joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3150
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0xc], edx
push 0x4000
mov dword [ebp - 8], esi
call fcn.004dad8d
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
jne 0x4b3181
lea eax, [edx + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 8]
xor edi, edi
cmp ebx, 0xffffffff
je 0x4b31a3
cmp edi, ebx
jae 0x4b3232
mov eax, ebx
mov ecx, 0x4000
sub eax, edi
cmp eax, ecx
cmovb ecx, eax
jmp 0x4b31a8
mov ecx, 0x4000
push esi
push ecx
push 1
push edx
call fcn.004e2fd2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b3209
push dword [ebp - 0xc]
push esi
push 1
push dword [ebp - 4]
call fcn.004e2dae
add esp, 0x10
cmp eax, esi
jne 0x4b31da
mov edx, dword [ebp - 4]
add edi, esi
mov esi, dword [ebp - 8]
jmp 0x4b3186
push dword [ebp - 4]
call fcn.004dab64
add esp, 4
push str._fcopy:_write_error_n
push 2
call fcn.004db37d
add esp, 4
push eax
call fcn.00451470
add esp, 8
mov eax, 0xa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
call fcn.004e2404
add esp, 4
test eax, eax
je 0x4b322f
push dword [ebp - 4]
call fcn.004dab64
add esp, 4
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call fcn.004dab64
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b37e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
movzx eax, byte [esi]
push eax
call fcn.004dcbc8
add esp, 4
test eax, eax
je 0x4b380c
cmp byte [esi + 1], 0x3a
je 0x4b382c
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea esi, [ebp - 0x20c]
push 3
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], esi
push esi
push eax
call fcn.004daa40
add esp, 0xc
mov byte [ebp - 0x20d], 0
lea eax, [ebp - 0x108]
push 0x104
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 3
lea eax, [ebp - 0x108]
push 0x54e9f0
push eax
call fcn.004db21f
add esp, 4
push eax
call fcn.004d5610
add esp, 0xc
pop esi
test eax, eax
je 0x4b38ed
push 4
lea eax, [ebp - 0x108]
push str.VFAT
push eax
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x4b38ed
push 4
lea eax, [ebp - 0x108]
push str.HPFS
push eax
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x4b38ed
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
Function at 0x4b4540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x568ba0]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test eax, eax
jne 0x4b457e
push dword [ebp + 0xc]
push esi
push dword [0x58aba0]
call fcn.004de977
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x4b465a
test edi, edi
jne 0x4b4633
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
cmp eax, 1
mov eax, dword [ebp + 0xc]
jne 0x4b45cd
shr eax, 1
push eax
lea ebx, [esi + eax]
push ebx
push dword [0x58aba0]
call fcn.004de977
mov edi, eax
add esp, 0xc
mov ecx, edi
cmp edi, 0xffffffff
je 0x4b465a
test edi, edi
je 0x4b465a
mov al, byte [ebx]
lea ebx, [ebx + 1]
mov byte [esi], al
inc esi
cmp al, 0xa
jne 0x4b45c4
mov word [esi - 1], 0xa0d
inc esi
inc edi
sub ecx, 1
jne 0x4b45b0
sub esi, edi
jmp 0x4b4633
dec eax
mov ebx, esi
push eax
push esi
push dword [0x58aba0]
call fcn.004de977
mov edi, eax
add esp, 0xc
mov ecx, edi
cmp edi, 0xffffffff
je 0x4b465a
test edi, edi
je 0x4b465a
mov byte [edi + esi], 0xa
mov al, byte [ebx]
lea ebx, [ebx + 1]
mov edx, esi
mov byte [esi], al
inc esi
cmp al, 0xd
jne 0x4b4607
cmp byte [ebx], 0xa
jne 0x4b4607
mov esi, edx
dec edi
mov eax, esi
sub ecx, 1
jne 0x4b45f1
test edi, edi
jne 0x4b462a
push 1
push esi
push dword [0x58aba0]
call fcn.004de977
add esp, 0xc
mov edi, 1
jmp 0x4b4633
sub esi, edi
cmp byte [eax - 1], 0x1a
jne 0x4b4633
dec edi
push edi
push esi
push dword [0x58a798]
call fcn.0049e270
mov dword [0x58a798], eax
add esp, 0xc
mov eax, dword [0x58aba8]
add eax, edi
mov dword [0x58aba8], eax
cmp eax, edi
jb 0x4b4660
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
mov edx, str.file_exceeds_Zips_4GB_uncompressed_size_limit
mov ecx, 6
call fcn.004af880
int3
Function at 0x4b4c60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x568bac], 1
push ebx
push esi
push edi
mov esi, ecx
jne 0x4b4d40
mov dword [0x568bac], 2
test esi, esi
je 0x4b4c9e
mov al, byte [esi]
cmp al, 0x80
jae 0x4b4c9e
cmp byte [esi + 1], 0x3a
jne 0x4b4c9e
movzx eax, al
movzx ebx, byte [eax + 0x5d56a0]
jmp 0x4b4ca0
xor ebx, ebx
mov ecx, 0x210000
mov dword [0x58abb0], 0x28
mov dword [0x58abb4], 0x210000
call fcn.004b30d0
push 0
push 0
mov dword [0x58abb8], eax
xor ecx, ecx
lea eax, [ebp - 8]
mov dword [ebp - 4], 0x5c3a78
push eax
lea eax, [ebp - 0xc]
mov dword [0x58abbc], edx
push eax
push 0
push 0xd
test ebx, ebx
mov byte [ebp - 4], bl
lea eax, [ebp - 4]
push 0x58a784
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4b4d18
push 0
mov ecx, 0x58a784
mov dword [0x568b84], 0x58a784
call fcn.004b2b10
add esp, 4
jmp 0x4b4d22
mov dword [0x568b84], 0
test esi, esi
je 0x4b4d37
cmp byte [esi], 0x80
jae 0x4b4d40
cmp byte [esi + 1], 0x3a
jne 0x4b4d40
cmp byte [esi + 2], 0
jne 0x4b4d40
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x54ecf8
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4b4d67
test dl, dl
je 0x4b4d63
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4b4d67
add eax, 2
add ecx, 2
test dl, dl
jne 0x4b4d47
xor eax, eax
jmp 0x4b4d6c
sbb eax, eax
or eax, 1
mov ecx, esi
test eax, eax
jne 0x4b4d82
push eax
call fcn.004b2b10
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b4d85
sub ecx, edx
lea eax, [ecx + 2]
push eax
call fcn.004dad8d
mov edi, eax
add esp, 4
test edi, edi
jne 0x4b4daa
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
sub ecx, esi
nop
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4b4db0
mov al, byte [edi]
mov esi, edi
test al, al
je 0x4b4de5
cmp al, 0x5c
jne 0x4b4dcc
mov byte [esi], 0x2f
call fcn.004e006f
push eax
push esi
call fcn.004e0021
add esi, eax
add esp, 8
mov al, byte [esi]
test al, al
jne 0x4b4dc5
mov al, byte [edi]
mov esi, edi
test al, al
je 0x4b4e0b
nop dword [eax + eax]
cmp al, 0x3a
je 0x4b4e2a
call fcn.004e006f
push eax
push esi
call fcn.004e0021
add esi, eax
add esp, 8
mov al, byte [esi]
test al, al
jne 0x4b4df0
mov esi, edi
mov edx, esi
mov ecx, edi
call fcn.004b48e0
push edi
mov esi, eax
call fcn.004dab64
mov eax, esi
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc esi
mov edx, 0x3a
mov ecx, esi
call fcn.004b3760
test eax, eax
je 0x4b4e45
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, edi
jbe 0x4b4e0d
cmp byte [esi], 0
jne 0x4b4e0d
mov eax, 0x2e
mov word [esi], ax
jmp 0x4b4e0d
Function at 0x4b7600
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
push edi
push 0x50
call fcn.004e0a51
push edi
push 0x4b
call fcn.004e0a51
push edi
push 3
call fcn.004e0a51
push edi
push 4
call fcn.004e0a51
movsx eax, byte [esi + 2]
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 3]
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 0x2c]
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 0x2d]
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 6]
add esp, 0x40
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 7]
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 8]
push edi
push eax
call fcn.004e0a51
mov eax, dword [esi + 8]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 0xa]
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 0xb]
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 0xc]
push edi
push eax
call fcn.004e0a51
mov eax, dword [esi + 0xc]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 0xe]
add esp, 0x40
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 0xf]
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 0x10]
push edi
push eax
call fcn.004e0a51
mov eax, dword [esi + 0x10]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 0x12]
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 0x13]
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 0x14]
push edi
push eax
call fcn.004e0a51
mov eax, dword [esi + 0x14]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 0x16]
add esp, 0x40
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 0x17]
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 0x18]
push edi
push eax
call fcn.004e0a51
mov eax, dword [esi + 0x18]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.004e0a51
movsx eax, byte [esi + 0x1c]
push edi
push eax
call fcn.004e0a51
mov eax, dword [esi + 0x1c]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.004e0a51
push edi
push dword [esi + 0x18]
push 1
push dword [esi + 0x48]
call fcn.004e2dae
add esp, 0x40
cmp eax, dword [esi + 0x18]
jne 0x4b77a1
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4b779c
push edi
push eax
push 1
push dword [esi + 0x3c]
call fcn.004e2dae
add esp, 0x10
cmp eax, dword [esi + 0x1c]
jne 0x4b77a1
pop edi
xor eax, eax
pop esi
ret
pop edi
mov eax, 0xa
pop esi
ret
Function at 0x4b7b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x568bc4]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, ecx
push edi
mov dword [ebp - 0xc], eax
mov eax, dword [0x5d57a0]
push esi
push 0x50
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
call fcn.004e0a51
push esi
push 0x4b
call fcn.004e0a51
push esi
push 5
call fcn.004e0a51
push esi
push 6
call fcn.004e0a51
push esi
push 0
call fcn.004e0a51
push esi
push 0
call fcn.004e0a51
push esi
push 0
call fcn.004e0a51
push esi
push 0
call fcn.004e0a51
add esp, 0x40
movsx edi, bl
push esi
push edi
call fcn.004e0a51
shr ebx, 8
movsx esi, bl
mov ebx, dword [ebp + 0x14]
push ebx
push esi
call fcn.004e0a51
push ebx
push edi
call fcn.004e0a51
mov edi, ebx
push edi
push esi
call fcn.004e0a51
mov ebx, dword [ebp - 4]
movsx eax, bl
push edi
push eax
call fcn.004e0a51
mov eax, ebx
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.004e0a51
mov eax, ebx
shr eax, 0x10
movsx eax, al
push edi
push eax
call fcn.004e0a51
shr ebx, 0x18
movsx eax, bl
push edi
push eax
call fcn.004e0a51
mov ebx, dword [ebp + 8]
add esp, 0x40
movsx eax, bl
push edi
push eax
call fcn.004e0a51
push edi
mov eax, ebx
shr eax, 8
movsx eax, al
push eax
call fcn.004e0a51
mov eax, ebx
shr eax, 0x10
movsx eax, al
push edi
push eax
call fcn.004e0a51
shr ebx, 0x18
movsx eax, bl
push edi
push eax
call fcn.004e0a51
mov ebx, dword [ebp - 8]
movsx eax, bl
push edi
push eax
call fcn.004e0a51
mov eax, ebx
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.004e0a51
add esp, 0x30
test ebx, ebx
je 0x4b7c53
push edi
push ebx
push 1
push dword [ebp - 0xc]
call fcn.004e2dae
add esp, 0x10
cmp eax, ebx
je 0x4b7c53
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b8730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [0x58abcc]
xor edx, edx
push esi
mov esi, dword [0x5a5504]
xor ecx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
mov dword [0x5d5564], 2
push edi
test ebx, ebx
je 0x4b890d
mov edi, dword [0x58abc8]
cmp ebx, 3
jb 0x4b87ab
movzx eax, byte [esi + 0x5b5542]
shl edi, 5
xor edi, eax
mov eax, esi
and edi, 0x7fff
and eax, 0x7fff
mov dword [0x58abc8], edi
movzx ecx, word [edi*2 + 0x5a5520]
mov edx, ecx
mov word [eax*2 + 0x5c5560], cx
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov word [edi*2 + 0x5a5520], si
test edx, edx
je 0x4b87da
mov eax, esi
sub eax, edx
cmp eax, 0x7efa
ja 0x4b87da
mov eax, dword [0x5a550c]
mov ecx, edx
cmp eax, ebx
cmova eax, ebx
mov dword [0x5a550c], eax
call fcn.004b8470
mov ecx, eax
cmp ecx, ebx
cmova ecx, ebx
mov dword [ebp - 4], ecx
cmp ecx, 3
jb 0x4b8885
lea edx, [ecx - 3]
mov ecx, esi
sub ecx, dword [0x5a5510]
call fcn.004b9e20
mov edx, dword [ebp - 4]
mov ecx, eax
sub ebx, edx
mov dword [ebp - 0xc], ecx
mov dword [0x58abcc], ebx
cmp edx, dword [0x58abc0]
ja 0x4b8859
cmp ebx, 3
jb 0x4b8859
dec edx
movzx eax, byte [esi + 0x5b5543]
inc esi
shl edi, 5
xor edi, eax
mov eax, esi
and edi, 0x7fff
and eax, 0x7fff
movzx ecx, word [edi*2 + 0x5a5520]
mov dword [ebp - 8], ecx
mov word [eax*2 + 0x5c5560], cx
mov word [edi*2 + 0x5a5520], si
sub edx, 1
jne 0x4b8811
mov ecx, dword [ebp - 0xc]
mov dword [0x58abc8], edi
mov dword [ebp - 4], edx
jmp 0x4b889c
add esi, edx
mov dword [ebp - 4], 0
mov edx, esi
movzx edi, byte [edx + 0x5b5540]
movzx eax, byte [edx + 0x5b5541]
shl edi, 5
xor edi, eax
and edi, 0x7fff
mov dword [0x58abc8], edi
jmp 0x4b889f
movzx edx, byte [esi + 0x5b5540]
xor ecx, ecx
call fcn.004b9e20
dec ebx
mov ecx, eax
mov dword [0x58abcc], ebx
inc esi
mov edx, esi
mov dword [0x5a5504], esi
test ecx, ecx
je 0x4b88e0
mov eax, dword [0x5d5560]
test eax, eax
js 0x4b88ba
lea ecx, [eax + 0x5b5540]
jmp 0x4b88bc
xor ecx, ecx
push 0
sub edx, eax
call fcn.004b9ac0
mov esi, dword [0x5a5504]
add esp, 4
mov ebx, dword [0x58abcc]
mov edi, dword [0x58abc8]
mov dword [0x5d5560], esi
cmp ebx, 0x106
jae 0x4b88ff
call fcn.004b85c0
mov ebx, dword [0x58abcc]
mov edi, dword [0x58abc8]
mov esi, dword [0x5a5504]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
test ebx, ebx
jne 0x4b8767
mov eax, dword [0x5d5560]
test eax, eax
js 0x4b891e
lea ecx, [eax + 0x5b5540]
jmp 0x4b8920
xor ecx, ecx
sub esi, eax
push 1
mov edx, esi
call fcn.004b9ac0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b8bf0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, 0x12345678
mov esi, 0x23456789
mov dword [0x58abd8], ebx
mov edx, 0x34567890
mov dword [0x58abdc], esi
mov dword [0x58abe0], edx
mov al, byte [edi]
test al, al
je 0x4b8c75
nop dword [eax]
movsx eax, al
lea edi, [edi + 1]
xor eax, ebx
mov ecx, ebx
mov ebx, dword [0x5d5c34]
movzx eax, al
shr ecx, 8
mov ebx, dword [ebx + eax*4]
xor ebx, ecx
mov ecx, dword [0x5d5c34]
movzx eax, bl
add eax, esi
imul esi, eax, 0x8088405
inc esi
mov eax, esi
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [ecx + eax*4]
mov al, byte [edi]
test al, al
jne 0x4b8c20
mov dword [0x58abe0], edx
mov dword [0x58abd8], ebx
mov dword [0x58abdc], esi
pop edi
pop esi
pop ebx
ret
Function at 0x4b8f10
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x568bd0], 0
mov edx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], edx
je 0x4b8fcf
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4b8fcf
mov eax, dword [0x58abdc]
push ebx
mov ebx, dword [0x58abd8]
push esi
push edi
mov edi, dword [0x58abe0]
mov dword [ebp - 4], eax
mov dl, byte [ecx]
mov esi, edi
movsx eax, dl
mov ecx, ebx
xor eax, ebx
shr ecx, 8
mov ebx, dword [0x5d5c34]
and esi, 0xfffd
movzx eax, al
or esi, 2
mov ebx, dword [ebx + eax*4]
xor ebx, ecx
mov ecx, dword [0x5d5c34]
movzx eax, bl
add eax, dword [ebp - 4]
imul eax, eax, 0x8088405
inc eax
mov dword [ebp - 4], eax
mov dword [0x58abdc], eax
shr eax, 0x18
xor eax, edi
shr edi, 8
movzx eax, al
xor edi, dword [ecx + eax*4]
mov eax, esi
mov ecx, dword [ebp - 8]
xor eax, 1
imul eax, esi
shr eax, 8
xor al, dl
mov byte [ecx], al
inc ecx
sub dword [ebp - 0xc], 1
mov dword [ebp - 8], ecx
jne 0x4b8f50
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [0x58abe0], edi
pop edi
pop esi
mov dword [0x58abd8], ebx
pop ebx
push dword [ebp + 0xc]
push eax
push 1
push edx
call fcn.004e2dae
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4ba420
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x568d58], 0
push ebx
push esi
push edi
je 0x4ba452
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
jne 0x4ba475
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push edi
push 0x568d54
call ebx
mov esi, eax
test esi, esi
je 0x4ba4be
push esi
push 0x568d54
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x568d58]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
push 0x5d7da0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x124
push 0
push 0x5a53e0
call fcn.004cddb0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4ba5b2
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
lea eax, [ebp - 0x10]
push eax
push str.SeBackupPrivilege
push 0
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4ba55c
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4ba55c
call esi
test eax, eax
jne 0x4ba55c
mov dword [0x568c58], 1
push dword [ebp - 0x18]
mov esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4ba5b7
cmp dword [0x568c58], 0
jne 0x4ba54c
lea eax, [ebp - 0x10]
push eax
push str.SeSecurityPrivilege
push 0
call ebx
test eax, eax
je 0x4ba54c
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4ba54c
call esi
mov ecx, dword [0x569b74]
test eax, eax
push dword [ebp - 0x18]
mov esi, 1
cmove ecx, esi
mov dword [0x569b74], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4ba5b7
mov esi, 1
push edi
mov dword [0x568d58], 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
Function at 0x4bab50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push dword [0x5a4b80]
mov edi, ecx
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [edi + 4], eax
test eax, eax
jne 0x4bac08
push 0x569c18
mov dword [ebp - 8], 0x569c18
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x569b80]
test eax, eax
je 0x4babb8
mov dword [edi], eax
lea ecx, [ebp - 8]
mov eax, dword [eax + 0x60]
mov esi, dword [edi]
mov dword [0x569b80], eax
mov dword [edi + 4], esi
call fcn.0041e950
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x64
call fcn.004cbf3d
mov esi, eax
add esp, 4
lea ecx, [esi + 4]
mov dword [esi], vtable.omni_thread.0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 1
sub esp, 8
mov ecx, esi
call fcn.004bb0b0
mov dword [esi + 0x28], 0
lea ecx, [ebp - 8]
mov dword [esi + 0x2c], 0
mov dword [esi], vtable._internal_omni_thread_dummy.0
mov dword [esi + 0x60], 0
mov dword [edi], esi
mov dword [edi + 4], esi
call fcn.0041e950
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4bae10
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [0x5a4ba0]
push ebx
mov ebx, ecx
lea eax, [edx + 1]
mov dword [0x5a4ba0], eax
test edx, edx
jne 0x4baec6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x5a4b80], eax
cmp eax, 0xffffffff
je 0x4baecd
push esi
push edi
push 0x18
call fcn.004cbf3d
add esp, 4
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x60
mov dword [0x569b7c], esi
call fcn.004cbf3d
push ecx
mov ecx, eax
call fcn.004bb070
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
push 2
push 0
push 0
lea eax, [edi + 0x44]
mov dword [edi + 0x1c], 1
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x4baee9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
push dword [0x5a4b80]
mov dword [edi + 0x48], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4baf05
push 0
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
test eax, eax
je 0x4baf21
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 4]
call fcn.004bab00
push 0x55499c
mov eax, ecx
push eax
call fcn.004ce518
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 4]
call fcn.004bab00
push 0x55499c
mov eax, ecx
push eax
call fcn.004ce518
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 4]
call fcn.004bab00
push 0x55499c
mov eax, ecx
push eax
call fcn.004ce518
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 4]
call fcn.004bab00
push 0x55499c
mov eax, ecx
push eax
call fcn.004ce518
int3