joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4889d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov dword [eax], 0
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 0xc8]
test ecx, ecx
jne 0x488a48
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x488a2e
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.ntfs_file_get_sidstr:_file_argument_has_no_meta_data
mov dword [esi], 0x800000f
call fcn.004768f0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, 0x10
call fcn.0047fea0
test eax, eax
je 0x488ae8
mov esi, dword [eax + 0x50]
test esi, esi
jne 0x488a84
call fcn.00476ab0
mov ecx, 0x800000f
call fcn.00476850
push str.ntfs_file_get_sidstr:_SI_buf_is_NULL
call fcn.004768f0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
add edi, 0x194
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebx + 0xc]
cmp dword [ecx + 0x98], 1
jne 0x488ab9
movzx edx, byte [esi + 0x37]
movzx eax, byte [esi + 0x36]
shl edx, 8
add edx, eax
movzx eax, byte [esi + 0x35]
shl edx, 8
add edx, eax
movzx eax, byte [esi + 0x34]
jmp 0x488ad3
movzx edx, byte [esi + 0x34]
movzx eax, byte [esi + 0x35]
shl edx, 8
add edx, eax
movzx eax, byte [esi + 0x36]
shl edx, 8
add edx, eax
movzx eax, byte [esi + 0x37]
shl edx, 8
add edx, eax
call fcn.00488200
test eax, eax
jne 0x488afc
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.__ntfs_file_get_sidstr:SI_attribute
call fcn.00476950
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
push dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
mov edx, eax
call fcn.00487fc0
add esp, 4
push edi
test al, al
jne 0x488ae2
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
Function at 0x48f400
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
push edi
test esi, esi
jne 0x48f460
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x48f447
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.Null_fs_attr_in_tsk_fs_attr_set_str
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
pop edi
mov al, 1
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov ax, word [ebp + 0x10]
mov dword [esi + 4], ecx
mov ecx, esi
mov dword [esi + 8], 5
mov word [esi + 0x18], ax
mov dword [esi + 0x48], 0
call fcn.0048f340
test al, al
jne 0x48f45a
mov edi, dword [ebp + 0x18]
cmp dword [esi + 0x54], edi
jae 0x48f4a9
mov ecx, dword [esi + 0x50]
mov edx, edi
call fcn.00479c20
mov dword [esi + 0x50], eax
test eax, eax
je 0x48f45a
mov dword [esi + 0x54], edi
push dword [esi + 0x54]
push 0
push dword [esi + 0x50]
call fcn.004c13c0
push edi
push dword [ebp + 0x14]
push dword [esi + 0x50]
call fcn.004c0d70
add esp, 0x18
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 0
xor al, al
pop edi
pop esi
pop ebp
ret
Function at 0x48f4e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
test ecx, ecx
je 0x48f621
cmp dword [ecx + 8], 0
je 0x48f621
test edi, edi
jne 0x48f521
call fcn.00476ab0
mov ecx, 0x8000006
call fcn.00476850
push str.Null_fs_attr_in_tsk_fs_attr_set_run
call fcn.004768f0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0x2c]
mov esi, dword [ebp + 0x28]
mov ebx, dword [ebp + 0x18]
cmp edx, dword [ebp + 0x1c]
jg 0x48f560
jl 0x48f535
cmp esi, ebx
jae 0x48f560
call fcn.00476ab0
mov ecx, 0x8000006
call fcn.00476850
push dword [ebp + 0x1c]
push ebx
push dword [ebp + 0x2c]
push esi
push str.tsk_fs_attr_set_run:_alloc_size___llu__is_less_than_size___llu_
call fcn.004768f0
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x30]
or eax, 3
mov dword [edi + 4], ecx
mov dword [edi + 8], eax
mov ecx, edi
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x14], eax
mov ax, word [ebp + 0x14]
mov word [edi + 0x18], ax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [edi + 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [edi + 0x3c], edx
mov edx, dword [ebp + 0xc]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x34]
mov dword [edi + 0x20], ebx
mov dword [edi + 0x38], esi
mov dword [edi + 0x48], eax
call fcn.0048f340
test al, al
jne 0x48f670
mov esi, dword [ebp + 8]
test esi, esi
jne 0x48f5bf
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], esi
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
je 0x48f604
mov ecx, 0x28
call fcn.00479b80
mov dword [eax + 0x20], 1
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov ecx, dword [esi + 8]
mov dword [eax + 0x18], ecx
mov ecx, dword [esi + 0xc]
mov dword [eax], esi
mov esi, eax
mov dword [eax + 0x1c], ecx
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], esi
cmp dword [esi], 0
je 0x48f61a
nop
mov esi, dword [esi]
mov dword [edi + 0x2c], esi
cmp dword [esi], 0
jne 0x48f610
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x48f65d
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.Null_fs_file_in_tsk_fs_attr_set_run
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret
Function at 0x48fb30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x14], esi
test byte [esi + 8], 4
mov eax, dword [esi + 4]
mov eax, dword [eax + 0xc]
jne 0x48fb9f
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x48fb83
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_file_walk_res:_called_with_non_resident_data
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esi + 0x20]
mov eax, dword [eax + 0x50]
cmp ebx, eax
cmova ebx, eax
test dl, 4
jne 0x48fbbc
mov ecx, ebx
call fcn.00479b80
mov edi, eax
test edi, edi
je 0x48fb96
mov edx, dword [esi + 0x24]
xorps xmm0, xmm0
mov ecx, dword [esi + 0x20]
mov dword [ebp - 0x18], 0
movlpd qword [ebp - 0x10], xmm0
test edx, edx
jl 0x48fc85
jg 0x48fbe3
test ecx, ecx
je 0x48fc85
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
nop
sub ecx, eax
sbb edx, dword [ebp - 4]
js 0x48fc01
jg 0x48fbfd
cmp ecx, ebx
jbe 0x48fc01
mov esi, ebx
jmp 0x48fc06
mov esi, dword [esi + 0x20]
sub esi, eax
test edi, edi
je 0x48fc38
cmp esi, ebx
je 0x48fc21
mov eax, ebx
sub eax, esi
push eax
lea eax, [esi + edi]
push 0
push eax
call fcn.004c13c0
add esp, 0xc
mov eax, dword [ebp - 0x14]
push esi
mov eax, dword [eax + 0x50]
add eax, dword [ebp - 0xc]
push eax
push edi
call fcn.004c0d70
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp + 0xc]
push 0x105
push esi
push edi
push 0
push 0
push dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
push dword [eax + 4]
call dword [ebp + 8]
add esp, 0x24
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x48fc85
mov eax, dword [ebp - 0xc]
add eax, esi
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
adc dword [ebp - 4], 0
mov edx, dword [esi + 0x24]
mov ecx, dword [esi + 0x20]
cmp dword [ebp - 4], edx
jl 0x48fbf0
jg 0x48fc85
cmp eax, ecx
jb 0x48fbf0
test edi, edi
je 0x48fc92
push edi
call fcn.004bae83
add esp, 4
cmp dword [ebp - 0x18], 2
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4900e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.00476ab0
test esi, esi
je 0x4901fc
mov eax, dword [esi + 4]
test eax, eax
je 0x4901fc
cmp dword [eax + 8], 0
je 0x4901fc
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4901fc
cmp dword [eax], 0x10101010
je 0x490140
mov ecx, 0x8000006
call fcn.00476850
push str.tsk_fs_attr_walk:_called_with_unallocated_structures
call fcn.004768f0
add esp, 4
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
test al, 0x20
je 0x490180
mov eax, dword [esi + 0x64]
test eax, eax
jne 0x49016d
mov ecx, 0x8000006
call fcn.00476850
push str.tsk_fs_attr_walk:_compressed_attribute_found__but_special_function_not_defined
call fcn.004768f0
add esp, 4
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push esi
call eax
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test al, 4
je 0x4901ad
call fcn.004bdd06
add eax, 0x40
push eax
call fcn.004be33b
add esp, 4
mov edx, edi
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0048fb30
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test al, 2
je 0x4901da
call fcn.004bdd06
add eax, 0x40
push eax
call fcn.004be33b
add esp, 4
mov edx, edi
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0048fca0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8000006
call fcn.00476850
push dword [esi + 8]
push str.tsk_fs_attr_walk:_called_with_unknown_attribute_type:__x
call fcn.004768f0
add esp, 8
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x490236
push 0xc08
call fcn.004bb5d5
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.004c13c0
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_attr_walk:_called_with_NULL_pointers
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4907e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
jne 0x49084c
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x490830
push 0xc08
call fcn.004bb5d5
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.004c13c0
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_block_get:_fs_unallocated
mov dword [esi], 0x8000004
call fcn.004768f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
jne 0x490859
call fcn.00490750
mov ebx, eax
jmp 0x49086f
cmp dword [ebx], 0x1b7c3f4a
jne 0x490928
cmp dword [ebx + 8], 0
je 0x490928
mov eax, dword [edi + 0x50]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, dword [edi + 0x4c]
jb 0x4908d5
ja 0x490887
cmp esi, dword [edi + 0x48]
jbe 0x4908d5
call fcn.00476ab0
mov ecx, 0x8000004
call fcn.00476850
mov eax, dword [ebp + 0xc]
cmp eax, dword [edi + 0x44]
ja 0x4908bd
jb 0x4908a5
cmp esi, dword [edi + 0x40]
ja 0x4908bd
push eax
push esi
push str.tsk_fs_block_get:_Address_missing_in_partial_image:__llu_
call fcn.004768f0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push esi
push str.tsk_fs_block_get:_Address_is_too_large_for_image:__llu_
call fcn.004768f0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push dword [ebp + 8]
mov dword [ebx + 0x10], esi
mov esi, dword [ebp + 0x10]
or esi, 0x20
mov dword [ebx + 0x14], eax
push 0
mov dword [ebx + 4], edi
mov dword [ebx + 0x18], esi
push dword [edi + 0x50]
call fcn.004c2160
test esi, 0x200
jne 0x49091f
mov ecx, dword [edi + 8]
mov esi, dword [ebp - 4]
add ecx, eax
mov eax, dword [edi + 0xc]
adc eax, edx
mov edx, dword [ebx + 8]
push esi
push eax
push ecx
mov ecx, dword [edi + 4]
call fcn.00476be0
add esp, 0xc
cmp eax, esi
jne 0x490944
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00476ab0
mov ecx, 0x8000004
call fcn.00476850
push str.tsk_fs_block_get:_fs_block_unallocated
call fcn.004768f0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x490f90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov ecx, dword [ebp + 0x10]
xor edx, edx
mov eax, ecx
mov esi, dword [edi + 0x18]
div esi
test edx, edx
je 0x49100a
call fcn.00476ab0
mov ebx, dword [0x56161c]
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x490fe9
push 0xc08
call fcn.004bb5d5
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.004c13c0
add esp, 0xc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0x4000002
push dword [edi + 0x18]
push dword [ebp + 0x10]
push str.tsk_vs_read_block:_length__Iu_not_a_multiple_of__d
call fcn.004768f0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push esi
call fcn.004c2160
add eax, dword [edi + 0x10]
mov ecx, dword [edi + 4]
adc edx, dword [edi + 0x14]
push edx
push eax
mov edx, ebx
call fcn.00476be0
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x491170
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 4], edx
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0x4c]
mov eax, dword [esi + 0x48]
test ecx, ecx
jne 0x491196
test eax, eax
je 0x49125d
push 0
push dword [esi + 0x50]
add eax, 1
adc ecx, 0
push ecx
push eax
call fcn.004c2160
cmp ebx, edx
jb 0x49125a
ja 0x4911ba
cmp edi, eax
jb 0x49125a
call fcn.00476ab0
mov eax, dword [0x56161c]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4911fd
push 0xc08
call fcn.004bb5d5
add esp, 4
mov ebx, eax
push 0xc08
push 0
push ebx
call fcn.004c13c0
add esp, 0xc
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebx], 0x8000004
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x44]
add ecx, 1
push 0
push dword [esi + 0x50]
adc eax, 0
push eax
push ecx
call fcn.004c2160
mov ecx, dword [ebp + 0xc]
cmp ecx, edx
ja 0x491241
jb 0x491228
cmp edi, eax
jae 0x491241
push ecx
push edi
push str.tsk_fs_read:_Offset_missing_in_partial_image:__llu_
call fcn.004768f0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
push edi
push str.tsk_fs_read:_Offset_is_too_large_for_image:__llu_
call fcn.004768f0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
cmp dword [esi + 0x58], 0
jne 0x491269
cmp dword [esi + 0x5c], 0
je 0x491285
cmp dword [esi + 0x50], 0
je 0x491285
push dword [ebp + 0x10]
mov ecx, esi
push ebx
push edi
call fcn.00491040
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
add ecx, edi
push dword [ebp + 0x10]
adc eax, ebx
push eax
push ecx
mov ecx, dword [esi + 4]
call fcn.00476be0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4912b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
push edi
mov edi, dword [ebp + 0x10]
xor edx, edx
mov eax, edi
mov ecx, dword [esi + 0x50]
div ecx
test edx, edx
je 0x491330
call fcn.00476ab0
mov ebx, dword [0x56161c]
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x49130d
push 0xc08
call fcn.004bb5d5
add esp, 4
mov edi, eax
push 0xc08
push 0
push edi
call fcn.004c13c0
add esp, 0xc
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [edi], 0x8000004
push dword [esi + 0x50]
push dword [ebp + 0x10]
push str.tsk_fs_read_block:_length__Iu_not_a_multiple_of__d
call fcn.004768f0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp eax, dword [esi + 0x4c]
jb 0x4913d4
ja 0x49134a
cmp ebx, dword [esi + 0x48]
jbe 0x4913d4
call fcn.00476ab0
mov eax, dword [0x56161c]
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x49138d
push 0xc08
call fcn.004bb5d5
add esp, 4
mov edi, eax
push 0xc08
push 0
push edi
call fcn.004c13c0
add esp, 0xc
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp + 0xc]
mov dword [edi], 0x8000004
cmp eax, dword [esi + 0x44]
ja 0x4913bb
jb 0x4913a2
cmp ebx, dword [esi + 0x40]
ja 0x4913bb
push eax
push ebx
push str.tsk_fs_read_block:_Address_missing_in_partial_image:__llu_
call fcn.004768f0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ebx
push str.tsk_fs_read_block:_Address_is_too_large_for_image:__llu_
call fcn.004768f0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x58], 0
jne 0x491408
cmp dword [esi + 0x5c], 0
jne 0x491408
push eax
push ebx
push 0
push ecx
call fcn.004c2160
add eax, dword [esi + 8]
mov ecx, dword [esi + 4]
adc edx, dword [esi + 0xc]
push edi
push edx
mov edx, dword [ebp - 4]
push eax
call fcn.00476be0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ebx
push 0
push ecx
call fcn.004c2160
push edi
push edx
mov edx, dword [ebp - 4]
mov ecx, esi
push eax
call fcn.00491040
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x497ad0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00497ae0
Function at 0x4999c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x4999e5
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x4999fd
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x499a2c
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x499a6e
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x499b42
sub edx, 0x10000
js 0x499b42
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x499a54
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x499a54
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x499ac5
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x499ac2
add edx, 8
jne 0x499aa9
jmp 0x499b33
add edx, 4
test eax, 0xffff
jne 0x499ad2
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x499b33
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x499b06
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x499a54
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x499b42
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x499a54
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x499b53
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x49c930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
dec edx
je 0x49c958
movzx eax, byte [esi]
mov ecx, edx
and ecx, 0x1f
inc esi
mov eax, dword [eax*4 + section..data]
rol eax, cl
xor edi, eax
dec edx
jne 0x49c941
movzx eax, byte [esi]
mov eax, dword [eax*4 + section..data]
xor eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x49cba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
dec edx
je 0x49cbc8
movzx eax, byte [esi]
mov ecx, edx
and ecx, 0x1f
inc esi
mov eax, dword [eax*4 + section..data]
rol eax, cl
xor edi, eax
dec edx
jne 0x49cbb1
movzx eax, byte [esi]
mov ebx, dword [ebp + 0x14]
mov esi, dword [eax*4 + section..data]
xor esi, edi
test ebx, ebx
je 0x49cc17
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49cbe0
sub ecx, edx
mov edi, esi
mov edx, ebx
lea esi, [ecx - 1]
test esi, esi
je 0x49cc0b
movzx eax, byte [edx]
mov ecx, esi
and ecx, 0x1f
inc edx
mov eax, dword [eax*4 + section..data]
rol eax, cl
xor edi, eax
dec esi
jne 0x49cbf4
movzx eax, byte [edx]
mov esi, dword [eax*4 + section..data]
xor esi, edi
mov ecx, dword [ebp + 8]
xor edx, edx
mov eax, esi
div dword [ecx]
mov edi, dword [ecx + edx*4 + 4]
test edi, edi
je 0x49cce6
lea esp, [esp]
mov eax, dword [ebp + 0x10]
cmp dword [edi + 4], eax
jne 0x49cc8e
mov ecx, dword [edi]
mov esi, eax
mov edx, dword [ebp + 0xc]
sub esi, 4
jb 0x49cc55
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x49cc5a
add ecx, 4
add edx, 4
sub esi, 4
jae 0x49cc44
cmp esi, 0xfffffffc
je 0x49cc87
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x49cc8e
cmp esi, 0xfffffffd
je 0x49cc87
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x49cc8e
cmp esi, 0xfffffffe
je 0x49cc87
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x49cc8e
cmp esi, 0xffffffff
je 0x49cc87
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x49cc8e
mov esi, 1
jmp 0x49cc90
xor esi, esi
mov eax, dword [edi + 8]
cmp eax, ebx
je 0x49ccce
test eax, eax
je 0x49ccca
test ebx, ebx
je 0x49ccca
mov ecx, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x49ccc1
test dl, dl
je 0x49ccbd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x49ccc1
add eax, 2
add ecx, 2
test dl, dl
jne 0x49cca1
xor eax, eax
jmp 0x49ccc6
sbb eax, eax
or eax, 1
test eax, eax
je 0x49ccce
xor eax, eax
jmp 0x49ccd3
mov eax, 1
test esi, esi
je 0x49ccdb
test eax, eax
jne 0x49cced
mov edi, dword [edi + 0x10]
test edi, edi
jne 0x49cc30
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [edi + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x49ce00
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
neg eax
sbb eax, eax
and eax, 0xffffffe1
add eax, 0x1f
pop ebp
ret