joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d1620
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
pop ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 0xc]
call fcn.0040caf0
push eax
mov eax, dword [ebp - 0x14]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0xc], 1
jne 0x4d167f
cmp dword [ebp - 0x10], 0
jne 0x4d16c6
mov dword [ebx], 0
push 0x532cb0
call fcn.0040dc70
pop ecx
push eax
push 0x532cb0
mov ecx, ebx
call fcn.0040c560
cmp dword [ebx], 0
je 0x4d16ad
mov ebx, dword [ebx]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
cmp dword [ebp - 8], 0
je 0x4d16bb
mov ecx, dword [ebp - 8]
call fcn.0040c380
mov eax, dword [ebp + 8]
lea esp, [ebp - 4]
pop ebx
pop ebp
ret 8
mov eax, dword [ebp - 0x10]
add eax, 0xffffffff
push eax
lea ecx, [ebp - 8]
call fcn.0040c430
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
call fcn.0040cb50
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 0xc]
call fcn.0040caf0
push eax
mov eax, dword [ebp - 0x14]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 8]
mov dword [ebx], edx
cmp dword [ebx], 0
je 0x4d170d
mov ecx, dword [ebx]
call fcn.0040c350
cmp dword [ebp - 8], 0
je 0x4d171b
mov ecx, dword [ebp - 8]
call fcn.0040c380
mov eax, dword [ebp + 8]
lea esp, [ebp - 4]
pop ebx
pop ebp
ret 8

Function at 0x4d1730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 8]
call fcn.0040caf0
push eax
mov eax, dword [ebp - 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 8], 4
jne 0x4d178b
cmp dword [ebp - 0xc], 4
je 0x4d1794
mov eax, 0xffffffff
leave
ret 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 8]
call fcn.0040caf0
push eax
mov eax, dword [ebp - 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x4d17c0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
call fcn.0040caf0
push eax
mov eax, dword [ebp - 4]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, 0
sete al
leave
ret 4
Function at 0x4d17f0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [ebp - 8], ecx
call fcn.00492660
cmp al, 0
je 0x4d1879
cmp byte [0x5491e4], 0
jne 0x4d182e
push str.shlwapi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x5491e0], eax
mov byte [0x5491e4], 1
mov dword [ebp - 4], 0
cmp dword [0x5491e0], 0
je 0x4d1879
cmp dword [ebp - 4], 0
jne 0x4d1858
push str.SHDeleteKeyA
push dword [0x5491e0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d1879
mov ecx, dword [ebp + 8]
call fcn.0040cb50
push eax
mov eax, dword [ebp - 8]
push dword [eax]
call dword [ebp - 4]
cmp eax, 0
sete al
leave
ret 4
mov ecx, dword [ebp + 8]
call fcn.0040cb50
push eax
mov eax, dword [ebp - 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, 0
sete al
leave
ret 4

Function at 0x4d5400
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0xc
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x14], 0
jne 0x4d5441
mov eax, dword [ebp - 0x10]
add eax, 0x14
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x4d5464
mov eax, dword [ebp - 0xc]
lea esp, [ebp - 4]
pop esi
pop ebp
ret 8
push dword [ebp + 0xc]
push 0x4ff048
push 0
push dword [ebp - 8]
mov eax, dword [ebp - 0x10]
push dword [eax + 0x14]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x14]
mov esi, dword [edx]
call dword [esi + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
lea esp, [ebp - 4]
pop esi
pop ebp
ret 8

Function at 0x4d9960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
pop ecx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x4d998a
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
jmp 0x4d998f
mov edx, 0
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
jmp 0x4d99ec
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x4d99ba
mov ebx, dword [ebp - 8]
add ebx, 1
mov eax, dword [ebp + 8]
mov edx, dword [eax]
add ebx, dword [edx + 4]
jmp 0x4d99bf
mov ebx, 0x501009
movzx eax, byte [ebx]
mov dword [ebp - 0x14], eax
cmp byte [ebp - 0x14], 0x61
jl 0x4d99da
cmp byte [ebp - 0x14], 0x7a
jg 0x4d99da
mov dl, byte [ebp - 0x14]
add dl, 0xe0
mov byte [ebp - 0x14], dl
mov ecx, dword [ebp - 0x10]
shl ecx, 2
movsx edx, byte [ebp - 0x14]
xor ecx, edx
mov dword [ebp - 0x10], ecx
inc dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 8], eax
jl 0x4d99a2
mov eax, dword [ebp - 0x10]
and eax, 0xff
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
Function at 0x4e44b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [ebp - 0x10], 0
call fcn.00492600
cmp al, 0
je 0x4e44e1
call fcn.00492630
mov dword [ebp - 0x10], eax
jmp 0x4e4500
mov dword [0x5354a0], 0
push 0
push 0x4e1160
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x5354a0]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
push str.HWND
call fcn.0040dc70
pop ecx
push eax
push str.HWND
lea ecx, [ebp - 8]
call fcn.0040c560
cmp dword [ebp - 8], 0
je 0x4e4532
mov ebx, dword [ebp - 8]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
call fcn.0040dfd0
pop ecx
pop ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.004e10c0
pop ecx
pop ecx
cmp dword [ebp - 0xc], 0
je 0x4e455d
mov ecx, dword [ebp - 0xc]
call fcn.0040c380
cmp dword [ebp - 8], 0
je 0x4e456b
mov ecx, dword [ebp - 8]
call fcn.0040c380
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
Function at 0x4ec920
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0x50
push dword [ebp + 8]
push 0x40000038
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x51
push eax
push 0x40000039
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0xa2
push eax
push 0x4000003a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0xf3
push eax
push 0x4000003b
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x144
push eax
push 0x4000003c
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x195
push eax
push 0x4000003d
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x1e6
push eax
push 0x4000003e
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x237
push eax
push 0x4000003f
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x288
push eax
push 0x40000040
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x2d9
push eax
push 0x40000041
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x32a
push eax
push 0x40000042
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x37b
push eax
push 0x40000043
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov eax, dword [ebp + 8]
mov byte [eax + 3], 0
push dword [ebp + 8]
call fcn.004f94d0
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x54], 0
mov eax, dword [ebp + 8]
add eax, 0x51
push eax
call fcn.004f94d0
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0xa5], 0
mov eax, dword [ebp + 8]
add eax, 0xa2
push eax
call fcn.004f94d0
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0xf6], 0
mov eax, dword [ebp + 8]
add eax, 0xf3
push eax
call fcn.004f94d0
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x147], 0
mov eax, dword [ebp + 8]
add eax, 0x144
push eax
call fcn.004f94d0
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x198], 0
mov eax, dword [ebp + 8]
add eax, 0x195
push eax
call fcn.004f94d0
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x1e9], 0
mov eax, dword [ebp + 8]
add eax, 0x1e6
push eax
call fcn.004f94d0
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x23a], 0
mov eax, dword [ebp + 8]
add eax, 0x237
push eax
call fcn.004f94d0
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x28b], 0
mov eax, dword [ebp + 8]
add eax, 0x288
push eax
call fcn.004f94d0
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x2dc], 0
mov eax, dword [ebp + 8]
add eax, 0x2d9
push eax
call fcn.004f94d0
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x32d], 0
mov eax, dword [ebp + 8]
add eax, 0x32a
push eax
call fcn.004f94d0
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x37e], 0
mov eax, dword [ebp + 8]
add eax, 0x37b
push eax
call fcn.004f94d0
pop ecx
leave
ret
Function at 0x4f0770
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 8
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [esp + 4], eax
cmp byte [0x549c48], 0
jne 0x4f07b4
mov dword [0x549c58], 0
push 0x549c4c
push 0x401ea0
push 0x549c58
call fcn.004f2fa0
add esp, 0xc
mov byte [0x549c48], 1
cmp byte [0x549c60], 0
jne 0x4f07d0
mov edx, dword [0x5022fc]
mov dword [0x549c5c], edx
mov byte [0x549c60], 1
mov ebx, dword [0x549c58]
mov eax, dword [ebp + 8]
mov edx, dword [eax]
cmp ebx, edx
jne 0x4f07ea
mov eax, dword [0x549c5c]
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
mov eax, dword [0x5022f8]
mov dword [ebp - 8], eax
mov dword [ebp - 8], 0x500
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [ebp - 0xc], eax
movzx edx, word [ebp - 0xc]
sub edx, 0x411
cmp edx, 0
ja case.default.0x4f0811
jmp dword [edx*4 + 0x4feaf4]
mov dword [ebp - 8], 0xa01
mov eax, dword [ebp - 8]
mov dword [0x549c5c], eax
mov eax, dword [ebp - 8]
lea esp, [ebp - 4]
pop ebx
pop ebp
ret

Function at 0x4f0830
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [ebp - 8], 0x500
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [ebp - 0xc], eax
movzx edx, word [ebp - 0xc]
sub edx, 0x411
cmp edx, 0
ja case.default.0x4f0865
jmp dword [edx*4 + 0x4feaf8]
mov dword [ebp - 8], 0xa01
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x4f0889
mov ecx, dword [ebp - 4]
call fcn.0040c350
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.004f0540
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4f08a9
mov ecx, dword [ebp - 4]
call fcn.0040c380
mov eax, dword [ebp + 8]
leave
ret
Function at 0x4f1750
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 0x201
rep stosd dword es:[edi], eax
pop edi
pop ecx
mov dword [ebp - 0x804], ecx
mov eax, dword [ebp - 0x804]
mov byte [eax + 0x10], 0
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x4f178f
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [edx + 0xc]
jmp 0x4f1794
mov eax, 0
cmp eax, 0
je 0x4f17c5
push 0
push 0x4000100
push 3
push 0
push 1
push 0xc0000000
mov ecx, dword [ebp + 8]
call fcn.0040caf0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x804]
mov dword [ecx + 0x18], eax
jmp 0x4f181a
lea eax, [ebp - 0x400]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x800]
push eax
push 0
push 0x53a634
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0
push 0x4000100
push 3
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x804]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x804]
cmp dword [eax + 0x18], 0xffffffff
jne 0x4f182c
mov al, 0
leave
ret 4
push 0xc
call fcn.00476140
pop ecx
cmp eax, 0
je 0x4f1848
push dword [ebp - 0x804]
mov ecx, eax
call fcn.004f13e0
mov eax, eax
mov ecx, dword [ebp - 0x804]
mov dword [ecx + 0x1c], eax
mov al, 1
leave
ret 4
Function at 0x4f3a70
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x549fac]
sub esp, 0x104
test eax, eax
jle 0x4f3a8f
inc eax
mov dword [0x549fac], eax
xor ax, ax
add esp, 0x104
ret
push esi
push str.QuickTime.qts
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4f3ac5
lea ecx, [esp + 4]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x4f3ac5
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
jmp 0x4f3b44
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x4f3b44
push ebp
push edi
mov edi, 0x53f8f8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.QuickTime.qts
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov esi, eax
pop ebp
test esi, esi
mov dword [0x549fb0], esi
jne 0x4f3b5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xfffff7d3
jmp 0x4f3bdf
push str._CallComponentFunctionWithStorage
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
mov dword [0x53f8a8], eax
je 0x4f3bda
mov ecx, dword [0x549fb0]
push str._CallComponent
push ecx
call esi
test eax, eax
mov dword [0x53f8a4], eax
je 0x4f3bda
mov edx, dword [0x549fb0]
push str.theQuickTimeDispatcher
push edx
call esi
test eax, eax
mov dword [0x53f8a0], eax
je 0x4f3bda
mov eax, dword [esp + 0x10c]
mov dword [0x53f89c], 0
push eax
call fcn.004f38f0
mov esi, eax
add esp, 4
test si, si
jne 0x4f3bdf
mov eax, dword [0x549fac]
inc eax
mov dword [0x549fac], eax
mov ax, si
pop esi
add esp, 0x104
ret
mov esi, 0xfffff7d2
mov eax, dword [0x549fb0]
test eax, eax
je 0x4f3bf9
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x549fb0], 0
mov eax, 0x4f3910
mov dword [0x53f89c], 0x4f3c30
mov dword [0x53f8a4], eax
mov dword [0x53f8a8], eax
mov dword [0x53f8a0], eax
mov ax, si
pop esi
add esp, 0x104
ret
Function at 0x4f9f70
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5412d8
push 0x4fbc30
push dword fs:[0]
mov dword fs:[0], esp
push eax
push ebx
sub esp, 0x48
mov dword [ebp - 0x14], esp
mov dword [ebp - 4], 0
push ebp
mov eax, 0xffffffff
push eax
push eax
push 0x4fbe70
push dword fs:[0]
mov dword fs:[0], esp
sub esp, 0x20
and esp, 0xffffffe0
push 0x540330
call fcn.004fbee0
pop ecx
call fcn.004fb9d0
test eax, eax
jne 0x4f9fd9
push 0xffffffffffffffff
call fcn.004f95d0
pop ecx
push section..CRT
call fcn.004fc2d0
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
test ebx, ebx
je 0x4f9ff6
add ebx, dword [0x54c2e0]
lea edx, [ebp - 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test dword [ebp - 0x34], 1
je 0x4fa010
movzx eax, word [ebp - 0x30]
jmp 0x4fa015
mov eax, 0xa
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.004f95d0
pop ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x4fa054
lea esp, [ebp - 0x18]
pop ebx
pop ecx
pop dword fs:[0]
add esp, 0xc
pop ebp
ret
Function at 0x4fa130
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push dword [0x540340]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4fa315
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4fa310
push 0x1d0
call fcn.004f4810
mov ebx, eax
test ebx, ebx
pop ecx
jne 0x4fa170
xor eax, eax
pop ebp
pop ebx
ret
mov ebp, 0x54c238
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x54a928]
mov dword [ebx], edx
mov dword [0x54a928], ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebx + 4], 0
mov dword [ebx + 8], 1
mov dword [ebx + 0xc], 0x540344
mov dword [ebx + 0x10], 0x540344
mov eax, dword [esp + 0xc]
mov dword [ebx + 0x14], eax
lea edx, [ebx + 0x188]
mov dword [ebx + 0x180], 0x540348
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 1
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x54], 1
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0xffffffff
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 1
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 1
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x184], 0
push 0x540b60
push edx
call fcn.004f6b50
pop ecx
pop ecx
mov ecx, dword [0x540b90]
mov dword [ebx + 0x1b8], ecx
mov eax, dword [0x540b94]
mov dword [ebx + 0x1bc], eax
mov edx, dword [0x540b98]
mov dword [ebx + 0x1c0], edx
mov ecx, dword [0x540b9c]
mov dword [ebx + 0x1c4], ecx
mov eax, dword [0x540ba0]
mov dword [ebx + 0x1c8], eax
xor edx, edx
mov ecx, dword [edx + 0x540b5c]
mov dword [edx + ebx + 0x184], ecx
mov ecx, dword [edx + 0x540b60]
mov dword [edx + ebx + 0x188], ecx
mov ecx, dword [edx + 0x540b64]
mov dword [edx + ebx + 0x18c], ecx
mov ecx, dword [edx + 0x540b68]
mov dword [edx + ebx + 0x190], ecx
add edx, 0x10
cmp edx, 0x40
jl 0x4fa295
mov ecx, dword [0x540b9c]
mov dword [ebx + 0x1c4], ecx
mov ecx, dword [0x540ba0]
mov dword [ebx + 0x1c8], ecx
mov dword [ebx + 0x17c], 0x540a84
mov dword [ebx + 0x1cc], 0
push ebx
push dword [0x540340]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop ebp
pop ebx
ret
xor eax, eax
pop ebp
pop ebx
ret
mov eax, 1
pop ebp
pop ebx
ret
Function at 0x4fab80
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 0xc
mov edi, dword [esp + 0x20]
cmp edi, 0x100
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov dword [esp], 0
jge 0x4fabad
mov ecx, dword [edi*4 + 0x54bda8]
test ecx, ecx
jne 0x4fabc7
push 1
call fcn.004fa390
pop ecx
mov dword [eax + 4], 9
or eax, 0xffffffff
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [ecx]
mov dword [esp + 8], eax
movsx edx, byte [ecx + 4]
test edx, edx
je 0x4fac26
xor esi, esi
xor eax, eax
test ebx, ebx
jbe 0x4fabf0
lea eax, [eax]
cmp byte [eax + ebp], 0xa
jne 0x4fabe9
add esi, 1
add eax, 1
cmp eax, ebx
jb 0x4fabe0
lea ecx, [esi + ebx]
push ecx
call fcn.004f4810
pop ecx
xor ecx, ecx
test ebx, ebx
mov dword [esp], eax
mov edx, eax
jbe 0x4fac21
cmp byte [ecx + ebp], 0xa
jne 0x4fac11
mov byte [edx], 0xd
add edx, 1
movzx eax, byte [ecx + ebp]
add ecx, 1
mov byte [edx], al
add edx, 1
cmp ecx, ebx
jb 0x4fac05
add ebx, esi
mov ebp, dword [esp]
mov edx, dword [edi*4 + 0x54bda8]
cmp byte [edx + 5], 0
je 0x4fac40
push 2
push 0
push edi
call fcn.004fab10
add esp, 0xc
push 0
lea ecx, [esp + 8]
push ecx
push ebx
push ebp
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp], 0
mov esi, eax
je 0x4fac64
push dword [esp]
call fcn.004f4840
pop ecx
test esi, esi
je 0x4fac74
mov eax, dword [esp + 4]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004fb690
xor eax, eax
pop ecx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4facf0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 4
cmp dword [esp + 0x18], 0x100
mov ebp, dword [esp + 0x1c]
jge 0x4fad14
mov eax, dword [esp + 0x18]
mov edx, dword [eax*4 + 0x54bda8]
test edx, edx
jne 0x4fad30
push 1
call fcn.004fa390
pop ecx
mov dword [eax + 4], 9
or eax, 0xffffffff
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
ret
movsx ebx, byte [edx + 4]
push 0
lea ecx, [esp + 4]
push ecx
push dword [esp + 0x28]
push ebp
push dword [edx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4fadd1
cmp dword [esp], 0
je 0x4fadc6
test ebx, ebx
je 0x4fadc6
mov esi, ebp
xor ebx, ebx
xor ecx, ecx
cmp dword [esp], 0
mov edi, esi
jbe 0x4fad97
movzx eax, byte [edi]
cmp al, 0xd
jne 0x4fad87
mov edx, dword [esp]
add edx, 0xffffffff
cmp ecx, edx
jae 0x4fad87
cmp byte [edi + 1], 0xa
jne 0x4fad87
add edi, 1
add ebx, 1
jmp 0x4fad8f
mov byte [esi], al
add edi, 1
add esi, 1
add ecx, 1
cmp ecx, dword [esp]
jb 0x4fad68
mov eax, dword [esp + 0x20]
cmp dword [esp], eax
jne 0x4fadc3
cmp dword [esp], 1
jbe 0x4fadc3
mov ecx, dword [esp]
cmp byte [ebp + ecx - 1], 0xd
jne 0x4fadc3
push 1
push 0xffffffffffffffff
push dword [esp + 0x20]
call fcn.004fab10
add esp, 0xc
add ebx, 1
sub dword [esp], ebx
mov eax, dword [esp]
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004fb690
xor eax, eax
pop ecx
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
ret