push ecx
push eax
jge 0x40d2b7
pop ebx
dec ebp
fst st(0)
nop
mov esp, dr0
push esi
js 0x40d2dc
push ecx
shr byte [eax + esi*8 - 0x6f], cl
jo 0x40d2be
pop ss
out 0x96, al
push eax
mov esi, 0x4f2e8773
popfd
dec eax
xor byte [esi - 0x79], bh
aas
mov dword [ebx - 0x7f], edi
invalid
Function at 0x40ef9b
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0x87
push esi
sub dword fs:[eax - 0x5b], ebp
mov al, byte [0x45464069]
dec eax
add eax, 0xf8c31bf2
add dword [ebx - 0x53d197e0], eax
lodsb al, byte cs:[esi]
fisttp word [edi]
adc eax, dword [ecx + 0x4c]
xor dword [ecx - 0x34], ecx
fdiv st(6)
test byte [edx - 0x222680b5], 0x36
xlatb
scasd eax, dword es:[edi]
sal edi, 0x44
lds ebx, es:[edx + 0x43]
fisttp dword [0x9e48e83c]
sub byte [eax - 0x451be38f], cl
call 0x88698e1d
jno 0x40eff3
in al, 0xba
push 0xffffffffffffff86
jnp 0x40efb1
xor esi, dword [edi]
xor dl, byte [0x54184f3a]
xor edx, esi
mov al, byte [0x8e83db21]
dec eax
dec eax
call 0xa02d5608
lahf
and bh, byte [eax - 0x3fa5b643]
mov dh, 0xc8
stosb byte es:[edi], al
div dword [ebp - 0x26]
mov bh, byte [eax + 0x2a]
xchg esi, eax
mov ecx, 0x67ce35df
nop
adc al, 0xc9
jae 0x40f058
aad 0x90
pop esp
dec eax
sbb eax, edx
and dword [ecx + 0x147a7ce3], esi
mov ebx, dword [edi - 0x5f7456b8]
cmp eax, 0xa90ec91d
je 0x40f04f
sub eax, 0x36ec6488
push eax
xchg esi, eax
dec ebx
sbb dh, dl
popfd
cmp bl, byte [ebx - 0x4b]
mov dh, 0xd2
ror byte [ecx], cl
dec edx
test dword [ebx - 0x2c25755f], ebp
pop ebx
jecxz 0x40efd0
mov cl, byte [ecx + 0x4a]
push 0x4277e1f2
stc
pop eax
mov byte [edx], bh
jl 0x40efe0
cmp bh, byte [esi + ecx*4 + 0x3c]
mov dh, 0xc5
jecxz 0x40efe6
cmp al, 0xb6
invalid
lodsd eax, dword [esi]
xor al, 0xed
xor bh, byte [edi - 1]
ror byte [edx + 0x1a41fb38], 0xc2
aas
push 0xffffffffffffffe3
jmp 0x40f0e0
int1
std
movsd dword es:[edi], dword [esi]
test byte [esi + 0x2e], bl
leave
movsb byte es:[edi], byte [esi]
enter 0xf54, 0x20
dec ebx
int1
mov ebx, 0xeda13b8d
jno 0x40f0f0
cmp esp, dword [ecx - 0x7b048e13]
and byte [eax], bl
int3
test byte [eax], ah
sbb ah, cl
jle 0x40f122
xlatb
pop ss
push edx
dec esi
and dword [esi - 0x3ab16d02], edx
add al, 0xb5
dec eax
push esp
loopne 0x40f14a
mov esi, gs
add byte [edx - 0x3f5b9929], dh
adc edx, dword [esi + 0x3f0d173c]
push 0x49c0d199
sal dword [ecx - 0x2ceee68f], 1
adc ebx, edx
xchg esi, eax
mov esi, 0xc723655a
cmp eax, dword [edx]
movsd dword es:[edi], dword [esi]
add dword [ecx + 0x2c], esp
out 0xff, eax
push ss
mov bl, 0xe5
fidiv dword [eax + 0x26]
mov edx, fs
iretd
sub al, 0x57
sbb dword [edi], ebx
or dword [0x2dd30e1c], ecx
push edx
add dword [edx - 0x108c2768], ecx
jae 0x40f13b
and ebx, dword [ebx]
and al, 0xb4
xchg dword [0xc60647dd], esi
xchg edx, eax
cmp eax, 0x1fb2d150
hlt
Function at 0x41224a
Capabilities:
Encode data using xor

Disassembly:
pop edx
idiv dword [eax + 0x70]
and dword [edi], 0xffffffcb
loope 0x41228f
sbb dword [ecx + edx*8], edx
push cs
arpl word [edi + 0x5c], bp
outsd dx, dword [esi]
pop esp
xchg ebx, eax
fmul st(4), st(0)
jp 0x4122b4
inc ecx
or edi, dword [0x290bb452]
xor byte [eax - 0x2eff57fe], al
sahf
mov ds, word [ecx + ecx*8]
sbb ebx, ebx
out 0xa3, eax
stosd dword es:[edi], eax
salc
mov eax, fs
xor ch, byte [esp - 0x5789bb72]
push ss
and edi, esi
xchg dword [esi], ebx
jg 0x412258
sub ebx, eax
push ebp
xchg ebp, eax
cmc
sti
pop ecx
cdq
pop eax
inc ecx
out dx, al
cmp byte [edi + 0x11], dl
mov dword [0x2f77d267], eax
adc dword [ebx + 0x2f77d267], esp
insb byte es:[edi], dx
loopne 0x41231a
fadd qword [edx - 0x4b]
nop
cmp al, 0x39
push eax
xor ah, byte [esi - 0x28]
sahf
inc edi
mov al, byte [0xb1c4d594]
jno 0x412294
imul eax, dword [ebp - 0x69], 0xffffffbf
dec edi
push 0xffffffffffffff8d
adc edx, ebp
insb byte es:[edi], dx
cdq
inc ebx
je 0x41229e
mov edi, 0x118d6a4f
ljmp 0x94df
xchg esp, eax
dec ecx
push edx
int1
pop edx
test byte [esi + 0x27], dh
aaa
invalid
dec ebp
sbb dh, byte [ecx]
inc edi
mov cs, word [esi + 0x69]
jge 0x412368
sbb dword [ebx + 6], ecx
retf 0x4cd
xor edx, dword [edi - 0x21234d11]
mov cl, 0x26
and al, 0xdc
xchg ebx, eax
push edi
push ds
dec ebx
pop ss
inc ecx
adc dword [eax + 0x2a], 0x5baaf68d
sbb eax, 0x33c7e25d
mov eax, 0x15105468
ret 0x40ab

Function at 0x455245
Capabilities:
Encode data using xor

Disassembly:
inc esp
add al, 0xfb
mov byte [edi - 0x2a], bl
ror dword [edi - 0x7adbff1c], 1
wait
shl byte [esp + ebx*2 - 0x10], 1
and eax, 0x954c9f72
jb 0x4552b8
aaa
mov al, 0x5b
xchg esp, eax
jge 0x4552cf
add ah, cl
in eax, dx
xchg byte [ebx + esi*4 + 0x77], bh
sahf
fld xword [0xf8be25fb]
pop ds
cmpsd dword [esi], dword es:[edi]
sti
and eax, 0xa71ff8be
div byte [ecx]
inc esi
and ch, ch
movsb byte es:[edi], byte [esi]
mov dword [0xdc45e9be], eax
sal byte [ebx + 0x28], 0x4d
mov dword [0x43b00d69], eax
fisttp dword [ecx + 0x45]
invalid
dec ebx
int 0x22
and ecx, 0xb3cf3c61
jne 0x4552e7
cmp dword [eax + 0x39], esi
or eax, 0x65cb3cf7
fdivr qword [ecx]
daa
les ecx, [ebp + 0x4a27964e]
lea ecx, [esi - 0x6a]
daa
dec edx
scasd eax, dword es:[edi]
in al, 0xe6
cmpsb byte [esi], byte es:[edi]
fdivr dword [ecx - 0x7e]
push esp
invalid
loopne 0x45526d
lodsb al, byte [esi]
leave
cmp al, 0xf6
out 0x89, al
dec esi
aaa
dec ebp
dec esi
cmp ecx, eax
imul ecx, esp, 0xa49061a6
invalid

Function at 0x49a7e5
Capabilities:
Encode data using xor

Disassembly:
inc ecx
lcall 0xda1b, 0x890030d1
test esp, eax
xor dword [ebx - 0x70dde75b], edi
div byte [edi - 0x2cc32c6e]
mov al, byte [0x689f73b3]
scasb al, byte es:[edi]
in eax, 0xa0
pop edi
push 0x5fa0e5ae
inc ecx
xchg ecx, eax
pop edi
mov dword [0xcbbbdeae], ebp
mov dword [ebx - 0x79dca28c], eax
jg 0x49a7b0
xor byte [edi], 0x3f
mov byte [edx - 0xa06d8fc], ah
jl 0x49a7cb
and bh, byte [edx + 0x6c]
mov al, 0xa0
ret
Function at 0x628c85
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x630380
cmp edx, dword [eax]
je 0x628ca7
add eax, 8
inc ecx
cmp eax, 0x630410
jl 0x628c98
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x630380]
jne 0x628dd5
mov eax, dword [0x639d10]
cmp eax, 1
je 0x628daf
test eax, eax
jne 0x628cd8
cmp dword [0x6302a8], 1
je 0x628daf
cmp edx, 0xfc
je 0x628dd5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x628d0f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00629b00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x628d52
lea eax, [ebp - 0x1a4]
push eax
call fcn.00629b00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62d99c
push edi
call fcn.0062b9d0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629680
lea eax, [ebp - 0xa0]
push 0x62d97c
push eax
call fcn.00629680
push dword [esi + 0x630384]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062b944
add esp, 0x2c
pop edi
jmp 0x628dd5
lea eax, [ebp + 8]
lea esi, [esi + 0x630384]
push 0
push eax
push dword [esi]
call fcn.00629b00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4b14b7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4b14f6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b14f6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b14f6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4b14f6
cmp dword [ecx + 0x74], 0xe
jbe 0x4b14f6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4b72a6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004b1ec0
mov eax, dword [0x4d2784]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004bbc38
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4b72e8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4b7444
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004bf570
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4d5730]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.004bf39c
mov ecx, dword [esi*4 + 0x4d5730]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x4b743d
cmp eax, dword [ecx + edi + 0x24]
jne 0x4b743d
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b743d
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004bf39c
add esp, 0x14
test edx, edx
jl 0x4b743d
jg 0x4b73b3
test eax, eax
jb 0x4b743d
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4b743d
jl 0x4b73cd
cmp dword [ebp - 0x1008], eax
ja 0x4b743d
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4b73eb
test ebx, ebx
je 0x4b7424
cmp ecx, edi
jae 0x4b7424
mov al, byte [ecx]
cmp al, 0xd
jne 0x4b7405
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4b7411
cmp byte [ecx + 1], 0xa
jne 0x4b7411
inc ecx
jmp 0x4b7411
movzx eax, al
movsx eax, byte [eax + 0x4d2f10]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4b73eb
cmp edx, ebx
jne 0x4b73eb
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4b7442
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004affb3
leave
ret

Function at 0x4b8890
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b88bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b88bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4b8c22
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4c8b38
push 0x4c8b30
push str.FlsAlloc
push 0x1f
call fcn.004b8f05
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b8c56
push dword [ebp + 8]
mov ecx, esi
call dword [section..05cfg]
call esi
jmp 0x4b8c5c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4b8ca0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4c8b48
push 0x4c8b40
push str.FlsGetValue
push 0x21
call fcn.004b8f05
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b8cd7
push dword [ebp + 8]
mov ecx, esi
call dword [section..05cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4b8cdf
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4c8b50
push 0x4c8b48
push str.FlsSetValue
push 0x22
call fcn.004b8f05
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b8d19
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..05cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4bd5ab
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4bd648
push ebx
push esi
call fcn.004bd64b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004bd4af
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4bd5f5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4bd647
push edi
push eax
call fcn.004baa66
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4bd615
call fcn.004ba0bb
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4bd646
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004bd4af
add esp, 0x20
test eax, eax
jne 0x4bd634
push edi
call fcn.004ba0bb
jmp 0x4bd63c
push ebx
call fcn.004ba0bb
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4bee5d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4d5730]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4bee9d
cmp byte [ebx], 0xa
jne 0x4bee9d
or byte [edi + eax + 0x28], 4
jmp 0x4beea2
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x4befa1
mov dl, byte [eax]
cmp dl, 0x1a
je 0x4bef84
inc eax
cmp dl, 0xd
je 0x4beece
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x4beef4
cmp eax, ecx
jae 0x4bef02
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x4beeb6
jmp 0x4befa1
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4bef7f
cmp dword [ebp - 0x10], 0
je 0x4bef7f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4d5730]
test byte [eax + edi + 0x28], 0x48
je 0x4bef59
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4bef44
mov byte [esi], dl
jmp 0x4bef55
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4d5730]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4befa1
cmp byte [ebp - 1], 0xa
jne 0x4bef68
cmp esi, ebx
jne 0x4bef68
mov byte [esi], 0xa
jmp 0x4befa0
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004bf33e
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4befa1
mov byte [esi], 0xd
jmp 0x4befa0
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4d5730]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4bef9e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4befa1
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4befaa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4d5730]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4beff0
cmp word [ebx], dx
jne 0x4beff0
or byte [eax + edi + 0x28], 4
jmp 0x4beff5
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x4bf158
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x4bf138
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x4bf036
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4bf06c
cmp eax, edx
jae 0x4bf07a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x4bf011
jmp 0x4bf158
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4bf133
cmp dword [ebp - 0x18], 0
je 0x4bf133
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4d5730]
test byte [eax + edi + 0x28], 0x48
je 0x4bf109
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x4bf0cd
mov word [esi], cx
jmp 0x4bf104
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4d5730]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4d5730]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4d5730]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x4bf158
pop eax
cmp word [ebp - 4], ax
jne 0x4bf119
cmp esi, ebx
jne 0x4bf119
mov word [esi], ax
jmp 0x4bf155
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004bf33e
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4bf158
push 0xd
pop eax
jmp 0x4bf114
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4d5730]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x4bf152
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x4bf158
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret