joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4993c0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
cmp byte [0x51a9bc], 0
je 0x499400
mov eax, dword [0xa37838]
test eax, eax
je 0x49941d
mov dword [esp + 4], 0
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0xa37838]
mov byte [eax + 0x38], 0
sub esp, 8
add esp, 0x1c
ret
mov dword [esp + 4], str.glutHideWindow
mov dword [esp], 0x54a618
call fcn.0049ce40
mov eax, dword [0xa37838]
test eax, eax
jne 0x4993d5
cmp dword [0x51aa14], 2
je 0x4993d5
mov dword [esp + 4], str.glutHideWindow
mov dword [esp], 0x54a6c4
call fcn.0049ce40
mov eax, dword [0xa37838]
jmp 0x4993d5

Function at 0x499450
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
cmp byte [0x51a9bc], 0
je 0x499490
mov eax, dword [0xa37838]
test eax, eax
je 0x4994ad
mov byte [eax + 0x39], 0
mov dword [esp + 4], 6
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0xa37838]
mov byte [eax + 0x38], 0
sub esp, 8
add esp, 0x1c
ret
mov dword [esp + 4], str.glutIconifyWindow
mov dword [esp], 0x54a618
call fcn.0049ce40
mov eax, dword [0xa37838]
test eax, eax
jne 0x499465
cmp dword [0x51aa14], 2
je 0x499465
mov dword [esp + 4], str.glutIconifyWindow
mov dword [esp], 0x54a6c4
call fcn.0049ce40
mov eax, dword [0xa37838]
jmp 0x499465

Function at 0x49cc40
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, 1
push ebx
sub esp, 0x14
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [esp], 0xa0
call ebx
sub esp, 4
test ax, ax
js 0x49cc73
mov dword [esp], 0xa1
call ebx
movsx esi, ax
sub esp, 4
shr esi, 0x1f
mov dword [esp], 0xa2
call ebx
mov edx, 2
sub esp, 4
test ax, ax
js 0x49cc9d
mov dword [esp], 0xa3
call ebx
mov edx, eax
sub esp, 4
shr edx, 0xe
and edx, 2
or esi, edx
mov dword [esp], 0xa4
call ebx
mov edx, 4
sub esp, 4
test ax, ax
js 0x49ccc9
mov dword [esp], 0xa5
call ebx
mov edx, eax
sub esp, 4
shr edx, 0xd
and edx, 4
mov eax, esi
add esp, 0x14
or eax, edx
pop ebx
pop esi
ret

Function at 0x49ce40
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x51aa48]
test ebx, ebx
je 0x49ce68
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [0x51aa48]
add esp, 0x18
pop ebx
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea ebx, [esp + 0x24]
mov dword [esp + 8], 9
mov dword [esp + 4], 1
mov dword [esp], str.freeglut
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [0x51aa1c]
test eax, eax
je 0x49ceb9
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.__s_:
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], 0xa
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
cmp byte [0x51a9bc], 0
jne 0x49cf02
mov dword [esp], 1
call sub.msvcrt.dll_exit
call fcn.00496d40
jmp 0x49cef6
Function at 0x49cf10
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [0x51aa4c]
test eax, eax
je 0x49cf37
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [0x51aa4c]
add esp, 0x18
pop ebx
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea ebx, [esp + 0x24]
mov dword [esp + 8], 9
mov dword [esp + 4], 1
mov dword [esp], str.freeglut
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [0x51aa1c]
test eax, eax
je 0x49cf88
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.__s_:
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], 0xa
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
add esp, 0x18
pop ebx
ret

Function at 0x49ece0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
movzx edx, byte [esp + 0x68]
mov dword [esp + 4], 1
mov ebp, dword [esp + 0x60]
mov dword [esp], 0xe8
movzx esi, byte [esp + 0x74]
movzx edi, byte [esp + 0x80]
mov byte [esp + 0x3f], dl
movzx ebx, byte [esp + 0x84]
call sub.msvcrt.dll_calloc
xor edx, edx
test eax, eax
je 0x49ed33
mov dword [eax + edx*4 + 0x54], 0
add edx, 1
cmp edx, 0x1c
jne 0x49ed23
mov edx, dword [0xa37848]
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
add edx, 1
test ebp, ebp
mov dword [0xa37848], edx
mov dword [eax + 8], edx
je 0x49ee07
mov edx, dword [ebp + 0xe0]
test edx, edx
je 0x49ee26
mov dword [edx], eax
mov dword [eax + 4], edx
mov dword [eax], 0
mov dword [ebp + 0xe0], eax
mov dword [eax + 0xd8], ebp
xor edx, edx
test ebp, ebp
setne dl
and edi, 0xff
mov byte [eax + 0xe4], bl
movzx ebx, byte [esp + 0x3f]
and esi, 0xff
mov dword [eax + 0x3c], 0x64
mov byte [eax + 0x50], 0
mov byte [eax + 0x51], 0
mov byte [eax + 0x53], 0
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x78]
mov dword [esp], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x6c]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x64]
mov dword [esp + 4], edx
call fcn.00498b20
mov eax, dword [esp + 0x38]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [0xa37824]
test edx, edx
je 0x49ee38
mov dword [edx], eax
mov dword [eax + 4], edx
mov dword [eax], 0
mov dword [0xa37824], eax
jmp 0x49ed86
mov dword [eax + 4], 0
mov dword [ebp + 0xdc], eax
jmp 0x49ed74
mov dword [eax + 4], 0
mov dword [0xa37820], eax
jmp 0x49ee16
Function at 0x49fd10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x4c
test eax, eax
mov byte [esp + 0x2c], dl
je 0x49fd50
lea edx, [esp + 0x3c]
mov dword [esp + 0xc], edx
lea edx, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 1
mov dword [esp + 4], edx
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
add esp, 0x4c
ret
xor eax, eax
add esp, 0x4c
ret
Function at 0x49ff70
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
cmp byte [0x51aa28], 0
je 0x49ff80
ret
sub esp, 0x7c
mov dword [esp], str.GLUT_DIALS_SERIAL
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], ebp
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4a0110
lea ebp, [esp + 0x44]
xor edx, edx
mov dword [ebp + edx], 0
add edx, 4
cmp edx, 0x1c
jb 0x49ffad
mov dword [esp + 0x44], 0x1c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
test eax, eax
mov esi, eax
je 0x4a019a
mov dword [esp], 0x34
call sub.msvcrt.dll_malloc
mov ecx, 0xd
mov ebx, eax
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [ebx + 0x18]
mov dword [ebx], esi
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetCommState]
lea eax, [ebx + 4]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetCommTimeouts]
sub esp, 8
mov dword [esp + 0x44], 0x1c
mov dword [esp + 4], ebp
mov dword [esp], str.96_n_8_1
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
sub esp, 8
mov dword [esp + 4], ebp
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetCommState]
sub esp, 8
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 1
mov dword [esp + 0x40], 1
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov eax, dword [ebx]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, 0x20
mov eax, ebx
mov dword [0xa37860], ebx
sub esp, 4
call fcn.0049fd10
mov dword [esp + 8], 0
mov dword [esp + 4], 0x49fdc0
mov dword [esp], 0xa
call fcn.0049b4e0
mov byte [0x51aa28], 1
mov ebx, dword [esp + 0x6c]
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x74]
mov ebp, dword [esp + 0x78]
add esp, 0x7c
ret
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], 0x100
mov dword [esp + 0x28], 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.SOFTWAREFreeGLUT
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
sub esp, 0xc
test eax, eax
jne 0x4a00f7
lea eax, [esp + 0x24]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], 0xa37880
mov dword [esp + 8], 0
mov dword [esp + 4], str.DialboxSerialPort
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x4a01a9
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xa37880
sub esp, 4
jmp 0x49ffa7
mov dword [0xa37860], 0
jmp 0x4a00f7
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
jmp 0x4a00f7
Function at 0x4a0270
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x26c
mov dword [esp + 0x264], edi
mov edi, eax
mov dword [esp + 0x25c], ebx
mov dword [esp + 0x260], esi
mov dword [esp + 0x268], ebp
cmp byte [eax + 0x1d0], 0
je 0x4a02c2
xor eax, eax
mov ebx, dword [esp + 0x25c]
mov esi, dword [esp + 0x260]
mov edi, dword [esp + 0x264]
mov ebp, dword [esp + 0x268]
add esp, 0x26c
ret
lea ebx, [esp + 0x50]
mov esi, dword [sym.imp.msvcrt.dll__snprintf]
lea eax, [eax + 0x70]
mov dword [esp + 0x14], str.CurrentJoystickSettings
lea ebp, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.SystemCurrentControlSetControlMediaResourcesJoystick
mov dword [esp + 8], str._s_s_s
mov dword [esp + 4], 0x100
mov dword [esp], ebx
mov dword [esp + 0x2c], edx
call esi
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
mov dword [esp + 0x3c], eax
call eax
sub esp, 0x14
test eax, eax
jne 0x4a029d
mov dword [esp + 0x10], str.OEMName
mov eax, dword [edi + 0x1c8]
mov dword [esp + 0x4c], 0x100
mov dword [esp + 8], str.Joystick_d_s
mov dword [esp + 4], 0x100
add eax, 1
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call esi
lea eax, [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x150]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp + 0x38], eax
call eax
sub esp, 0x18
mov edi, eax
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x34], eax
call eax
sub esp, 4
test edi, edi
mov ecx, dword [esp + 0x30]
jne 0x4a029d
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.SystemCurrentControlSetControlMediaPropertiesPrivatePropertiesJoystickOEM
mov dword [esp + 8], str._s_s
mov dword [esp + 4], 0x100
mov dword [esp], ebx
call esi
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
call dword [esp + 0x3c]
sub esp, 0x14
test eax, eax
mov edx, dword [esp + 0x2c]
jne 0x4a029d
lea eax, [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], edx
mov dword [esp + 0x4c], pe_nt_image_headers32
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.OEMName
mov dword [esp], eax
call dword [esp + 0x38]
sub esp, 0x18
mov ebx, eax
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call dword [esp + 0x34]
xor eax, eax
sub esp, 4
test ebx, ebx
sete al
jmp 0x4a029f
Function at 0x4a99c0
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
cmp word [edx], 0x5a4d
je 0x4a99d0
repz ret
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x4a99cd
xor eax, eax
cmp word [edx + 0x18], 0x10b
sete al
ret

Function at 0x4a99f0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4a9a28
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x4a9a1e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x4a9a2a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4a9a10
xor eax, eax
pop ebx
pop esi
ret

Function at 0x4a9f70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0xa37d64
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0xa37d7c]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 4
test ebx, ebx
je 0x4a9fc5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4a9fbe
test esi, esi
je 0x4a9fbe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4a9fa0
mov dword [esp], 0xa37d64
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4aa250
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4aa284
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0xa37d84], eax
call fcn.004ba490
test eax, eax
sete al
movzx eax, al
mov dword [0x51cbb4], eax
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4aa273

Function at 0x4aa320
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov dword [esp + 4], eax
mov eax, dword [0xa37d84]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x4aa340
add esp, 0x1c
ret
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
jmp eax
Function at 0x4aa3a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x2c
mov eax, dword [0x51cbb4]
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
test eax, eax
mov dword [esp + 0x28], ebp
js 0x4aa450
test eax, eax
jne 0x4aa3f0
mov eax, dword [0xa37d88]
mov dword [0xa37d88], ebx
mov dword [ebx], eax
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
add esp, 0x2c
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [0xa37d84]
call esi
mov dword [esp], ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebp, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0xa37d84]
mov dword [ebx], ebp
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4aa3d5
mov edx, esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
add esp, 0x2c
jmp edx
call fcn.004aa290
mov eax, dword [0x51cbb4]
jmp 0x4aa3c4

Function at 0x4aa460
Capabilities:
Set thread local storage value

Disassembly:
push ebx
sub esp, 8
mov edx, dword [0x51cbb4]
mov eax, dword [esp + 0x10]
test edx, edx
mov ebx, dword [eax]
js 0x4aa490
test edx, edx
jne 0x4aa483
mov dword [0xa37d88], ebx
add esp, 8
pop ebx
ret
add esp, 8
mov eax, ebx
pop ebx
jmp fcn.004aa320
call fcn.004aa290
mov edx, dword [0x51cbb4]
jmp 0x4aa474

Function at 0x4aa690
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [0x51cbb4]
mov edi, dword [esp + 0x40]
test eax, eax
js 0x4aa773
test eax, eax
mov esi, dword [0xa37d88]
jne 0x4aa711
test esi, esi
mov dword [esp + 0x2c], esi
je 0x4aa705
mov ecx, esi
lea ebx, [esp + 0x2c]
nop
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x4aa6f7
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [esp + 4], 1
mov dword [esp], 1
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call eax
cmp eax, 6
je 0x4aa740
cmp eax, 8
jne 0x4aa767
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
test ecx, ecx
mov dword [esp + 0x2c], ecx
jne 0x4aa6c0
mov eax, 5
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov esi, dword [0xa37d84]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x4aa6b1
mov eax, dword [esp + 0x2c]
mov edx, ebx
mov dword [edi + 0xc], 0
mov dword [esp + 0x2c], esi
mov dword [edi + 0x10], eax
mov eax, edi
call fcn.004aa1b0
cmp eax, 7
jne 0x4aa70a
mov eax, ebx
call fcn.004aa350
add esp, 0x30
mov eax, 3
pop ebx
pop esi
pop edi
ret
call fcn.004aa290
mov eax, dword [0x51cbb4]
jmp 0x4aa6a7
Function at 0x4aa840
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edx, dword [0x51cbb4]
mov ebx, dword [esp + 0x30]
test edx, edx
js 0x4aa8bb
test edx, edx
mov esi, dword [0xa37d88]
jne 0x4aa895
mov ecx, dword [ebx + 0xc]
mov eax, ebx
mov dword [esp + 0x1c], esi
lea esi, [esp + 0x1c]
mov edx, esi
test ecx, ecx
jne 0x4aa885
call fcn.004aa1b0
cmp eax, 7
je 0x4aa88c
nop
lea esi, [esi]
call sub.msvcrt.dll_abort
call fcn.004aa4a0
jmp 0x4aa876
mov eax, esi
nop
call fcn.004aa350
mov esi, dword [0xa37d84]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
jmp 0x4aa85e
call fcn.004aa290
mov edx, dword [0x51cbb4]
jmp 0x4aa854

Function at 0x4aa8d0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4aa902
mov dword [esp], ebx
call fcn.004aa690
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esp, 0x2c
ret
mov edx, dword [0x51cbb4]
test edx, edx
js 0x4aa970
test edx, edx
mov esi, dword [0xa37d88]
jne 0x4aa940
lea edx, [esp + 0x1c]
mov eax, ebx
mov dword [esp + 0x1c], esi
call fcn.004aa4a0
cmp eax, 7
je 0x4aa930
call sub.msvcrt.dll_abort
nop
lea eax, [esp + 0x1c]
call fcn.004aa350
lea esi, [esi]
mov esi, dword [0xa37d84]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x4aa916
call fcn.004aa290
mov edx, dword [0x51cbb4]
jmp 0x4aa90c

Function at 0x4aaec0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
add esp, 0x1c
ret

Function at 0x4aaf00
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x4aaf25
xor eax, eax
add esp, 0x1c
ret
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
jmp eax
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3aeb3bb2
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..text
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x6cd71452
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4018b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x4018d6
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x40196a
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401925
cmp eax, 0x40
je 0x401925
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x4018c9
cmp eax, 0x40
je 0x4018c9
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x4018c9
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sub.msvcrt.dll__assert
lea esi, [esi]
lea edi, [edi]