joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4479f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x80
mov esi, 0x81
mov ebx, ecx
nop word cs:[eax + eax]
nop dword [eax]
mov bh, cl
mov edi, esi
shr bl, 4
and bh, 0xf
mov al, bh
mov ah, bh
or al, 0x30
add ah, 0x37
cmp bh, 0xa
movzx esi, al
movzx eax, ah
cmovb eax, esi
cmp cl, 0x10
lea esi, [edi - 1]
mov ecx, ebx
mov byte [ebp + edi - 0x8e], al
jae 0x447a10
add edi, 0xfffffffe
cmp edi, 0x81
jae 0x447a79
mov eax, 0x81
mov ecx, edx
mov edx, 1
sub eax, esi
lea esi, [ebp + edi - 0x8c]
push eax
push esi
push 2
push 0x5138bf
call fcn.00442a60
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, edi
mov edx, pe_nt_image_headers32
push 0x5058f4
call fcn.004428a0
nop word [eax + eax]
Function at 0x4623e3
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], ecx
mov dword [esp + 0x10], edx
mov ecx, 0xcbf29ce4
mov ebx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 8], eax
lea edx, [eax*8]
mov eax, 0x84222325
mov dword [esp], ebx
test edx, edx
je 0x46248b
mov dword [esp + 0xc], edx
movzx edx, byte [ebx + 4]
xor eax, edx
mov edx, 0x100
mov edi, eax
imul edi, edx
mov edx, 0x1b3
mul edx
add edx, edi
mov edi, 0x1b3
imul ecx, edi
add ecx, edx
movzx edx, byte [ebx + 5]
imul ecx, edi
xor eax, edx
mov edx, 0x100
mov esi, eax
imul esi, edx
mul edi
xor eax, dword [ebx]
mov edi, edx
add ebx, 8
add edi, esi
add edi, ecx
mov ecx, 0x100
mov esi, eax
imul esi, ecx
mov ecx, 0x1b3
mul ecx
mov ecx, edx
mov edx, dword [esp + 0xc]
add ecx, esi
mov esi, 0x1b3
imul edi, esi
add ecx, edi
add edx, 0xfffffff8
jmp 0x462418
mov edx, dword [ebp + 8]
mov esi, dword [edx + 8]
test esi, esi
je 0x4625d1
push 0
push esi
push ecx
push eax
call fcn.004f2904
add esp, 0x10
mov ebx, dword [esp]
mov ecx, eax
cmp esi, eax
jbe 0x4625db
mov edx, dword [ebp + 8]
imul esi, ecx, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [edx + 4]
movzx ecx, word [eax + esi + 0x10]
cmp cx, word [edx + 0x10]
jne 0x462510
mov ecx, dword [esp + 8]
add eax, esi
cmp dword [eax + 8], ecx
jne 0x462510
mov ecx, dword [eax + 4]
xor edx, edx
cmp dword [esp + 8], edx
je 0x4625bf
mov bl, byte [ecx + edx*8 + 4]
mov edi, dword [esp]
cmp bl, byte [edi + edx*8 + 4]
mov ebx, dword [esp]
jne 0x462510
mov bl, byte [ecx + edx*8 + 5]
mov edi, dword [esp]
cmp bl, byte [edi + edx*8 + 5]
mov ebx, dword [esp]
jne 0x462510
mov edi, dword [ecx + edx*8]
cmp edi, dword [ebx + edx*8]
lea edx, [edx + 1]
je 0x4624db
mov edx, ebx
lea ebx, [esp + 0x14]
mov ecx, ebx
push dword [esp + 8]
call fcn.004625f1
pop eax
mov edx, dword [esp + 0x10]
lea edi, [esp + 0x20]
mov ecx, edi
push ebx
call fcn.00461622
pop eax
mov eax, dword [edi]
mov ebx, dword [edi + 4]
cmp eax, 0x2a
jne 0x462593
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp], ebx
mov edx, dword [eax + 8]
cmp edx, ecx
jbe 0x4625e7
mov edi, dword [eax + 4]
movzx ebx, word [eax + 0x10]
mov ecx, dword [edi + esi]
mov edx, dword [edi + esi + 4]
call fcn.00402f81
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
mov dword [edi + esi + 8], eax
mov eax, dword [esp + 4]
movsd xmm0, qword [ecx]
mov ecx, dword [esp]
movsd qword [edi + esi], xmm0
mov dword [edi + esi + 0xc], ecx
mov word [edi + esi + 0x10], bx
mov dword [eax + 4], ecx
mov dword [eax], 0x2a
jmp 0x4625b7
mov edx, dword [esp + 4]
lea esi, [esp + 0x28]
lea edi, [edx + 8]
push 0xe
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [edx], eax
mov dword [edx + 4], ebx
mov ebx, dword [esp]
mov eax, dword [ebp + 0xc]
mov edx, ebx
mov ecx, dword [eax]
call fcn.00402f81
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 4]
mov dword [ecx + 4], eax
mov dword [ecx], 0x2a
jmp 0x4625ab
mov ecx, 0x50d718
call fcn.0044a590
mov edx, esi
push 0x50d728
call fcn.00442900
push 0x50d738
call fcn.00442900
Function at 0x466285
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, ecx
mov ecx, dword [ebp + 8]
cmp edx, ecx
jbe 0x466298
shl ecx, 5
add eax, ecx
pop ebp
ret
push 0x50e004
call fcn.00442900

Function at 0x4662a2
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov esi, dword [0x4ff058]
mov edi, ecx
test esi, esi
je 0x46637c
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
mov ebx, eax
cmp eax, 1
ja 0x466372
je 0x466370
test edi, edi
je 0x466300
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
and dword [edi + 4], 0
and dword [edi], 0
or ecx, eax
je 0x466300
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x14]
mov edi, dword [edi + 0x10]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
jmp 0x466326
lea edi, [esp + 0x10]
xorps xmm0, xmm0
movaps xmmword [edi], xmm0
push 0x10
push edi
call dword [sym.imp.bcryptprimitives.dll_ProcessPrng]
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov ecx, dword [edi + 0xc]
mov edi, dword [edi + 8]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
push 0x18
pop ecx
push 8
pop edx
call fcn.004050f3
mov ebx, eax
mov eax, dword [esp + 8]
mov dword [ebx + 4], eax
mov eax, dword [esp + 4]
mov dword [ebx], eax
mov eax, dword [esp + 0xc]
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], esi
push esi
call sub.kernel32.dll_TlsGetValue
mov edi, eax
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x466372
push 8
pop edx
mov ecx, edi
call fcn.0044dba0
jmp 0x466372
xor ebx, ebx
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x4ff058
call fcn.004bbc60
mov esi, eax
jmp 0x4662bf
Function at 0x4a1a51
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov edi, ecx
mov ecx, edx
mov esi, edx
call fcn.0049c3ee
cmp eax, 0x78
je 0x4a1a86
mov ecx, esi
call fcn.0049c3ee
cmp eax, 0x75
je 0x4a1a86
mov ecx, esi
call fcn.0049c3ee
cmp eax, 0x55
jne 0x4a1b1f
mov ecx, esi
call fcn.0049c3ee
cmp eax, 0x75
mov dl, 2
sete cl
sub dl, cl
xor ecx, ecx
cmp eax, 0x78
movzx ebx, dl
cmove ebx, ecx
mov ecx, esi
call fcn.0049f134
test al, al
je 0x4a1ac8
mov ecx, esi
call fcn.0049c3ee
cmp eax, 0x7b
jne 0x4a1b09
movzx eax, bl
mov ecx, edi
mov edx, esi
push eax
call fcn.004a25c5
jmp 0x4a1b16
mov ecx, dword [esi]
lea eax, [ebp - 0x24]
lea ebx, [ebp - 0x40]
mov edx, dword [ecx + 0x58]
mov dword [eax + 0x14], edx
mov edx, dword [esi + 4]
movsd xmm0, qword [ecx + 0x50]
movsd qword [eax + 0xc], xmm0
movsd xmm0, qword [ecx + 0x50]
movsd qword [eax], xmm0
mov ecx, dword [ecx + 0x58]
mov dword [ebx], 0xa
mov dword [eax + 8], ecx
mov ecx, edi
push ebx
push eax
push dword [esi + 8]
call fcn.0049f0b5
add esp, 0x40
jmp 0x4a1b1a
movzx eax, bl
mov ecx, edi
mov edx, esi
push eax
call fcn.004a283a
pop eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x50
pop edx
mov ecx, str.assertion_failed:_self.char____x__self.char____u__self.char____U_b
push 0x510310
call fcn.004434c0
Function at 0x4bac40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, dword [ebp + 0xc]
call 0x4bac51
pop eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
test esi, esi
je 0x4bad1e
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x1c]
jmp 0x4bac88
test esi, esi
je 0x4bad1e
mov ecx, edi
mov edx, 0xfffffff4
push dword [ebp - 0x28]
push esi
push ebx
call fcn.004bad90
add esp, 0xc
movzx eax, byte [ebp - 0x1c]
cmp eax, 4
jne 0x4bacc0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4bad26
mov eax, esi
sub eax, ecx
jb 0x4bad43
add ebx, ecx
mov esi, eax
jmp 0x4bac80
mov eax, dword [eax*4 + 0x4bad7c]
add eax, dword [ebp - 0x24]
jmp eax
mov eax, dword [ebp - 0x20]
mov byte [eax], 4
jmp 0x4bad3b
mov edi, 0x5166f0
jmp 0x4bad30
movsd xmm0, qword [edi]
mov eax, dword [ebp - 0x20]
movsd qword [eax], xmm0
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, esi
push 0x514ff0
call fcn.004428a0
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov esi, eax
cmp dword [edx + 4], 0
je 0x4bad68
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 8]
call fcn.0044dba0
mov ecx, edi
mov edx, 4
call fcn.0044dba0
push esi
call fcn.004f50b0
nop
fild word [eax]
add byte [eax], al
jnp 0x4bad82
add byte [eax], al
sbb al, byte [eax]
add byte [eax], al
add dword [eax], 0
add byte [edi], cl
pop ds
inc eax
add byte [ebp - 0x77], dl
push ebp
mov ebp, esp
push ebx
Function at 0x4bb050
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov edi, edx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x103
lea edx, [ebp - 0x18]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x4bb0a0
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x18]
cmp eax, 0x103
je 0x4bb0c0
test eax, eax
js 0x4bb0ab
mov eax, dword [ebp - 0x14]
mov bl, 4
jmp 0x4bb0b3
xor ebx, ebx
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov dword [esi + 4], eax
mov byte [esi], bl
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x10]
mov dword [ebp - 0x40], 0x515978
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x1c], 0
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x34], 0
push eax
call fcn.004ba8f0
add esp, 4
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
call fcn.004ba9f0
mov ecx, 7
int 0x29
ud2
Function at 0x4bb9f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x4ff038]
mov edi, ecx
test esi, esi
je 0x4bba94
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x4bba8c
je 0x4bba3e
test edi, edi
je 0x4bba42
mov eax, dword [edi]
xor ecx, ecx
mov ebx, 0
mov dword [edi], 0
or eax, dword [edi + 4]
mov dword [edi + 4], 0
je 0x4bba3a
mov ecx, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov edi, ecx
jmp 0x4bba46
xor eax, eax
jmp 0x4bba8c
xor ebx, ebx
xor edi, edi
movzx eax, byte [0x537118]
xor ecx, ecx
mov edx, 0x10
call fcn.004e4370
test eax, eax
je 0x4bbaa5
mov dword [eax], ebx
mov dword [eax + 4], edi
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x4bba89
mov ecx, edi
mov edx, 8
call fcn.0044dba0
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x4ff038
call fcn.004bbc60
mov esi, eax
jmp 0x4bba08
mov ecx, 8
mov edx, 0x10
call fcn.0041ecb0
nop word cs:[eax + eax]
nop

Function at 0x4bbac0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x4ff048]
test esi, esi
je 0x4bbb44
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x4bbb3c
je 0x4bbb3a
movzx eax, byte [0x537118]
xor ecx, ecx
mov edx, 8
call fcn.004e4370
test eax, eax
je 0x4bbb52
mov dword [eax], 0
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x4bbb35
mov eax, dword [edi]
test eax, eax
je 0x4bbb29
lock dec dword [eax]
jne 0x4bbb29
mov ecx, dword [edi]
call fcn.004ba340
mov ecx, edi
mov edx, 4
call fcn.0044dba0
mov eax, dword [ebp - 0x10]
jmp 0x4bbb3c
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x4ff048
call fcn.004bbc60
mov esi, eax
jmp 0x4bbad2
mov ecx, 4
mov edx, 8
call fcn.0041ecb0
nop word cs:[eax + eax]
nop dword [eax + eax]
Function at 0x4bbc60
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x4bbcce
lea ebx, [esi + 0xc]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push 0
push ebx
call sub.kernel32.dll_InitOnceBeginInitialize
cmp eax, 1
mov dword [ebp - 0x30], eax
jne 0x4bbd04
cmp dword [ebp - 0x14], 0
je 0x4bbceb
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x4bbd16
mov edi, eax
mov eax, dword [entry1]
mov eax, dword [0x5370c4]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x5370c4], esi
jne 0x4bbcb0
mov eax, edi
inc eax
mov dword [esi], eax
push 0
push 0
push ebx
call sub.kernel32.dll_InitOnceComplete
jmp 0x4bbcfa
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x4bbd50
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x4bbcef
mov edi, dword [ebp - 0x10]
jmp 0x4bbcfa
mov edi, dword [esi]
jmp 0x4bbcf9
mov edi, eax
push dword [ebp - 0x10]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
call 0x4bbd80
push 0
push 4
push ebx
call sub.kernel32.dll_InitOnceComplete
lea ecx, [ebp - 0x2c]
mov edx, 0x51609c
mov dword [ebp - 0x2c], 0x516064
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 0
call fcn.004424d0
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x516064
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call 0x4bbdc0
nop
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0x515a4c
lea esi, [ebp - 0xc]
lea edx, [ebp - 8]
xor ecx, ecx
push 0x5160ac
push eax
push 0x514320
push esi
push 0x514320
call fcn.00443530
nop word cs:[eax + eax]
nop dword [eax + eax]
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0x5160bc
lea esi, [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, 1
push 0x5160c0
push eax
push 0x514310
push esi
push 0x514310
call fcn.00443530
nop word cs:[eax + eax]
nop
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov eax, dword [eax]
test dl, 0x10
jne 0x4bbe21
test dl, 0x20
jne 0x4bbe2a
push ecx
push eax
call fcn.00442960
jmp 0x4bbe31
push ecx
push eax
call fcn.004450f0
jmp 0x4bbe31
push ecx
push eax
call fcn.0044d510
add esp, 8
pop ebp
ret
Function at 0x4bbe40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x4bbe57
test eax, eax
jne 0x4bbfbe
mov al, 1
mov dword [ebp - 0x10], eax
mov esi, dword [0x5370c4]
nop word cs:[eax + eax]
nop dword [eax]
test esi, esi
je 0x4bbeac
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x4bc001
mov esi, dword [esi + 8]
test ebx, ebx
je 0x4bbe70
dec ebx
push ebx
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x4bbe70
push 0
push ebx
mov ebx, eax
call sub.kernel32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x4bbe70
test byte [ebp - 0x10], 1
jne 0x4bbfbe
mov al, 1
mov dword [ebp - 0x10], eax
mov esi, dword [0x5370c4]
nop word cs:[eax + eax]
nop dword [eax + eax]
test esi, esi
je 0x4bbf0c
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x4bc001
mov esi, dword [esi + 8]
test ebx, ebx
je 0x4bbed0
dec ebx
push ebx
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x4bbed0
push 0
push ebx
mov ebx, eax
call sub.kernel32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x4bbed0
test byte [ebp - 0x10], 1
jne 0x4bbfbe
mov al, 1
mov dword [ebp - 0x10], eax
mov esi, dword [0x5370c4]
nop word cs:[eax + eax]
nop dword [eax + eax]
test esi, esi
je 0x4bbf6c
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x4bc001
mov esi, dword [esi + 8]
test ebx, ebx
je 0x4bbf30
dec ebx
push ebx
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x4bbf30
push 0
push ebx
mov ebx, eax
call sub.kernel32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x4bbf30
test byte [ebp - 0x10], 1
jne 0x4bbfbe
mov al, 1
mov dword [ebp - 0x10], eax
mov esi, dword [0x5370c4]
nop dword [eax]
test esi, esi
je 0x4bbfb8
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x4bc001
mov esi, dword [esi + 8]
test ebx, ebx
je 0x4bbf80
dec ebx
push ebx
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x4bbf80
push 0
push ebx
mov ebx, eax
call sub.kernel32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x4bbf80
test byte [ebp - 0x10], 1
je 0x4bbfc8
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov edi, dword [0x5370c4]
nop
test edi, edi
je 0x4bbfbe
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x4bc001
mov edi, dword [edi + 8]
test esi, esi
je 0x4bbfd0
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x4bbfd0
push 0
push esi
mov esi, eax
call sub.kernel32.dll_TlsSetValue
push esi
call ebx
add esp, 4
jmp 0x4bbfd0
mov ecx, 0x5160d0
call fcn.00444f90
ud2
Function at 0x4bc260
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x4ff028]
test esi, esi
je 0x4bc2d6
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x4bc2ce
je 0x4bc2cc
movzx eax, byte [0x537118]
xor ecx, ecx
mov edx, 0xc
call fcn.004e4370
test eax, eax
je 0x4bc2e4
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x4bc2c7
mov ecx, edi
mov edx, 4
call fcn.0044dba0
mov eax, dword [ebp - 0x10]
jmp 0x4bc2ce
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x4ff028
call fcn.004bbc60
mov esi, eax
jmp 0x4bc272
mov ecx, 4
mov edx, 0xc
call fcn.0041ecb0
nop word cs:[eax + eax]
nop dword [eax]
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [esi + 8]
push 1
push edi
call sub.kernel32.dll_TlsSetValue
mov ecx, esi
mov edx, 4
call fcn.0044dba0
push 0
push edi
call sub.kernel32.dll_TlsSetValue
pop esi
pop edi
pop ebp
ret

Function at 0x4bd360
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x42c
mov esi, 0x200
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 2
cmp esi, 0x201
jae 0x4bd3d0
jmp 0x4bd3be
jbe 0x4bd43c
cmp esi, 0x201
jae 0x4bd3d0
mov dword [ebp - 0x24], 0x200
lea edi, [ebp - 0x438]
mov ebx, esi
jmp 0x4bd3fa
mov ebx, dword [ebp - 0x28]
sub esi, ebx
je 0x4bd3ee
mov edx, ebx
lea ecx, [ebp - 0x18]
push esi
call fcn.004bf070
add esp, 4
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
push 0
call sub.kernel32.dll_SetLastError
push edi
push ebx
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
test eax, eax
jne 0x4bd417
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4bd485
cmp esi, ebx
jne 0x4bd3b0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4bd4a2
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x4bd3be
jmp 0x4bd3d0
mov edx, dword [ebp - 0x24]
cmp esi, edx
ja 0x4bd4bb
mov edx, edi
lea ecx, [ebp - 0x38]
push esi
call fcn.004bdd20
add esp, 4
movsd xmm0, qword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
movsd xmm1, qword [ebp - 0x30]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
cmp dword [ebp - 0x18], 0
je 0x4bd47a
mov ecx, dword [ebp - 0x14]
mov edx, 2
call fcn.0044dba0
add esp, 0x42c
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 0x80000000
cmp dword [ebp - 0x18], 0
jne 0x4bd46d
jmp 0x4bd47a
mov edx, 0x28
mov ecx, 0x5167ea
push 0x515e3c
call fcn.004434c0
add esp, 4
jmp 0x4bd4ca
mov ecx, esi
push 0x515e2c
call fcn.00443260
add esp, 4
ud2
Function at 0x4bf750
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov eax, dword [ebp + 8]
mov edi, ecx
xorps xmm0, xmm0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 7
movsd qword [esp + 0x32], xmm0
movsd qword [esp + 0x2c], xmm0
mov byte [esp + 0x34], 1
lea esi, [esp + 0x18]
lea ecx, [esp + 0x10]
push esi
push eax
call fcn.004ddf10
add esp, 8
cmp byte [esp + 0x10], 4
jne 0x4bf7b4
mov esi, dword [esp + 0x14]
jmp 0x4bf7c1
movzx eax, byte [esp + 0x10]
mov esi, dword [esp + 0x14]
cmp al, 4
jne 0x4bf835
lea ebx, [esp + 0x18]
mov edx, esi
mov ecx, ebx
call fcn.004de110
mov eax, dword [esp + 0x18]
xor eax, 2
or eax, dword [esp + 0x1c]
jne 0x4bf823
cmp byte [esp + 0x20], 3
jne 0x4bf82a
mov eax, dword [esp + 0x24]
mov dword [esp + 4], edi
mov edi, dword [eax + 4]
mov ebx, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [edi]
test eax, eax
je 0x4bf7ff
push ebx
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x4bf80f
mov edx, dword [edi + 8]
mov ecx, ebx
call fcn.0044dba0
mov ecx, dword [esp + 0xc]
mov edx, 4
call fcn.0044dba0
mov edi, dword [esp + 4]
jmp 0x4bf82a
cmp dword [esp + 0x54], 0
je 0x4bf87a
mov dword [edi], 0
jmp 0x4bf921
cmp al, 3
jne 0x4bf86f
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 4], eax
mov eax, dword [ebx]
test eax, eax
je 0x4bf851
push dword [esp + 4]
call eax
add esp, 4
mov ecx, dword [esp + 4]
cmp dword [ebx + 4], 0
je 0x4bf863
mov edx, dword [ebx + 8]
call fcn.0044dba0
mov ecx, esi
mov edx, 4
call fcn.0044dba0
mov dword [edi], 0
jmp 0x4bf927
mov eax, dword [esp + 0x50]
test esi, esi
mov dword [esp + 0xc], eax
je 0x4bf8ac
mov dword [esp + 0x18], 0
call sub.kernel32.dll_GetCurrentProcess
push 2
push 0
push 0
push ebx
push eax
push esi
push eax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x4bf916
mov eax, dword [esp + 0x18]
jmp 0x4bf8ae
xor eax, eax
push 0
push 0
push 0
push 2
push 0
mov dword [esp + 0x1c], eax
push eax
call sub.kernel32.dll_CreateFileMappingA
test eax, eax
je 0x4bf905
push dword [esp + 0xc]
push 0
push 0
push 4
push eax
mov dword [esp + 0x18], edi
mov edi, eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
push edi
mov edi, dword [esp + 8]
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x4bf905
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ecx
mov dword [edi], 1
jmp 0x4bf921
mov dword [edi], 0
push dword [esp + 8]
call sub.kernel32.dll_CloseHandle
jmp 0x4bf921
call sub.kernel32.dll_GetLastError
mov dword [edi], 0
push esi
call sub.kernel32.dll_CloseHandle
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret