joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489d60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2010
call fcn.0049af20
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4ed5c8]
cmp eax, 0xffffffff
je 0x489fdd
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x489fdd
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.0049d740
add esp, 0xc
mov ecx, dword [0x4ed5c8]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x2014], ecx
push ecx
call fcn.004939e0
add esp, 8
test ebx, ebx
je 0x489ddb
push ebx
call fcn.0049426c
add esp, 4
mov ecx, 0x101
mov dword [ebp - 0x2018], ecx
mov eax, dword [0x501d84]
mov ecx, dword [0x4ed65c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x489f83
mov ebx, dword [0x501d80]
mov edi, ebx
shr edi, 0xe
mov esi, ebx
shr esi, 0x13
mov eax, dword [esi*4 + 0x4f500c]
bt eax, edi
jae 0x489e40
push ebx
call fcn.0045f9c0
add esp, 4
test ebx, ebx
jne 0x489e54
jmp 0x489ff2
mov eax, ebx
shr eax, 0x15
mov byte [eax + 0x4fd00c], 1
test ebx, ebx
je 0x489ff2
push ebx
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x489e66
mov ecx, ebx
call fcn.004455e0
push 0x1000
push 0x500d7c
lea eax, [ebp - 0x1810]
push eax
call fcn.0049d740
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi*4 + 0x4f500c]
bt eax, edi
jae 0x489e9b
push ebx
call fcn.0045fae0
add esp, 4
push 0x800
push 0xff
lea eax, [ebp - 0x2010]
push eax
call fcn.0049dcc0
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x1804]
nop dword [eax]
mov edx, dword [ecx]
mov dword [ebp + eax*8 - 0x2010], edx
mov word [ebp + eax*8 - 0x200c], ax
inc eax
add ecx, 0x10
cmp eax, 0x100
jne 0x489ec0
lea ecx, [ebp - 0x2010]
lea edx, [ebp - 0x1810]
push 1
push 0x10
call fcn.0048a360
add esp, 8
mov ebx, 4
xor eax, eax
jmp 0x489f0b
add ebx, 8
cmp ebx, 0x804
je 0x489f70
movzx edx, word [ebp + ebx - 0x2010]
mov esi, dword [ebp + edx*8 - 0x810]
test esi, esi
je 0x489f00
mov ecx, edx
shl ecx, 4
cmp dword [ebp + ecx - 0x1810], 0
je 0x489f00
mov edi, dword [ebp + edx*8 - 0x80c]
cmp edi, dword [ebp + ecx - 0x1808]
jne 0x489f00
mov ecx, dword [ebp + ecx - 0x180c]
test ecx, ecx
je 0x489f00
mov dword [ebp + edx*8 - 0x810], 0
call dword [0x4e4884]
push esi
call ecx
add esp, 4
mov al, 1
jmp 0x489f00
mov ecx, dword [ebp - 0x2018]
dec ecx
je 0x489fc8
test al, 1
jne 0x489de0
jmp 0x489fcd
push 0x501d84
call fcn.004942a7
add esp, 4
cmp dword [0x501d84], 0xffffffff
jne 0x489e07
push 4
call fcn.00494206
add esp, 4
mov ebx, eax
mov ecx, eax
call fcn.004455d0
mov dword [0x501d80], ebx
push 0x501d84
call fcn.0049431d
add esp, 4
jmp 0x489e07
call fcn.0045eeb0
push 2
push dword [ebp - 0x2014]
call fcn.004939e0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
add esp, 0x2010
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x48a000
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov dword [ebp - 0x10], ecx
mov eax, dword [0x4ed5c8]
cmp eax, 0xffffffff
je 0x48a021
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x48a026
call fcn.0048a190
mov eax, dword [0x501d84]
mov ecx, dword [0x4ed65c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x48a146
mov edi, dword [0x501d80]
mov ecx, edi
shr ecx, 0xe
mov esi, edi
shr esi, 0x13
mov eax, dword [esi*4 + 0x4f500c]
mov dword [ebp - 0x14], ecx
bt eax, ecx
jae 0x48a12f
push edi
call fcn.0045f9c0
add esp, 4
test edi, edi
je 0x48a143
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x48a08d
mov ecx, edi
call fcn.004455e0
mov ecx, dword [0x500d78]
inc ecx
xor edx, edx
nop word cs:[eax + eax]
lea eax, [ecx + edx]
movzx ebx, al
mov eax, ebx
shl eax, 4
cmp dword [eax + 0x500d7c], 0
je 0x48a0bf
inc edx
cmp edx, 0x100
jne 0x48a0a0
jmp 0x48a0fb
lea ecx, [eax + 0x500d7c]
mov dword [ecx], 1
mov ecx, dword [ebp + 8]
mov dword [eax + 0x500d80], ecx
mov ecx, dword [0x501d7c]
inc ecx
mov dword [0x501d7c], ecx
mov dword [eax + 0x500d88], ecx
mov dword [0x500d78], ebx
mov ecx, dword [ebp - 0x10]
mov dword [ecx], ebx
mov eax, dword [eax + 0x500d84]
mov dword [ecx + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi*4 + 0x4f500c]
mov ecx, dword [ebp - 0x14]
bt eax, ecx
jae 0x48a11a
push edi
call fcn.0045fae0
add esp, 4
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x100
jae 0x48a18b
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x4fd00c], 1
test edi, edi
jne 0x48a07b
int3
push 0x501d84
call fcn.004942a7
add esp, 4
cmp dword [0x501d84], 0xffffffff
jne 0x48a047
push 4
call fcn.00494206
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.004455d0
mov dword [0x501d80], edi
push 0x501d84
call fcn.0049431d
add esp, 4
jmp 0x48a047
int3
Function at 0x48a190
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x808
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x810], 0xffffffff
mov ecx, dword [0x4ed5c8]
mov dword [ebp - 0x810], ecx
cmp ecx, 0xffffffff
jne 0x48a234
lea esi, [ebp - 0x810]
push esi
call fcn.004939b0
add esp, 4
test al, al
je 0x48a2b5
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x48a210
push esi
call fcn.004939b0
add esp, 4
test al, al
je 0x48a2b8
cmp dword [ebp - 0x810], 0xffffffff
je 0x48a2b8
push 0xffffffffffffffff
call fcn.004939d0
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x4ed5c8], ecx
je 0x48a234
push ecx
call fcn.004939d0
add esp, 4
mov ecx, dword [0x4ed5c8]
mov dword [ebp - 0x810], ecx
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x48a2b2
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.0049dcc0
add esp, 0xc
lea eax, [ebp - 0x809]
push eax
push dword [ebp - 0x810]
call fcn.004939e0
add esp, 8
push 0x800
call fcn.00494263
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.0049d740
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x810]
call fcn.004939e0
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004961ed
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebp
ret
int3
int3
int3
Function at 0x494170
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
test ecx, ecx
js 0x4941ad
mov eax, dword [ebp + 8]
je 0x4941a8
mov edx, dword [ebp + 0xc]
xor esi, esi
nop word [eax + eax]
movzx edi, byte [edx + esi]
movzx ebx, al
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x4e3144]
inc esi
cmp ecx, esi
jne 0x494190
pop esi
pop edi
pop ebx
pop ebp
ret
int3

Function at 0x494d11
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x494d50
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x494d50
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x494d50
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x494d50
cmp dword [ecx + 0x74], 0xe
jbe 0x494d50
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4978ac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4978fb
mov esi, dword [ebp + 0x18]
lea eax, [ebp + 0x10]
push edi
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4978fb
cmp esi, dword [ebp + 0x10]
je 0x4978f6
push 0x4ca618
push 1
push edi
push edi
call fcn.004967ad
jmp 0x497909
xor eax, eax
inc eax
jmp 0x49790e
mov eax, 0x4ca618
push eax
push eax
push edi
push edi
call fcn.00496790
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x497aee
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x497b18
mov eax, 0x4ca618
push eax
push eax
push 0
push 0
call fcn.00496790
add esp, 0x10
xor eax, eax
pop ebp
ret
xor eax, eax
inc eax
pop ebp
ret
Function at 0x498afd
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x49956c
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x499cc0
Capabilities:
Check mutex on windows

Disassembly:
push 0xa4
mov eax, 0x4c8e2d
call fcn.0049a3ab
mov esi, ecx
mov dword [ebp - 0xa0], esi
xor ebx, ebx
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
push 0x41
lea eax, [ebp - 0x98]
push eax
call fcn.00499ad2
add esp, 0x14
xor eax, eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x98]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x9c], edi
test edi, edi
je 0x499e0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x499d39
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], ebx
call fcn.00499b6e
test eax, eax
je 0x499d6e
mov dword [esi], eax
mov eax, dword [esi]
inc dword [eax + 0x5bc]
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
jne 0x499e0c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x499e0c
push 0x5c0
call fcn.0049a120
pop ecx
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x499d91
push edi
mov ecx, eax
call fcn.0049a026
jmp 0x499d93
mov eax, ebx
mov byte [ebp - 4], bl
mov dword [esi], eax
test eax, eax
je 0x499e14
xor ebx, ebx
inc ebx
mov dword [ebp - 0xb0], ebx
push eax
call fcn.00499be7
pop ecx
test eax, eax
jne 0x499d47
mov dword [ebp - 0xa8], 3
push 0x4e9334
lea eax, [ebp - 0xa8]
jmp 0x499e29
mov eax, esi
call fcn.0049a3f8
ret
mov dword [ebp - 0xa4], 1
push 0x4e9334
lea eax, [ebp - 0xa4]
push eax
call fcn.0049b5dc
int3
Function at 0x499f7f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebx]
add ecx, 8
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x5a8]
mov dword [ecx + 0x5b0], eax
call fcn.0049a2a4
mov edi, eax
test edi, edi
je 0x49a00a
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jne 0x499fba
mov esi, edi
jmp 0x499ff6
push dword [edi]
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x499fef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x499fe2
mov ecx, dword [ebx]
push edi
add ecx, 8
call fcn.0049a26f
jmp 0x499ff6
push 0x4caa28
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x499ff6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx]
add ecx, 8
call fcn.0049a2a4
mov edi, eax
test edi, edi
jne 0x499faf
test esi, esi
jne 0x49a01f
mov ecx, dword [ebx]
add ecx, 8
call fcn.0049a1c0
mov esi, eax
test esi, esi
je 0x49a01f
mov eax, dword [ebp - 4]
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x49a026
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x4c8e6b
call fcn.0049a342
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [esi], 0
lea ecx, [esi + 8]
or dword [esi + 4], 0xffffffff
call fcn.0049a187
and dword [ebp - 4], 0
and dword [esi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x49a072
mov eax, dword [ebp + 8]
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0049a3e4
ret 4
push 0x4e9334
lea eax, [ebp + 8]
mov dword [ebp + 8], 2
push eax
call fcn.0049b5dc
int3
Function at 0x4abda5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.004abf3c
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4abf14
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4abf14
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4abec9
jg 0x4abe01
test eax, eax
je 0x4abebf
push 1
push 0x1000
call fcn.004600e0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4abe24
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4abeb6
push 0x8000
push ebx
call fcn.004b0931
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4abe4d
jg 0x4abe48
cmp ecx, 0x1000
jb 0x4abe4d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004b421d
add esp, 0x10
cmp eax, 0xffffffff
je 0x4abe92
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4abe48
jl 0x4abe79
test ecx, ecx
jne 0x4abe3a
push dword [ebp - 0xc]
push ebx
call fcn.004b0931
push esi
call fcn.00460060
add esp, 0xc
xor ebx, ebx
jmp 0x4abf22
cmp byte [edi + 0x24], 0
je 0x4abea9
cmp dword [edi + 0x20], 5
jne 0x4abea9
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4abeb4
mov ebx, dword [edi + 0x18]
jmp 0x4abeb6
xor ebx, ebx
push esi
call fcn.00460060
pop ecx
jmp 0x4abf22
test ecx, ecx
jg 0x4abe8b
jl 0x4abec9
test eax, eax
jae 0x4abe8b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004bdc97
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4abee9
cmp byte [edi + 0x1c], 0
je 0x4abe8b
jmp 0x4abf1a
push ebx
call fcn.004aed9a
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4abe8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4abf22
cmp byte [edi + 0x1c], 0
je 0x4abf1f
mov ebx, dword [edi + 0x18]
jmp 0x4abf22
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004bdc97
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b0421
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4ee1c8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4b0461
cmp byte [ebx], 0xa
jne 0x4b0461
or byte [edi + eax + 0x28], 4
jmp 0x4b0466
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x4b0565
mov dl, byte [eax]
cmp dl, 0x1a
je 0x4b0548
inc eax
cmp dl, 0xd
je 0x4b0492
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x4b04b8
cmp eax, ecx
jae 0x4b04c6
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x4b047a
jmp 0x4b0565
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b0543
cmp dword [ebp - 0x10], 0
je 0x4b0543
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4ee1c8]
test byte [eax + edi + 0x28], 0x48
je 0x4b051d
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4b0508
mov byte [esi], dl
jmp 0x4b0519
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4ee1c8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4b0565
cmp byte [ebp - 1], 0xa
jne 0x4b052c
cmp esi, ebx
jne 0x4b052c
mov byte [esi], 0xa
jmp 0x4b0564
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004bdc97
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4b0565
mov byte [esi], 0xd
jmp 0x4b0564
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4ee1c8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4b0562
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4b0565
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4b056e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4ee1c8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4b05b4
cmp word [ebx], dx
jne 0x4b05b4
or byte [eax + edi + 0x28], 4
jmp 0x4b05b9
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x4b071c
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x4b06fc
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x4b05fa
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4b0630
cmp eax, edx
jae 0x4b063e
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x4b05d5
jmp 0x4b071c
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b06f7
cmp dword [ebp - 0x18], 0
je 0x4b06f7
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4ee1c8]
test byte [eax + edi + 0x28], 0x48
je 0x4b06cd
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x4b0691
mov word [esi], cx
jmp 0x4b06c8
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4ee1c8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4ee1c8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4ee1c8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x4b071c
pop eax
cmp word [ebp - 4], ax
jne 0x4b06dd
cmp esi, ebx
jne 0x4b06dd
mov word [esi], ax
jmp 0x4b0719
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004bdc97
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4b071c
push 0xd
pop eax
jmp 0x4b06d8
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4ee1c8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x4b0716
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x4b071c
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4b61db
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0049af20
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004aed40
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4b621d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4b6379
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0049a430
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4ee1c8]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.004bdcf5
mov ecx, dword [esi*4 + 0x4ee1c8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x4b6372
cmp eax, dword [ecx + edi + 0x24]
jne 0x4b6372
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b6372
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004bdcf5
add esp, 0x14
test edx, edx
jl 0x4b6372
jg 0x4b62e8
test eax, eax
jb 0x4b6372
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4b6372
jl 0x4b6302
cmp dword [ebp - 0x1008], eax
ja 0x4b6372
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4b6320
test ebx, ebx
je 0x4b6359
cmp ecx, edi
jae 0x4b6359
mov al, byte [ecx]
cmp al, 0xd
jne 0x4b633a
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4b6346
cmp byte [ecx + 1], 0xa
jne 0x4b6346
inc ecx
jmp 0x4b6346
movzx eax, al
movsx eax, byte [eax + 0x4ea6c0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4b6320
cmp edx, ebx
jne 0x4b6320
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4b6377
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004961ed
leave
ret

Function at 0x4ba6e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4ba70d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4ba70d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4bb776
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x4cdee0
push str.FlsAlloc
push 0x1f
call fcn.004bbcd2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4bb7aa
push dword [ebp + 8]
mov ecx, esi
call dword [0x4e4884]
call esi
jmp 0x4bb7b0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x4bb7f4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x4cdf04
push str.FlsGetValue
push 0x21
call fcn.004bbcd2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4bb82b
push dword [ebp + 8]
mov ecx, esi
call dword [0x4e4884]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4bb833
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x4cdf18
push str.FlsSetValue
push 0x22
call fcn.004bbcd2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4bb86d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4e4884]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]