joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e0c30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x577698]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x4e0c63
mov dword [esp + 0x10], 0xffffffff
jmp 0x4e0c69
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4e0c97
push 0x52f388
mov eax, 0x52f388
call fcn.004e37b0
add esp, 4
jmp 0x4e0d77
push 0
lea edx, [esp + 0x1c]
push edx
push 8
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4e0cc7
push 0x52f388
mov eax, 0x52f388
call fcn.004e37b0
add esp, 4
jmp 0x4e0d77
mov eax, 8
cmp dword [esp + 0x18], eax
je 0x4e0ce9
mov eax, 1
push 0x52f388
call fcn.004e3820
add esp, 4
jmp 0x4e0d77
cmp dword [esp + 0x40], ebx
je 0x4e0d25
mov ebx, eax
cmp dword [esp + 0x10], eax
jae 0x4e0d0b
mov eax, 5
push 0x52f388
call fcn.004e3820
add esp, 4
jmp 0x4e0d77
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov dword [esi], ecx
mov cx, word [esp + 0x2a]
mov word [esi + 4], dx
mov word [esi + 6], cx
jmp 0x4e0d6f
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x10]
jbe 0x4e0d33
mov ebx, esi
jmp 0x4e0cf7
mov edx, dword [esp + 0x38]
xor ebx, ebx
push ebx
push ebx
push ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4e0d5c
push 0x52f388
mov eax, 0x52f388
call fcn.004e37b0
add esp, 4
jmp 0x4e0d77
mov ecx, dword [esp + 0x20]
mov edx, edi
call fcn.004e0340
test eax, eax
je 0x4e0d77
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4e0d81
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e736b
add esp, 0x28
ret
Function at 0x4e1660
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4e16a6
push 0x52f388
mov eax, 0x52f388
call fcn.004e37b0
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
xor edx, edx
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x4e1738
jg 0x4e16ce
cmp ebx, ecx
jb 0x4e1738
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4e16fd
push 0x52f388
mov eax, 0x52f388
call fcn.004e37b0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.004e0340
test eax, eax
je 0x4e16f3
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4e171e
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4e1745
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x4e1745
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x4e1ff0
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x577698]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x4e2131
cmp dword [esp + 0x28], ebp
je 0x4e2131
push edi
push 0x2800
call fcn.004eaa86
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x4e2053
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004e736b
add esp, 0x1c
ret
push ebx
push esi
xor ebx, ebx
jmp 0x4e2060
push ebx
push str..PhysicalDrive_d
push 0x2800
call fcn.004e0210
add esp, 0xc
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e2107
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.004e7380
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push edi
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4e20fa
mov eax, dword [edi + 0x18]
cmp eax, ebp
jbe 0x4e20fa
mov edx, dword [esp + 0x34]
add eax, edi
push eax
mov eax, dword [esp + 0x1c]
push edx
push eax
push str.DISKID:
call fcn.004e1d80
add esp, 0x10
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x4e2111
inc ebx
cmp ebx, 0x10
jl 0x4e2060
push edi
call fcn.004e8476
mov eax, dword [esp + 0x14]
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004e736b
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.004e736b
add esp, 0x1c
ret
Function at 0x4e21e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor esi, esi
xor ebx, ebx
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
cmp dword [esp + 0x30], esi
je 0x4e221a
cmp dword [esp + 0x34], esi
je 0x4e221a
push 0x200
call fcn.004eaa86
mov edi, eax
add esp, 4
cmp edi, esi
jne 0x4e2225
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x14]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4e2385
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push edi
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
jne 0x4e231a
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4e227d
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
push ecx
push 0x20119
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4e22f3
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4e22e8
mov eax, edi
mov dword [edi], 0x5c2e5c5c
call fcn.004e2150
cmp edx, ebx
jb 0x4e22e8
ja 0x4e22e2
cmp eax, dword [esp + 0x24]
jbe 0x4e22e8
mov dword [esp + 0x24], eax
mov ebx, edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push edi
inc esi
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
je 0x4e2270
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
ja 0x4e2330
cmp dword [esp + 0x24], 0
jbe 0x4e2385
mov ecx, dword [esp + 0x24]
push ebx
push ecx
push str._012I64X
push 0x200
call fcn.004e0210
add esp, 0x10
test eax, eax
jne 0x4e2369
push edi
mov dword [esp + 0x1c], 0xffffffff
call fcn.004e8476
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edi
push edx
push eax
push str.MAC:
call fcn.004e1d80
add esp, 0x10
mov dword [esp + 0x18], eax
push edi
call fcn.004e8476
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4e4ea0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512eb0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x577698]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x586a50]
xor edi, edi
cmp ecx, edi
jne 0x4e4eeb
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x4e4ef8
mov dword [ebp - 0x14], edi
jmp 0x4e4f10
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x4e4fb6
mov ecx, dword [0x586a50]
mov eax, dword [ecx]
cmp eax, edi
je 0x4e4ed7
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4e4ed7
mov dword [ebp - 4], edi
push 0x586a50
call fcn.004e4fd0
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x4e4f4e
mov dword [ebp - 0x18], 1
push 0x55a57c
lea eax, [ebp - 0x18]
push eax
call fcn.004f1d2c
mov ecx, dword [0x586a50]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x4e4f68
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
jne 0x4e4f7d
mov dword [ebp - 0x1c], 4
push 0x55a57c
lea edx, [ebp - 0x1c]
push edx
call fcn.004f1d2c
mov dword [ebp - 4], 0xffffffff
jmp 0x4e4fa2
mov eax, dword [0x586a50]
mov eax, dword [eax]
test eax, eax
je 0x4e4fb4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e4fd0
Capabilities:
Print debug messages

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x4e5002
xor ecx, ecx
jmp 0x4e500e
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
mov esi, ecx
test ecx, ecx
je 0x4e50c1
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x4e5034
mov dword [esp + 0x18], esi
jmp 0x4e5094
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x4e508d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4e5080
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x4e5094
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4e5094
push 0x54e388
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4e5094
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x4e50b7
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x4e5026
mov eax, dword [esp + 0x18]
pop edi
pop ebp
test eax, eax
jne 0x4e50d5
mov ecx, dword [ebx]
add ecx, 8
call fcn.004e5240
test eax, eax
je 0x4e50d5
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
pop ebx
pop ecx
ret 4

Function at 0x4e50e0
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x5131fb
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x577698]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.004e7380
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x14], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x4e5178
push 0x55a57c
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.004f1d2c
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x4e5ae5
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x582d60], 0
push esi
jne 0x4e5a58
call fcn.004e597e
test eax, eax
je 0x4e5a9b
mov eax, dword [0x582d60]
cmp eax, 1
jne 0x4e5a79
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4e5a9b
pop esi
ret
push eax
call dword [0x582d68]
test eax, eax
jne 0x4e5ae3
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4e5a9f
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x582d60]
call dword [0x582d68]
mov edi, eax
test edi, edi
je 0x4e5ac4
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4e5ae0
mov edi, esi
add esi, 0xff0
push edi
push dword [0x582d60]
call dword [0x582d64]
add edi, 0x10
cmp edi, esi
jb 0x4e5acc
mov eax, edi
pop edi
pop esi
ret
jmp 0x4e5a45

Function at 0x4e736b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x577698]
jne 0x4e7375
repz ret
jmp fcn.004f4528

Function at 0x4f152b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4f155c
call fcn.004f2801
mov dword [eax], esi
call fcn.004f27ee
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004e8440
add esp, 0x14
push 0x16
pop eax
jmp 0x4f15b1
test dword [ebp + 0xc], 0xfffffff9
jne 0x4f1538
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4f1589
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f2814
pop ecx
call fcn.004f27ee
mov eax, dword [eax]
jmp 0x4f15b1
test al, 0x10
jne 0x4f15af
test al, 1
je 0x4f15af
test byte [ebp + 0xc], 2
je 0x4f15af
call fcn.004f2801
mov dword [eax], 5
call fcn.004f27ee
mov dword [eax], 0xd
jmp 0x4f1580
xor eax, eax
pop esi
pop ebp
ret
Function at 0x50971c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004f50c4
and dword [ebp - 4], 0
cmp dword [0x583be4], 0
mov ebx, eax
jne 0x5097cd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x50987e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x50987e
push eax
call fcn.004f5052
mov dword [esp], 0x52ec34
push edi
mov dword [0x583be4], eax
call esi
push eax
call fcn.004f5052
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x583be8], eax
call esi
push eax
call fcn.004f5052
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x583bec], eax
call esi
push eax
call fcn.004f5052
pop ecx
mov dword [0x583bf4], eax
test eax, eax
je 0x5097cd
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004f5052
pop ecx
mov dword [0x583bf0], eax
mov eax, dword [0x583bf0]
cmp eax, ebx
je 0x509825
cmp dword [0x583bf4], ebx
je 0x509825
push eax
call fcn.004f50cd
push dword [0x583bf4]
mov esi, eax
call fcn.004f50cd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x509825
test edi, edi
je 0x509825
call esi
test eax, eax
je 0x50981c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x50981c
test byte [ebp - 0xc], 1
jne 0x509825
or dword [ebp + 0x10], 0x200000
jmp 0x50985e
mov eax, dword [0x583be8]
cmp eax, ebx
je 0x50985e
push eax
call fcn.004f50cd
pop ecx
test eax, eax
je 0x50985e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x50985e
mov eax, dword [0x583bec]
cmp eax, ebx
je 0x50985e
push eax
call fcn.004f50cd
pop ecx
test eax, eax
je 0x50985e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x583be4]
call fcn.004f50cd
pop ecx
test eax, eax
je 0x50987e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x509880
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x50f260
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x512c68
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x577698]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x50eaf0
push 0x583c0c
call fcn.0050ed20
mov eax, dword [0x583c14]
add esp, 8
test eax, eax
je 0x50f2ba
mov ecx, dword [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret
lea ecx, [esp + 4]
call fcn.004e75e0
mov dword [esp + 0x10], 0
mov dword [esp + 4], vtable.boost::thread_resource_error.0
lea edx, [esp + 4]
push edx
mov dword [esp + 0x20], 0
call fcn.00429c18
int3
Function at 0x50f2f0
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x512c98
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x577698]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x583c14]
test eax, eax
jne 0x50f322
xor esi, esi
jmp 0x50f32b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x50f357
cmp dword [esi + 0x14], 0
jne 0x50f399
cmp dword [esi + 0x10], 0
jne 0x50f3a0
push 0
call fcn.0050f260
add esp, 4
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x50f385
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x50f385
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x50f3e0
nop
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x50f3ce
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x50f3a0
cmp dword [esi + 0x14], 0
je 0x50f347
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x50f405
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x50f436
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x50f436
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x50f436
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x50f3ea
jmp 0x50f341
Function at 0x50f4d0
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x512ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x577698]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x50f450
push 0
push 0
call fcn.004eb0fa
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x50f53b
lea ecx, [esp + 0x10]
call fcn.004e75e0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.00429c18
mov eax, dword [edi]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x50f561
cmp eax, 0xffffffff
je 0x50f561
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x5102a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x577698]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
mov ebx, dword [esp + 0x214]
test ebx, ebx
jne 0x5102d8
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004e736b
add esp, 0x20c
ret
push esi
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004e7380
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x5103a3
mov ecx, ebx
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x510310
sub ecx, esi
sar ecx, 1
mov edx, 0x103
sub edx, ecx
cmp eax, edx
jae 0x5103a3
push edi
lea edi, [esp + 0xc]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x510332
mov eax, dword [0x53c890]
mov dword [edi], eax
mov eax, ebx
mov edx, ebx
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x510350
lea edi, [esp + 0xc]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x510364
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004e736b
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004e736b
add esp, 0x20c
ret
Function at 0x510a20
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2c14
call fcn.00504570
mov eax, dword [0x577698]
xor eax, esp
mov dword [esp + 0x2c10], eax
mov eax, dword [esp + 0x2c18]
push edi
xor edi, edi
mov dword [esp + 0xc], eax
cmp eax, edi
je 0x510b8b
cmp dword [esp + 0x2c20], edi
je 0x510b8b
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov dword [esp + 0x10], edi
xor ebx, ebx
lea ebx, [ebx]
push ebx
push str..PhysicalDrive_d
lea eax, [esp + 0x30]
push 0x100
push eax
call fcn.0042356d
add esp, 0x10
push edi
push edi
push 3
push edi
push 3
push edi
lea ecx, [esp + 0x40]
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x510b64
xor eax, eax
push 0x2710
lea edx, [esp + 0x514]
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.004e7380
add esp, 0xc
push edi
lea eax, [esp + 0x18]
push eax
push 0x2710
lea ecx, [esp + 0x51c]
push ecx
push 0xc
lea edx, [esp + 0x30]
push edx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x510b57
push 0x3e8
lea eax, [esp + 0x12c]
push edi
push eax
call fcn.004e7380
mov edx, dword [esp + 0x534]
lea ecx, [esp + 0x134]
push ecx
push 1
push edx
lea eax, [esp + 0x528]
push eax
call fcn.00512330
mov edx, dword [esp + 0x2c48]
mov eax, dword [esp + 0x34]
add esp, 0x1c
lea ecx, [esp + 0x128]
push ecx
push edx
push eax
call fcn.00423547
test eax, eax
jne 0x510b57
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], edi
jne 0x510b6e
inc ebx
cmp ebx, 0x10
jl 0x510a70
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x2c10]
xor ecx, esp
call fcn.004e736b
add esp, 0x2c14
ret
mov ecx, dword [esp + 0x2c14]
pop edi
xor ecx, esp
xor eax, eax
call fcn.004e736b
add esp, 0x2c14
ret