joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470560
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x482030
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
cmp eax, 3
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
je 0x47059e
test eax, eax
jne 0x47071a
mov ebx, dword [0x4f8d1c]
test ebx, ebx
je 0x47071a
mov dword [ebp - 0x20], 0
jmp 0x4705c7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4705f8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x47076b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4705c0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4705c0
test byte [ebp - 0x20], 1
je 0x47071a
mov ebx, dword [0x4f8d1c]
test ebx, ebx
je 0x47071a
mov dword [ebp - 0x20], 0
jmp 0x470627
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x470658
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x47076b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x470620
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x470620
test byte [ebp - 0x20], 1
je 0x47071a
mov ebx, dword [0x4f8d1c]
test ebx, ebx
je 0x47071a
mov dword [ebp - 0x20], 0
jmp 0x470687
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4706b8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x47076b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x470680
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x470680
test byte [ebp - 0x20], 1
je 0x47071a
mov ebx, dword [0x4f8d1c]
test ebx, ebx
je 0x47071a
mov dword [ebp - 0x20], 0
jmp 0x4706e7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x470714
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x47076b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4706e0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4706e0
test byte [ebp - 0x20], 1
jne 0x470734
movzx eax, byte [0x4efec0]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x4f8d1c]
jmp 0x47073f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x47071a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x47076b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47073c
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x47073c
mov dword [ebp - 0x10], 0
mov ecx, 0x4eaf98
mov edx, 0x2b
push 0x4ea0f4
call fcn.00491430
add esp, 4
ud2
Function at 0x470e00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x4f82b0]
test eax, eax
je 0x470ec3
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x470e2c
cmp dword [eax + 4], 0
mov edi, eax
je 0x470e2c
add edi, 8
jmp 0x470ebe
mov eax, dword [0x4f82b0]
test eax, eax
je 0x470ed2
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x470ebc
mov esi, eax
test eax, eax
jne 0x470e8b
movzx eax, byte [0x4f8d7c]
mov ecx, 0x10
mov edx, 4
call fcn.00412aa0
test eax, eax
je 0x470eed
mov dword [eax], 0x4f82b0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4f82b0]
test eax, eax
je 0x470ee1
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 0xc]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
je 0x470ebe
test ecx, ecx
je 0x470ebe
lock dec dword [ecx]
jne 0x470ebe
call fcn.00470f00
jmp 0x470ebe
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x4f82b0
call fcn.00492aa0
jmp 0x470e10
mov ecx, 0x4f82b0
call fcn.00492aa0
jmp 0x470e3a
mov ecx, 0x4f82b0
call fcn.00492aa0
jmp 0x470e83
mov ecx, 4
mov edx, 0x10
call fcn.004911b0
ud2

Function at 0x471970
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x4f82c0]
test eax, eax
je 0x4719f4
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x47198f
cmp byte [eax + 4], 0
mov esi, eax
jne 0x4719e9
mov eax, dword [0x4f82c0]
test eax, eax
je 0x471a03
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4719ee
mov esi, eax
test eax, eax
jne 0x4719e3
movzx eax, byte [0x4f8d7c]
mov ecx, 8
mov edx, 4
call fcn.00412aa0
test eax, eax
je 0x471a1b
mov dword [eax], 0x4f82c0
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x4f82c0]
test eax, eax
je 0x471a0f
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x4719f0
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x4f82c0
call fcn.00492aa0
jmp 0x47197b
mov ecx, 0x4f82c0
call fcn.00492aa0
jmp 0x471999
mov ecx, 0x4f82c0
call fcn.00492aa0
jmp 0x4719db
mov ecx, 4
mov edx, 8
call fcn.004911b0
ud2
Function at 0x472780
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x4727d4
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x4727f7
test eax, eax
js 0x4727e3
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x4727ef
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x4e9c14
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
call fcn.00470b40
add esp, 4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.00476be0
mov ecx, 7
int 0x29
ud2
Function at 0x472e40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x4f82a0]
test eax, eax
je 0x472ed8
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x472e66
cmp dword [eax + 4], 0
je 0x472e66
add eax, 8
pop esi
ret
mov eax, dword [0x4f82a0]
test eax, eax
je 0x472ee7
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x472ed4
mov esi, eax
test eax, eax
jne 0x472ebd
movzx eax, byte [0x4f8d7c]
mov ecx, 0x10
mov edx, 4
call fcn.00412aa0
test eax, eax
je 0x472f02
mov dword [eax], 0x4f82a0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4f82a0]
test eax, eax
je 0x472ef6
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x4f82a0
call fcn.00492aa0
jmp 0x472e4f
mov ecx, 0x4f82a0
call fcn.00492aa0
jmp 0x472e70
mov ecx, 0x4f82a0
call fcn.00492aa0
jmp 0x472eb5
mov ecx, 4
mov edx, 0x10
call fcn.004911b0
ud2
Function at 0x473ef0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4821b0
mov dword [ebp - 0x28], ecx
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x30], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jae 0x473f80
jmp 0x473f6e
jbe 0x47400a
cmp esi, 0x201
jae 0x473f80
lea edi, [ebp - 0x44c]
mov dword [ebp - 0x2c], 0x200
mov ebx, esi
jmp 0x473fbb
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
sub esi, ebx
sub eax, ebx
cmp eax, esi
jae 0x473fac
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
mov edx, ebx
push esi
call fcn.00492d40
add esp, 4
mov eax, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x473fda
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x474042
cmp esi, ebx
jne 0x473f60
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x47407c
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x473f6e
jmp 0x473f80
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
cmp esi, edx
ja 0x47409c
lea ecx, [ebp - 0x4c]
mov edx, edi
push esi
call fcn.00474900
add esp, 4
movsd xmm0, qword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
movsd xmm1, qword [ebp - 0x44]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
jmp 0x474054
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [ebp - 0x28]
mov byte [ecx], 0
mov dword [ecx + 4], eax
mov byte [ecx + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x474068
mov ecx, dword [ebp - 0x24]
mov edx, 2
call fcn.00412b00
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, str.internal_error:_entered_unreachable_code
mov edx, 0x28
push 0x4ea1a0
call fcn.00491430
add esp, 4
jmp 0x4740ab
mov ecx, esi
push 0x4ea1b0
call fcn.004913c0
add esp, 4
ud2
Function at 0x475bf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
movzx ebx, byte [edx + 0x1c]
mov dword [esp + 8], ecx
xor eax, eax
mov ecx, 0
mov edi, edx
call 0x475c0d
pop ebp
cmp bl, 1
setne dl
sbb ecx, ecx
or cl, dl
movzx edx, cl
cmp cl, 0xff
je 0x475c24
test edx, edx
jne 0x475c48
mov byte [esp + 3], bl
movzx ebx, byte [edi + 0x1e]
cmp cl, 0xff
mov esi, ebx
je 0x475c37
test edx, edx
jne 0x475c41
mov ecx, edi
call fcn.00475b00
movzx eax, al
movzx ebx, byte [esp + 3]
jmp 0x475c4a
xor esi, esi
xor ecx, ecx
test bl, bl
jne 0x475ca4
xor ecx, ecx
cmp byte [edi + 8], 6
lea edx, [edi + 8]
cmove edx, ecx
je 0x475ca4
movzx ebx, byte [edx]
mov ecx, 6
add ebp, dword [ebx*4 + 0x475da4]
jmp ebp
mov edx, dword [edi + 4]
add eax, ecx
mov ecx, esi
movzx esi, cl
lea ecx, [eax + esi]
cmp edx, ecx
jb 0x475d8b
mov ebp, dword [edi]
cmp edx, ecx
lea ebx, [ebp + ecx]
jne 0x475cd3
movzx eax, byte [edi + 8]
mov byte [esp + 3], al
xor eax, eax
sub edx, ecx
jne 0x475d42
jmp 0x475d27
mov dword [esp + 4], ebx
mov bh, byte [edi + 8]
add eax, esi
sub eax, edx
cmp bh, 3
mov byte [esp + 3], bh
jae 0x475cfb
mov ebx, dword [esp + 4]
lea esi, [edx + ebp - 1]
nop
cmp byte [esi], 0x5c
je 0x475d2b
dec esi
inc eax
jne 0x475cf0
jmp 0x475d21
mov ebx, dword [esp + 4]
lea edi, [edx + ebp - 1]
nop word cs:[eax + eax]
nop dword [eax]
movzx esi, byte [edi]
cmp esi, 0x2f
je 0x475d2b
cmp esi, 0x5c
je 0x475d2b
dec edi
inc eax
jne 0x475d10
xor eax, eax
sub edx, ecx
jne 0x475d42
mov cl, 0xa
jmp 0x475d72
not eax
lea ecx, [ecx + eax + 1]
cmp edx, ecx
jb 0x475d92
add ebp, ecx
mov eax, 1
mov ebx, ebp
sub edx, ecx
je 0x475d27
mov cl, 9
cmp edx, 2
je 0x475d63
cmp edx, 1
jne 0x475d72
cmp byte [ebx], 0x2e
jne 0x475d72
xor ecx, ecx
cmp byte [esp + 3], 3
setae cl
lea ecx, [ecx + ecx*2 + 7]
jmp 0x475d72
cmp byte [ebx], 0x2e
jne 0x475d72
cmp byte [ebx + 1], 0x2e
sete cl
xor cl, 9
mov esi, dword [esp + 8]
add eax, edx
mov dword [esi], eax
mov byte [esi + 4], cl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4e9198
jmp 0x475d97
push 0x4e91a8
call fcn.00491350
add esp, 4
ud2
Function at 0x47bf10
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x4822f0
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x47bf8e
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
lea edx, [esi + 4]
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], 0x4e9da0
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov byte [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x30]
mov edx, 0x4e9dcc
mov dword [esi + 0x2c], 0x476c90
mov dword [esi + 0x3c], 1
call fcn.004912b0
ud2

Function at 0x47ee50
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x4f82d0]
test eax, eax
je 0x47ef35
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x47ee81
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x47ef2a
mov eax, dword [0x4f82d0]
test eax, eax
je 0x47ef44
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x47ef07
mov esi, eax
test eax, eax
jne 0x47eee7
movzx eax, byte [0x4f8d7c]
mov ecx, 0x20
mov edx, 8
call fcn.00412aa0
test eax, eax
je 0x47ef5f
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x4f82d0
mov esi, eax
mov eax, dword [0x4f82d0]
test eax, eax
je 0x47ef53
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x47ef0b
movaps xmm0, xmmword [esp]
jmp 0x47ef19
xor esi, esi
jmp 0x47ef2d
lea ecx, [esp + 0x10]
call fcn.0047bf10
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x4f82d0
call fcn.00492aa0
jmp 0x47ee68
mov ecx, 0x4f82d0
call fcn.00492aa0
jmp 0x47ee8f
mov ecx, 0x4f82d0
call fcn.00492aa0
jmp 0x47eedf
mov ecx, 8
mov edx, 0x20
call fcn.004911b0
ud2

Function at 0x480405
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x4f82f4]
test eax, eax
je 0x480410
dec eax
ret
mov ecx, 0x4f82f4
jmp fcn.00492aa0
Function at 0x4805f7
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
lea eax, [ebp - 0x18]
mov edi, ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4824a0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
call fcn.00480405
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x480643
cmp dword [eax + 4], 0
mov ebx, eax
je 0x480643
add ebx, 8
jmp 0x480780
call fcn.00480405
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x480716
mov esi, eax
test eax, eax
jne 0x48068a
push 4
pop ecx
push 0xc
pop edx
call fcn.00422bed
test eax, eax
je 0x480793
mov dword [eax], 0x4f82f4
and dword [eax + 4], 0
mov esi, eax
call fcn.00480405
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, edi
je 0x4806a7
mov eax, dword [edi]
and dword [edi], 0
test eax, eax
mov eax, dword [edi + 4]
jne 0x480768
xor ecx, ecx
mov edx, eax
call fcn.004801e6
call fcn.004800ea
lea edi, [ebp - 0x3c]
mov edx, eax
mov ecx, edi
call fcn.00480133
mov ecx, edi
mov edx, 0x4eadbc
call fcn.0048015c
mov edi, eax
mov eax, dword [eax + 0x10]
test eax, eax
je 0x48072c
mov ebx, eax
mov byte [ebp - 0x1d], dl
dec ebx
mov dword [edi + 0x10], ebx
mov ecx, dword [edi + 8]
mov edx, dword [ecx + eax*4 - 4]
je 0x48073c
mov dword [ebp - 0x30], eax
mov eax, dword [ecx]
mov dword [ebp - 0x24], edi
xor edi, edi
sub ebx, 2
mov dword [ebp - 0x2c], edx
mov dword [ecx], edx
cmovb ebx, edi
mov dword [ebp - 0x28], eax
lea edx, [edi + edi + 1]
cmp edx, ebx
ja 0x48071a
lea eax, [edi + edi]
mov eax, dword [ecx + eax*4 + 8]
cmp eax, dword [ecx + edx*4]
sbb edx, 0xffffffff
mov eax, dword [ecx + edx*4]
mov dword [ecx + edi*4], eax
mov edi, edx
jmp 0x4806f7
xor ebx, ebx
jmp 0x480780
mov eax, dword [ebp - 0x30]
add eax, 0xfffffffe
cmp edx, eax
jne 0x480741
mov eax, dword [ecx + edx*4]
mov dword [ecx + edi*4], eax
jmp 0x480743
mov eax, dword [edi + 0x14]
test eax, eax
je 0x4807a7
mov dword [ebp - 0x28], eax
dec eax
mov dword [edi + 0x14], eax
jmp 0x48075b
mov dword [ebp - 0x28], edx
jmp 0x480758
mov edx, edi
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x24]
mov dword [ecx + edx*4], eax
mov ecx, dword [edi + 8]
call fcn.004802d0
or dword [ebp - 0x10], 0xffffffff
mov dl, byte [ebp - 0x1d]
movzx edx, dl
mov ecx, edi
call fcn.00401ba4
mov eax, dword [ebp - 0x28]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov dword [esi + 4], 1
lea ebx, [esi + 8]
mov dword [esi + 8], eax
call fcn.004801e6
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 1
push 4
pop ecx
push 0xc
pop edx
call fcn.004911b0
jmp 0x4807c4
and dword [ebp - 0x10], 0
mov byte [ebp - 0x1d], dl
mov dword [ebp - 0x24], edi
push 0x15
pop edx
mov ecx, 0x4ead2f
push 0x4eadac
call fcn.004916c0
pop eax
ud2
Function at 0x482ef4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x482f33
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x482f33
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x482f33
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x482f33
cmp dword [ecx + 0x74], 0xe
jbe 0x482f33
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x48a103
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x48a1a0
push ebx
push esi
call fcn.0048a0cc
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0048a060
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x48a14d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x48a19f
push edi
push eax
call fcn.0048ad20
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x48a16d
call fcn.00488bc1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x48a19e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0048a060
add esp, 0x20
test eax, eax
jne 0x48a18c
push edi
call fcn.00488bc1
jmp 0x48a194
push ebx
call fcn.00488bc1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x48b49d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4ed0c0
push 0x4ed0b8
push str.FlsAlloc
push 0x1f
call fcn.0048b35c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48b4d1
push dword [ebp + 8]
mov ecx, esi
call dword [0x4941ac]
call esi
jmp 0x48b4d7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x48b51b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4ed0d0
push 0x4ed0c8
push str.FlsGetValue
push 0x21
call fcn.0048b35c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48b552
push dword [ebp + 8]
mov ecx, esi
call dword [0x4941ac]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x48b55a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4ed0d8
push 0x4ed0d0
push str.FlsSetValue
push 0x22
call fcn.0048b35c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48b594
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4941ac]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4909f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x490a1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x490a1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x492aa0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x492b0a
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x492b45
cmp dword [esp + 4], 0
je 0x492b2c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x492b5a
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x4f8d1c]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x4f8d1c], esi
jne 0x492af0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
jmp 0x492b3c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x492b9d
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x492b30
mov edi, dword [esp]
jmp 0x492b3c
mov edi, dword [esi]
jmp 0x492b3b
mov edi, eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
call fcn.00492be0
ud2
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x4ea0d0
mov dword [esp + 8], 0x4ea0c8
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], str.failed_to_write_the_buffered_data
mov dword [esp + 0x14], 0
call fcn.004912b0
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x4ea0c8
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], str.failed_to_write_the_buffered_data
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00492c40
ud2