joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aad90
Capabilities:
Get common file path

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
je 0x4aaeb9
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
mov esi, dword [ecx]
cmp byte [esi], 0x7e
jne 0x4aaeaf
mov edx, 0xffffffff
dec eax
je 0x4aaddc
xor edi, edi
nop word [eax + eax]
movzx ebx, byte [esi + edi + 1]
cmp ebx, 0x5c
je 0x4aaea0
cmp ebx, 0x2f
je 0x4aadda
inc edi
cmp eax, edi
jne 0x4aadc0
jmp 0x4aaddc
mov edx, edi
cmp eax, edx
cmovb edx, eax
test edx, edx
jne 0x4aaeaf
mov ebx, ecx
lea edi, [esp + 0x20]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x80
mov eax, dword [0x515ec8]
movups xmm0, xmmword [eax]
movups xmmword [esp + 4], xmm0
mov dword [esp], 0
mov eax, esp
lea ecx, [esp + 4]
push eax
push 0
push 0x8000
push ecx
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x4aae8d
mov esi, dword [esp]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
lea ebp, [esp + 0x14]
mov ecx, 0xfde9
mov edx, esi
push ebp
push eax
call fcn.004ab0c0
add esp, 8
mov esi, eax
push dword [esp]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jne 0x4aae8d
push 0
push ebp
call fcn.004a3e30
add esp, 8
mov eax, dword [esp + 0x14]
movzx eax, byte [eax]
mov ecx, ebx
mov edx, dword [ebx]
mov byte [edx], al
mov eax, dword [ebx]
inc eax
mov edx, dword [esp + 0x14]
lea esi, [edx + 1]
add edx, dword [esp + 0x18]
push edx
push esi
push eax
call fcn.004ac7a0
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x4aaeaf
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
jmp 0x4aaeaf
mov edx, edi
cmp eax, edx
cmovb edx, eax
test edx, edx
je 0x4aade9
add esp, 0xa0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ae8d0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x444
mov ebp, dword [esp + 0x458]
lea esi, [esp + 0x20]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x80
mov eax, dword [esp + 0x45c]
mov ecx, dword [esp + 0x460]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
sub esp, 0xc
movsd xmm0, qword [esp + 0x18]
movsd qword [esp], xmm0
lea eax, [esp + 0x20]
mov dword [esp + 8], eax
call fcn.004a8040
add esp, 0xc
test eax, eax
je 0x4ae93e
mov byte [ebp], 0
mov byte [ebp + 0xc], 0
jmp 0x4aea87
lea eax, [esp + 0x23c]
mov dword [esp + 0x230], eax
mov dword [esp + 0x234], 0
mov dword [esp + 0x238], 0x104
mov ebx, 0x104
xor eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4ae9b0
mov dword [esp + 0x234], ebx
push 0
call ebp
push dword [esp + 0x234]
push dword [esp + 0x234]
push dword [esp + 0x1c]
call esi
mov ebx, eax
test eax, eax
je 0x4ae9e0
mov eax, dword [esp + 0x234]
cmp ebx, eax
jbe 0x4ae9fe
cmp eax, ebx
je 0x4ae987
ja 0x4ae980
cmp dword [esp + 0x238], ebx
jae 0x4ae980
lea ecx, [esp + 0x230]
push 2
push ebx
lea eax, [esp + 0x244]
push eax
call fcn.0046e2c0
jmp 0x4ae980
call edi
cmp eax, 0xcb
jne 0x4ae9a5
mov ebp, dword [esp + 0x458]
mov byte [ebp], 0
mov byte [ebp + 0xc], 0
lea esi, [esp + 0x20]
jmp 0x4aea6c
mov dword [esp + 0x234], ebx
lea esi, [esp + 0x12c]
mov dword [esp + 0x120], esi
mov dword [esp + 0x124], 0
mov dword [esp + 0x128], 0x104
lea eax, [esp + 0x120]
push eax
push ebx
push dword [esp + 0x238]
call fcn.004a8240
add esp, 0xc
test eax, eax
je 0x4aeaa5
mov ebp, dword [esp + 0x458]
mov byte [ebp], 0
mov byte [ebp + 0xc], 0
mov eax, dword [esp + 0x120]
cmp eax, esi
lea esi, [esp + 0x20]
je 0x4aea6c
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, dword [esp + 0x230]
lea ecx, [esp + 0x23c]
cmp eax, ecx
je 0x4aea87
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x4aea98
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, ebp
add esp, 0x444
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + 0x120]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
cmp eax, 0xfffffff8
jae 0x4aeb48
mov ebx, eax
cmp eax, 0xb
jae 0x4aeadd
mov eax, ebx
add al, bl
mov byte [esp], al
lea edi, [esp + 1]
test ebx, ebx
mov ebp, dword [esp + 0x458]
jne 0x4aeb05
jmp 0x4aeb10
mov ebp, ebx
or ebp, 7
lea eax, [ebp + 1]
push eax
call sub.libc.dll_operator_new_unsigned_int_
add esp, 4
mov edi, eax
mov dword [esp + 8], eax
add ebp, 2
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x458]
push ebx
push esi
push edi
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
add esp, 0xc
mov byte [edi + ebx], 0
mov eax, dword [esp + 8]
mov dword [ebp + 8], eax
movsd xmm0, qword [esp]
movsd qword [ebp], xmm0
mov byte [ebp + 0xc], 1
lea esi, [esp + 0x12c]
mov eax, dword [esp + 0x120]
cmp eax, esi
lea esi, [esp + 0x20]
jne 0x4aea63
jmp 0x4aea6c
mov ecx, esp
call fcn.00401af0
int3
Function at 0x4aeb60
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
call fcn.004c7a60
test eax, eax
jne 0x4aeb7b
cmp byte [esp + 0xc], 0
je 0x4aeb83
push esi
call fcn.004aeb90
mov ecx, eax
push esi
call fcn.004c7c20
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3

Function at 0x4aebc0
Capabilities:
Get system information on windows

Disassembly:
push esi
sub esp, 0x24
mov eax, dword [esp + 0x2c]
movzx ecx, byte [0x533440]
test cl, cl
je 0x4aebe4
and byte [eax + 4], 0xfe
mov ecx, dword [0x5347c8]
mov dword [eax], ecx
add esp, 0x24
pop esi
ret
push 0x533440
mov esi, eax
call sub.libc.dll___cxa_guard_acquire
add esp, 4
mov ecx, eax
mov eax, esi
test ecx, ecx
je 0x4aebd3
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 4]
mov dword [0x5347c8], eax
push 0x533440
call sub.libc.dll___cxa_guard_release
mov eax, esi
add esp, 4
jmp 0x4aebd3

Function at 0x4afb50
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push edi
push esi
sub esp, 8
sub esp, 0x14
movaps xmm0, xmmword [0x516220]
movups xmmword [esp + 4], xmm0
lea eax, [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4afba5
mov edi, dword [esp + 4]
mov eax, esp
push eax
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov esi, eax
mov eax, dword [esp]
test edi, edi
je 0x4afb9b
push 0
push edi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
test esi, esi
je 0x4afba5
add esp, 8
pop esi
pop edi
ret
movzx eax, byte [0x533170]
test al, al
je 0x4afbbb
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
add esp, 8
pop esi
pop edi
ret
push 0x533170
call sub.libc.dll___cxa_guard_acquire
add esp, 4
test eax, eax
je 0x4afbb0
call fcn.004afd60
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_srand
add esp, 4
push 0x533170
call sub.libc.dll___cxa_guard_release
add esp, 4
jmp 0x4afbb0
Function at 0x4b06e0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x70
movzx ebx, byte [esp + 0x88]
mov esi, dword [esp + 0x84]
mov ecx, 0x5334f0
call fcn.00504b88
mov edi, dword [0x533498]
mov ebp, dword [0x533514]
mov ecx, 0x5334f0
call fcn.00504b8e
test edi, edi
jne 0x4b0792
lea ebp, [esp + 0x30]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x40
xorps xmm0, xmm0
movups xmmword [esp + 4], xmm0
mov byte [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 1
mov eax, dword [0x513c00]
add eax, 8
mov dword [esp], eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], eax
mov edi, esp
mov ecx, edi
push 0
push 0
push 0
call fcn.0046ab90
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, eax
cmp ecx, 0xb
ja 0x4b07a9
mov ecx, esp
push 0xc
push str.LLVM_ERROR:
call fcn.0046b680
mov edi, eax
jmp 0x4b07c2
lea ecx, [esp + 0x24]
push esi
call fcn.00465260
test byte [esp + 0x24], 1
je 0x4b07e2
mov eax, dword [esp + 0x2c]
jmp 0x4b07e6
mov dword [eax + 8], 0x203a524f
mov dword [eax + 4], 0x52524520
mov dword [eax], 0x4d564c4c
add dword [esp + 0x10], 0xc
mov ecx, esi
push edi
call fcn.004655f0
mov eax, dword [edi + 0x10]
cmp dword [edi + 0xc], eax
jne 0x4b0803
mov ecx, edi
push 1
push 0x51640b
call fcn.0046b680
jmp 0x4b0809
lea eax, [esp + 0x25]
movzx ecx, bl
push ecx
push eax
push ebp
call edi
add esp, 0xc
test byte [esp + 0x24], 1
je 0x4b0834
push dword [esp + 0x2c]
call sub.libc.dll_operator_delete_void_
jmp 0x4b0831
mov byte [eax], 0xa
inc dword [edi + 0x10]
mov eax, dword [esp + 0x20]
push dword [eax + 4]
push dword [eax]
push 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll__write
add esp, 0xc
mov ecx, esp
call fcn.0046d8e0
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x4b0834
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
call fcn.00468270
test bl, bl
je 0x4b0842
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x4c5510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov esi, dword [esp + 0x70]
lea eax, [esi + 0xc]
mov dword [esp], eax
mov dword [esi], eax
mov dword [esi + 4], 0
mov dword [esi + 8], 2
xorps xmm0, xmm0
movups xmmword [esp + 4], xmm0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 2
mov byte [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
cmp dword [esp + 0x78], 0
je 0x4c5656
lea eax, [esp + 0x74]
mov ebp, dword [eax]
mov edi, dword [eax + 4]
jmp 0x4c55bc
mov ecx, esi
push 0x24
push edx
push dword [esp + 8]
call fcn.0046e2c0
mov eax, dword [esi]
nop word cs:[eax + eax]
lea ebx, [esp + 4]
mov ecx, dword [esi + 4]
lea ecx, [ecx + ecx*8]
mov edx, dword [ebx + 0x20]
mov dword [eax + ecx*4 + 0x20], edx
movups xmm0, xmmword [ebx]
movups xmm1, xmmword [ebx + 0x10]
movups xmmword [eax + ecx*4 + 0x10], xmm1
movups xmmword [eax + ecx*4], xmm0
inc dword [esi + 4]
test edi, edi
je 0x4c5656
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], edi
sub esp, 0xc
movsd xmm0, qword [esp + 0x34]
movsd qword [esp + 4], xmm0
lea eax, [esp + 0x3c]
mov dword [esp], eax
call fcn.004c52a0
add esp, 0xc
mov eax, dword [esp + 0x50]
mov dword [esp + 0x24], eax
movups xmm0, xmmword [esp + 0x30]
movups xmm1, xmmword [esp + 0x40]
movups xmmword [esp + 0x14], xmm1
movups xmmword [esp + 4], xmm0
mov edi, dword [esp + 0x58]
mov ebp, dword [esp + 0x54]
cmp dword [esp + 4], 0
je 0x4c55b4
mov eax, dword [esi]
mov ecx, dword [esi + 4]
lea edx, [ecx + 1]
cmp edx, dword [esi + 8]
jbe 0x4c5590
lea ecx, [ecx + ecx*8]
lea ecx, [eax + ecx*4]
lea ebx, [esp + 4]
cmp ecx, ebx
seta cl
cmp eax, ebx
ja 0x4c5574
test cl, cl
je 0x4c5574
sub ebx, eax
mov ecx, esi
push 0x24
push edx
push dword [esp + 8]
call fcn.0046e2c0
mov eax, dword [esi]
add ebx, eax
jmp 0x4c5594
mov eax, esi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c5750
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x4c5761
jmp dword [eax*4 + 0x518000]
cmp dword [0x533120], 0
je 0x4c5870
push 0x533124
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x53313c]
test edi, edi
je 0x4c5865
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4c57ab
mov edi, dword [edi + 8]
test edi, edi
je 0x4c5865
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x4c57a0
test esi, esi
je 0x4c57a0
mov ecx, dword [edi + 4]
call dword [0x529704]
push esi
call ecx
add esp, 4
jmp 0x4c57a0
call fcn.0046a340
jmp case.default.0x4c5761
cmp dword [0x533120], 0
je case.default.0x4c5761
push 0x533124
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x53313c]
test edi, edi
je 0x4c5858
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4c5817
mov edi, dword [edi + 8]
test edi, edi
je 0x4c5858
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x4c5810
test esi, esi
je 0x4c5810
mov ecx, dword [edi + 4]
call dword [0x529704]
push esi
call ecx
add esp, 4
jmp 0x4c5810
cmp dword [0x533120], 0
jne 0x4c584c
push 0x533124
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x533120], 1
jmp case.default.0x4c5761
push 0x533124
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.default.0x4c5761
push 0x533124
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x533120]
cmp eax, 1
jne case.default.0x4c5761
mov eax, dword [0x53313c]
test eax, eax
je 0x4c58a2
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, esi
test esi, esi
jne 0x4c5890
mov dword [0x53313c], 0
mov dword [0x533120], 0
push 0x533124
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4c5a00
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x506004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x4c5a66
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x4c5a66
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x4c5a66
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x4c5a66
mov edx, dword [esp + 0xc]
sub edx, dword [0x506004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x4c5a56
add esi, 0x28
dec ecx
je 0x4c5a66
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x4c5a50
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x4c5a50
mov eax, esi
pop esi
pop edi
ret
Function at 0x4dd0d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edi, dword [ecx]
mov esi, dword [eax]
movzx eax, byte [edi]
mov byte [esp + 4], al
movzx eax, byte [edi + 1]
mov byte [esp + 3], al
movzx eax, word [edi + 6]
mov word [esp + 0x14], ax
mov eax, dword [edi + 2]
mov dword [esp + 0x10], eax
mov ebp, dword [edi + 8]
xorps xmm0, xmm0
movsd qword [edi], xmm0
mov dword [edi + 8], 0
movzx eax, byte [edi + 0xc]
mov byte [esp + 7], al
movzx eax, byte [edi + 0xd]
mov byte [esp + 6], al
movzx eax, word [edi + 0x12]
mov word [esp + 0xc], ax
mov eax, dword [edi + 0xe]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x18], eax
movsd qword [edi + 0xc], xmm0
mov dword [edi + 0x14], 0
movzx eax, byte [edi + 0x18]
mov byte [esp + 5], al
movsd xmm0, qword [esi]
movsd qword [edi], xmm0
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov word [esi], 0
test byte [edi + 0xc], 1
lea ebx, [edi + 0xc]
je 0x4dd175
push dword [edi + 0x14]
call sub.libc.dll_operator_delete_void_
add esp, 4
mov eax, dword [esi + 0x14]
mov dword [ebx + 8], eax
movsd xmm0, qword [esi + 0xc]
movsd qword [ebx], xmm0
mov word [esi + 0xc], 0
movzx eax, byte [esi + 0x18]
mov byte [edi + 0x18], al
test byte [esi], 1
je 0x4dd1a1
push dword [esi + 8]
call sub.libc.dll_operator_delete_void_
add esp, 4
movzx eax, byte [esp + 4]
mov byte [esi], al
movzx eax, byte [esp + 3]
mov byte [esi + 1], al
mov eax, dword [esp + 0x10]
mov dword [esi + 2], eax
movzx eax, word [esp + 0x14]
mov word [esi + 6], ax
mov dword [esi + 8], ebp
test byte [esi + 0xc], 1
je 0x4dd1d4
push dword [esi + 0x14]
call sub.libc.dll_operator_delete_void_
add esp, 4
movzx eax, byte [esp + 7]
mov byte [esi + 0xc], al
movzx eax, byte [esp + 6]
mov byte [esi + 0xd], al
mov eax, dword [esp + 8]
mov dword [esi + 0xe], eax
movzx eax, word [esp + 0xc]
mov word [esi + 0x12], ax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x14], eax
movzx eax, byte [esp + 5]
mov byte [esi + 0x18], al
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4dd5c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edi, dword [ecx]
mov esi, dword [eax]
movzx eax, byte [edi]
mov byte [esp + 4], al
movzx eax, byte [edi + 1]
mov byte [esp + 3], al
movzx eax, word [edi + 6]
mov word [esp + 0x14], ax
mov eax, dword [edi + 2]
mov dword [esp + 0x10], eax
mov ebp, dword [edi + 8]
xorps xmm0, xmm0
movsd qword [edi], xmm0
mov dword [edi + 8], 0
movzx eax, byte [edi + 0xc]
mov byte [esp + 7], al
movzx eax, byte [edi + 0xd]
mov byte [esp + 6], al
movzx eax, word [edi + 0x12]
mov word [esp + 0xc], ax
mov eax, dword [edi + 0xe]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x18], eax
movsd qword [edi + 0xc], xmm0
mov dword [edi + 0x14], 0
movzx eax, byte [edi + 0x18]
mov byte [esp + 5], al
movsd xmm0, qword [esi]
movsd qword [edi], xmm0
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov word [esi], 0
test byte [edi + 0xc], 1
lea ebx, [edi + 0xc]
je 0x4dd665
push dword [edi + 0x14]
call sub.libc.dll_operator_delete_void_
add esp, 4
mov eax, dword [esi + 0x14]
mov dword [ebx + 8], eax
movsd xmm0, qword [esi + 0xc]
movsd qword [ebx], xmm0
mov word [esi + 0xc], 0
movzx eax, byte [esi + 0x18]
mov byte [edi + 0x18], al
test byte [esi], 1
je 0x4dd691
push dword [esi + 8]
call sub.libc.dll_operator_delete_void_
add esp, 4
movzx eax, byte [esp + 4]
mov byte [esi], al
movzx eax, byte [esp + 3]
mov byte [esi + 1], al
mov eax, dword [esp + 0x10]
mov dword [esi + 2], eax
movzx eax, word [esp + 0x14]
mov word [esi + 6], ax
mov dword [esi + 8], ebp
test byte [esi + 0xc], 1
je 0x4dd6c4
push dword [esi + 0x14]
call sub.libc.dll_operator_delete_void_
add esp, 4
movzx eax, byte [esp + 7]
mov byte [esi + 0xc], al
movzx eax, byte [esp + 6]
mov byte [esi + 0xd], al
mov eax, dword [esp + 8]
mov dword [esi + 0xe], eax
movzx eax, word [esp + 0xc]
mov word [esi + 0x12], ax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x14], eax
movzx eax, byte [esp + 5]
mov byte [esi + 0x18], al
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4efba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [0x514340]
add eax, 8
mov dword [ecx], eax
mov word [ecx + 4], 0
and word [ecx + 6], 0x8000
mov edi, dword [esp + 0x20]
lea ebp, [ecx + 0x30]
xorps xmm0, xmm0
movups xmmword [ecx + 8], xmm0
movups xmmword [ecx + 0x14], xmm0
mov dword [ecx + 0x24], ebp
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 1
lea eax, [ecx + 0x48]
mov dword [ecx + 0x34], eax
mov dword [ecx + 0x38], eax
mov ebx, dword [esp + 0x1c]
mov dword [ecx + 0x3c], 1
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
call fcn.004b3e30
mov ecx, dword [esi + 0x28]
lea edx, [ecx + 1]
cmp edx, dword [esi + 0x2c]
ja 0x4efcd6
mov edx, dword [esi + 0x24]
mov dword [edx + ecx*4], eax
inc dword [esi + 0x28]
xorps xmm0, xmm0
movups xmmword [esi + 0x50], xmm0
movups xmmword [esi + 0x60], xmm0
mov dword [esi + 0x58], 0x524e20
mov dword [esi], 0x524dec
mov eax, dword [0x524f04]
add eax, 8
mov dword [esi + 0x70], eax
lea eax, [esi + 0x78]
mov dword [esi + 0x78], 0x524e30
mov dword [esi + 0x88], eax
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov dword [esp], ebx
mov dword [esp + 4], eax
sub esp, 8
movsd xmm0, qword [esp + 8]
movsd qword [esp], xmm0
mov ecx, esi
call fcn.004b3bf0
movsd xmm0, qword [edi]
movsd qword [esi + 0x1c], xmm0
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
movzx ecx, word [esi + 6]
shl eax, 5
and eax, 0x60
and ecx, 0xffffff9f
or ecx, eax
mov word [esi + 6], cx
mov eax, dword [esp + 0x28]
movsd xmm0, qword [eax]
movsd qword [esi + 0x14], xmm0
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, eax
sar ecx, 0x1f
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], ecx
mov byte [esi + 0x68], 1
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], ecx
mov ecx, esi
call fcn.004b2790
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
lea ecx, [esi + 0x24]
push 4
push edx
push ebp
mov ebp, eax
call fcn.0046e2c0
mov eax, ebp
mov ecx, dword [esi + 0x28]
jmp 0x4efc18
Function at 0x4f08b0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
xor ecx, ecx
cmp byte [esp + 0x10], 0
je 0x4f08c5
mov ecx, dword [esp + 0xc]
push 0
push 0
push edx
push eax
push ecx
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x4f08dc
ret
push str._beginthreadex_failed
call fcn.004f08f0
int3
Function at 0x4f68b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x58
mov ebx, dword [esp + 0x78]
mov eax, dword [ecx + 0x14]
mov ebp, dword [ecx + 0x18]
mov dword [esp + 0x20], 0
mov esi, 0xffffffff
mov edx, eax
cmp edx, ebp
je 0x4f6a0e
lea edi, [edx + 1]
inc esi
cmp byte [edx], 0x20
mov edx, edi
je 0x4f68d0
mov ebx, dword [ecx + 0x20]
add ebx, esi
mov dword [ecx + 0x20], ebx
lea edx, [edi - 1]
mov dword [esp + 0x2c], edx
mov dword [ecx + 0x14], edx
movzx edx, byte [edi - 1]
cmp edx, 9
je 0x4f6a27
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x28]
add dl, 0x81
cmp dl, 0xa0
mov edx, dword [esp + 0x28]
ja 0x4f6a27
test dl, dl
jns 0x4f6990
mov edx, ebp
sub edx, eax
sub edx, esi
mov esi, ecx
mov ecx, dword [esp + 0x2c]
call fcn.004f2db0
mov ecx, esi
test edx, edx
mov edx, dword [esp + 0x28]
je 0x4f6990
cmp eax, 0xfeff
je 0x4f6990
lea edx, [eax - 0x10000]
cmp edx, 0x100000
jb 0x4f6a27
lea edx, [eax - 0xe000]
cmp edx, 0x1ffe
mov edx, dword [esp + 0x28]
jb 0x4f6a27
cmp eax, 0x85
je 0x4f6a27
add eax, 0xffffff60
cmp eax, 0xd75f
jbe 0x4f6a27
nop word cs:[eax + eax]
cmp edx, 0xa
je 0x4f69d0
cmp edx, 0xd
mov eax, dword [esp + 0x24]
jne 0x4f6af7
mov edx, dword [esp + 0x20]
cmp ebx, edx
cmova edx, ebx
mov dword [esp + 0x20], edx
cmova eax, dword [esp + 0x2c]
cmp edi, ebp
mov dword [esp + 0x24], eax
je 0x4f69ec
lea eax, [edi + 1]
cmp byte [edi], 0xa
cmove edi, eax
jmp 0x4f69f0
mov eax, dword [esp + 0x20]
cmp ebx, eax
cmova eax, ebx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
cmova eax, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
jmp 0x4f69f0
mov edi, ebp
nop
mov ebx, dword [esp + 0x78]
mov dword [ecx + 0x20], 0
inc dword [ecx + 0x24]
mov dword [ecx + 0x14], edi
mov eax, dword [esp + 0x74]
inc dword [eax]
mov eax, edi
jmp 0x4f68c9
mov edx, ebp
sub edx, eax
add dword [ecx + 0x20], edx
mov dword [ecx + 0x14], ebp
mov byte [ebx], 1
mov al, 1
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
cmp ebx, dword [esp + 0x70]
jbe 0x4f6af7
mov eax, dword [esp + 0x6c]
mov dword [eax], ebx
mov al, 1
cmp dword [esp + 0x20], ebx
jbe 0x4f6a1d
lea esi, [ebp - 1]
mov eax, dword [esp + 0x24]
cmp ebp, eax
cmova esi, eax
mov dword [esp + 0x44], str.Leading_all_spaces_line_must_be_smaller_than_the_block_indent
mov word [esp + 0x54], 0x103
cmp dword [ecx + 0xec], 0
je 0x4f6a7b
mov edi, ecx
call fcn.00504e40
mov ecx, edi
mov edx, dword [edi + 0xec]
mov dword [edx + 4], eax
mov dword [edx], 0x16
cmp byte [ecx + 0x2f], 0
jne 0x4f6aec
mov eax, dword [ecx]
mov dword [esp + 0x30], esi
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
movzx edx, byte [ecx + 0x30]
movsd xmm0, qword [esp + 0x34]
movsd qword [esp + 0x14], xmm0
movsd xmm0, qword [esp + 0x3c]
movsd qword [esp + 0xc], xmm0
mov esi, dword [esp + 0x30]
mov dword [esp], esi
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x44]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov esi, ecx
mov ecx, eax
call fcn.004fd900
sub esp, 0x20
mov ecx, esi
mov byte [ecx + 0x2f], 1
xor eax, eax
jmp 0x4f6a1d
mov eax, dword [esp + 0x78]
mov byte [eax], 1
jmp 0x4f6a1b
Function at 0x10003280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x100032a5
push 0
push 0
push 0
push 0x10002480
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc