joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4572b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x45733c
call fcn.004afa22
mov dword [ebp - 0x10], eax
push 0xf0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x45733c
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45730f
xor eax, eax
jmp 0x45736d
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x457336
push 0xcc5
push str.wincore.cpp
call fcn.004a6790
test eax, eax
je 0x457336
int3
xor edx, edx
test edx, edx
jne 0x45731c
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00457376
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x45736a
cmp dword [ebp - 8], 0
je 0x45736a
mov ecx, dword [ebp - 8]
push ecx
call fcn.00402f00
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45ed97
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push 0xed
push str.filecore.cpp
mov eax, dword [ebp - 8]
push eax
call fcn.0045ad40
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0xffffffff
jne 0x45edd3
push 0xee
push str.filecore.cpp
call fcn.004a6790
test eax, eax
je 0x45edd3
int3
xor edx, edx
test edx, edx
jne 0x45edb6
cmp dword [ebp + 0xc], 0
jne 0x45ede4
jmp 0x45ee85
cmp dword [ebp + 8], 0
jne 0x45edfe
push 0xf3
push str.filecore.cpp
call fcn.004a6790
test eax, eax
je 0x45edfe
int3
xor eax, eax
test eax, eax
jne 0x45ede4
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004279a6
test eax, eax
jne 0x45ee2b
push 0xf4
push str.filecore.cpp
call fcn.004a6790
test eax, eax
je 0x45ee2b
int3
xor eax, eax
test eax, eax
jne 0x45ee04
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x45ee68
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004a2dba
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0045cdf0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x45ee85
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004a2dba
push eax
push 0xffffffffffffffff
push 0xd
call fcn.0045cfd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45f5cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push str.CLSID
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x45f6a2
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x45f698
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push str.InProcServer32
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x45f68e
push 0x104
mov ecx, dword [ebp + 0xc]
call fcn.0045a2a8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0x104
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0x596780
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.0045a3e3
xor ecx, ecx
cmp dword [ebp - 0x18], 0
sete cl
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x45f6ab
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x178], 0
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
push 0x800
push 0x160
lea ecx, [ebp - 0x174]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x45f70c
mov eax, dword [ebp - 0x16c]
and eax, 0x10000
test eax, eax
jne 0x45f713
xor eax, eax
jmp 0x45f843
lea ecx, [ebp - 0x14]
push ecx
push 0x51af78
push 0
push 0x51af88
lea ecx, [ebp - 4]
call fcn.0045f347
test eax, eax
jge 0x45f736
xor eax, eax
jmp 0x45f843
lea edx, [ebp - 0x10]
push edx
push 0x51ea98
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx]
test eax, eax
jl 0x45f835
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jne 0x45f770
mov dword [ebp - 0x180], 0
jmp 0x45f7be
mov ecx, dword [ebp - 0x178]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
shl eax, 1
add eax, 3
and al, 0xfc
call fcn.004084b0
mov dword [ebp - 0x184], esp
mov edx, dword [ebp - 0x17c]
push edx
mov eax, dword [ebp - 0x178]
push eax
mov ecx, dword [ebp - 0x184]
push ecx
call fcn.00403830
mov dword [ebp - 0x180], eax
push 0
mov edx, dword [ebp - 0x180]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
push edx
call dword [ecx + 0x14]
test eax, eax
jl 0x45f829
push 2
mov ecx, dword [ebp + 8]
call fcn.004a951c
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx + 0x4c]
test eax, eax
jl 0x45f829
push 0
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 8]
mov eax, 1
jmp 0x45f843
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 8]
xor eax, eax
lea esp, [ebp - 0x184]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45f84f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c85ed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
push ebx
push esi
push edi
push 1
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.004279a6
test eax, eax
jne 0x45f898
push 0x216
push str.filecore.cpp
call fcn.004a6790
test eax, eax
je 0x45f898
int3
xor ecx, ecx
test ecx, ecx
jne 0x45f870
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x45f8ee
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x45f8d4
mov ecx, dword [ebp + 0xc]
push ecx
push str.Warning:_could_not_parse_the_path__s._n
call fcn.00427765
add esp, 8
push 0x104
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
jmp 0x45f9e1
lea ecx, [ebp - 0x1c]
call fcn.004a2d17
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0045f9f4
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.004a2dba
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x45f966
lea ecx, [ebp - 0x1c]
call fcn.004a2dba
push eax
push str.Warning:_could_not_get_volume_information__s._n
call fcn.00427765
add esp, 8
mov dword [ebp - 0x164], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00459afc
mov eax, dword [ebp - 0x164]
jmp 0x45f9e1
mov edx, dword [ebp - 0x18]
and edx, 2
test edx, edx
jne 0x45f97a
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov ecx, dword [ebp - 0x18]
and ecx, 4
test ecx, ecx
jne 0x45f9c2
lea edx, [ebp - 0x15c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffff
je 0x45f9c2
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x168], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00459afc
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46e880
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.004a2dba
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x46e8d6
push 1
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x46e8d4
push str.Warning:_File_save_with_new_name_failed._n
push 0x58e054
call fcn.00427765
add esp, 8
xor eax, eax
jmp 0x46e911
jmp 0x46e90c
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.004a2dba
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x46e90c
push str.Warning:_File_save_failed._n
push 0x58e074
call fcn.00427765
add esp, 8
xor eax, eax
jmp 0x46e911
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x46f040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c8945
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov dword [ebp - 0x11c], 0
lea ecx, [ebp - 0x10]
call fcn.004a2d17
mov dword [ebp - 4], 1
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0x104
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [ebp - 0x118]
mov byte [eax], 0
push 0x105
lea ecx, [ebp - 0x10]
call fcn.0045a2a8
push eax
push 0
push 0x58e100
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0045a3e3
cmp dword [ebp + 0x10], 0
jne 0x46f0dd
lea ecx, [ebp - 0x10]
call fcn.004a2dba
push eax
call fcn.0045f324
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.0045972a
mov eax, dword [ebp - 0x11c]
or al, 1
mov dword [ebp - 0x11c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00459afc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x478cd5
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
jne 0x478cfb
push 0x110
push str.appui3.cpp
call fcn.004a6790
test eax, eax
je 0x478cfb
int3
xor eax, eax
test eax, eax
jne 0x478ce1
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x80], 0
je 0x478de6
cmp dword [ebp + 0xc], 0
jne 0x478d4f
mov ecx, dword [ebp - 0x14]
call fcn.004bd98c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x478d2f
xor eax, eax
jmp 0x478e59
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x478ddb
cmp dword [ebp + 0x10], 0
jne 0x478d8e
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.004bda92
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x478d71
xor eax, eax
jmp 0x478e59
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x478ddb
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.004bda92
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x478daa
xor eax, eax
jmp 0x478e59
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 4], 0
sete al
jmp 0x478e59
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x94], 0
jne 0x478e06
push 0x132
push str.appui3.cpp
call fcn.004a6790
test eax, eax
je 0x478e06
int3
xor ecx, ecx
test ecx, ecx
jne 0x478de6
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xfff
jl 0x478e37
push 0x133
push str.appui3.cpp
call fcn.004a6790
test eax, eax
je 0x478e37
int3
xor ecx, ecx
test ecx, ecx
jne 0x478e0c
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x94]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48fc18
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x48fd07
mov eax, dword [ebp - 4]
push eax
call fcn.004522a8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x48fcf3
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
cmp edx, dword [ebp - 4]
je 0x48fcf3
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.0048f830
test eax, eax
je 0x48fcf3
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x48fcb9
mov ecx, dword [ebp - 0xc]
and ecx, 0x18000000
cmp ecx, 0x10000000
jne 0x48fcb9
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
or ecx, 2
mov edx, dword [ebp - 8]
mov dword [edx + 0x24], ecx
jmp 0x48fcf3
cmp dword [ebp + 8], 0
je 0x48fcf3
mov eax, dword [ebp - 0xc]
and eax, 0x18000000
test eax, eax
jne 0x48fcf3
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 2
test edx, edx
je 0x48fcf3
push 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0xfffffffd
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], edx
push 2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
jmp 0x48fc33
mov esp, ebp
pop ebp
ret 4
Function at 0x493b6e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
test ecx, ecx
je 0x493b92
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x493bcc
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x493be6
push 0xc9
push str.dlgprop.cpp
call fcn.004a6790
test eax, eax
je 0x493be6
int3
xor eax, eax
test eax, eax
jne 0x493bcc
mov ecx, dword [ebp - 4]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0xffff
jne 0x493cc1
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 0x80000000
test eax, eax
je 0x493c91
push 0x58ccfc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x493c3e
push 0xe1
push str.dlgprop.cpp
call fcn.004a6790
test eax, eax
je 0x493c3e
int3
xor ecx, ecx
test ecx, ecx
jne 0x493c24
cmp dword [ebp - 0x18], 0
je 0x493c8f
push 0x58cd0c
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x493c85
mov eax, 1
test eax, eax
je 0x493c7f
push 0xe6
push str.dlgprop.cpp
call fcn.004a6790
test eax, eax
je 0x493c7f
int3
xor ecx, ecx
test ecx, ecx
jne 0x493c62
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x493cc1
mov eax, dword [ebp - 0x14]
and eax, 0xff
cmp eax, 3
jne 0x493cc1
mov ecx, 1
test ecx, ecx
je 0x493cbb
push 0xed
push str.dlgprop.cpp
call fcn.004a6790
test eax, eax
je 0x493cbb
int3
xor edx, edx
test edx, edx
jne 0x493c9e
call fcn.004bd453
cmp dword [eax + 0x1038], 0
je 0x493cde
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.00493b23
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004939e5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x44], 0
je 0x493d0e
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x44], 0
cmp dword [ebp - 8], 0
je 0x493d23
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov dword [edx + 0x44], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4bc71c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
jne 0x4bc742
push 0x146
push str.afxtls.cpp
call fcn.004a6790
test eax, eax
je 0x4bc742
int3
xor eax, eax
test eax, eax
jne 0x4bc728
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
jmp 0x4bc761
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 8]
jge 0x4bc7e4
cmp dword [ebp + 0xc], 0
je 0x4bc784
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [edx + eax*8 + 4]
cmp ecx, dword [ebp + 0xc]
jne 0x4bc7c9
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4bc7b0
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx]
mov dword [ebp - 0x20], eax
jmp 0x4bc7b7
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx + edx*4], 0
jmp 0x4bc7df
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
cmp dword [ecx + edx*4], 0
je 0x4bc7df
mov dword [ebp - 4], 0
jmp 0x4bc758
cmp dword [ebp - 4], 0
je 0x4bc858
mov eax, dword [ebp - 0x1c]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.004bcde0
mov edx, dword [ebp - 0x1c]
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4bc843
push 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx]
mov dword [ebp - 0x24], eax
jmp 0x4bc84a
mov dword [ebp - 0x24], 0
push 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4bc861
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp + 0xc], 0
jne 0x4bc8a4
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4bc8a2
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.004bc71c
jmp 0x4bc8d9
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004bce00
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4bc8d9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.004bc71c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x4bc8b2
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret 8