joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50816b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x521f54
push 0x521f4c
push str.FlsAlloc
push 0x1f
call fcn.00507e39
mov esi, eax
add esp, 0x10
test esi, esi
je 0x50819f
push dword [ebp + 8]
mov ecx, esi
call dword [0x51e36c]
call esi
jmp 0x5081a5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x5081e9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x521f64
push 0x521f5c
push str.FlsGetValue
push 0x21
call fcn.00507e39
mov esi, eax
add esp, 0x10
test esi, esi
je 0x508220
push dword [ebp + 8]
mov ecx, esi
call dword [0x51e36c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x508228
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x521f6c
push 0x521f64
push str.FlsSetValue
push 0x22
call fcn.00507e39
mov esi, eax
add esp, 0x10
test esi, esi
je 0x508262
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x51e36c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x5148eb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x573ad8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x51492b
cmp byte [ebx], 0xa
jne 0x51492b
or byte [edi + eax + 0x28], 4
jmp 0x514930
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x514a2f
mov dl, byte [eax]
cmp dl, 0x1a
je 0x514a12
inc eax
cmp dl, 0xd
je 0x51495c
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x514982
cmp eax, ecx
jae 0x514990
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x514944
jmp 0x514a2f
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x514a0d
cmp dword [ebp - 0x10], 0
je 0x514a0d
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x573ad8]
test byte [eax + edi + 0x28], 0x48
je 0x5149e7
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x5149d2
mov byte [esi], dl
jmp 0x5149e3
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x573ad8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x514a2f
cmp byte [ebp - 1], 0xa
jne 0x5149f6
cmp esi, ebx
jne 0x5149f6
mov byte [esi], 0xa
jmp 0x514a2e
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0051473d
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x514a2f
mov byte [esi], 0xd
jmp 0x514a2e
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x573ad8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x514a2c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x514a2f
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x514a38
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x573ad8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x514a7e
cmp word [ebx], dx
jne 0x514a7e
or byte [eax + edi + 0x28], 4
jmp 0x514a83
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x514be6
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x514bc6
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x514ac4
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x514afa
cmp eax, edx
jae 0x514b08
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x514a9f
jmp 0x514be6
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x514bc1
cmp dword [ebp - 0x18], 0
je 0x514bc1
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x573ad8]
test byte [eax + edi + 0x28], 0x48
je 0x514b97
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x514b5b
mov word [esi], cx
jmp 0x514b92
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x573ad8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x573ad8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x573ad8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x514be6
pop eax
cmp word [ebp - 4], ax
jne 0x514ba7
cmp esi, ebx
jne 0x514ba7
mov word [esi], ax
jmp 0x514be3
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0051473d
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x514be6
push 0xd
pop eax
jmp 0x514ba2
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x573ad8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x514be0
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x514be6
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x5195b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5195dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5195dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401020
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x401082
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x401073
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 4]
cmp eax, ebx
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401090
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x138]
xor eax, eax
push ecx
mov word [esi], ax
mov dword [ebp - 0x138], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x128], 2
jne 0x4010e7
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x24], 0
jne 0x4010e7
push str.i486_nt
push 0x400
push esi
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401590
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x4015a8
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0
push 6
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4015c1
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 0x128]
push eax
push esi
mov dword [ebp - 0x128], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401644
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
je 0x4015f3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x120], eax
je 0x401629
mov ecx, edi
lea eax, [ebp - 0x104]
jmp 0x401600
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401620
test dl, dl
je 0x40161c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401620
add eax, 2
add ecx, 2
test dl, dl
jne 0x401600
xor eax, eax
jmp 0x401625
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401654
lea ecx, [ebp - 0x128]
push ecx
push esi
mov dword [ebp - 0x128], 0x128
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4015e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4018e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
lea eax, [ebp - 8]
push eax
xor edi, edi
lea ecx, [ebp - 4]
push ecx
push edi
push 0xf003f
push edi
push edi
push edi
push str.SOFTWAREPTC
push 0x80000002
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x40191e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push edi
push 0xf003f
push 1
push edi
push edi
push str.SOFTWAREPTCPIMInProgress
push 0x80000002
call esi
test eax, eax
jne 0x401996
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [ebp - 0x14]
movzx edx, word [ebp - 0x12]
mov ecx, eax
shl ecx, 4
sub ecx, eax
lea eax, [edx + ecx*4]
movzx edx, word [ebp - 0x10]
mov ecx, eax
shl ecx, 4
sub ecx, eax
push 4
lea eax, [edx + ecx*4]
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push ecx
push 4
push edi
push str.TimeStamp
push edx
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40198c
lea edi, [eax + 1]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4019a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
lea eax, [ebp - 4]
push eax
push 0xf003f
xor esi, esi
push esi
push str.SOFTWAREPTCPIMInProgress
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401a81
mov eax, 4
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
push ecx
push esi
push str.TimeStamp
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401a77
push 1
push str.setup.exe
call fcn.00401590
add esp, 8
test eax, eax
jne 0x401a72
push 1
push str.pim_setup.exe
call fcn.00401590
add esp, 8
test eax, eax
jne 0x401a72
push 1
push 0x40434c
call fcn.00401590
add esp, 8
test eax, eax
jne 0x401a72
push 1
push 0x40433c
call fcn.00401590
add esp, 8
test eax, eax
jne 0x401a72
push 1
push str.pimuninstall.exe
call fcn.00401590
add esp, 8
test eax, eax
jne 0x401a72
push 1
push 0x404318
call fcn.00401590
add esp, 8
test eax, eax
je 0x401a77
mov esi, 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401a90
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0xf003f
xor esi, esi
push esi
push str.SOFTWAREPTCPIM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401ad5
mov ecx, dword [ebp - 4]
push str.InProgress
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x401acb
lea esi, [eax + 1]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401ae0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
push ebx
push esi
mov esi, dword [ebp + 8]
cmp word [esi], 0
push edi
jne 0x401b18
lea eax, [ebp - 0x14]
push eax
call fcn.00401090
lea ecx, [ebp - 0x14]
push ecx
push str.pim_sinstallmgr.dll
push 0xffffffffffffffff
push 0x400
push esi
call dword [sym.imp.MSVCR100.dll__snwprintf_s]
add esp, 0x18
push 0x400
lea edx, [ebp - 0x814]
push edx
push str.PIM_INSTALLMGR_DLL
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x401b5f
lea eax, [ebp - 0x814]
push eax
call edi
mov ebx, eax
test ebx, ebx
je 0x401b5f
lea ecx, [ebp - 0x814]
push ecx
push str.Loaded_PIM__s
call dword [sym.imp.MSVCR100.dll_wprintf]
add esp, 8
jmp 0x401b64
push esi
call edi
mov ebx, eax
test ebx, ebx
jne 0x401ba4
lea edx, [ebp - 0x14]
push edx
call fcn.004014f0
lea eax, [ebp - 0x14]
push eax
push str.pim_sinstallmgr.dll
push 0xffffffffffffffff
push 0x400
push esi
call dword [sym.imp.MSVCR100.dll__snwprintf_s]
add esp, 0x18
push esi
call edi
test eax, eax
jne 0x401ba6
push str.installmgr.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401bb0
Capabilities:
Get common file path
Get system information on windows
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20b54
call fcn.00402be0
lea ecx, [ebp - 0x14c]
xor eax, eax
push ecx
mov word [ebp - 0x14], ax
mov dword [ebp - 0x14c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x13c], 2
jne 0x401c0b
lea edx, [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x38], 0
jne 0x401c0b
push str.i486_nt
lea eax, [ebp - 0x14]
push 0x400
push eax
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
push esi
lea ecx, [ebp - 0x354]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, dword [sym.imp.MSVCR100.dll__snwprintf_s]
lea edx, [ebp - 0x354]
push edx
push str.PIM_DIRECTORY_spim
push 0xffffffffffffffff
lea eax, [ebp - 0xb54]
push 0x400
push eax
call esi
lea ecx, [ebp - 0xb54]
push ecx
call dword [sym.imp.MSVCR100.dll__wputenv]
add esp, 0x18
push 0x7fff
lea edx, [ebp - 0x20b54]
push edx
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x354]
push ecx
push 0x404438
push 0xffffffffffffffff
lea edx, [ebp - 0xb54]
push 0x400
push edx
call esi
mov esi, dword [sym.imp.MSVCR100.dll_wcscat_s]
lea eax, [ebp - 0xb54]
push eax
lea ecx, [ebp - 0x10b54]
push 0x7fff
push ecx
call esi
push 0x404434
lea edx, [ebp - 0x10b54]
push 0x7fff
push edx
call esi
lea eax, [ebp - 0x20b54]
push eax
lea ecx, [ebp - 0x10b54]
push 0x7fff
push ecx
call esi
add esp, 0x3c
lea edx, [ebp - 0x10b54]
push edx
push str.PATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b200
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 8], 0xdd
mov dword [ebp - 0x50], 0x1bd
mov dword [ebp - 0x30], 0x24e
mov dword [ebp - 0x10], 0x47
mov dword [ebp - 0x5c], 0x35e
mov dword [ebp - 0x60], 0xbe
mov dword [ebp - 0x6c], 0x267
mov dword [ebp - 0x4c], 0x28f
mov dword [ebp - 0x38], 0x37e
mov dword [ebp - 0x74], 0x2ec
mov dword [ebp - 0x68], 0x32b
mov dword [ebp - 0x3c], 0xfb
mov dword [ebp - 0x64], 0x379
mov dword [ebp - 0x54], 0x20d
mov dword [ebp - 0x34], 0x38e
mov dword [ebp - 0x78], 0x33b
mov dword [ebp - 0x70], 0x2f9
mov dword [ebp - 4], 0x24d
mov dword [ebp - 0x58], 0x101
mov dword [ebp - 0x7c], 0x274
mov dword [ebp - 0x80], 0x181
mov dword [ebp - 0x48], 0x1ce
mov dword [ebp - 0x84], 0x1ae
mov dword [ebp - 0xc], 0x157
mov dword [ebp - 0x88], 0x256
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x50]
jge 0x40b2cf
mov dword [ebp - 0x18], 1
jmp 0x40b2d6
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x38]
jge 0x40b2e7
mov dword [ebp - 0x1c], 1
jmp 0x40b2ee
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x54]
add edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 0x10]
jge 0x40b302
mov dword [ebp - 0x20], 1
jmp 0x40b309
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x20]
je 0x40b31d
mov ecx, dword [ebp - 4]
nop
nop
inc ecx
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x5c]
jge 0x40b32e
mov dword [ebp - 0x24], 1
jmp 0x40b335
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 4]
jge 0x40b346
mov dword [ebp - 0x28], 1
jmp 0x40b34d
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x60]
cmp ecx, dword [ebp - 0x10]
jge 0x40b35e
mov dword [ebp - 0x2c], 1
jmp 0x40b365
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp - 0x24]
and edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x64]
xor eax, dword [ebp - 0x2c]
or edx, eax
je 0x40b37e
mov ecx, dword [ebp - 0xc]
dec ecx
nop
nop
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 0x131
push edx
call fcn.00424a50
add esp, 4
mov dword [ebp - 0x14], 0
jmp 0x40b3a2
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x186e7
cmp dword [ebp - 0x14], ecx
jge 0x40b423
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 8]
nop
dec edx
nop
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x34]
or edx, dword [ebp - 0x68]
or edx, ecx
or edx, eax
je 0x40b41e
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x3c]
jge 0x40b3eb
mov dword [ebp - 0x40], 1
jmp 0x40b3f2
mov dword [ebp - 0x40], 0
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x70]
jge 0x40b406
mov dword [ebp - 0x44], 1
jmp 0x40b40d
mov dword [ebp - 0x44], 0
mov edx, dword [ebp - 0x40]
or edx, dword [ebp - 0x44]
je 0x40b41e
mov eax, dword [ebp - 0x48]
dec eax
nop
nop
mov dword [ebp - 0x48], eax
jmp 0x40b399
mov ecx, dword [ebp - 0x4c]
nop
nop
inc ecx
mov dword [ebp - 0x4c], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40b520
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x5c], 0x94
mov dword [ebp - 0x4c], 0xd0
mov dword [ebp - 0x3c], 0x3e
mov dword [ebp - 0x54], 0x9b
mov dword [ebp - 0x68], 0x1a0
mov dword [ebp - 0x34], 0x2ef
mov dword [ebp - 0x2c], 0x22d
mov dword [ebp - 4], 0xde
mov dword [ebp - 8], 0xcd
mov dword [ebp - 0x6c], 0x256
mov dword [ebp - 0x14], 0xfe
mov dword [ebp - 0x10], 0x2cf
mov dword [ebp - 0x44], 0x365
mov dword [ebp - 0x70], 0x1ac
mov dword [ebp - 0x40], 0x153
mov dword [ebp - 0x20], 0x31f
mov dword [ebp - 0x64], 0x28e
mov dword [ebp - 0x50], 0x2ef
mov dword [ebp - 0x18], 0x231
mov dword [ebp - 0x60], 0x385
mov dword [ebp - 0x48], 0x32a
mov dword [ebp - 0x74], 0x25
mov dword [ebp - 0x38], 0x1c9
mov dword [ebp - 0xc], 0
jmp 0x40b5d9
mov eax, dword [ebp - 0xc]
nop
inc eax
nop
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x186de
cmp dword [ebp - 0xc], ecx
jge 0x40b695
mov edx, dword [ebp - 0x40]
and edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 4]
jge 0x40b5ff
mov dword [ebp - 0x24], 1
jmp 0x40b606
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x48]
jge 0x40b617
mov dword [ebp - 0x28], 1
jmp 0x40b61e
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x10]
nop
inc ecx
nop
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x28]
or edx, eax
je 0x40b68a
mov ecx, dword [ebp - 0x14]
nop
nop
dec ecx
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
or edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x18]
jge 0x40b657
mov dword [ebp - 0x30], 1
jmp 0x40b65e
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
and ecx, dword [ebp - 0x54]
and ecx, dword [ebp - 0x30]
or eax, ecx
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 8]
dec edx
nop
nop
mov dword [ebp - 8], edx
cmp dword [ebp - 0x58], 0
je 0x40b68a
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x40b5d0
mov dword [ebp - 0x1c], 0
jmp 0x40b6a7
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x5c]
sub edx, 0x18734
cmp dword [ebp - 0x1c], edx
jge 0x40b6c6
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [ebp - 0x34]
dec eax
nop
nop
mov dword [ebp - 0x34], eax
jmp 0x40b69e
mov ecx, dword [ebp - 0x38]
add ecx, 0x183
push ecx
mov edx, dword [ebp - 4]
add edx, 0x60
push edx
mov eax, dword [ebp - 4]
add eax, 3
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x3b
push ecx
mov edx, dword [ebp - 0x38]
add edx, 0x208
push edx
mov eax, dword [ebp - 0x60]
sub eax, 0x17f
push eax
mov ecx, dword [ebp - 0x64]
sub ecx, 0x224
push ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x2e5
push edx
mov eax, dword [ebp - 0x20]
sub eax, 0x2df
push eax
call fcn.004096e0
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x40c750
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x1c], 0x159
mov dword [ebp - 0x20], 0x2fe
mov dword [ebp - 0x24], 0x300
mov dword [ebp - 0x28], 0x1fe
mov dword [ebp - 0x2c], 0x380
mov dword [ebp - 0x30], 0x62
mov dword [ebp - 0x34], 0x1a4
mov dword [ebp - 0x38], 0x171
mov dword [ebp - 0x3c], 0x63
mov dword [ebp - 0x40], 0x2ef
mov dword [ebp - 0x44], 0xe4
mov dword [ebp - 0xc], 0x26b
mov dword [ebp - 0x48], 0x18d
mov dword [ebp - 0x4c], 0x222
mov dword [ebp - 0x14], 0x190
mov dword [ebp - 0x50], 0xea
mov dword [ebp - 0x54], 0x272
mov dword [ebp - 0x10], 0x97
mov dword [ebp - 0x18], 0x20a
mov dword [ebp - 0x58], 0xab
mov dword [ebp - 0x5c], 0x318
mov dword [ebp - 8], 0x32c
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x40c80b
mov ecx, dword [ebp - 4]
nop
nop
inc ecx
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x18737
cmp dword [ebp - 4], edx
jge 0x40c832
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jge 0x40c830
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x40c802
mov esp, ebp
pop ebp
ret