joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451be0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [esp], esi
call fcn.00451b40
test eax, eax
mov edx, 0xffffffff
je 0x451c2c
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call sub.WSOCK32.DLL_send
sub esp, 0x10
mov ebx, eax
cmp eax, 0xffffffff
je 0x451c38
mov edx, ebx
mov ebx, dword [ebp - 8]
mov eax, edx
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], esi
call fcn.00451ef0
jmp 0x451c2a

Function at 0x451c50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [esp], ebx
call fcn.00451b40
test eax, eax
mov ecx, 0xffffffff
je 0x451c8a
mov eax, dword [ebx + 4]
test eax, eax
je 0x451cf2
mov edx, dword [ebx + 8]
cmp edx, dword [ebx + 0xc]
je 0x451ce0
mov eax, 0x400
xor ecx, ecx
sub eax, edx
jne 0x451c96
mov ebx, dword [ebp - 8]
mov eax, ecx
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebx + 4]
add edx, eax
mov dword [esp + 4], edx
mov eax, dword [ebx]
mov dword [esp], eax
call sub.WSOCK32.DLL_recv
sub esp, 0x10
mov esi, eax
test eax, eax
jle 0x451cc5
add dword [ebx + 8], eax
mov ecx, esi
jmp 0x451c8a
test eax, eax
jns 0x451cc1
mov eax, dword [ebx + 0xc]
cmp dword [ebx + 8], eax
jne 0x451cc1
mov dword [esp], ebx
call fcn.00451ef0
jmp 0x451cc1
mov dword [ebx + 0xc], 0
xor edx, edx
mov dword [ebx + 8], 0
jmp 0x451c7f
mov dword [esp], 0x403
call fcn.00475ce0
mov dword [ebx + 4], eax
jmp 0x451c77

Function at 0x4543a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0x4cfd60
mov dword [esp + 8], 0x454310
mov dword [0x4cfd60], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [0x4cfd64], eax
lea eax, [ebp - 4]
mov dword [esp + 0x14], eax
call sub.KERNEL32.DLL_CreateThread
sub esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x45bc40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov edi, dword [esi + 0x24]
mov ecx, dword [esi + 0x6c]
lea esi, [esi]
lea edi, [edi]
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x64]
sub eax, ecx
sub eax, edx
mov dword [ebp - 0x10], eax
jne 0x45bd08
test edx, edx
jne 0x45bd08
test ecx, ecx
jne 0x45bd08
mov dword [ebp - 0x10], edi
lea esi, [esi]
lea edi, [edi]
mov edx, dword [esi]
mov ebx, dword [edx + 4]
test ebx, ebx
je 0x45bd00
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov ecx, dword [esi + 0x30]
mov eax, dword [esi + 0x64]
mov ebx, dword [esi + 0x6c]
mov dword [esp], edx
add eax, ecx
add eax, ebx
mov dword [esp + 4], eax
call fcn.0045b980
mov ecx, dword [esi + 0x6c]
add eax, ecx
cmp eax, 2
mov dword [esi + 0x6c], eax
jbe 0x45bce7
mov ebx, dword [esi + 0x30]
mov edx, dword [esi + 0x64]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edx + ebx]
mov dword [esi + 0x40], eax
shl eax, cl
movzx edx, byte [edx + ebx + 1]
xor eax, edx
mov edx, dword [esi + 0x4c]
and eax, edx
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x6c]
cmp eax, 0x105
mov ecx, eax
ja 0x45bd00
mov eax, dword [esi]
mov eax, dword [eax + 4]
test eax, eax
jne 0x45bc60
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [ebp - 0x10], 0xffffffff
je 0x45bd90
mov ecx, dword [esi + 0x24]
mov eax, edi
add eax, ecx
sub eax, 0x106
cmp edx, eax
jb 0x45bc90
mov edx, dword [esi + 0x30]
mov dword [esp + 8], edi
lea eax, [edi + edx]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_memcpy
sub dword [esi + 0x68], edi
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x64], edi
sub dword [esi + 0x54], edi
lea eax, [eax + ecx*2]
mov esi, esi
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, edi
jb 0x45bd60
mov ebx, edx
sub ebx, edi
mov word [eax], bx
dec ecx
jne 0x45bd50
mov eax, dword [esi + 0x38]
mov ecx, edi
lea eax, [eax + edi*2]
mov esi, esi
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, edi
jb 0x45bd80
mov ebx, edx
sub ebx, edi
mov word [eax], bx
dec ecx
jne 0x45bd70
add dword [ebp - 0x10], edi
jmp 0x45bc90
mov dword [ebp - 0x10], 0xfffffffe
jmp 0x45bc90
Function at 0x45cb70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
test ecx, ecx
je 0x45cc6a
cmp ebx, 7
not edx
jbe 0x45cc44
lea esi, [esi]
lea edi, [edi]
movzx eax, byte [ecx]
sub ebx, 8
inc ecx
xor al, dl
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x45c760]
movzx eax, byte [ecx]
inc ecx
xor al, dl
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x45c760]
movzx eax, byte [ecx]
inc ecx
xor al, dl
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x45c760]
movzx eax, byte [ecx]
inc ecx
xor al, dl
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x45c760]
movzx eax, byte [ecx]
inc ecx
xor al, dl
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x45c760]
movzx eax, byte [ecx]
inc ecx
xor al, dl
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x45c760]
movzx eax, byte [ecx]
inc ecx
xor al, dl
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x45c760]
movzx eax, byte [ecx]
inc ecx
xor al, dl
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x45c760]
cmp ebx, 7
ja 0x45cba0
test ebx, ebx
je 0x45cc66
nop
lea esi, [esi]
movzx eax, byte [ecx]
inc ecx
xor al, dl
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x45c760]
dec ebx
jne 0x45cc50
mov eax, edx
not eax
pop ebx
pop ebp
ret

Function at 0x45dc20
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
movzx ecx, ax
push esi
mov esi, dword [ebp + 0xc]
push ebx
mov ebx, eax
shr ebx, 0x10
test esi, esi
mov eax, 1
je 0x45dd4e
test edi, edi
je 0x45dd47
lea esi, [esi]
cmp edi, 0x15b0
mov edx, edi
jbe 0x45dc5f
mov edx, 0x15b0
sub edi, edx
cmp edx, 0xf
jle 0x45dcfe
lea esi, [esi]
movzx eax, byte [esi]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 1]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 2]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 3]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 4]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 5]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 6]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 7]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 8]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 9]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xa]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xb]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xc]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xd]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xe]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xf]
add esi, 0x10
add ecx, eax
add ebx, ecx
sub edx, 0x10
cmp edx, 0xf
jg 0x45dc70
test edx, edx
je 0x45dd1b
lea esi, [esi]
lea edi, [edi]
movzx eax, byte [esi]
inc esi
add ecx, eax
add ebx, ecx
dec edx
jne 0x45dd10
mov eax, 0x80078071
mul ecx
mov eax, 0x80078071
shr edx, 0xf
imul edx, edx, 0xfff1
sub ecx, edx
mul ebx
shr edx, 0xf
imul edx, edx, 0xfff1
sub ebx, edx
test edi, edi
jne 0x45dc50
mov eax, ebx
shl eax, 0x10
or eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x462970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
call fcn.004650b0
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x462380
add eax, 0x40
mov dword [esp], eax
call fcn.00413ea0
cmp ebx, 0x3ef
je 0x4629b5
mov dword [esp], 3
call sub.msvcrt.dll_exit
mov dword [esp + 8], 0x420
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], 1
mov dword [esp], 0x462540
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x4629a9

Function at 0x462cf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 4
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx + 0x34]
mov edi, dword [ebx + 0x38]
test edi, edi
mov byte [ebp - 0xd], al
jle 0x462d30
movzx esi, al
mov ecx, edi
nop
mov eax, dword [ebx + 0x260]
mov edx, eax
shr eax, 0x18
shl edx, 8
xor eax, esi
xor edx, dword [eax*4 + 0x4b8960]
dec ecx
mov dword [ebx + 0x260], edx
jne 0x462d10
mov eax, dword [ebx + 0x34]
cmp edi, 2
mov byte [ebx + eax + 0x58], 1
je 0x462ddd
cmp edi, 2
jg 0x462daf
cmp edi, 1
je 0x462da0
mov byte [ebx + edi + 0x54], 1
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x24]
movzx ecx, byte [ebp - 0xd]
mov byte [eax + edx], cl
mov edx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x24]
inc edx
mov dword [ebx + 0x44], edx
mov byte [edx + eax], cl
mov edx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x24]
inc edx
mov dword [ebx + 0x44], edx
mov byte [edx + eax], cl
mov edx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x24]
inc edx
mov dword [ebx + 0x44], edx
mov byte [edx + eax], cl
mov ecx, dword [ebx + 0x44]
mov edx, dword [ebx + 0x24]
movzx eax, byte [ebx + 0x38]
inc ecx
mov dword [ebx + 0x44], ecx
sub al, 4
mov byte [ecx + edx], al
inc dword [ebx + 0x44]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ecx, byte [ebp - 0xd]
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x44]
mov byte [eax + edx], cl
jmp 0x462d97
cmp edi, 3
jne 0x462d4b
movzx ecx, byte [ebp - 0xd]
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x24]
mov byte [eax + edx], cl
mov edx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x24]
inc edx
mov dword [ebx + 0x44], edx
mov byte [edx + eax], cl
mov edx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x24]
inc edx
mov dword [ebx + 0x44], edx
mov byte [edx + eax], cl
jmp 0x462d97
movzx ecx, byte [ebp - 0xd]
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x44]
mov byte [eax + edx], cl
jmp 0x462dce
Function at 0x464550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 0x14]
test edi, edi
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0xc]
je 0x464572
mov dword [edi], 0
test esi, esi
je 0x4646b0
xor eax, eax
mov dword [esi + 0x13c4], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4646b0
test ebx, ebx
js 0x4646b0
cmp byte [esi + 0x1390], 0
jne 0x4645c0
test edi, edi
je 0x4645a8
mov dword [edi], 0xffffffff
mov edx, 0xffffffff
mov dword [esi + 0x13c4], edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov dword [esp], eax
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x464690
test ebx, ebx
je 0x464643
mov dword [esi + 0x1398], ebx
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1394], eax
lea eax, [esi + 4]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x1394]
mov dword [ebp - 0x14], eax
lea esi, [esi]
lea edi, [edi]
mov eax, 0x1388
mov dword [esi + 0x13a8], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x13a4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00463170
cmp eax, 1
jne 0x4646a1
mov eax, dword [esi + 0x13a8]
cmp eax, 0x1387
jbe 0x46465a
mov eax, dword [esi + 0x1398]
test eax, eax
jne 0x464600
test edi, edi
je 0x46464d
mov dword [edi], 0
xor eax, eax
mov dword [esi + 0x13c4], eax
jmp 0x4645b3
mov ebx, 0x1388
sub ebx, eax
mov eax, dword [esi]
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp ebx, eax
jne 0x464690
mov eax, dword [esi]
mov dword [esp], eax
call sub.msvcrt.dll_ferror
test eax, eax
je 0x464639
test edi, edi
je 0x46469a
mov dword [edi], 0xfffffffa
mov eax, 0xfffffffa
jmp 0x46464f
test edi, edi
je 0x46464f
mov dword [edi], eax
jmp 0x46464f
test edi, edi
je 0x4646ba
mov dword [edi], 0xfffffffe
test esi, esi
je 0x4645b3
mov ecx, 0xfffffffe
mov dword [esi + 0x13c4], ecx
jmp 0x4645b3
Function at 0x464be0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
test edi, edi
je 0x464bfc
mov dword [edi], 0
test esi, esi
je 0x464dd6
xor ecx, ecx
test eax, eax
mov dword [esi + 0x13c4], ecx
je 0x464dd6
mov edx, dword [ebp + 0x14]
test edx, edx
js 0x464dd6
cmp byte [esi + 0x1390], 0
je 0x464c50
test edi, edi
je 0x464c32
mov dword [edi], 0xffffffff
mov ebx, 0xffffffff
mov dword [esi + 0x13c4], ebx
lea esi, [esi]
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jne 0x464c70
test edi, edi
je 0x464c61
mov dword [edi], 0
xor edx, edx
mov dword [esi + 0x13c4], edx
jmp 0x464c40
mov dword [esi + 0x13a4], eax
mov edx, dword [ebp + 0x14]
mov dword [esi + 0x13a8], edx
nop
mov eax, dword [esi]
mov dword [esp], eax
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x464dc5
mov eax, dword [esi + 0x1398]
test eax, eax
jne 0x464cae
mov eax, dword [esi]
mov dword [esp], eax
call fcn.004643c0
test al, al
je 0x464d77
lea eax, [esi + 0x1394]
mov dword [esp], eax
call fcn.00464190
test eax, eax
mov ebx, eax
je 0x464d00
cmp eax, 4
jne 0x464cec
test edi, edi
je 0x464cd1
mov dword [edi], 4
mov eax, 4
mov edi, dword [esi + 0x13a8]
mov dword [esi + 0x13c4], eax
mov eax, dword [ebp + 0x14]
sub eax, edi
jmp 0x464c42
test edi, edi
je 0x464c37
mov dword [edi], eax
jmp 0x464c37
mov eax, dword [esi]
mov dword [esp], eax
call fcn.004643c0
test al, al
je 0x464d30
mov eax, dword [esi + 0x1398]
test eax, eax
jne 0x464d30
mov eax, dword [esi + 0x13a8]
test eax, eax
jne 0x464d5d
lea esi, [esi]
lea edi, [edi]
cmp ebx, 4
je 0x464cc7
mov ebx, dword [esi + 0x13a8]
test ebx, ebx
jne 0x464c80
test edi, edi
je 0x464d4d
mov dword [edi], 0
mov eax, dword [ebp + 0x14]
xor ecx, ecx
mov dword [esi + 0x13c4], ecx
jmp 0x464c42
test edi, edi
je 0x464d67
mov dword [edi], 0xfffffff9
mov eax, 0xfffffff9
mov dword [esi + 0x13c4], eax
jmp 0x464c40
mov eax, dword [esi]
mov dword [esp + 8], 0x1388
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [esi + 4]
mov dword [ebp - 0x10], eax
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov ebx, eax
mov eax, dword [esi]
mov dword [esp], eax
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x464dc5
mov dword [esi + 0x138c], ebx
mov edx, dword [ebp - 0x10]
mov dword [esi + 0x1398], ebx
mov dword [esi + 0x1394], edx
jmp 0x464cae
test edi, edi
je 0x464dcf
mov dword [edi], 0xfffffffa
mov eax, 0xfffffffa
jmp 0x464d6c
test edi, edi
je 0x464de0
mov dword [edi], 0xfffffffe
test esi, esi
je 0x464c40
mov edi, 0xfffffffe
mov dword [esi + 0x13c4], edi
jmp 0x464c40
Function at 0x46d5c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x20]
mov ebx, dword [esi + 0x44]
mov ecx, dword [esi + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x18]
cmp ebx, 0x270f
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x268]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x30]
jle 0x46d758
lea edx, [ebx + 0x22]
test dl, 1
je 0x46d601
lea edx, [ebx + 0x23]
lea edx, [edx + ecx]
test eax, eax
mov dword [ebp - 0x20], edx
jle 0x46d74e
cmp eax, 0x64
jle 0x46d619
mov eax, 0x64
mov dword [esp + 4], ecx
lea edi, [eax - 1]
mov edx, 0x55555556
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, dword [ebp - 0x14]
imul edx
mov eax, edi
sar eax, 0x1f
mov dword [esp], ecx
mov edi, ebx
sub edx, eax
lea eax, [ebp - 0x10]
imul edi, edx
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edi
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
call fcn.0046cd90
cmp dword [ebp - 0x1c], 2
jle 0x46d6a8
mov edx, dword [ebp - 0x10]
mov eax, edi
sub eax, edx
push eax
fild dword [esp]
add esp, 4
test ebx, ebx
je 0x46d684
push ebx
fild dword [esp]
add esp, 4
fdivp st(1)
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
fstp qword [esp + 0x10]
mov dword [esp + 0xc], ebx
add eax, 0x40
mov dword [esp + 4], 0x46d540
mov dword [esp], eax
call fcn.00413ea0
mov edi, dword [ebp - 0x10]
test edi, edi
js 0x46d6f0
mov dword [esi + 0x1c], 0xffffffff
mov eax, dword [esi + 0x44]
xor edx, edx
cmp edx, eax
jge 0x46d6cf
nop
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ecx + edx*4]
test ebx, ebx
je 0x46d6eb
inc edx
cmp edx, eax
jl 0x46d6c0
cmp dword [esi + 0x1c], 0xffffffff
je 0x46d6dd
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x3eb
call fcn.00462970
jmp 0x46d6d5
mov dword [esi + 0x1c], edx
jmp 0x46d6cf
cmp dword [ebp - 0x1c], 1
jg 0x46d724
mov dword [esp + 0xc], ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [esp + 0x10], eax
mov dword [esp + 8], ecx
nop
lea esi, [esi]
mov eax, dword [esi + 0x14]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call fcn.0046bf90
jmp 0x46d6af
mov dword [esp + 8], 0x35
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], 1
mov dword [esp], 0x46d580
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x46d6f6
mov eax, 1
jmp 0x46d60f
mov dword [esp + 0xc], ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x10], ecx
mov dword [esp + 8], eax
jmp 0x46d710
Function at 0x472f40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.0047fb50
call fcn.00473160
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetStartupInfoA
sub esp, 4
test ebx, ebx
je 0x472fae
movzx eax, byte [ebx]
cmp al, 0x20
je 0x473020
cmp al, 9
je 0x473020
cmp al, 0x22
je 0x472ffe
cmp al, 0x20
je 0x472ff0
cmp al, 9
je 0x472fa6
test al, al
je 0x472fa6
inc ebx
movzx eax, byte [ebx]
cmp al, 0x20
je 0x472ff0
cmp al, 9
je 0x472fa6
test al, al
jne 0x472f96
cmp al, 0x20
je 0x472ff0
cmp al, 9
je 0x472ff0
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], ebx
je 0x472fe7
movzx eax, word [ebp - 0x28]
mov dword [esp + 0xc], eax
call fcn.0042fea0
mov ebx, dword [ebp - 4]
sub esp, 0x10
leave
ret
mov eax, 0xa
jmp 0x472fd6
inc ebx
movzx eax, byte [ebx]
cmp al, 0x20
je 0x472ff0
cmp al, 9
je 0x472ff0
jmp 0x472fae
inc ebx
movzx eax, byte [ebx]
cmp al, 0x22
je 0x47300c
test al, al
jne 0x472ffe
jmp 0x472fa6
inc ebx
movzx eax, byte [ebx]
jmp 0x472fa6
inc ebx
movzx eax, byte [ebx]
cmp al, 0x20
je 0x473020
cmp al, 9
je 0x473020
jmp 0x472f82
Function at 0x47e270
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov esp, ebp
pop ebp
ret

Function at 0x47e2a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov esp, ebp
pop ebp
ret

Function at 0x47f080
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ebx
mov ebx, dword [0x4d4a80]
call sub.KERNEL32.DLL_TlsAlloc
cmp eax, 0xffffffff
je 0x47f0c1
mov dword [ebx + 0x28], eax
mov dword [esp + 4], 0x47f070
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call fcn.0047ecf0
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x2c], eax
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call fcn.00471630
jmp 0x47f0af
Function at 0x47f410
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x4d4a80]
mov edi, dword [ebp + 8]
test eax, eax
je 0x47f592
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x47f583
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x47f55a
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x47f550
xor ecx, ecx
mov eax, 5
cmp eax, 5
mov edx, 5
je 0x47f4bb
test eax, eax
mov edx, 3
jne 0x47f4bb
test ecx, ecx
jne 0x47f483
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
jmp 0x47f450
mov dword [esp + 0x10], edi
lea ebx, [ebp - 0x14]
mov dword [esp + 0x14], ebx
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp], 1
call ecx
cmp eax, 6
je 0x47f4c5
cmp eax, 8
mov edx, 3
je 0x47f47c
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.0047f370
cmp eax, 7
mov edx, eax
jne 0x47f4bb
mov eax, dword [0x4d4a80]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x47f542
mov edi, dword [eax + 0x2c]
test edi, edi
js 0x47f536
mov esi, dword [eax + 0x2c]
test esi, esi
jne 0x47f519
mov dword [eax + 0x24], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ebp, dword [eax + 0x20]
mov ecx, dword [edx + 4]
mov esp, dword [edx + 8]
jmp ecx
mov eax, dword [eax + 0x28]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.DLL_TlsSetValue
sub esp, 8
test eax, eax
jne 0x47f508
call fcn.00471630
jmp 0x47f508
call fcn.0047f0d0
mov eax, dword [0x4d4a80]
jmp 0x47f4fe
call fcn.0047ee10
mov eax, dword [0x4d4a80]
jmp 0x47f4f7
mov ecx, dword [eax + 0x18]
xor eax, eax
jmp 0x47f465
mov ebx, dword [eax + 0x28]
call fcn.00471630
mov esi, eax
mov dword [esp], ebx
call sub.KERNEL32.DLL_TlsGetValue
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.DLL_SetLastError
sub esp, 4
mov eax, ebx
jmp 0x47f442
call fcn.0047f0d0
mov eax, dword [0x4d4a80]
jmp 0x47f434
call fcn.0047ee10
mov eax, dword [0x4d4a80]
jmp 0x47f429
Function at 0x47f7c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x4d4a80]
mov edi, dword [ebp + 8]
test eax, eax
je 0x47f8e0
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x47f8d0
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x47f8a4
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x47f890
mov dword [esp], edi
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
call fcn.0047f370
cmp eax, 7
jne 0x47f8ef
mov eax, dword [0x4d4a80]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x47f880
mov edi, dword [eax + 0x2c]
test edi, edi
js 0x47f870
mov esi, dword [eax + 0x2c]
test esi, esi
jne 0x47f850
mov dword [eax + 0x24], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ebp, dword [eax + 0x20]
mov ecx, dword [edx + 4]
mov esp, dword [edx + 8]
jmp ecx
mov eax, dword [eax + 0x28]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.DLL_TlsSetValue
sub esp, 8
test eax, eax
jne 0x47f838
call fcn.00471630
jmp 0x47f838
call fcn.0047f0d0
mov eax, dword [0x4d4a80]
jmp 0x47f82e
call fcn.0047ee10
mov eax, dword [0x4d4a80]
jmp 0x47f827
mov dword [esp], edi
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
call fcn.0047f5b0
jmp 0x47f812
mov ebx, dword [eax + 0x28]
call fcn.00471630
mov esi, eax
mov dword [esp], ebx
call sub.KERNEL32.DLL_TlsGetValue
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.DLL_SetLastError
sub esp, 4
mov eax, ebx
jmp 0x47f7f2
call fcn.0047f0d0
mov eax, dword [0x4d4a80]
jmp 0x47f7e4
call fcn.0047ee10
mov eax, dword [0x4d4a80]
jmp 0x47f7d9
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]