joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b770
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x514580], 0
push esi
mov esi, edx
je 0x45b7c5
push dword [0x514588]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45b7c5
cmp dword [eax], 1
jbe 0x45b7c5
mov eax, dword [eax + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x45b7c5
push 0
push 0x516354
push 0x515ff0
push 0
push eax
call fcn.004def21
mov ecx, eax
add esp, 0x14
test ecx, ecx
je 0x45b7c5
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
mov byte [esi], al
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x45bf60
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3430
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x513200]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x14], edi
push 0xc
mov dword [ebp - 4], 0
call fcn.004894ff
mov esi, eax
add esp, 4
mov dword [esi], 0
push esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x45bfd6
push eax
push esi
call fcn.0048952f
add esp, 8
push 0
push dword [edi + 4]
jmp 0x45c00d
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4637c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4637ce
xor al, al
pop ebp
ret
push esi
push 0x4e7960
push eax
call fcn.00497769
mov esi, eax
add esp, 8
test esi, esi
jne 0x4637e8
xor al, al
pop esi
pop ebp
ret
push edi
push esi
call fcn.004a9d1e
push eax
call fcn.004aa32b
mov edi, eax
push edi
call fcn.004a9943
add esp, 0xc
mov dword [0x527bbc], eax
push esi
test eax, eax
je 0x463824
push edi
push 1
push eax
call fcn.004a9f2d
mov eax, dword [0x527bbc]
add esp, 0x10
cmp dword [eax], 0x504d444d
push esi
je 0x463832
call fcn.00497416
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
ret
call fcn.00497416
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
ret

Function at 0x464360
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x40
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [edi + 0x148]
mov edx, eax
lea esi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x464390
sub edx, esi
lea esi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4643a0
push dword [ebp - 0x30]
mov ecx, 0x64
sub eax, esi
push dword [ebp - 0x34]
sub ecx, edx
add edi, 0x148
push str.__I64d
push ecx
add eax, edi
push eax
call fcn.004251c0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
call fcn.00489940
mov esp, ebp
pop ebp
ret
Function at 0x4656b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
push 0x4e7960
lea eax, [ebp - 4]
push esi
push eax
call fcn.00497780
add esp, 0xc
test eax, eax
je 0x4656e6
push eax
mov ecx, esi
call fcn.00464a20
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4656f7
mov eax, 2
pop esi
mov esp, ebp
pop ebp
ret
push edi
push eax
call fcn.004a9d1e
push eax
call fcn.004aa32b
mov edi, eax
add esp, 8
test edi, edi
jg 0x465720
push edi
mov ecx, esi
call fcn.00464a20
pop edi
mov eax, 3
pop esi
mov esp, ebp
pop ebp
ret
cdq
push 1
push edi
mov dword [esi + 0x108], eax
mov dword [esi + 0x10c], edx
call fcn.00496f36
add esp, 8
mov dword [esi + 0x104], eax
test eax, eax
jne 0x46575c
push edi
mov ecx, esi
call fcn.00464a20
mov ecx, esi
call fcn.00464360
pop edi
mov eax, 4
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
push edi
push 1
push eax
call fcn.004a9f2d
push dword [ebp - 4]
call fcn.00497416
add esp, 0x14
mov ecx, esi
call fcn.00465530
test eax, eax
jne 0x4657b1
mov ecx, esi
call fcn.004659c0
test eax, eax
jne 0x4657b1
mov ecx, esi
call fcn.004655a0
test eax, eax
jne 0x4657b1
mov ecx, esi
call fcn.004657c0
test eax, eax
jne 0x4657b1
mov ecx, esi
call fcn.00464a70
test eax, eax
jne 0x4657b1
mov ecx, esi
call fcn.00465a70
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4667d0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x40
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [edi + 0x124]
mov edx, eax
lea esi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x466800
sub edx, esi
lea esi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x466810
push dword [ebp - 0x30]
mov ecx, 0x64
sub eax, esi
push dword [ebp - 0x34]
sub ecx, edx
add edi, 0x124
push str.__I64d
push ecx
add eax, edi
push eax
call fcn.004251c0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
call fcn.00489940
mov esp, ebp
pop ebp
ret
Function at 0x467500
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x50c7e8
push 0x48c220
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x513200]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0
push 0x4e7960
push esi
lea eax, [ebp - 0x1c]
push eax
call fcn.00497780
add esp, 0xc
test eax, eax
je 0x467576
push 0
push eax
mov ecx, esi
call fcn.00467140
mov eax, 6
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x467594
mov eax, 5
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call fcn.004a9d1e
push eax
call fcn.004aa32b
add esp, 8
mov edi, eax
test edi, edi
jg 0x4675ca
push 0
push edi
mov ecx, esi
call fcn.00467140
mov eax, 7
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
push 1
push edi
call fcn.00496f36
add esp, 8
mov dword [esi + 0x104], eax
mov dword [ebp - 4], 0xfffffffe
test eax, eax
jne 0x467634
mov dword [ebp - 0x20], 0x3e7
lea eax, [ebp - 0x20]
push eax
call fcn.004aa3f2
add esp, 4
push 0
push edi
mov ecx, esi
call fcn.00467140
mov ecx, esi
call fcn.004667d0
push 1
push dword [ebp - 0x20]
mov ecx, esi
call fcn.00467140
mov eax, 8
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x1c]
push edi
push 1
push eax
call fcn.004a9f2d
push dword [ebp - 0x1c]
call fcn.00497416
add esp, 0x14
mov ecx, esi
call fcn.00467230
test eax, eax
jne 0x4676a9
mov ecx, esi
call fcn.004676c0
test eax, eax
jne 0x4676a9
mov ecx, esi
call fcn.00467f30
test eax, eax
jne 0x4676a9
mov ecx, esi
call fcn.00467d50
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x469400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3db8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x469546
cmp byte [ebx + 0x3d], 0
je 0x469546
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x469454
xor al, al
jmp 0x469548
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.0045cbf0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14]
nop dword [eax]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmp edx, 0x10
lea esi, [ebp - 0x28]
cmovae esi, eax
cmovae edi, eax
mov edx, dword [ecx]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4694af
sub eax, 1
je 0x4694b3
mov edx, dword [ebp - 0x14]
sub eax, 2
mov eax, dword [ebp - 0x28]
je 0x469509
xor bl, bl
jmp 0x46950b
mov byte [ebx + 0x3d], 0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp edx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae ecx, eax
sub esi, ecx
je 0x4694eb
push dword [ebx + 0x4c]
cmp edx, 0x10
lea ecx, [ebp - 0x28]
push esi
cmovae ecx, eax
push 1
push ecx
call fcn.00497ae1
mov edx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
mov eax, dword [ebp - 0x28]
jne 0x4694ab
cmp byte [ebx + 0x3d], 0
je 0x469509
test esi, esi
jne 0x469470
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00460640
jmp 0x469467
mov bl, 1
cmp edx, 0x10
jb 0x46953d
lea ecx, [edx + 1]
cmp ecx, 0x1000
jb 0x469534
test al, 0x1f
jne 0x469541
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x469541
sub eax, ecx
cmp eax, 4
jb 0x469541
cmp eax, 0x23
ja 0x469541
mov eax, ecx
push eax
call fcn.004894fa
add esp, 4
mov al, bl
jmp 0x469548
call fcn.00496c88
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00489940
mov esp, ebp
pop ebp
ret
Function at 0x46ac13
Capabilities:
Check http status code
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 4
pop eax
push 0x800
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x804]
push ecx
push eax
mov dword [ebp - 0x810], ecx
mov dword [ebp - 0x80c], ecx
mov dword [ebp - 0x808], ecx
mov dword [ebx], ecx
call fcn.0048bb90
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.004ab240
add esp, 0x14
xor eax, eax
push eax
push SysReAllocString
push eax
push eax
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x46ad0e
mov edi, dword [sym.imp.WININET.dll_HttpQueryInfoA]
lea eax, [ebp - 0x814]
push 0
push eax
lea eax, [ebp - 0x810]
push eax
push 0x20000013
push esi
call edi
test eax, eax
je 0x46ad0e
cmp dword [ebp - 0x810], 0xc8
jne 0x46ad0e
push 0
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x80c]
push eax
push 0x20000005
push esi
call edi
test eax, eax
je 0x46ad0e
mov eax, dword [ebp - 0x80c]
inc eax
push eax
call fcn.004a9943
push dword [ebp - 0x80c]
mov dword [ebx], eax
push eax
push esi
call fcn.0046bf40
mov edi, eax
add esp, 0x10
test edi, edi
je 0x46ad14
mov ecx, dword [ebx]
mov byte [edi + ecx], 0
jmp 0x46ad24
mov edi, dword [ebp - 0x808]
cmp dword [ebx], 0
je 0x46ad24
push dword [ebx]
call fcn.00496f41
and dword [ebx], 0
pop ecx
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489940
mov esp, ebp
pop ebp
ret
Function at 0x46ba0c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, 0x104
push edi
push 0
push eax
call fcn.0048bb90
add esp, 0xc
lea eax, [ebp - 0x108]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x46ba51
xor al, al
jmp 0x46bab0
push 0x4e84b8
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.00496e7c
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0046b977
add esp, 0x14
test al, al
je 0x46ba4d
movzx eax, word [ebp - 0x10a]
push eax
movzx eax, word [ebp - 0x10c]
push eax
movzx eax, word [ebp - 0x10e]
push eax
movzx eax, word [ebp - 0x110]
push eax
push 0x4e84c8
push dword [ebp + 0xc]
push esi
call fcn.004251c0
add esp, 0x1c
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00489940
mov esp, ebp
pop ebp
ret

Function at 0x46bac0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 4], 0xbb8
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
test edi, edi
je 0x46bb3a
push esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionA]
lea eax, [ebp - 4]
push 4
push eax
push 2
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 5
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 6
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 8
push edi
call esi
push ebx
push 0x84200000
push ebx
push ebx
push dword [ebp + 8]
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
je 0x46bb36
mov bl, 1
push eax
call esi
push edi
call esi
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46bf40
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], esi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x46bf70
add esi, ecx
add ebx, ecx
sub edi, ecx
je 0x46bf78
test eax, eax
je 0x46bf78
test ecx, ecx
jne 0x46bf52
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46c2f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
jne 0x46c2fd
xor al, al
pop ebp
ret
mov dword [ebp + 0xc], 0x4e888c
pop ebp
jmp fcn.0046c330

Function at 0x46c330
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x100
mov byte [ebp - 0x10c], al
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.0048bb90
add esp, 0xc
mov dword [ebp - 0x108], 0
lea eax, [ebp - 0x108]
push eax
push 0x20019
push 0
push dword [ebp - 0x10c]
call fcn.0046c310
add esp, 4
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x46c3b2
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489940
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x110], 1
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x10c], 0x100
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push esi
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x108]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x46c3a0
lea edx, [ebp - 0x104]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x46c405
sub edx, esi
lea eax, [ebp - 0x104]
push edx
push eax
mov ecx, edi
call fcn.004608e0
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00489940
mov esp, ebp
pop ebp
ret
Function at 0x489d46
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x50fac8
call fcn.0048a5b0
push 1
call fcn.0048970d
pop ecx
test al, al
jne 0x489bba
push 7
call fcn.0048a3bf
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00489610
mov byte [ebp - 0x24], al
mov eax, dword [0x528524]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x489bb3
test eax, eax
jne 0x489c24
mov dword [0x528524], ecx
push 0x4e7498
push 0x4e7478
call fcn.004c199a
pop ecx
pop ecx
test eax, eax
je 0x489c07
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x489cfd
push 0x4e7474
push 0x4e7420
call fcn.004c193e
pop ecx
pop ecx
mov dword [0x528524], 2
jmp 0x489c29
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0048987a
pop ecx
call fcn.0048a72c
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x489c59
push esi
call fcn.004897f0
pop ecx
test al, al
je 0x489c59
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0048a065
call esi
call fcn.0048a732
mov esi, eax
cmp dword [esi], edi
je 0x489c77
push esi
call fcn.004897f0
pop ecx
test al, al
je 0x489c77
push dword [esi]
call fcn.004bfed3
pop ecx
call fcn.0048a4db
movzx eax, ax
push eax
call fcn.004c18a5
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0048a511
test al, al
jne 0x489ca2
push esi
call fcn.004bff0b
test bl, bl
jne 0x489cab
call fcn.004bfea8
push edi
push 1
call fcn.00489897
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x489cfd
call fcn.0048a5f6
ret
call fcn.0048a65a
jmp 0x489b9b

Function at 0x490a0e
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4ebaec
push 0x4ebae4
push 0x4e9be8
push 0
call fcn.004908bc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x490a40
push dword [ebp + 8]
mov ecx, esi
call fcn.0048a065
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x490a82
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4ebafc
push 0x4ebaf4
push str.FlsGetValue
push 2
call fcn.004908bc
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x490ab3
mov ecx, esi
call fcn.0048a065
call esi
jmp 0x490ab9
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x490abc
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4ebb04
push 0x4ebafc
push str.FlsSetValue
push 3
call fcn.004908bc
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x490af0
mov ecx, esi
call fcn.0048a065
call esi
jmp 0x490af6
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x4c9753
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c9358

Function at 0x4c975e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c94d9

Function at 0x4d0986
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d016b

Function at 0x4d0991
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d03a6

Function at 0x4d0e96
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d0c1d
Function at 0xb12000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0xb1200a
jmp 0xb1400f
jmp fcn.008c20b0
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x405044], 1
mov dword [0x405040], 1
mov dword [0x40503c], 1
mov dword [0x405034], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x405014], eax
mov eax, dword [0x405050]
test eax, eax
je 0x4010b0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x405064]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x40504c]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x40301c], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060

Function at 0x4017f0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x401850
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x405058]
test esi, esi
jle 0x401970
mov eax, dword [0x40505c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401884
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401907
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401870
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401997
mov eax, dword [0x40505c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x40505c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401977
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401900
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401910
add dword [0x405058], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40505c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401900
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40188e
mov eax, dword [0x40505c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x401e30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405074
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40506c]
sub esp, 4
test ebx, ebx
je 0x401e85
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401e7e
test esi, esi
je 0x401e7e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e60
mov dword [esp], 0x405074
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4021b0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4021d5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4021e0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4021d5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x402228
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40221e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40222a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402210
xor eax, eax
pop ebx
pop esi
ret