joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c56c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x24]
push esi
push edi
mov dword [ebx], 1
cmp edx, 0x100
je 0x4c572c
cmp edx, 0x101
je 0x4c572c
cmp edx, 0x104
je 0x4c56f6
cmp edx, 0x105
jne 0x4c583f
mov eax, dword [ebp + 0x14]
cmp eax, 0x12
je 0x4c583f
cmp eax, 0x24
je 0x4c5839
cmp eax, 0x25
je 0x4c5839
cmp eax, 0x27
jne 0x4c583f
pop edi
pop esi
mov dword [ebx], 0
xor eax, eax
pop ebx
pop ebp
ret 0x20
mov ecx, dword [ebp + 0x14]
lea eax, [ecx - 0x70]
cmp eax, 0x17
jbe 0x4c5839
cmp ecx, 0xbb
je 0x4c5827
cmp ecx, 0xbd
je 0x4c5827
cmp ecx, 0x6b
je 0x4c5827
cmp ecx, 0x6d
je 0x4c5827
cmp ecx, 0x30
je 0x4c5827
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x4c583f
cmp edx, 0x100
jne 0x4c583f
cmp ecx, 9
je 0x4c57e3
cmp ecx, 0xd
je 0x4c57c1
cmp ecx, 0x1b
jne 0x4c583f
mov esi, dword [esi + 0x10]
test esi, esi
je 0x4c5839
push 0
push 0
push esi
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov dword [ebx], 0
xor eax, eax
pop ebx
pop ebp
ret 0x20
mov esi, dword [esi + 0xc]
test esi, esi
je 0x4c5839
push 0
push 0
push esi
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov dword [ebx], 0
xor eax, eax
pop ebx
pop ebp
ret 0x20
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
mov ecx, 0x8000
test cx, ax
je 0x4c583f
cmp dword [esi + 8], 0
je 0x4c5839
push 0
push 0x10
call edi
mov edx, dword [esi + 8]
shr eax, 0xf
and eax, 1
push eax
mov eax, dword [esi + 4]
push edx
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov dword [ebx], 0
xor eax, eax
pop ebx
pop ebp
ret 0x20
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x4c583f
mov dword [ebx], 0
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x20
Function at 0x4c9d90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52bd98
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x566148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x240], ebx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov dword [ebp - 0x244], esi
mov word [esi], ax
mov dword [ebp - 4], ebx
mov eax, dword [0x56ed14]
mov dword [ebp - 0x240], 1
cmp eax, 6
ja 0x4c9dfa
jne 0x4c9f4d
push str.Shell32.dll
call fcn.004ca3c0
mov ecx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
push ecx
push edi
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x234], edi
call fcn.004ca1d0
push edi
lea edx, [ebp - 0x234]
push edi
push edx
call fcn.004082b0
add esp, 0xc
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x234]
cmp eax, ebx
jne 0x4c9e78
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x21c], str.Shell32.dll_utility.cpp343_
call fcn.004e8fea
push 0x5554a4
lea ecx, [ebp - 0x22c]
push ecx
mov dword [ebp - method.std::logic_error.virtual_0], vtable.std::runtime_error.0
call fcn.004ecd9a
push str.SHGetKnownFolderPath
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x4c9ebf
mov dword [ebp - 0x21c], str.Internal_error_KFP1_utility.cpp349_
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x22c]
call fcn.004e8fea
push 0x5554a4
lea eax, [ebp - 0x22c]
push eax
mov dword [ebp - method.std::logic_error.virtual_0], vtable.std::runtime_error.0
call fcn.004ecd9a
lea ecx, [ebp - 0x220]
push ecx
push ebx
push ebx
push 0x532868
mov dword [ebp - 0x220], ebx
call eax
test eax, eax
js 0x4c9f3e
mov eax, dword [ebp - 0x220]
cmp eax, ebx
je 0x4c9f3e
mov edx, dword [sym.imp.ole32.dll_CoTaskMemFree]
push edx
push eax
lea ecx, [ebp - 0x238]
mov edi, eax
mov dword [ebp - 0x23c], eax
call fcn.004ca260
push edi
lea eax, [ebp - 0x23c]
push edi
push eax
call fcn.004082b0
add esp, 0xc
lea ecx, [ebp - 0x220]
push ecx
mov byte [ebp - 4], 2
call fcn.004c9fa0
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 1
call fcn.004c9d50
lea eax, [ebp - 0x234]
mov byte [ebp - 4], bl
call fcn.004c9d50
jmp 0x4c9f7d
mov dword [ebp - 0x21c], str.Internal_error_KFP2_utility.cpp354_
jmp 0x4c9e92
lea ecx, [ebp - 0x218]
push ecx
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x4c9f72
mov dword [ebp - 0x21c], str.Internal_error_GFP1_utility.cpp365_
jmp 0x4c9e92
lea edx, [ebp - 0x218]
call fcn.004c9ff0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8965
mov esp, ebp
pop ebp
ret
Function at 0x4cbf06
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x56d384], 0
push esi
push edi
jne 0x4cbe7c
call fcn.004cbde8
test eax, eax
je 0x4cbec1
mov eax, dword [0x56d384]
cmp eax, 1
jne 0x4cbe9d
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4cbec1
jmp 0x4cbf03
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x4cbf03
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4cbec5
xor eax, eax
jmp 0x4cbf03
mov eax, dword [esi]
push dword [0x56d384]
call edi
mov edi, eax
test edi, edi
je 0x4cbee7
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4cbf03
lea edi, [esi + 0xff0]
push esi
push dword [0x56d384]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x4cbeed
mov eax, esi
pop edi
pop esi
ret
jmp 0x4cbe68
Function at 0x4cdac0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x52318b
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x566148]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x566148]
xor eax, esp
push eax
lea eax, [esp + 0x28c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x29c]
mov ecx, dword [esp + 0x2a8]
mov ebx, dword [esp + 0x2a0]
mov esi, dword [esp + 0x2ac]
mov ebp, dword [esp + 0x2b0]
push 0xffffffffffffffff
xor edi, edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2a8]
push edi
mov dword [esp + 0x20], ecx
xor edx, edx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], edi
mov word [esp + 0x28], dx
call fcn.00404950
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x294], edi
cmp eax, edi
je 0x4cdba4
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
mov edx, ecx
cmp edi, 8
jae 0x4cdb71
lea edx, [esp + 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4cdb9d
mov edx, ecx
cmp edi, 8
jae 0x4cdb84
lea edx, [esp + 0x1c]
cmp word [edx + eax*2 - 2], 0x2f
je 0x4cdb9d
cmp edi, 8
jae 0x4cdb95
lea ecx, [esp + 0x1c]
cmp word [ecx + eax*2 - 2], 0x3a
jne 0x4cdba4
mov edx, 0x543ce4
jmp 0x4cdba9
mov edx, 0x532c94
mov eax, edx
lea edi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4cdbb0
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.00404540
mov eax, dword [esp + 0x1c]
mov edi, 8
cmp dword [esp + 0x30], edi
jae 0x4cdbdd
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x4cdc3b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], 0
call edi
cmp eax, 2
je 0x4cdc10
call edi
cmp eax, 0x12
je 0x4cdc10
call edi
mov esi, eax
jmp 0x4cdc12
xor esi, esi
call fcn.004d0f50
cmp dword [esp + 0x30], 8
mov edi, dword [esp + 0x14]
mov dword [edi], esi
mov dword [edi + 4], eax
jb 0x4cdc34
mov edx, dword [esp + 0x1c]
push edx
call fcn.004e895a
add esp, 4
mov eax, edi
jmp 0x4cdcc1
lea eax, [esp + 0x64]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4cdc42
mov ecx, dword [esp + 0x18]
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x68]
push eax
call fcn.00404dc0
mov eax, dword [esp + 0x38]
test eax, 0x400
je 0x4cdc7a
mov dword [esi], 0
mov dword [ebp], 0
jmp 0x4cdc9a
test al, 0x10
je 0x4cdc8d
mov dword [esi], 3
mov dword [ebp], 3
jmp 0x4cdc9a
mov dword [esi], 2
mov dword [ebp], 2
mov esi, dword [esp + 0x14]
mov dword [esi], 0
call fcn.004d0f50
mov dword [esi + 4], eax
cmp dword [esp + 0x30], edi
jb 0x4cdcbf
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004e895a
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x274]
xor ecx, esp
call fcn.004e8965
add esp, 0x284
ret
Function at 0x4ce5e0
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5232b0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x566148]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x566148]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x5c]
mov edi, dword [esp + 0x64]
cmp eax, 1
jne 0x4ce63b
test edi, edi
je 0x4ce634
mov dword [edi], 0
call fcn.004d0f50
mov dword [edi + 4], eax
xor al, al
jmp 0x4ce73a
cmp eax, 3
je 0x4ce6c4
cmp eax, 0xb
je 0x4ce6c4
push 0x19
push str.boost::filesystem::remove
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.00407b20
cmp dword [esi + 0x14], 8
mov dword [esp + 0x54], 1
jb 0x4ce680
mov eax, dword [esi]
jmp 0x4ce682
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
lea ecx, [esp + 0x10]
push ecx
sete dl
push edi
movzx eax, dl
push esi
push eax
call fcn.004ce4a0
add esp, 0x10
cmp dword [esp + 0x24], 0x10
mov bl, al
jb 0x4ce6bc
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004e895a
add esp, 4
test bl, bl
je 0x4ce738
xor al, al
jmp 0x4ce73a
push 0x19
xor ebx, ebx
push str.boost::filesystem::remove
lea ecx, [esp + 0x34]
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
call fcn.00407b20
cmp dword [esi + 0x14], 8
mov dword [esp + 0x54], ebx
jb 0x4ce6f4
mov eax, dword [esi]
jmp 0x4ce6f6
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
lea edx, [esp + 0x2c]
push edx
test al, al
sete al
push edi
movzx ecx, al
push esi
push ecx
call fcn.004ce4a0
add esp, 0x10
cmp dword [esp + 0x40], 0x10
mov bl, al
jb 0x4ce730
mov edx, dword [esp + 0x2c]
push edx
call fcn.004e895a
add esp, 4
test bl, bl
jne 0x4ce634
mov al, 1
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004e8965
add esp, 0x48
ret

Function at 0x4ce880
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp dword [ebx + 0x14], 8
push edi
jb 0x4ce890
mov eax, dword [ebx]
jmp 0x4ce892
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4ce8b8
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ebx
push ecx
call fcn.004ce760
mov eax, dword [eax]
add esp, 0xc
pop edi
pop ebx
ret
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4ce8cf
mov dword [esi], 0
call fcn.004d0f50
mov dword [esi + 4], eax
pop esi
test edi, 0x400
je 0x4ce902
push ebx
call fcn.004cd550
add esp, 4
test al, al
je 0x4ce8fa
mov edx, edi
and dl, 0x10
movzx eax, dl
neg eax
sbb eax, eax
and eax, 7
pop edi
add eax, 4
pop ebx
ret
pop edi
mov eax, 9
pop ebx
ret
mov eax, edi
and eax, 0x10
or eax, 0x20
pop edi
shr eax, 4
pop ebx
ret
Function at 0x4cea10
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x523318
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x566148]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x566148]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x7c]
mov esi, dword [esp + 0x80]
mov ebp, dword [esp + 0x84]
push 0x19
xor ebx, ebx
push str.boost::filesystem::rename
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.00407b20
mov eax, 8
mov dword [esp + 0x74], ebx
cmp dword [esi + 0x14], eax
jb 0x4cea88
mov ecx, dword [esi]
jmp 0x4cea8a
mov ecx, esi
cmp dword [edi + 0x14], eax
jb 0x4cea93
mov eax, dword [edi]
jmp 0x4cea95
mov eax, edi
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x4ceab4
cmp ebp, ebx
je 0x4ceaf4
mov dword [ebp], ebx
call fcn.004d0f50
mov dword [ebp + 4], eax
jmp 0x4ceaf4
call fcn.004d0f50
cmp ebp, ebx
jne 0x4ceae6
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push eax
push esi
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x44]
call fcn.004ce0d0
push 0x551c60
lea ecx, [esp + 0x34]
push ecx
call fcn.004ecd9a
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp], eax
mov dword [ebp + 4], esi
cmp dword [esp + 0x28], 0x10
jb 0x4ceb08
mov edx, dword [esp + 0x14]
push edx
call fcn.004e895a
add esp, 4
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.004e8965
add esp, 0x64
ret
Function at 0x4ceb30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x523358
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x566148]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push esi
push edi
mov eax, dword [0x566148]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, dword [esp + 0x54]
cmp dword [edi + 0x14], 8
mov ebx, dword [esp + 0x50]
mov esi, dword [esp + 0x58]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], esi
jb 0x4ceb7f
mov eax, dword [edi]
jmp 0x4ceb81
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x4ceba1
push esi
push edi
push ebx
call fcn.004ce760
add esp, 0xc
jmp 0x4cece0
test eax, 0x400
je 0x4cecae
cmp dword [edi + 0x14], 8
jb 0x4cebb6
mov esi, dword [edi]
jmp 0x4cebb8
mov esi, edi
mov ebx, 7
xor eax, eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
mov dword [esp + 0x48], eax
call fcn.004d0050
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4cebe0
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x28]
call fcn.00404540
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
mov dword [esp + 0x48], 1
jae 0x4cec11
lea eax, [esp + 0x20]
push 0
push 0x2000000
push 3
push 0
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x34], 8
mov byte [esp + 0x48], 3
jb 0x4cec45
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004e895a
add esp, 4
mov dword [esp + 0x34], ebx
xor edx, edx
or ebx, 0xffffffff
mov dword [esp + 0x30], 0
mov word [esp + 0x20], dx
cmp esi, ebx
jne 0x4cec76
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
push eax
push edi
push esi
call fcn.004ce760
add esp, 0xc
mov eax, esi
jmp 0x4cece2
push edi
call fcn.004cd550
add esp, 4
mov dword [esp + 0x48], ebx
push esi
test al, al
jne 0x4cec9c
mov edi, dword [esp + 0x18]
mov dword [edi], 9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x4cece2
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test esi, esi
je 0x4cecc4
mov dword [esi], 0
call fcn.004d0f50
mov dword [esi + 4], eax
mov eax, dword [esp + 0x10]
test al, 0x10
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 3
jne 0x4cecdc
mov dword [esp + 0x10], 2
mov ecx, dword [eax]
mov dword [ebx], ecx
mov eax, ebx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004e8965
add esp, 0x3c
ret
Function at 0x4cef90
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x5233e8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x566148]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x566148]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, dword [esp + 0x88]
cmp dword [edi + 0x14], 8
mov esi, dword [esp + 0x8c]
jb 0x4cefda
mov eax, dword [edi]
jmp 0x4cefdc
mov eax, edi
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4cefff
cmp esi, ebx
je 0x4ceff8
mov dword [esi], ebx
call fcn.004d0f50
mov dword [esi + 4], eax
mov al, 1
jmp 0x4cf09d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov dword [esp + 0x14], ebx
call fcn.004d0f50
mov dword [esp + 0x18], eax
cmp ebp, 0xb7
jne 0x4cf041
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push edi
push ecx
call fcn.004ceb30
add esp, 0xc
cmp dword [eax], 3
jne 0x4cf041
cmp esi, ebx
je 0x4cf09b
mov dword [esi], ebx
call fcn.004d0f50
jmp 0x4cf098
cmp esi, ebx
jne 0x4cf091
push 0x23
push str.boost::filesystem::create_directory
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00407b20
mov dword [esp + 0x80], ebx
call fcn.004d0f50
push eax
push ebp
push edi
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x4c]
call fcn.004cdfd0
push 0x551c60
lea eax, [esp + 0x40]
push eax
call fcn.004ecd9a
call fcn.004d0f50
mov dword [esi], ebp
mov dword [esi + 4], eax
xor al, al
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.004e8965
add esp, 0x70
ret

Function at 0x4cf9e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x523540
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x566148]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x532a14
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__int_.0
call fcn.00403f40
mov byte [esp + 0x38], 1
call fcn.004cc5c0
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.00404010
mov dword [esi], vtable.windows_file_codecvt.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x4d03d0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x5236e0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x566148]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x566148]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x40]
mov eax, 7
xor edx, edx
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], 0
mov dword [esp + 0xc], esi
mov word [esi], dx
mov dword [esp + 0x24], eax
xor eax, eax
mov word [esp + 0x10], ax
mov eax, ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x20], edx
lea ebx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4d0436
sub eax, ebx
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.00404dc0
mov byte [esp + 0x38], 1
call fcn.004d0050
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.0040ade0
add esp, 0xc
cmp dword [esp + 0x24], 8
jb 0x4d047f
mov edx, dword [esp + 0x10]
push edx
call fcn.004e895a
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004e8965
add esp, 0x30
ret 8
Function at 0x4d2e10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x523b20
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x566148]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [0x56d680]
test eax, eax
jne 0x4d2e44
xor esi, esi
jmp 0x4d2e4d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x30], 0
test esi, esi
je 0x4d2e97
cmp dword [esi + 0x14], 0
jne 0x4d2ed9
cmp dword [esi + 0x10], 0
jne 0x4d2ee0
push 0x4d1da0
push 0x56d678
call fcn.004d2150
mov eax, dword [0x56d680]
add esp, 8
test eax, eax
je 0x4d2f8d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x30], 0xffffffff
test esi, esi
je 0x4d2ec5
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4d2ec5
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
cmp dword [esi + 0x10], 0
je 0x4d2f20
nop
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x4d2f0e
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x4d2ee0
cmp dword [esi + 0x14], 0
je 0x4d2e69
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4d2f45
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x4d2f76
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4d2f76
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4d2f76
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x4d2f2a
jmp 0x4d2e63
lea ecx, [esp + 0x18]
call fcn.004e8f51
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], vtable.boost::thread_resource_error.0
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x34], 1
call fcn.0043a520
int3
Function at 0x4d3080
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x523b78
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x566148]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x4d2fc0
push 0
push 0
call fcn.004f0047
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x4d30eb
lea ecx, [esp + 0x10]
call fcn.004e8f51
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.0043a520
mov eax, dword [edi]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
test eax, eax
je 0x4d310e
cmp eax, 0xffffffff
je 0x4d310e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x4d55d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
xor ecx, ecx
cmp eax, edx
je 0x4d55ff
push esi
push edi
mov esi, ecx
mov edi, ecx
shl esi, 6
shr edi, 2
add esi, edi
movsx edi, byte [eax]
lea esi, [esi + edi - 0x61c88647]
inc eax
xor ecx, esi
cmp eax, edx
jne 0x4d55e0
pop edi
pop esi
mov eax, 0x4e25
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add edx, eax
shr edx, 0x1e
imul edx, edx, 0x7fffd8ee
mov eax, ecx
sub eax, edx
add eax, 0x2710
ret