joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482720
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edi, ecx
mov eax, dword [0x587040]
xor eax, ebp
mov dword [esp + 0x1c], eax
push dword [0x58a2ec]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and ecx, 3
cmp ecx, 2
je 0x482765
xor esi, esi
and eax, 0xfffffffc
je 0x4827a8
mov ecx, dword [edi]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [edi + 4]
jne 0x4827a8
mov esi, dword [eax + ecx*8]
jmp 0x4827a8
mov dword [esp + 0x14], 0x14
mov dword [esp + 0x10], 0x1dd76000
mov esi, esp
push 0x1f6
push str....._base_threading_thread_local_storage.cc
push 0x579899
push esi
call fcn.004b8ac0
add esp, 4
movsd xmm0, qword [esp + 0x1c]
movsd qword [esp + 4], xmm0
mov dword [esp], esi
call fcn.0053eda0
add esp, 0xc
xor esi, esi
mov ecx, dword [esp + 0x1c]
xor ecx, ebp
call fcn.004ecef0
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret

Function at 0x482f50
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp byte [edx + 0xb], 0
jns 0x482f69
mov edx, dword [edx]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x482f81
cmp byte [esi + 0x28], 1
je 0x482ff2
or ebx, 0x20000000
test bl, 8
jne 0x482ffa
mov dword [ebp - 0x10], 0
cmp byte [esi + 0x30], 0
mov eax, 0
je 0x482f9b
mov eax, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x482fa9
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x18], eax
cmp byte [esi + 0x1c], 1
je 0x48304c
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 1
je 0x483062
test ecx, ecx
jne 0x48301f
xor ecx, ecx
inc ecx
push dword [ebp - 0x18]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x483016
test esi, esi
sete al
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
or ebx, 0x80000000
jmp 0x482f81
cmp byte [esi + 0x34], 1
jne 0x48300b
or ebx, 0x40000000
jmp 0x482f86
or ebx, 0x10000000
jmp 0x482f86
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x482fe3
cmp ecx, 4
jne 0x48302b
mov ecx, 6
jmp 0x482fcc
mov esi, ecx
add ecx, 0xfffffffe
cmp ecx, 2
jae 0x48303c
mov ecx, 7
jmp 0x482fcc
cmp esi, 1
jne 0x483048
mov ecx, 4
jmp 0x482fcc
xor ecx, ecx
jmp 0x482fcc
lea ecx, [esi + 0x10]
mov dword [ebp - 0x14], edx
call fcn.0045de70
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x482fb6
mov ecx, esi
mov esi, edx
call fcn.0045de70
mov ecx, dword [ebp + 0xc]
mov edx, esi
jmp 0x482fc5
Function at 0x483080
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x4830aa
cmp byte [esi + 0x28], 1
je 0x483130
or ebx, 0x20000000
test bl, 8
jne 0x48313b
xor eax, eax
cmp byte [esi + 0x30], 0
mov ecx, 0
je 0x4830c3
mov ecx, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x4830d1
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0x1c], 1
je 0x483157
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 1
je 0x48316d
mov ecx, dword [ebp + 8]
cmp edx, 4
jne 0x48311f
mov edx, 6
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x483164
test esi, esi
sete al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov esi, edx
add edx, 0xfffffffe
cmp edx, 2
jae 0x48317d
mov edx, 7
jmp 0x4830f9
or ebx, 0x80000000
jmp 0x4830aa
cmp byte [esi + 0x34], 1
jne 0x48314c
or ebx, 0x40000000
jmp 0x4830b3
or ebx, 0x10000000
jmp 0x4830b3
lea ecx, [esi + 0x10]
call fcn.0045de70
jmp 0x4830da
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x483110
mov ecx, esi
mov esi, edx
call fcn.0045de70
mov edx, esi
jmp 0x4830ec
test esi, esi
jne 0x483189
xor edx, edx
inc edx
jmp 0x4830f9
cmp esi, 1
jne 0x483198
mov edx, 4
jmp 0x4830f9
xor edx, edx
jmp 0x4830f9
Function at 0x484630
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x59c3e8]
mov ecx, dword [0x58a36c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4847b6
mov esi, dword [0x59c3d8]
lea edi, [esi + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4847ec
mov ebx, esi
mov esi, dword [esi + 0x18]
test esi, esi
je 0x48476d
imul eax, dword [ebp + 8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0x6f47a654
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
add ebx, 0x14
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x20], eax
cmp eax, 1
jbe 0x4847ac
mov edx, ecx
cmp ecx, esi
jb 0x484707
mov eax, ecx
xor edx, edx
div esi
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x48476d
mov ebx, dword [eax]
test ebx, ebx
je 0x48476d
lea eax, [esi - 1]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 4]
cmp eax, ecx
jne 0x484786
mov eax, dword [ebp + 8]
cmp dword [ebx + 8], eax
jne 0x4847a0
mov dword [ebp - 0x20], edi
lea edi, [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
push ebx
push edi
call fcn.00484e70
mov esi, dword [edi]
mov dword [edi], 0
test esi, esi
je 0x48476a
cmp byte [ebp - 0x14], 1
jne 0x484761
mov eax, dword [esi + 0xc]
test eax, eax
je 0x484761
lock dec dword [eax + 4]
je 0x4847f8
push esi
call fcn.004ec97e
add esp, 4
mov edi, dword [ebp - 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [ebp - 0x20], 1
mov dword [ebp - 0x24], edx
jbe 0x484806
cmp eax, esi
jb 0x484799
xor edx, edx
div esi
mov eax, edx
mov edx, dword [ebp - 0x24]
cmp eax, edx
jne 0x48476d
mov ebx, dword [ebx]
test ebx, ebx
jne 0x48471f
jmp 0x48476d
lea edx, [esi - 1]
and edx, ecx
jmp 0x484707
push 0x59c3e8
call fcn.004ec9c1
add esp, 4
cmp dword [0x59c3e8], 0xffffffff
jne 0x484664
mov ecx, 0x59c3b0
call fcn.00484810
push 0x59c3e8
call fcn.004eca3b
add esp, 4
jmp 0x484664
mov ecx, edi
call fcn.004a5a80
jmp 0x48467c
push eax
call fcn.004aaf30
add esp, 4
jmp 0x484761
and eax, dword [ebp - 0x28]
jmp 0x484799
Function at 0x48f410
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x48f427
test eax, eax
je 0x48f427
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
sete al
mov ecx, dword [0x59c42c]
test ecx, ecx
setne dl
and dl, al
cmp dl, 1
je 0x48f47a
cmp dword [0x59c424], 0
je 0x48f421
mov esi, dword [0x59c428]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x48f484
test esi, esi
je 0x48f421
mov ecx, dword [0x59c424]
call dword [0x580f64]
push esi
call ecx
add esp, 4
jmp 0x48f421
call dword [0x580f64]
call ecx
jmp 0x48f43e
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x48f462
Function at 0x491530
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x59cde8]
mov ecx, dword [0x58a36c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x49159a
mov ecx, 0x59cde0
call fcn.00482720
test eax, eax
jne 0x49158d
push 4
call fcn.004ec94e
add esp, 4
mov edi, eax
mov dword [eax], 0
mov ecx, 0x59cde0
call fcn.00482720
mov esi, eax
mov ecx, 0x59cde0
push edi
call fcn.004827c0
test esi, esi
jne 0x4915dd
mov ecx, 0x59cde0
pop esi
pop edi
pop ebp
jmp fcn.00482720
push 0x59cde8
call fcn.004ec9c1
add esp, 4
cmp dword [0x59cde8], 0xffffffff
jne 0x491552
xor eax, eax
mov dword [0x59cde4], eax
mov dword [0x59cde0], eax
mov ecx, 0x59cde0
push 0x416f00
call fcn.00482800
push 0x59cde8
call fcn.004eca3b
add esp, 4
jmp 0x491552
push esi
call fcn.004ec97e
add esp, 4
jmp 0x49158d
Function at 0x49ee80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x49eeb5
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x49eebc
lea eax, [ebx + 1]
cmp eax, 2
jb 0x49eeae
mov dword [esi], ebx
call fcn.004b8af0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004b8af0
push dword [esi]
call fcn.004a4810
add esp, 4
mov dword [esi], 0
jmp 0x49ee9f

Function at 0x4a46c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x58dd64]
mov ecx, dword [0x58a36c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4a4710
mov esi, dword [0x58dd60]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x58dd64
call fcn.004ec9c1
add esp, 4
cmp dword [0x58dd64], 0xffffffff
jne 0x4a46f3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.004f0940
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x58
call fcn.004ec94e
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x58dd94]
mov ecx, dword [0x58a36c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4a47b9
mov ecx, esi
push ebx
push 0x58dd70
push edi
call fcn.00456c90
mov dword [0x58dd60], esi
push 0x58dd64
call fcn.004eca3b
add esp, 4
jmp 0x4a46f3
push 0x58dd94
call fcn.004ec9c1
add esp, 4
cmp dword [0x58dd94], 0xffffffff
jne 0x4a4793
xorps xmm0, xmm0
movups xmmword [0x58dd80], xmm0
movups xmmword [0x58dd70], xmm0
mov dword [0x58dd90], 0
push 0x58dd70
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x58dd94
call fcn.004eca3b
add esp, 4
jmp 0x4a4793
Function at 0x4a57b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x4a582e
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4a5817
lea eax, [edi + 1]
cmp eax, 2
jb 0x4a57fb
mov dword [esi], edi
call fcn.004b8af0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 0
inc eax
cmp eax, 1
jbe 0x4a5832
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.004b8af0
push dword [esi]
call fcn.004a4810
add esp, 4
mov dword [esi], 0
jmp 0x4a57ec
mov byte [esi + 4], 0
int3

Function at 0x4a5ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
movzx eax, byte [0x58de34]
test al, 1
je 0x4a5f3c
call fcn.004bfab0
pop esi
pop edi
pop ebp
jmp fcn.004bfad0
push 0x58de3c
call fcn.004ec9c1
add esp, 4
cmp dword [0x58de3c], 0xffffffff
jne 0x4a5f59
push str.bcryptprimitives.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4a5f74
push str.ProcessPrng
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a5f77
mov dword [0x58de38], eax
push 0x58de3c
call fcn.004eca3b
add esp, 4
jmp 0x4a5f59
mov eax, dword [0x58de3c]
mov ecx, dword [0x58a36c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4a5ef3
mov ecx, dword [0x58de38]
call dword [0x580f64]
push edi
push esi
call ecx
test eax, eax
je 0x4a5f71
pop esi
pop edi
pop ebp
ret
int3
int3
int3
Function at 0x4b9370
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ccfd0
Function at 0x4cc5d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
test ecx, ecx
js 0x4cc60d
mov eax, dword [ebp + 8]
je 0x4cc608
mov edx, dword [ebp + 0xc]
xor esi, esi
nop word [eax + eax]
movzx edi, byte [edx + esi]
movzx ebx, al
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x578e38]
inc esi
cmp ecx, esi
jne 0x4cc5f0
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x4d5820
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x481ad0
lea eax, [ebp - 0x14]
push 0
push eax
push 0x481970
push 0x59b344
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x4d589a
xor esi, esi
cmp dword [0x59b348], 0
jne 0x4d5886
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x59b34c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x4d5886
mov eax, dword [ebp + 8]
mov esi, dword [edi + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00500e00
int3
Function at 0x4d6920
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2010
call fcn.004edcb0
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x58a2ec]
cmp eax, 0xffffffff
jne 0x4d696b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
add esp, 0x2010
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
push dword [ebp - 0x2018]
call fcn.00490610
add esp, 8
jmp 0x4d6944
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x4d6944
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.004f03c0
add esp, 0xc
mov ecx, dword [0x58a2ec]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x2018], ecx
push ecx
call fcn.00490610
add esp, 8
test ebx, ebx
je 0x4d69ba
push ebx
call fcn.004ec9bc
add esp, 4
mov esi, 0x101
lea edi, [ebp - 0x2010]
mov eax, dword [0x59c394]
mov ecx, dword [0x58a36c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4d6afe
mov ebx, dword [0x59c390]
push ebx
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4d6b5a
push 0x1000
push 0x59b38c
lea eax, [ebp - 0x1810]
push eax
call fcn.004f03c0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push 0x800
push 0xff
push edi
call fcn.004f0940
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x1804]
mov edx, dword [ecx]
mov dword [ebp + eax*8 - 0x2010], edx
mov word [ebp + eax*8 - 0x200c], ax
inc eax
add ecx, 0x10
cmp eax, 0x100
jne 0x4d6a36
mov ecx, edi
lea edx, [ebp - 0x1810]
push 1
push 0x10
call fcn.004d6b70
add esp, 8
mov ebx, 4
xor eax, eax
movzx edx, word [ebp + ebx - 0x2010]
mov edi, dword [ebp + edx*8 - 0x810]
test edi, edi
jne 0x4d6aa5
add ebx, 8
cmp ebx, 0x804
jne 0x4d6a6d
dec esi
je 0x4d6b43
test al, 1
lea edi, [ebp - 0x2010]
jne 0x4d69c5
jmp 0x4d6959
mov dword [ebp - 0x2014], eax
mov eax, esi
mov ecx, edx
shl ecx, 4
cmp dword [ebp + ecx - 0x1810], 0
je 0x4d6b4d
add ecx, ebp
add ecx, 0xffffe7f0
mov esi, dword [ebp + edx*8 - 0x80c]
cmp esi, dword [ecx + 8]
jne 0x4d6b4d
mov ecx, dword [ecx + 4]
test ecx, ecx
mov esi, eax
mov eax, dword [ebp - 0x2014]
je 0x4d6a80
mov dword [ebp + edx*8 - 0x810], 0
call dword [0x580f64]
push edi
call ecx
add esp, 4
mov al, 1
jmp 0x4d6a80
push 0x59c394
call fcn.004ec9c1
add esp, 4
cmp dword [0x59c394], 0xffffffff
jne 0x4d69e6
push 4
call fcn.004ec94e
add esp, 4
mov ebx, eax
mov ecx, eax
call fcn.004a5a70
mov dword [0x59c390], ebx
push 0x59c394
call fcn.004eca3b
add esp, 4
jmp 0x4d69e6
call fcn.0053f890
jmp 0x4d6959
mov esi, eax
mov eax, dword [ebp - 0x2014]
jmp 0x4d6a80
mov ecx, ebx
call fcn.004a5a80
jmp 0x4d69fb
Function at 0x4ea2c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x587040]
xor eax, ebp
mov dword [esp + 8], eax
mov byte [ecx], 0
mov eax, dword [0x58a36c]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
lea ecx, [eax + 0xf8]
mov dword [esi + 4], ecx
mov edx, dword [eax + 0xf8]
mov dword [eax + 0xf8], esi
mov ecx, dword [ebp + 8]
mov dword [esi + 8], edx
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi + 0x30], 0
xorps xmm0, xmm0
movups xmmword [esi + 0x10], xmm0
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x38], eax
mov eax, dword [0x574474]
movzx eax, byte [eax + 0x7f]
test al, al
setne byte [esi + 0x20]
jne 0x4ea356
mov ecx, dword [esp + 8]
xor ecx, ebp
call fcn.004ecef0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea edi, [esi + 0x10]
mov ebx, esp
push ebx
call fcn.004a9ec0
movsd xmm0, qword [ebx]
movsd qword [edi], xmm0
jmp 0x4ea33f
Function at 0x4ed378
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4ed3b7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4ed3b7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4ed3b7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4ed3b7
cmp dword [ecx + 0x74], 0xe
jbe 0x4ed3b7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4fbdb2
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.004fbf49
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4fbf21
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4fbf21
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4fbed6
jg 0x4fbe0e
test eax, eax
je 0x4fbecc
push 1
push 0x1000
call fcn.004bd730
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4fbe31
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4fbec3
push 0x8000
push ebx
call fcn.00500ec3
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4fbe5a
jg 0x4fbe55
cmp ecx, 0x1000
jb 0x4fbe5a
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00503ca4
add esp, 0x10
cmp eax, 0xffffffff
je 0x4fbe9f
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4fbe55
jl 0x4fbe86
test ecx, ecx
jne 0x4fbe47
push dword [ebp - 0xc]
push ebx
call fcn.00500ec3
push esi
call fcn.004bd690
add esp, 0xc
xor ebx, ebx
jmp 0x4fbf2f
cmp byte [edi + 0x24], 0
je 0x4fbeb6
cmp dword [edi + 0x20], 5
jne 0x4fbeb6
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4fbec1
mov ebx, dword [edi + 0x18]
jmp 0x4fbec3
xor ebx, ebx
push esi
call fcn.004bd690
pop ecx
jmp 0x4fbf2f
test ecx, ecx
jg 0x4fbe98
jl 0x4fbed6
test eax, eax
jae 0x4fbe98
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004fff74
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4fbef6
cmp byte [edi + 0x1c], 0
je 0x4fbe98
jmp 0x4fbf27
push ebx
call fcn.004feb7a
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4fbe98
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4fbf2f
cmp byte [edi + 0x1c], 0
je 0x4fbf2c
mov ebx, dword [edi + 0x18]
jmp 0x4fbf2f
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004fff74
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ff06f
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x4ff0b2
call fcn.004fe70a
mov dword [eax], 0xf
call fcn.004fe6f7
mov dword [eax], 0xd
call fcn.004ffa79
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ecef0
leave
ret
test eax, eax
jne 0x4ff0b9
inc eax
jmp 0x4ff0a6
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x4ff0a4
xor eax, eax
cmp ecx, 1
setne al
jmp 0x4ff0a6
Function at 0x5009b3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x58ae50]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x5009f3
cmp byte [ebx], 0xa
jne 0x5009f3
or byte [edi + eax + 0x28], 4
jmp 0x5009f8
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x500af7
mov dl, byte [eax]
cmp dl, 0x1a
je 0x500ada
inc eax
cmp dl, 0xd
je 0x500a24
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x500a4a
cmp eax, ecx
jae 0x500a58
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x500a0c
jmp 0x500af7
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x500ad5
cmp dword [ebp - 0x10], 0
je 0x500ad5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x58ae50]
test byte [eax + edi + 0x28], 0x48
je 0x500aaf
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x500a9a
mov byte [esi], dl
jmp 0x500aab
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x58ae50]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x500af7
cmp byte [ebp - 1], 0xa
jne 0x500abe
cmp esi, ebx
jne 0x500abe
mov byte [esi], 0xa
jmp 0x500af6
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004fff74
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x500af7
mov byte [esi], 0xd
jmp 0x500af6
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x58ae50]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x500af4
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x500af7
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret