joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c090
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 8], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x16f
push str....._base_files_file_win.cc
push str.DoInitialize
push esi
call fcn.004b4450
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.004be2f0
mov eax, ebx
and eax, 1
neg eax
and eax, 3
xor ecx, ecx
inc ecx
test bl, 2
cmove ecx, eax
test bl, 4
mov edx, 4
cmovne ecx, edx
test bl, 8
mov esi, 2
cmove esi, ecx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x47c297
mov ecx, ebx
and ecx, 0x40
shl ecx, 0x18
test bl, 0x80
cmove edx, ecx
mov ecx, ebx
rol ecx, 0x1a
mov esi, ebx
shl esi, 0xb
and esi, 0x20000000
mov edi, ebx
shr edi, 4
and edi, 0x10000
and ecx, 0x80000100
or ecx, esi
or ecx, edi
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
and ebx, 0x400
mov dword [esp + 0xc], ebx
shl ebx, 0x14
mov esi, dword [ebp + 0xc]
shr esi, 3
and esi, 0x100
or esi, ebx
mov ebx, dword [ebp + 0xc]
mov edi, ebx
shr edi, 0xb
and edi, 2
or edi, esi
mov esi, ebx
shl esi, 0xd
and esi, 0x4000000
or esi, edi
mov edi, ebx
shl edi, 8
and edi, 0xa000000
or edi, esi
mov esi, dword [ebp + 8]
xor edx, 3
cmp byte [esi + 0xb], 0
jns 0x47c1c2
mov esi, dword [esi]
xor ebx, ebx
push ebx
push edi
push eax
push ebx
push edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov esi, dword [esp + 8]
cmp dword [esi], eax
je 0x47c24f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x47c279
mov ecx, edi
inc ecx
cmp ecx, 2
mov ebx, dword [ebp + 0xc]
jb 0x47c203
mov dword [esi], edi
mov edi, eax
call fcn.004b4480
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi]
inc edi
cmp edi, 2
jb 0x47c254
mov eax, dword [esp + 0xc]
shr eax, 0xa
mov dword [esi + 0x14], 0
mov byte [esi + 0x19], al
test bl, 4
jne 0x47c268
test bl, 0xa
je 0x47c231
mov byte [esi + 0x18], 1
lea ecx, [esp + 0x20]
call fcn.004be370
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004ed092
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ebx, dword [ebp + 0xc]
jmp 0x47c20c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047bf60
add esp, 4
mov dword [esi + 0x14], eax
jmp 0x47c231
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [esi + 0x18]
jmp 0x47c231
mov ebx, eax
call fcn.004b4480
push dword [esi]
call fcn.004c3200
mov eax, ebx
add esp, 4
mov dword [esi], 0
jmp 0x47c1ed
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 8]
mov dword [eax + 0x14], 0xffffffff
jmp 0x47c231
Function at 0x47ca70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
call fcn.004926e0
mov byte [esi + 4], 0
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi], 0x5836c0
mov dword [esi + 0xc], eax
movaps xmm0, xmmword [0x58e170]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esp, 0x10
cmp dword [esi + 0xc], eax
je 0x47cada
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0xc]
inc eax
cmp eax, 2
jae 0x47cae4
lea eax, [edi + 1]
cmp eax, 2
jb 0x47cace
mov dword [esi + 0xc], edi
call fcn.004b4480
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004b4480
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call fcn.004c3200
mov dword [esi + 0xc], 0
jmp 0x47cabe
Function at 0x47d760
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jb 0x47d781
call fcn.004b4480
mov dword [esi], 0
test edi, edi
je 0x47d7b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x47d7d1
cmp ebx, 2
jb 0x47d7a9
mov dword [esi], edi
mov edi, eax
call fcn.004b4480
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
inc eax
cmp eax, 2
jae 0x47d7ee
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.004b4480
push dword [esi]
call fcn.004c3200
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
jmp 0x47d799
call fcn.004b4480
push dword [edi]
call fcn.004c3200
add esp, 4
mov dword [edi], 0
jmp 0x47d7c5
Function at 0x47edf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov ebx, ecx
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x47ee27
mov eax, dword [0x59ecf0]
cmp eax, 0xffffffff
je 0x47eeb4
mov ebx, 0x100000
test eax, eax
jne 0x47ee27
mov ebx, 0x80000
push 0x10
call fcn.004eca5e
add esp, 4
mov esi, eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x5a5e98]
bt ecx, eax
jb 0x47eea9
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x5ade98], 1
mov dword [esi], edi
mov edi, dword [ebp + 8]
test edi, edi
setne byte [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
xor eax, eax
push eax
push 0x10000
push esi
push 0x47f290
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x47eed8
test edi, edi
je 0x47ef36
mov dword [edi], eax
test eax, eax
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed092
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.004b5630
add esp, 4
jmp 0x47ee55
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x59ecf0
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x47efaa
mov eax, dword [0x59ecf0]
jmp 0x47ee19
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x47eef4
mov edi, eax
cmp eax, 0x5af
je 0x47eef4
cmp edi, 0xe
jne 0x47ef46
push ebx
call fcn.00546690
add esp, 4
test esi, esi
mov eax, dword [ebp - 0x20]
je 0x47ee90
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x5a5e98]
bt edx, ecx
jae 0x47ef25
push eax
call fcn.004b5750
add esp, 4
push esi
call fcn.004eca8e
add esp, 4
mov eax, dword [ebp - 0x20]
jmp 0x47ee90
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x47ee90
mov eax, dword [0x5a3b90]
mov ecx, dword [0x5a0f40]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x47efb9
lea ebx, [ebp - 0x1c]
push edi
push ebx
call fcn.004754d0
add esp, 8
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x47ef80
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
jmp 0x47ef83
and eax, 0x7f
push eax
push ebx
push dword [0x5a3b8c]
call fcn.004b2f90
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x47eefd
push dword [ebp - 0x1c]
call fcn.004eca8e
jmp 0x47eefa
mov dword [0x59ecf0], 0
jmp 0x47ee22
push 0x5a3b90
call fcn.004ecb07
add esp, 4
cmp dword [0x5a3b90], 0xffffffff
jne 0x47ef63
push 0x20
push str.create_thread_last_error
call fcn.0046c9e0
add esp, 8
mov dword [0x5a3b8c], eax
push 0x5a3b90
call fcn.004ecb7d
add esp, 4
jmp 0x47ef63
Function at 0x47fa90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, dword [ecx + 4]
lea eax, [ebx + 1]
cmp eax, 1
ja 0x47fafa
sub esp, 0x10
movaps xmm0, xmmword [0x58e540]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
cmp dword [esi + 4], eax
je 0x47fafa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x47fb82
mov eax, ebx
inc eax
cmp eax, 2
jb 0x47faf0
mov dword [esi + 4], ebx
call fcn.004b4480
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [esi + 4]
lea edi, [ebp + 0xc]
inc ebx
cmp ebx, 2
jb 0x47fbbe
lea ebx, [ebp + 8]
call fcn.004c34d0
xor ecx, ecx
cmp eax, 5
setge cl
shl ecx, 0x1c
or ecx, 0xf
xor eax, eax
inc eax
push eax
push dword [esi + 4]
push ecx
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
jne 0x47fb9e
lea ecx, [esi + 0x34]
push edi
call fcn.004b3ef0
lea ebx, [esi + 8]
lea edi, [ebp - 0x20]
push 0x65
push str....._basewin_registry.cc
push str.StartWatching
push edi
call fcn.004b4450
add esp, 0x10
mov ecx, ebx
push edi
push esi
push dword [esi + 4]
call fcn.0047f6f0
mov ebx, eax
lea ecx, [ebp + 0xc]
call fcn.004b3f90
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed092
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.004b4480
push dword [esi + 4]
call fcn.004c3200
add esp, 4
mov dword [esi + 4], 0
jmp 0x47fae0
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jb 0x47fbbe
call fcn.004b4480
push dword [esi + 4]
call fcn.004c3200
add esp, 4
mov dword [esi + 4], 0
xor ebx, ebx
jmp 0x47fb64

Function at 0x47fd30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
sete al
add esp, 0x18
pop ebp
ret 4
Function at 0x47fdd0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [esp + 0x28], eax
push 0
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
xor esi, esi
test eax, eax
jne 0x47fe15
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.004ed092
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
lea eax, [esp + 0x24]
mov dword [eax], esi
or edi, 8
push eax
push edi
push esi
push ebx
mov eax, dword [ebp + 8]
mov ebx, eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
je 0x47fe00
mov esi, eax
test eax, eax
jne 0x47fe00
xor eax, eax
dec eax
lea esi, [esp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push dword [ebp + 0xc]
call fcn.0051d070
movzx eax, byte [esi + 0xb]
test al, al
jns 0x47fe62
mov eax, dword [esp + 0x1c]
jmp 0x47fe65
and eax, 0x7f
test eax, eax
je 0x47fe7c
lea ecx, [esp + 0x18]
call fcn.00466de0
cmp word [eax], 0x5c
jne 0x47ff8f
movzx ecx, byte [esp + 0x23]
test cl, cl
jns 0x47fe8b
mov eax, dword [esp + 0x1c]
jmp 0x47fe90
mov eax, ecx
and eax, 0x7f
mov dword [esp], eax
xor eax, eax
lea esi, [esp + 8]
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
mov eax, 0x104
mov dword [esp + 4], eax
push eax
push esi
call fcn.0047e760
add esp, 8
mov ecx, dword [esp + 0x24]
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
lea edx, [esp + 0x24]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp], ecx
mov dword [esp + 4], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x47ff45
mov ecx, esi
xor edi, edi
push edi
push dword [esp + 8]
call fcn.004b20e0
lea ecx, [esp + 0x18]
push edi
push dword [esp + 4]
call fcn.004b20e0
movzx eax, byte [esp + 0x13]
test al, al
jns 0x47ff13
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
jmp 0x47ff18
and eax, 0x7f
mov edx, esi
lea edi, [esp + 0x18]
mov ecx, edi
push eax
push edx
call fcn.004691c0
cmp byte [esp + 0x23], 0
jns 0x47ff30
mov edi, dword [esp + 0x18]
push dword [ebp + 0x10]
push edi
push ebx
call fcn.0047fdd0
add esp, 0xc
test eax, eax
je 0x47fea1
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov esi, eax
cmp byte [esp + 0x13], 0
jns 0x47ff73
push dword [esp + 8]
call fcn.004eca8e
add esp, 4
cmp byte [esp + 0x23], 0
jns 0x47fe00
push dword [esp + 0x18]
call fcn.004eca8e
add esp, 4
jmp 0x47fe00
lea ecx, [esp + 0x18]
push 0x5c
call fcn.004b1ee0
jmp 0x47fe7c
Function at 0x47ffc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x480033
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x48001d
cmp dword [ebp - 0x18], 4
jne 0x48001d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed092
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x48001d

Function at 0x480040
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.004edde0
mov esi, ecx
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, 0x800
lea edi, [ebp - 0x810]
push ebx
push 0xff
push edi
call fcn.004f0310
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], ebx
push ecx
push edi
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4800d9
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 1
jne 0x4800dd
push edi
call fcn.00508f54
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00468e50
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed092
mov eax, esi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x4800c0
cmp eax, 2
jne 0x480129
lea ebx, [ebp - 0x1010]
push 0x800
push 0xff
push ebx
call fcn.004f0310
add esp, 0xc
push 0x400
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x480130
push ebx
call fcn.00508f54
add esp, 4
mov ecx, esi
push eax
push ebx
jmp 0x4800b9
mov esi, 0x3f4
jmp 0x4800c0
mov esi, 0xea
jmp 0x4800c0

Function at 0x480140
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.00508f54
add esp, 4
add eax, eax
add eax, 2
push eax
push ebx
push 1
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4810a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5a3bdc]
mov ecx, dword [0x5a0f40]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4810d1
movzx eax, word [0x5a3bb8]
cmp eax, 9
jne 0x48111c
xor eax, eax
inc eax
pop ebp
ret
push 0x5a3bdc
call fcn.004ecb07
add esp, 4
cmp dword [0x5a3bdc], 0xffffffff
jne 0x4810c0
xorps xmm0, xmm0
movups xmmword [0x5a3bc8], xmm0
movups xmmword [0x5a3bb8], xmm0
mov dword [0x5a3bd8], 0
push 0x5a3bb8
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x5a3bdc
call fcn.004ecb7d
add esp, 4
jmp 0x4810c0
test eax, eax
je 0x4810cf
cmp eax, 6
jne 0x48112c
mov eax, 2
jmp 0x4810cf
cmp eax, 0xc
jne 0x481138
mov eax, 3
jmp 0x4810cf
mov eax, 4
jmp 0x4810cf
Function at 0x48cae0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [esp + 0x28], eax
cmp dword [ebp + 8], 0
je 0x48ccb3
cmp dword [0x59fdb8], 0xe69e32f3
jne 0x48ccb6
mov ecx, 0x308
mov esi, dword [ebp + 8]
add ecx, dword [esi + 0xc]
mov byte [esp + 0xf], 0xff
movzx eax, byte [esi + 2]
push eax
mov dword [esp + 8], ecx
push ecx
call fcn.004b5500
add esp, 8
movzx ebx, ax
shl ebx, 5
lea edi, [esi + ebx]
add edi, 0x48
add esi, 0x40
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x48cc7b
mov dword [esp + 8], esi
mov eax, dword [edi]
mov esi, dword [eax]
test esi, esi
je 0x48cc2a
mov byte [esp + 0xf], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x48cc20
mov edi, dword [ebp + 8]
add ebx, edi
mov ebx, dword [ebx + 0x54]
bswap ecx
mov edx, ecx
xor edx, esi
cmp edx, 0x1fffff
ja 0x48cc87
mov edx, ecx
and edx, 0x1fc000
je 0x48cc87
prefetcht0 byte [ecx]
mov dword [eax], ecx
mov ecx, dword [eax + 0xc]
lea edx, [ecx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [eax + 0xc], ecx
mov eax, dword [eax + 8]
mov ecx, dword [edi + 0x117c]
add ecx, dword [eax + 0xc]
mov eax, dword [edi + 0x1180]
mov dword [edi + 0x117c], ecx
cmp eax, ecx
cmova ecx, eax
mov dword [edi + 0x1180], ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, esi
push edi
call fcn.004cdcb0
push esi
push dword [0x5b1030]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x5a0f40]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x90], esi
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.004ed092
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
mov edi, dword [ebp + 8]
jmp 0x48cb9b
lea eax, [esp + 0xf]
mov ecx, edi
push eax
push 0x4000
push dword [esp + 0xc]
push 2
mov edi, dword [ebp + 8]
push edi
call fcn.004ceae0
test eax, eax
je 0x48ccb9
mov esi, eax
mov ecx, eax
and ecx, 0xffe00000
mov edx, eax
shr edx, 9
and edx, 0xfe0
lea eax, [edx + ecx]
movzx ecx, byte [edx + ecx + 0x101e]
and ecx, 0x3f
shl ecx, 5
sub eax, ecx
add eax, 0x1000
jmp 0x48cbb4
mov ecx, esi
call fcn.004ce980
jmp 0x48cb51
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi], xmm0
mov ecx, edi
push 0
push dword [esi]
push str.first
call fcn.0053a010
push edi
call fcn.0042a760
add esp, 4
mov ecx, ebx
call fcn.00545ac0
int3
int3
xor esi, esi
jmp 0x48cbd7
Function at 0x494d90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x494e69
cmp dword [esi], 0
jne 0x494e69
cmp dword [esi + 0xc], 0
jne 0x494e69
xor eax, eax
cmp dword [esi + 4], 0
jne 0x494e69
mov ebx, dword [edi]
cmp eax, ebx
je 0x494df3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x494e39
lea eax, [ebx + 1]
cmp eax, 2
jb 0x494de9
mov dword [esi], ebx
call fcn.004b4480
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x494e26
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x494e50
lea eax, [ebx + 1]
cmp eax, 2
jb 0x494e1c
mov dword [esi + 4], ebx
call fcn.004b4480
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004b4480
push dword [esi]
call fcn.004c3200
add esp, 4
mov dword [esi], 0
jmp 0x494dda
call fcn.004b4480
push dword [esi + 4]
call fcn.004c3200
add esp, 4
mov dword [esi + 4], 0
jmp 0x494e0c
mov ecx, esi
call fcn.0054a060
mov eax, dword [esi]
jmp 0x494dc4
Function at 0x495060
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp + 0x10]
mov edx, dword [0x59d024]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], 0
test cl, cl
jne 0x495114
lea ecx, [ebp - 0x14]
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x49516a
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x49510c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp ebx, 0xffffffff
je 0x495110
call fcn.004b4480
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi], 1
mov dword [esi + 4], 0
cmp ebx, 0xffffffff
je 0x4950d9
test ebx, ebx
je 0x4950f8
call fcn.004b4480
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4950f1
mov dword [esi + 4], ebx
call fcn.004b4480
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed092
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x4950c1
xor ebx, ebx
jmp 0x4950ba
lea ebx, [ebp - 0x14]
push ebx
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x49516a
mov eax, dword [ebp - 0x14]
lea edi, [ebp - 0x18]
mov dword [edi], 0
mov ecx, edi
push eax
call fcn.004af130
push ebx
push 1
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x49516f
mov eax, dword [ebp - 0x18]
inc eax
cmp eax, 2
jb 0x4950a1
call fcn.004b4480
push dword [ebp - 0x18]
call fcn.004c3200
add esp, 4
jmp 0x4950a1
mov byte [esi], 0
jmp 0x4950f8
mov byte [esi], 0
mov eax, dword [ebp - 0x18]
inc eax
cmp eax, 2
jb 0x4950f8
call fcn.004b4480
push dword [ebp - 0x18]
call fcn.004c3200
add esp, 4
jmp 0x4950f8
Function at 0x49cef0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x49cf07
test eax, eax
je 0x49cf07
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
jne 0x49cf15
mov ecx, dword [0x5b268c]
test ecx, ecx
jne 0x49cf51
cmp dword [0x5b2684], 0
je 0x49cf01
mov esi, dword [0x5b2688]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x49cf5b
test esi, esi
je 0x49cf01
mov ecx, dword [0x5b2684]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x49cf01
call dword [section..00cfg]
call ecx
jmp 0x49cf15
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x49cf39

Function at 0x4a0b70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5b26a8]
mov ecx, dword [0x5a0f40]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4a0b9b
mov ecx, 0x5b26a0
pop ebp
jmp fcn.00478d80
push 0x5b26a8
call fcn.004ecb07
add esp, 4
cmp dword [0x5b26a8], 0xffffffff
jne 0x4a0b90
xor eax, eax
mov dword [0x5b26a4], eax
mov dword [0x5b26a0], eax
mov ecx, 0x5b26a0
push eax
call fcn.00478e20
push 0x5b26a8
call fcn.004ecb7d
add esp, 4
jmp 0x4a0b90