joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479648
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x100], edx
mov edi, eax
xor eax, eax
push ebp
push 0x479842
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xcc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xac]
cmp dword [ebp - 0xb0], 0
jne 0x4796fb
test byte [ebp - 0xc5], 0x40
je 0x4796fb
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x4796bb
test byte [ebx + 0x1c], 2
je 0x4796bb
mov eax, ebx
mov edx, dword [0x46ca3c]
call fcn.00405120
test al, al
je 0x4796bb
mov eax, ebx
call fcn.0047d8a4
mov dword [ebp - 0xb0], eax
jmp 0x4796fb
mov eax, dword [edi + 8]
mov dword [ebp - 0xfc], eax
mov byte [ebp - 0xf8], 0x11
lea eax, [ebp - 0xfc]
push eax
push 0
lea edx, [ebp - 0x100]
mov eax, dword [0x55f7f0]
call fcn.00409f10
mov ecx, dword [ebp - 0x100]
mov dl, 1
mov eax, dword [0x432424]
call fcn.004212fc
call fcn.00406078
mov eax, dword [ebp - 0xa4]
mov dword [edi + 0x254], eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x98]
push eax
call fcn.0040be4c
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x479735
mov edx, 0x470d04
cmp edx, dword [ebp - 0xf0]
je 0x479772
test al, al
je 0x479749
mov eax, dword [ebp - 0x98]
push eax
lea eax, [ebp - 0x80]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov dword [ebp - 0xa4], 0x470d04
lea eax, [ebp - 0x80]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0xa8]
push eax
call sub.KERNEL32.DLL_VirtualQueryEx
test ax, ax
jne 0x479772
call fcn.004230e8
mov dword [0x5584cc], edi
lea edx, [ebp - 0xcc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xb0]
cmp dword [edi + 0x258], 0
jne 0x479796
call fcn.004230e8
push 0xfffffffffffffff0
mov eax, dword [edi + 0x258]
push eax
call sub.KERNEL32.DLL_GetExitCodeThread
test eax, 0x40000000
je 0x4797cc
push 0xfffffffffffffff4
mov eax, dword [edi + 0x258]
push eax
call sub.KERNEL32.DLL_GetExitCodeThread
test eax, eax
jne 0x4797cc
mov eax, dword [edi + 0x258]
push eax
push 0xfffffffffffffff4
push eax
call sub.KERNEL32.DLL_GetStartupInfoA
mov eax, dword [edi + 0x174]
call fcn.0041d5f0
xor eax, eax
mov dword [edi + 0x174], eax
mov eax, edi
call fcn.0047dc5c
push 1
mov eax, dword [edi + 0x64]
call fcn.00457d08
mov ecx, eax
mov edx, 0x30
mov eax, edi
call fcn.00475e18
cmp byte [edi + 0x5e], 0
je 0x47980f
mov eax, edi
mov si, 0xffef
call fcn.00405190
mov eax, dword [edi + 0xac]
mov eax, dword [eax + 8]
test eax, eax
je 0x479829
test byte [edi + 0x52], 0x20
je 0x479829
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479849
lea eax, [ebp - 0x100]
call fcn.00406974
ret
Function at 0x47a06c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x47a14c
mov eax, dword [ebp - 4]
cmp ebx, dword [eax + 0x1d4]
je 0x47a14c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x258], 0
je 0x47a0f9
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1d4], 0
je 0x47a0f9
test ebx, ebx
je 0x47a0f9
mov eax, dword [ebp - 4]
mov dword [eax + 0x1d4], ebx
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x258]
push eax
call sub.KERNEL32.DLL_GetCommandLineW
mov eax, dword [0x55f330]
cmp dword [eax], 5
jl 0x47a0ef
mov eax, dword [0x55fb10]
cmp dword [eax], 2
jne 0x47a0ef
push 0
mov ecx, 0x30003
mov edx, 0x127
mov eax, dword [ebp - 4]
call fcn.00475e18
mov eax, dword [ebp - 4]
call fcn.00479f78
jmp 0x47a14c
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0047f79c
xor eax, eax
push ebp
push 0x47a145
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xc0]
mov eax, dword [ebp - 4]
mov dword [eax + 0x1d4], ebx
mov eax, dword [ebp - 4]
call fcn.00479f78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a14c
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0047f79c
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x47dc5c
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffbc
mov ebx, eax
mov eax, dword [ebx + 0x258]
push eax
call sub.KERNEL32.DLL_GlobalDeleteAtom
test eax, eax
je 0x47dc9b
mov dword [esp + 0x18], 0x2c
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebx + 0x258]
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
lea esi, [esp + 0x34]
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x47dcac
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x258]
push eax
call sub.KERNEL32.DLL_GetFileSize
push 0xfffffffffffffff0
mov eax, dword [ebx + 0x258]
push eax
call sub.KERNEL32.DLL_GetExitCodeThread
test eax, 0x40000000
je 0x47dd45
push 0xfffffffffffffff8
mov eax, dword [ebx + 0x258]
push eax
call sub.KERNEL32.DLL_GetExitCodeThread
mov esi, eax
test esi, esi
je 0x47dd45
push 0xffffffffffffffec
push esi
call sub.KERNEL32.DLL_GetExitCodeThread
test eax, 0x400000
je 0x47dcfb
mov eax, dword [esp + 8]
mov dword [esp], eax
mov edx, dword [esp + 0x10]
mov dword [esp + 8], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 8]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
push esp
push esi
call sub.KERNEL32.DLL_DeleteCriticalSection
mov eax, dword [esp]
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
push esp
push esi
call sub.KERNEL32.DLL_DeleteCriticalSection
mov eax, dword [esp]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
mov dword [ebx + 0x40], eax
mov eax, dword [esp + 0xc]
mov dword [ebx + 0x44], eax
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 8]
mov dword [ebx + 0x48], eax
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0xc]
mov dword [ebx + 0x4c], eax
mov eax, ebx
call fcn.00473d54
add esp, 0x44
pop edi
pop esi
pop ebx
ret
Function at 0x480120
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
lea eax, [ebp - 8]
push eax
push ebx
call fcn.0040bd0c
lea eax, [ebp - 0x18]
push eax
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x18]
mov dword [esi], eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x14]
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48ae68
Capabilities:
Get common file path
Get file size
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebp - 4]
call fcn.0047d8a4
push eax
call sub.KERNEL32.DLL_GetExitCodeThread
test ah, 2
je 0x48b005
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
call fcn.0047d8a4
push eax
call sub.KERNEL32.DLL_GetFileSize
mov ecx, dword [ebp - 0x24]
neg ecx
mov edx, dword [ebp - 0x28]
neg edx
lea eax, [ebp - 0x28]
call fcn.0040a980
mov eax, dword [ebp - 4]
call fcn.0047d8a4
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x48affe
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
lea esi, [ebp - 0x28]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
test bl, bl
je 0x48af9c
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
call fcn.0047d8a4
push eax
call sub.KERNEL32.DLL_GetExitCodeThread
test eax, 0x100000
je 0x48af9c
test eax, 0x200000
je 0x48af9c
push 2
call sub.KERNEL32.DLL_GetDateFormatW
mov edi, eax
push 3
call sub.KERNEL32.DLL_GetDateFormatW
mov ebx, eax
push 0xfffffffffffffffe
push 0xfffffffffffffffe
lea eax, [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetTempPathW
mov eax, dword [ebp - 4]
call fcn.004750dc
test al, al
je 0x48af61
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, edi
mov edx, dword [ebp - 0xc]
sub edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.0040a89c
push esi
lea esi, [ebp - 0x44]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
jmp 0x48af87
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x44]
push eax
mov edx, dword [ebp - 0xc]
sub edx, ebx
mov eax, dword [ebp - 0x10]
sub eax, edi
mov ecx, dword [ebp - 0x10]
call fcn.0040a89c
push esi
lea esi, [ebp - 0x44]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push 0xf
call sub.KERNEL32.DLL_GetCurrentProcessId
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.0040be1c
mov eax, dword [ebp - 0x1c]
sub eax, 2
push eax
mov eax, dword [ebp - 0x20]
sub eax, 2
push eax
mov eax, dword [ebp - 0x24]
add eax, 2
push eax
mov eax, dword [ebp - 0x28]
add eax, 2
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_ExcludeClipRect
lea ecx, [ebp - 0x34]
mov dl, 2
mov eax, esi
call fcn.00489ec0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00489bb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b005
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0047d8a4
push eax
call sub.KERNEL32.DLL_InitializeCriticalSection
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4912e8
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406974
push 0
mov eax, esi
movzx eax, al
push eax
call sub.KERNEL32.DLL_ResumeThread
shl eax, 0x10
test eax, eax
je 0x49132d
push 0x100
lea edx, [esp + 4]
push edx
push eax
call fcn.0040beac
mov eax, ebx
mov edx, esp
mov ecx, 0x100
call fcn.00407408
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x4921a0
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, eax
test byte [ebp + 0x1c], 8
jne 0x49226f
test byte [ebp + 0x1c], 2
je 0x4921bf
mov byte [ebp + 0x74], 1
jmp 0x49226f
mov eax, dword [ebp + 0x6c]
test eax, eax
je 0x4921d0
call fcn.004921a0
jmp 0x49226f
mov eax, ebp
call fcn.004922d4
push eax
call sub.KERNEL32.DLL_TlsSetValue
mov esi, eax
test esi, esi
sete bl
test esi, esi
jle 0x49221c
push 0x400
mov edi, esi
dec edi
push edi
mov eax, ebp
call fcn.004922d4
push eax
call sub.KERNEL32.DLL_EnumCalendarInfoW
test al, 4
jne 0x492217
push 0x400
push edi
mov eax, ebp
call fcn.004922d4
push eax
call sub.KERNEL32.DLL_EnterCriticalSection
mov bl, 1
dec esi
test esi, esi
jg 0x4921e8
test bl, bl
je 0x49226f
cmp dword [ebp + 0x64], 0
jne 0x49225f
mov eax, dword [ebp + 0x70]
mov edx, dword [0x490640]
call fcn.00405120
test al, al
je 0x49225f
mov eax, ebp
call fcn.004922d4
push eax
call sub.KERNEL32.DLL_TlsSetValue
test eax, eax
jne 0x49225f
mov eax, dword [ebp + 0xac]
push eax
call fcn.0040bd6c
xor eax, eax
mov dword [ebp + 0xac], eax
jmp 0x492266
mov eax, ebp
call fcn.00492060
xor edx, edx
mov eax, ebp
mov ecx, dword [eax]
call dword [ecx + pe_nt_image_headers32]
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x496ed8
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_TlsSetValue
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
lea ebx, [eax - 0x400]
mov eax, dword [ebp + 8]
add eax, 0xfffffff6
mov dword [ebp - 8], eax
xor esi, esi
jmp 0x496f93
push ebx
mov eax, dword [ebp - 8]
sub eax, ebx
sar eax, 1
jns 0x496f16
adc eax, 0
push eax
push 0x400
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x404]
mov ecx, esi
mov edx, dword [ebp - 4]
call fcn.004974ac
mov eax, ebx
call fcn.0041d1cc
mov ebx, eax
push 0x400
push esi
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_EnumCalendarInfoW
mov edi, eax
test di, 2
je 0x496f5d
mov word [ebx], 0x24
add ebx, 2
mov word [ebx], 0
test di, 0x40
je 0x496f71
mov word [ebx], pe_nt_image_headers32
add ebx, 2
mov word [ebx], 0
test di, 1
je 0x496f85
mov word [ebx], 0x23
add ebx, 2
mov word [ebx], 0
mov word [ebx], 0x3b
add ebx, 2
mov word [ebx], 0
inc esi
cmp esi, dword [ebp - 0xc]
jge 0x496fa1
cmp ebx, dword [ebp - 8]
jb 0x496f09
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x497248
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
mov esi, ecx
mov word [ebp - 2], dx
xor edx, edx
push ebp
push 0x49731f
push dword fs:[edx]
mov dword fs:[edx], esp
test byte [ebp - 2], 0x10
je 0x497288
push esi
push eax
call sub.KERNEL32.DLL_GetComputerNameW
mov edx, dword [ebp + 0xc]
mov edx, dword [edx - 4]
mov cl, 1
xchg edx, eax
call fcn.00496744
mov ebx, eax
jmp 0x4972b2
mov edx, dword [ebp + 0xc]
mov edx, dword [edx - 4]
mov cl, 1
xchg edx, eax
call fcn.00496744
mov ebx, eax
test ebx, ebx
je 0x4972b2
mov eax, ebx
call fcn.00494f94
cmp esi, eax
jge 0x4972b2
mov edx, esi
mov eax, ebx
call fcn.00494fa4
mov ebx, eax
test ebx, ebx
je 0x497302
cmp dword [ebx + 0x34], 0
je 0x497302
lea eax, [ebp - 8]
movzx edx, word [ebp + 8]
call fcn.00407374
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0x34]
movzx edx, word [edx]
call fcn.00407374
mov eax, dword [ebp - 0xc]
pop edx
call fcn.0041c12c
test eax, eax
jne 0x4972f8
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 0x34]
call fcn.004983a8
cmp dword [ebp - 0x10], 0
je 0x4972fc
xor eax, eax
jmp 0x4972fe
mov al, 1
mov ebx, eax
jmp 0x497304
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497326
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004069d4
ret
Function at 0x497330
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebx + 0xc], eax
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_TlsSetValue
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x4973e4
inc eax
mov dword [ebp - 0x18], eax
xor esi, esi
push 0x400
push esi
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_EnumCalendarInfoW
mov edi, eax
push ebp
movzx eax, word [ebx + 4]
push eax
mov eax, dword [ebx + 8]
mov ecx, esi
mov edx, edi
call fcn.004971ec
pop ecx
test al, al
je 0x4973de
test di, 2
je 0x4973b0
cmp dword [ebp - 0xc], 0
jge 0x4973de
mov dword [ebp - 0xc], 0xfffffffe
jmp 0x4973de
cmp dword [ebp - 0xc], 0
jge 0x4973c2
mov dword [ebp - 0xc], esi
mov dword [ebx + 0xc], 2
jmp 0x4973c9
mov dword [ebx + 0xc], 3
test di, 0x80
je 0x4973d5
mov dword [ebp - 0x10], esi
jmp 0x4973de
cmp dword [ebp - 0x10], 0
jl 0x4973de
mov dword [ebp - 0x14], esi
inc esi
dec dword [ebp - 0x18]
jne 0x497372
cmp dword [ebp - 0xc], 0xffffffff
jge 0x4973f6
mov dword [ebx + 0xc], 0x10000
jmp 0x4974a3
cmp dword [ebp - 0xc], 0
jge 0x497476
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x497476
inc eax
mov dword [ebp - 0x18], eax
xor esi, esi
push 0x400
push esi
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_EnumCalendarInfoW
mov edi, eax
push ebp
movzx eax, word [ebx + 4]
push eax
mov eax, dword [ebx + 8]
mov ecx, esi
mov edx, edi
call fcn.00497248
pop ecx
test al, al
je 0x497470
test di, 2
je 0x497442
mov dword [ebx + 0xc], 0x10000
jmp 0x4974a3
cmp dword [ebp - 0xc], 0
jge 0x497454
mov dword [ebp - 0xc], esi
mov dword [ebx + 0xc], 2
jmp 0x49745b
mov dword [ebx + 0xc], 3
test di, 0x80
je 0x497467
mov dword [ebp - 0x10], esi
jmp 0x497470
cmp dword [ebp - 0x10], 0
jl 0x497470
mov dword [ebp - 0x14], esi
inc esi
dec dword [ebp - 0x18]
jne 0x49740a
mov eax, dword [ebx + 0xc]
cmp eax, 2
jne 0x497489
shl eax, 0x10
or eax, dword [ebp - 0xc]
mov dword [ebx + 0xc], eax
jmp 0x4974a3
cmp eax, 3
jne 0x4974a3
cmp dword [ebp - 0x14], 0
jge 0x49749a
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
shl eax, 0x10
or eax, dword [ebp - 0x14]
mov dword [ebx + 0xc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b8a5c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, eax
cmp byte [ebp + 0x29e], 2
jne 0x4b8ad0
cmp dword [ebp + 0x37c], 0
je 0x4b8ad0
xor esi, esi
mov eax, dword [ebp + 0x2b4]
test eax, eax
je 0x4b8a87
mov edx, dword [eax]
call dword [edx + 0x38]
mov esi, eax
xor edi, edi
mov eax, dword [ebp + 0x2c0]
test eax, eax
je 0x4b8a9a
call fcn.004922d4
mov edi, eax
mov eax, ebp
call fcn.0047d8a4
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp esi, eax
setne bl
push edi
push esi
push 0x230
mov eax, dword [ebp + 0x37c]
push eax
call sub.KERNEL32.DLL_RaiseException
test bl, bl
je 0x4b8ad0
mov eax, ebp
call fcn.0047d8a4
push eax
call fcn.0040bdbc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b8b24
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b8d38
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x4b8bb8
mov eax, dword [0x565258]
call fcn.004bdc9c
dec eax
test eax, eax
jl 0x4b8bb8
inc eax
mov dword [ebp - 4], eax
xor edi, edi
mov edx, edi
mov eax, dword [0x565258]
call fcn.004bdc88
cmp esi, dword [eax + 0x2b4]
jne 0x4b8bb2
mov edx, edi
mov eax, dword [0x565258]
call fcn.004bdc88
cmp ebx, eax
je 0x4b8bb2
mov eax, dword [esi + 8]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x55f270]
call fcn.00409f10
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x432424]
call fcn.004212fc
call fcn.00406078
inc edi
dec dword [ebp - 4]
jne 0x4b8b5d
mov eax, dword [ebx + 0x2b4]
test eax, eax
je 0x4b8bc9
xor edx, edx
call fcn.004970bc
test byte [ebx + 0x1c], 8
jne 0x4b8bd9
test esi, esi
je 0x4b8bdb
test byte [esi + 0x1c], 8
je 0x4b8bdb
xor esi, esi
mov dword [ebx + 0x2b4], esi
test esi, esi
je 0x4b8bee
mov edx, ebx
mov eax, esi
call fcn.0044a4e4
test esi, esi
je 0x4b8ca1
test byte [ebx + 0x1c], 0x10
jne 0x4b8c09
cmp byte [ebx + 0x299], 3
je 0x4b8ca1
mov eax, dword [ebx + 0x2b4]
cmp byte [eax + 0x64], 0
jne 0x4b8c1e
cmp byte [ebx + 0x29e], 1
jne 0x4b8c24
test byte [ebx + 0x1c], 0x10
je 0x4b8c7c
mov eax, ebx
call fcn.0047dc50
test al, al
je 0x4b8cbb
mov eax, dword [ebx + 0x2b4]
mov edx, dword [eax]
call dword [edx + 0x38]
mov edi, eax
mov eax, ebx
call fcn.0047d8a4
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp edi, eax
je 0x4b8c6a
mov eax, dword [ebx + 0x2b4]
mov edx, dword [eax]
call dword [edx + 0x38]
push eax
mov eax, ebx
call fcn.0047d8a4
push eax
call sub.KERNEL32.DLL_FindFirstFileW
mov eax, ebx
call fcn.0047d8a4
mov edx, eax
mov eax, esi
call fcn.004970bc
jmp 0x4b8cbb
cmp byte [ebx + 0x29e], 1
je 0x4b8cbb
mov eax, ebx
call fcn.0047dc50
test al, al
je 0x4b8cbb
push 0
mov eax, ebx
call fcn.0047d8a4
push eax
call sub.KERNEL32.DLL_FindFirstFileW
jmp 0x4b8cbb
mov eax, ebx
call fcn.0047dc50
test al, al
je 0x4b8cbb
push 0
mov eax, ebx
call fcn.0047d8a4
push eax
call sub.KERNEL32.DLL_FindFirstFileW
cmp byte [ebx + 0x29d], 0
je 0x4b8ccd
mov dl, 1
mov eax, ebx
call fcn.004ba4c8
mov eax, ebx
call fcn.004b8a5c
cmp dword [ebx + 0x2bc], 0
je 0x4b8d22
test byte [ebx + 0x1c], 0x10
je 0x4b8d22
cmp dword [ebx + 0x34], 0
je 0x4b8d22
push 0x37
push 0
push 0
push 0
push 0
push 0
mov eax, ebx
call fcn.0047d8a4
push eax
call sub.KERNEL32.DLL_IsValidLocale
push 0
xor ecx, ecx
mov edx, 0x85
mov eax, ebx
call fcn.00475e18
push 0
xor ecx, ecx
mov edx, 0xf
mov eax, ebx
call fcn.00475e18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8d3f
lea eax, [ebp - 0x10]
call fcn.00406974
ret
Function at 0x4bc8e0
Capabilities:
Get file attributes

Disassembly:
push ebx
add esp, 0xffffffd4
mov ebx, eax
mov eax, ebx
call fcn.0047dc50
test al, al
je 0x4bc92d
mov dword [esp], 0x2c
push esp
mov eax, ebx
call fcn.0047d8a4
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov eax, dword [esp + 8]
sub eax, 2
je 0x4bc914
dec eax
je 0x4bc91d
jmp 0x4bc926
mov byte [ebx + 0x29a], 1
jmp 0x4bc92d
mov byte [ebx + 0x29a], 2
jmp 0x4bc92d
mov byte [ebx + 0x29a], 0
add esp, 0x2c
pop ebx
ret

Function at 0x4be214
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, edx
mov ebx, eax
cmp si, word [ebx + 0x48]
je 0x4be2b1
mov word [ebx + 0x48], si
test si, si
jne 0x4be2a1
push esp
call fcn.0040be74
push dword [esp + 4]
push dword [esp + 4]
call sub.KERNEL32.DLL_VirtualAlloc
mov edi, eax
test edi, edi
je 0x4be2a1
push 0
push edi
call sub.KERNEL32.DLL_GetLocalTime
mov ebp, eax
call fcn.0040b710
cmp ebp, eax
jne 0x4be2a1
mov eax, dword [esp]
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
and eax, 0xffff
mov edx, dword [esp + 0xc]
shl edx, 0x10
or eax, edx
push eax
push 0
push 0x84
push edi
call sub.KERNEL32.DLL_RaiseException
movzx eax, ax
or eax, 0x2000000
push eax
push edi
push 0x20
push edi
call sub.KERNEL32.DLL_RaiseException
jmp 0x4be2b4
movsx edx, si
mov eax, ebx
call fcn.004be1e8
push eax
call sub.KERNEL32.DLL_CreateThread
inc dword [ebx + 0x4c]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4c0fdc
Capabilities:
Suspend thread

Disassembly:
call fcn.0042319c
test al, al
je 0x4c0fec
push 0
call sub.KERNEL32.DLL_SuspendThread
ret