joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bf50
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x40bfb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x4de39c]
test esi, esi
jle 0x40c0b0
mov eax, dword [0x4de3a0]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x40bfe0
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40c05f
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40bfd0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x40c0d7
mov eax, dword [0x4de3a0]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x4de3a0]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40c0b7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40c058
sub eax, 4
and eax, 0xfffffffb
jne 0x40c066
add dword [0x4de39c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x4de3a0]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40c058
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
xor esi, esi
jmp 0x40bfea
mov eax, dword [0x4de3a0]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x40c590
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4de3b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4de3b0]
sub esp, 4
test ebx, ebx
je 0x40c5e5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40c5de
test esi, esi
je 0x40c5de
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40c5c0
mov dword [esp], 0x4de3b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40dee0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov dword [esp], esi
call sym._strlen
mov ebx, eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebx + 0x41]
lea ecx, [ebx + 0x31]
shr eax, 4
mov dword [ebp - 0x20], ecx
shl eax, 4
call fcn.0040cba0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], ebx
lea edi, [esp + 0xc]
mov dword [esp + 4], esi
mov dword [esp], eax
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
add eax, edi
mov dword [eax], 0x61616161
mov dword [eax + 4], 0x61616161
mov dword [eax + 8], 0x61616161
mov dword [eax + 0xc], 0x61616161
mov dword [eax + 0x10], 0x61616161
mov dword [eax + 0x14], 0x61616161
mov dword [eax + 0x18], 0x61616161
mov dword [eax + 0x1c], 0x61616161
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [edi + ebx + 0xf], 0x2d
sub esp, 0xc
mov dword [ebp - 0x24], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x40dfd4
int3
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
je 0x40e020
mov ecx, dword [ebp - 0x1c]
movzx eax, ax
mov edx, edi
mov dword [esp], ecx
mov ecx, dword [ebp - 0x20]
call dbg.get_ptr_from_atom
mov ebx, eax
mov edi, dword [ebp - 0x24]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
add ebx, edi
mov dword [esp], eax
call sym._malloc
mov edx, 0x20
mov esi, eax
lea esi, [esi]
bt esi, edx
jae 0x40e046
mov eax, edx
neg eax
mov byte [ebx + eax + 0x30], 0x41
sub edx, 1
jne 0x40e038
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
jne 0x40e05d
int3
mov ecx, dword [ebp - 0x1c]
movzx eax, ax
mov edx, edi
mov dword [esp], ecx
mov ecx, dword [ebp - 0x20]
call dbg.get_ptr_from_atom
mov ebx, eax
cmp esi, eax
je 0x40e083
mov dword [esp], esi
call sym._free
jmp 0x40dffa
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40dffa
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x40dffa
Function at 0x41edf0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x4dedf4]
test ebx, ebx
je 0x41ee20
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx], eax
mov eax, dword [0x4dedf4]
test eax, eax
je 0x41ee48
cmp dword [eax], 0xffffffff
je sym._pthread_tls_init.cold
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4dedf4], eax
mov ebx, eax
jmp 0x41edfe
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4dedf4], eax
jmp 0x41ee0f

Function at 0x41f2f0
Capabilities:
Print debug messages

Disassembly:
test eax, eax
je 0x41f320
push edi
push esi
push ebx
mov ebx, eax
add esp, 0xffffff80
mov dword [esp], eax
call sym._pthread_spin_destroy
cmp eax, 1
je 0x41f321
mov dword [ebx], 0xffffffff
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
ret
ret
lea ebx, [esp + 0x15]
xor eax, eax
mov esi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x3d]
mov ecx, 0x43
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
mov eax, 0x27
jne 0x41f375
jmp 0x41f383
cmp eax, 0x6a
je 0x41f38d
add eax, 1
cmp byte [ebx + eax], 0
jne 0x41f370
cmp eax, 0x6a
je 0x41f38d
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + eax + 0x16], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sym._abort
lea esi, [esi]
Function at 0x41f3a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x4dedf8]
test eax, eax
je 0x41f508
cmp dword [eax], 1
je 0x41f3be
call sym.__pthread_once_raw.part.0.constprop.0
mov eax, dword [0x4dedf4]
test eax, eax
je 0x41f530
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41f3f0
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._pop_pthread_mem
mov esi, eax
mov eax, dword [entry3]
test eax, eax
je 0x41f3df
test esi, esi
je 0x41f3df
mov dword [esi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x18], eax
sub esp, 0x10
lea eax, [esi + 0x38]
call sym._replace_spin_keys.constprop.0
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esi + 0x64], 0
mov dword [esi + 0x14], 0
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, eax
call ebp
lea edx, [esi + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je sym.___pthread_self_lite.cold
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], eax
movzx eax, byte [esi + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [esi + 0x20], al
mov eax, dword [0x4dedf4]
test eax, eax
je 0x41f560
mov dword [esp + 4], esi
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je sym.___pthread_self_lite.cold
add esp, 0x2c
mov ebx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_once_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4dedf8], eax
jmp 0x41f3b4
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4dedf4], eax
jmp 0x41f3cb
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4dedf4], eax
jmp 0x41f4de
Function at 0x421000
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x421022
call sym.__pthread_cleanup_dest.part.0
test byte [ebx + 0x20], 0x30
je 0x421084
mov eax, dword [0x4dedf4]
test eax, eax
je 0x42110b
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x42107b
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x4210db
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x42106e
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [ebx + 0x18], 0
test byte [ebx + 0x24], 4
jne 0x421098
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x14], 0
je 0x421102
mov eax, dword [0x4dedf4]
test eax, eax
je 0x421131
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x42107b
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x4210ef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xb0], 0
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], 0
jne 0x4210bb
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x4210bb
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4dedf4], eax
jmp 0x421035
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4dedf4], eax
jmp 0x4210c4
Function at 0x422b20
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov dword [esp], esi
call sym._strlen
mov ebx, eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebx + 0x40]
lea ecx, [ebx + 0x30]
shr eax, 4
mov dword [ebp - 0x20], ecx
shl eax, 4
call fcn.0040cba0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], ebx
lea edi, [esp + 0xc]
mov dword [esp + 4], esi
mov dword [esp], eax
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
add eax, edi
mov dword [eax], 0x61616161
mov dword [eax + 4], 0x61616161
mov dword [eax + 8], 0x61616161
mov dword [eax + 0xc], 0x61616161
mov dword [eax + 0x10], 0x61616161
mov dword [eax + 0x14], 0x61616161
mov dword [eax + 0x18], 0x61616161
mov dword [eax + 0x1c], 0x61616161
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [edi + ebx + 0xf], 0x2d
sub esp, 0xc
mov dword [ebp - 0x24], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x422c14
int3
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
je 0x422c60
mov ecx, dword [ebp - 0x1c]
movzx eax, ax
mov edx, edi
mov dword [esp], ecx
mov ecx, dword [ebp - 0x20]
call sym._get_ptr_from_atom_1
mov ebx, eax
mov edi, dword [ebp - 0x24]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
add ebx, edi
mov dword [esp], eax
call sym._malloc
mov edx, 0x20
mov esi, eax
lea esi, [esi]
bt esi, edx
jae 0x422c86
mov eax, edx
neg eax
mov byte [ebx + eax + 0x30], 0x41
sub edx, 1
jne 0x422c78
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
jne 0x422c9d
int3
mov ecx, dword [ebp - 0x1c]
movzx eax, ax
mov edx, edi
mov dword [esp], ecx
mov ecx, dword [ebp - 0x20]
call sym._get_ptr_from_atom_1
mov ebx, eax
cmp esi, eax
je 0x422cc3
mov dword [esp], esi
call sym._free
jmp 0x422c3a
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x422c3a
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x422c3a
Function at 0x5000730c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call sym.rtl120.bpl__System_TMonitor_TryEnter_qqrv
mov byte [esp], al
cmp byte [esp], 0
jne 0x50007495
test edi, edi
je 0x50007495
mov byte [esp + 1], 0
test ebp, ebp
jle 0x500073cc
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x500073a7
cmp edi, 0xffffffff
je 0x5000736b
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x5000736b
mov byte [esp], 0
jmp 0x50007495
mov ebx, dword [esi]
cmp ebx, 1
jg 0x500073a7
test ebx, ebx
jne 0x500073a0
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.50001d04
test eax, eax
jne 0x500073a0
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x50007495
pause
dec ebp
test ebp, ebp
jg 0x50007350
cmp edi, 0xffffffff
je 0x500073cc
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x500073ca
mov byte [esp], 0
jmp 0x50007495
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x5000731a
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.50001d04
cmp ebx, eax
jne 0x500073cc
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call sym.rtl120.bpl__System_TMonitor_GetEvent_qqrv
mov edx, eax
mov ebx, dword [sym.rtl120.bpl__System_MonitorSupport]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x50007433
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x50007431
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x50007433
xor edi, edi
cmp byte [esp], 0
je 0x5000745c
mov ebx, dword [esi]
test bl, 1
jne 0x50007475
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.50001d04
cmp ebx, eax
jne 0x50007439
mov byte [esp + 1], 1
jmp 0x50007475
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.50001d04
cmp ebx, eax
jne 0x5000745c
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x500073e6
cmp byte [esp], 0
je 0x50007495
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5000898c
Capabilities:
Access peb ldr_data

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
jno 0x50008992
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x88
mov eax, dword [0x5009ebba]
mov edx, 0x895009eb
inc ebp
les esp, [ecx + 0x30]
add byte [eax], al
add byte [ebx + 0x588b0c40], cl
or al, 0x8d
js 0x500089c6
cmp edi, ebx
je 0x50008a0b
mov edx, dword [ebx + 0x30]
movzx eax, word [edx]
invalid
inc ebp
rol byte [eax], 0
Function at 0x50008994
Capabilities:
Access peb ldr_data

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
jno 0x50008992
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x88
mov eax, dword [0x5009ebba]
mov edx, 0x895009eb
inc ebp
les esp, [ecx + 0x30]
add byte [eax], al
add byte [ebx + 0x588b0c40], cl
or al, 0x8d
js 0x500089c6
cmp edi, ebx
je 0x50008a0b
mov edx, dword [ebx + 0x30]
movzx eax, word [edx]
invalid
inc ebp
rol byte [eax], 0

Function at 0x5000ab98
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x5000abda
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x5000abfa
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call sym.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
add esp, 0x41c
pop esi
pop ebx
ret
Function at 0x4162ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4963d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x34
lea eax, [ebp - 0x38]
push 0
push eax
mov esi, ecx
call fcn.00456ef0
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
and dword [ebp - 0x1c], 0
add esp, 0xc
mov dword [ebp - 0x28], eax
imul eax, eax, 3
push 0x36
xor ebx, ebx
pop edx
inc ebx
mov word [ebp - 0x20], bx
push 0x18
pop ebx
mov word [ebp - 0x1e], bx
mov ebx, eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], 0x28
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x40], ebx
test bl, 3
je 0x416354
or ebx, 3
inc ebx
mov dword [ebp - 0x40], ebx
mov eax, ebx
imul eax, ecx
add eax, edx
push ebx
push 0x47cbc4
mov dword [ebp - 0x38], eax
call fcn.00459f93
push 0x47cbc0
push edi
call fcn.00459ebe
mov edi, eax
add esp, 0x10
mov dword [ebp - 0x44], edi
test edi, edi
je 0x41644e
push edi
push 2
push 1
push 0x47cbbc
call fcn.004584df
push edi
push 0x34
lea eax, [ebp - 0x38]
push 1
push eax
call fcn.004584df
push ebx
push 1
call fcn.00459f53
mov edi, eax
add esp, 0x28
test edi, edi
jne 0x4163c0
push dword [esi]
call fcn.00457bc2
xor eax, eax
jmp 0x41644d
mov eax, dword [esi + 8]
dec eax
mov dword [ebp - 0x3c], eax
js 0x41643e
xor ecx, ecx
cmp dword [esi + 4], ecx
jle 0x416428
mov edx, dword [esi + 4]
imul edx, dword [ebp - 0x3c]
mov eax, dword [esi + 0xc]
mov ebx, dword [esi]
add edx, ecx
imul edx, eax
imul eax, ecx
mov dl, byte [edx + ebx + 2]
mov byte [eax + edi], dl
mov edx, dword [esi + 4]
imul edx, dword [ebp - 0x3c]
mov eax, dword [esi + 0xc]
mov ebx, dword [esi]
add edx, ecx
imul edx, eax
imul eax, ecx
mov dl, byte [edx + ebx + 1]
mov byte [eax + edi + 1], dl
mov edx, dword [esi + 4]
imul edx, dword [ebp - 0x3c]
mov eax, dword [esi + 0xc]
mov ebx, dword [esi]
add edx, ecx
imul edx, eax
imul eax, ecx
mov dl, byte [edx + ebx]
inc ecx
mov byte [eax + edi + 2], dl
cmp ecx, dword [esi + 4]
jl 0x4163d0
push dword [ebp - 0x44]
push dword [ebp - 0x40]
push 1
push edi
call fcn.004584df
add esp, 0x10
dec dword [ebp - 0x3c]
jns 0x4163c9
push edi
call fcn.00457bc2
push dword [ebp - 0x44]
call fcn.004589d9
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00456dcf
leave
ret 4