joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009e362
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x5b
xor dword [esp + 0x57], ebp
xor ebp, dword [esp + 0x57]
xor dword [esp + 0x57], ebp
mov ebp, dword [esp + 0x57]
add esp, 0x57
mov ebp, esp
push 0
add dword [esp], edx
sub esp, 4
mov dword [esp], 0x8744bbc7
and dword [esp], ecx
or dword [esp], ecx
sub esp, 4
xor dword [esp], ebx
xor ebx, dword [esp]
xor dword [esp], ebx
mov ebx, dword [esp]
lea esp, [esp - 4]
mov dword [esp], edi
sub esp, 4
xor dword [esp], esi
xor esi, dword [esp]
xor dword [esp], esi
mov esi, dword [esp]
mov esi, dword [ebp + 8]
shl ecx, 0xd
shl ecx, 0x13
add ecx, dword [ebp + 0xc]
xor edx, edx
xor eax, eax
cmp ecx, 0
je 0x1009e41d
mov ebx, dword [ebp + 0x10]
push 0
or dword [esp], ebp
not edi
xor edi, edi
add edi, dword [esp]
add esp, 4
push eax
or eax, 0xffffffff
inc eax
sub eax, 0x29a58556
neg eax
xchg dword [esp], eax
xor dword [esp], 0x29a58542
add edi, dword [esp]
lea esp, [esp + 4]
mov edi, dword [edi]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1009e402
shl eax, 0xf
shl eax, 0x11
add eax, ebx
pop esi
pop edi
pop ebx
sub ecx, ecx
add ecx, esp
sub ecx, 0x5f
mov ecx, dword [ecx + 0x4c]
and ecx, dword [esp]
or ecx, dword [esp]
add esp, 4
mov edx, dword [esp]
lea esp, [esp + 4]
leave
ret 0x10

Function at 0x1009e441
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf
mov dword [esp + 0xb], esi
add esp, 0xb
push edi
sub esp, 0x3e
mov dword [esp + 0x3a], ecx
add esp, 0x3a
shl edi, 0xb
shl edi, 0x15
not edi
and edi, 0x4e12ec40
xor edi, 0x4e12ec4c
add edi, ebp
mov edi, dword [edi]
mov esi, dword [ebp + 8]
xchg ecx, ebp
mov ebp, ecx
push ebx
xor ebx, edx
lea esp, [esp - 0x11]
mov dword [esp + 0xd], 0x69a8452d
lea esp, [esp + 0xd]
lea ebx, [eax + ecx*4 + 0x52d83bd7]
sub ebx, ebx
or ebx, dword [esp]
add esp, 4
xor ebx, 0x69a8453d
add ecx, ebx
lea esp, [esp - 0x53]
mov ebx, dword [esp + 0x53]
lea esp, [esp + 0x57]
mov ecx, dword [ecx]
cmp ecx, 0
je 0x1009e4ce
push 0
xor dword [esp], esi
call fcn.1009e55a
mov byte [edi], al
inc edi
inc esi
dec ecx
jne 0x1009e4b9
sub eax, eax
add eax, edi
lea esp, [esp - 0x39]
mov ecx, dword [esp + 0x39]
lea esp, [esp + 0x3d]
shl edi, 1
shl edi, 0x1f
not edi
and edi, 0xffffffff
and edi, dword [esp]
add esp, 4
mov esi, dword [esp]
lea esp, [esp + 4]
leave
ret 0xc
Function at 0x1009ee48
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
lea esp, [esp - 4]
mov dword [esp], ecx
sub esp, 0x2b
mov dword [esp + 0x27], 0xf6a47d7
add esp, 0x27
mov dword [esp], edx
sub esp, 0x65
xor dword [esp + 0x61], ebx
xor dword gs:[esp + 0x61], ebx
xor ebx, dword [esp + 0x61]
xor dword [esp + 0x61], ebx
mov ebx, dword [esp + 0x61]
add esp, 0x61
mov esi, dword fs:[0x30]
mov esi, dword [esi + 0x10]
movzx ecx, word [esi + 0x38]
mov esi, dword [esi + 0x3c]
push 0xffffffffffffffff
call fcn.1009f9b0
cmp ecx, 0
je 0x1009eeb1
xor eax, eax
xor edx, edx
cld
rol edx, 7
xor dl, al
mov al, byte [esi]
inc esi
dec ecx
jne 0x1009ee9e
xor eax, eax
add eax, edx
or ebx, ebx
and ebx, dword [esp]
or ebx, dword [esp]
add esp, 4
call fcn.1009eecd
enter 0xffffffffffff8661, 0x47
je 0x1009ee64
adc ah, bl
loopne 0x1009ee64
pop esi
aas

Function at 0x1009efd1
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 4]
mov dword [esp], 0x93c2f523
and dword [esp], ebp
or dword [esp], ebp
mov ebp, esp
push 0xac82907f
xor dword [esp], 0xbd35560a
and dword [esp], edi
or dword [esp], edi
push esi
push ecx
sub esp, 4
xor dword [esp], edx
xor edx, dword [esp]
xor dword [esp], edx
mov edx, dword [esp]
sub esp, 4
xchg dword [esp], ebx
lea esp, [esp - 0x6c]
xchg dword [esp + 0x6c], ebx
mov dword [esp + 0x6c], ebx
lea esp, [esp + 0x70]
sub esp, 4
shr esi, 7
shr esi, 0x19
xor esi, dword [ebp + 0xc]
dec esi
lea edi, [esi]
add edi, dword [ebp + 0x14]
mov ecx, esi
sub ecx, dword [ebp + 0x10]
inc ecx
je 0x1009f04d
add esi, dword [ebp + 8]
add edi, dword [ebp + 8]
movsb byte es:[edi], byte [esi]
dec esi
dec esi
dec edi
dec edi
dec ecx
jne 0x1009f041
mov edi, dword [ebp + 0x10]
add edi, dword [ebp + 8]
lea ecx, [ebp + 0x14]
mov ecx, dword [ecx]
cld
push 0xffffffffffffffff
call fcn.1009f9b0
push 0
pop edx
sub edx, eax
dec edx
not edx
push 0xffffffffffffffff
call fcn.1009f9b0
add edx, ecx
add eax, edx
xor al, ah
add edx, eax
rcl edx, 4
rcr eax, 6
mov byte [edi], al
lea edi, [edi + 1]
dec ecx
jne 0x1009f06f
sub ebx, 0x16dbc99e
and ebx, dword [esp]
or ebx, dword [esp]
add esp, 4
pop edx
pop ecx
lea esi, [edx]
and esi, dword [esp]
or esi, dword [esp]
add esp, 4
xchg dword [esp], edi
mov dword [esp], edi
add esp, 4
leave
ret 0x10

Function at 0x1009facd
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x16
mov dword [esp + 0x12], ebp
add esp, 0x12
mov ebp, esp
push 0
xor dword [esp], esi
sub esp, 4
xchg dword [esp], ecx
mov ecx, dword [esp]
push edx
mov esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
xor ecx, ecx
rol edx, 7
xor dl, al
mov al, byte [esi]
inc esi
cmp al, 0x5a
adc ecx, 0
cmp al, 0x41
sbb ecx, 0
shl ecx, 5
add eax, ecx
jne 0x1009faf0
mov eax, edx
pop edx
pop ecx
lea esp, [esp - 0x6a]
xchg dword [esp + 0x6a], esi
mov dword [esp + 0x6a], esi
lea esp, [esp + 0x6e]
leave
ret 4
Function at 0x1009fb32
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
lea esp, [esp - 4]
xchg dword [esp], edx
mov edx, dword [esp]
mov esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
xor ecx, ecx
rol edx, 7
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x1009fb49
mov eax, edx
pop edx
pop ecx
or esi, 0xffffffff
inc esi
sub esi, 0xffffffff
neg esi
sub esp, 0x3e
and esi, dword [esp + 0x3e]
add esp, 0x42
leave
ret 4

Function at 0x100a0b79
Capabilities:
Encode data using xor

Disassembly:
push 0
or dword [esp], ebp
mov ebp, esp
sub esp, 8
push eax
push 0
xor dword [esp], ebx
push 0xffffffffffffffff
and dword [esp], edx
push ecx
push edi
sub esp, 0x44
xor dword [esp + 0x40], esi
xor esi, dword [esp + 0x40]
xor dword [esp + 0x40], esi
mov esi, dword [esp + 0x40]
add esp, 0x40
sub ebx, ebx
or ebx, 0x7fe3134b
sub ebx, dword [0x7fe45c4b]
push eax
lea eax, [ebp - 8]
mov dword [eax], ebx
pop eax
xchg esi, eax
push 0x7fe45c3b
call fcn.1009ea63
xchg esi, eax
add esi, ebx
shr edx, 3
shr edx, 0x1d
add edx, dword [ebp + 8]
sub edx, ebx
call fcn.1009e32e
or edi, 0xffffffff
not edi
sub edi, eax
dec edi
not edi
push 0
mov eax, dword [esp]
lea esp, [esp + 4]
sub eax, dword [esi + 8]
dec eax
not eax
xor eax, edi
cmp edx, eax
jb 0x100a0cfc
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x100a0cfc
mov ecx, dword [esi + 0x10]
xor ecx, edi
xor edx, edx
or edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x100a0ca5
mov eax, 1
lock xchg dword [0x7fe45c47], eax
cmp eax, 0
jne 0x100a0c2b
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x100a0c43
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
cmp eax, 0
je 0x100a0c8d
sub esp, 0x4b
mov dword [esp + 0x47], 0x93428cfb
add esp, 0x47
and dword [esp], eax
or dword [esp], eax
pop dword [ebp - 4]
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x100a0c77
xor eax, eax
sub eax, 1
neg eax
xor eax, edi
mov dword [esi], eax
mov dword [0x7fe45c47], 0
add edx, esi
mov dword [ebp + 4], edx
xor esi, ecx
or esi, 0xffffffff
not esi
xor esi, dword [esp]
add esp, 4
lea esp, [esp - 0x6a]
xchg dword [esp + 0x6a], edi
mov dword [esp + 0x6a], edi
lea esp, [esp + 0x6e]
mov ecx, dword [esp]
add esp, 4
xchg dword [esp], edx
mov dword [esp], edx
add esp, 4
mov ebx, dword [esp]
add esp, 4
xor dword [esp], eax
xor eax, dword [esp]
xor dword [esp], eax
mov dword [esp], eax
add esp, 4
leave
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x100a0be6
Function at 0x100a4901
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
sub esp, 4
xor dword [esp], ecx
xor ecx, dword [esp]
xor dword [esp], ecx
mov ecx, dword [esp]
sub esp, 4
xor dword [esp], edx
xor edx, dword [esp]
xor dword [esp], edx
mov edx, dword [esp]
push edi
push 0xffffffffffffffff
and dword [esp], esi
mov edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
shl ecx, 0xf
shl ecx, 0x11
sub ecx, dword [eax + 0xc]
dec ecx
not ecx
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x100a49ff
push 0
add dword [esp], ebp
push 0xffffffffffffffff
lea esp, [esp - 0xd]
mov dword [esp + 9], 0x7fe379fe
lea esp, [esp + 9]
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], 0x7fe32e77
lea esp, [esp + 0x5c]
push 0xffffffffffffffff
call fcn.1009fdd2
mov edx, dword [ecx + 0x18]
cmp edx, 0
je 0x100a49b7
mov ebx, edx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
cmp ebx, 0
je 0x100a49b7
lea ebx, [ebx + edx]
mov esi, dword [ebx + 0xc]
lea esi, [esi + edx]
push esi
call fcn.1009facd
call fcn.1009fe8e
cmp eax, edi
jne 0x100a4950
add esp, 4
or eax, 0xffffffff
inc eax
add eax, ecx
pop esi
lea esp, [esp - 0xd]
xchg dword [esp + 0xd], edi
mov dword [esp + 0xd], edi
lea esp, [esp + 0x11]
pop edx
add ecx, 0x441c6b93
shr ecx, 0xd
shr ecx, 0x13
or ecx, dword [esp]
add esp, 4
mov ebx, dword [esp]
lea esp, [esp + 4]
leave
ret 4
xor ecx, ecx
jmp 0x100a49c7
Function at 0x100a4a10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 0xfffffffc
mov dword [esp], ebp
mov ebp, esp
sub esp, 0x108
push ebx
add esp, 0xfffffffc
mov dword [esp], edx
push ecx
push 0
or dword [esp], edi
push esi
push ebp
push 0xffffffffffffffff
sub esp, 0x11
mov dword [esp + 0xd], 0x7fe37b13
add esp, 0xd
add esp, 0xfffffffc
mov dword [esp], esi
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], 0x7fe32e77
lea esp, [esp + 0x5f]
xor dword [esp], esi
xor esi, dword [esp]
xor dword [esp], esi
mov dword [esp], esi
add esp, 4
xchg dword [esp], esi
push 0xffffffffffffffff
call fcn.1009fdd2
push 0
mov ebx, dword [esp]
add esp, 4
add ebx, 0x6fed9913
xor ebx, 0x6fed991b
add ebx, ebp
mov ebx, dword [ebx]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
mov edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
sub esp, 4
xor dword [esp], eax
xor eax, dword [esp]
xor dword [esp], eax
mov eax, dword [esp]
push esi
call fcn.1009fb32
cmp eax, dword [ebp + 0xc]
pop eax
je 0x100a4ae1
add edi, 4
add eax, 2
dec ecx
jne 0x100a4a9c
call fcn.1009fe8e
xor eax, eax
jmp 0x100a4ba3
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x100a4be8
cmp eax, ecx
ja 0x100a4be8
sub esi, esi
sub esi, eax
dec esi
not esi
lea edi, [ebp - 0x104]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
cmp al, 0x2e
jne 0x100a4b1c
mov dword [edi], 0x6c6c64
lea eax, [ebp - 0x104]
push 0
add dword [esp], eax
call fcn.1009facd
lea ebx, [ebp - 0x104]
lea edx, [ebp - 0x108]
lea esp, [esp - 4]
xchg dword [esp], edx
mov edx, dword [esp]
lea esp, [esp - 4]
xchg dword [esp], ebx
pop ebx
lea esp, [esp - 4]
sub esp, 4
xor dword [esp], eax
xor eax, dword [esp]
xor dword [esp], eax
mov eax, dword [esp]
call fcn.100a4bf6
mov ebx, eax
sub esp, 0x4c
xor dword [esp + 0x48], esi
xor esi, dword [esp + 0x48]
xor dword [esp + 0x48], esi
mov esi, dword [esp + 0x48]
add esp, 0x48
call fcn.1009fb32
call fcn.1009fe8e
push eax
push 0
xor dword [esp], ebx
call fcn.100a4a10
sub esi, ecx
shl esi, 0x13
shl esi, 0xd
add esi, dword [esp]
add esp, 4
pop edi
shr ecx, 0xb
shr ecx, 0x15
sub ecx, 0xffffffff
neg ecx
and ecx, dword [esp]
add esp, 4
and edx, edi
xor edx, edx
or edx, dword [esp]
add esp, 4
and ebx, ecx
and ebx, dword [esp]
or ebx, dword [esp]
add esp, 4
leave
ret 8
call fcn.1009fe8e
jmp 0x100a4ba3
Function at 0x100a9fae
Capabilities:
Encode data using xor

Disassembly:
push 0x773c5767
and dword [esp], ebp
or dword [esp], ebp
mov ebp, esp
sub esp, 4
lea esp, [esp - 4]
mov dword [esp], edi
push esi
sub esp, 0xc
mov dword [esp + 8], ebx
add esp, 8
push ecx
push edx
mov esi, dword [ebp + 8]
call fcn.1009e32e
cmp dword [esi], 0xffffffff
je 0x100aa012
lea ecx, [esi]
lea ecx, [ecx + 0x14]
add ecx, 0
mov ecx, dword [ecx]
add ecx, 6
mov ebx, dword [esi + 0x10]
xor dword [esi], eax
add esi, 4
dec ecx
jne 0x100a9ff3
xor byte [esi], al
inc esi
dec ebx
jne 0x100a9fff
cmp dword [esi], 0xffffffff
jne 0x100a9fe3
pop edx
pop ecx
lea esp, [esp - 0x1f]
xchg dword [esp + 0x1f], ebx
mov dword [esp + 0x1f], ebx
lea esp, [esp + 0x23]
pop esi
pop edi
leave
ret 4
Function at 0x100af32a
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x52
mov dword [esp + 0x4e], 0xad5c28f8
add esp, 0x4e
mov dword [esp], ebp
mov ebp, esp
push ebx
push 0xffffffffffffffff
and dword [esp], ecx
push 0
add dword [esp], edx
add esp, 0xfffffffc
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x100af352
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x100af352
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x100af352
cmp word [ebx + 4], 0x14c
jne 0x100af352
test word [ebx + 0x16], 2
je 0x100af352
test word [ebx + 0x16], 0x100
je 0x100af352
cmp word [ebx + 0x18], 0x10b
jne 0x100af352
sub esp, 0x3d
mov dword [esp + 0x39], 0x1d70e4af
add esp, 0x39
and dword [esp], eax
or dword [esp], eax
push 0
mov eax, 0xffffffff
and eax, dword [esp]
add esp, 4
add eax, 0xfefcf4f5
xchg dword [esp], eax
xchg dword [esp], edx
mov dword [esp], edx
lea esp, [esp + 4]
xor edx, 0xfefcf48d
add edx, ebx
mov edx, dword [edx]
cmp edx, 0
je 0x100af352
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
lea edx, [edx + eax]
mov ebx, eax
lea esp, [esp - 0x64]
mov dword [esp + 0x60], 0x6009042c
lea esp, [esp + 0x60]
mov dword [esp], edx
call fcn.1009facd
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x100af352
mov esi, dword [esp]
add esp, 4
shl edi, 0xb
shl edi, 0x15
or edi, 0xffffffff
and edi, dword [esp]
add esp, 4
mov edx, dword [esp]
lea esp, [esp + 4]
xor dword [esp], ecx
xor ecx, dword [esp]
xor dword [esp], ecx
mov dword [esp], ecx
add esp, 4
pop ebx
leave
ret 8
Function at 0x100af4ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
sub esp, 4
xchg dword [esp], edx
mov edx, dword [esp]
push ecx
lea esp, [esp - 0x4d]
xchg dword [esp + 0x49], edi
mov edi, dword [esp + 0x49]
lea esp, [esp + 0x49]
lea esp, [esp - 4]
xchg dword [esp], esi
sub esp, 0x65
mov esi, dword [esp + 0x65]
add esp, 0x69
lea esp, [esp - 4]
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
and eax, 0xdb83d375
push dword [ebx + 0x24]
lea esp, [esp - 0x26]
mov eax, dword [esp + 0x26]
lea esp, [esp + 0x2a]
add eax, edx
or edi, 0xffffffff
inc edi
or edi, dword [ebx + 0x20]
add edi, edx
lea ecx, [ebx + 0x18]
mov ecx, dword [ecx]
mov esi, dword [edi]
add esi, edx
push eax
add esp, 0xfffffffc
mov dword [esp], esi
call fcn.1009fb32
cmp eax, dword [ebp + 0xc]
xchg dword [esp], eax
mov dword [esp], eax
lea esp, [esp + 4]
je 0x100af571
add edi, 4
add eax, 2
dec ecx
jne 0x100af51b
xor eax, eax
mov esi, dword [esp]
lea esp, [esp + 4]
pop edi
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
dec ebx
and ebx, dword [esp]
or ebx, dword [esp]
add esp, 4
leave
ret 8
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x100af54d
cmp eax, ecx
ja 0x100af54d
xor esi, esi
sub esi, eax
dec esi
not esi
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
cmp al, 0x2e
jne 0x100af5ac
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1009fcd8
push edi
push 0x50b70ff2
call fcn.100af03a
jmp 0x100af54d
Function at 0x4bd150
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
call fcn.004bf4b0
test al, al
je 0x4bd197
mov esi, dword [fcn.004bf070]
push 2
call esi
add esp, 4
push ebp
push ebx
push edi
push str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0x__n
push eax
call fcn.004c3d30
add esp, 0x14
push 2
call esi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004bf5a0

Function at 0x4beef0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x4bef01
jmp dword [eax*4 + 0x4ed9d4]
cmp dword [0x4f6364], 0
je 0x4bf010
push 0x4f6368
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4f6380]
test edi, edi
je 0x4bf005
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4bef4b
mov edi, dword [edi + 8]
test edi, edi
je 0x4bf005
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x4bef40
test esi, esi
je 0x4bef40
mov ecx, dword [edi + 4]
call dword [0x4f3688]
push esi
call ecx
add esp, 4
jmp 0x4bef40
call fcn.004bbe80
jmp case.default.0x4bef01
cmp dword [0x4f6364], 0
je case.default.0x4bef01
push 0x4f6368
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4f6380]
test edi, edi
je 0x4beff8
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4befb7
mov edi, dword [edi + 8]
test edi, edi
je 0x4beff8
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x4befb0
test esi, esi
je 0x4befb0
mov ecx, dword [edi + 4]
call dword [0x4f3688]
push esi
call ecx
add esp, 4
jmp 0x4befb0
cmp dword [0x4f6364], 0
jne 0x4befec
push 0x4f6368
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4f6364], 1
jmp case.default.0x4bef01
push 0x4f6368
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.default.0x4bef01
push 0x4f6368
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x4f6364]
cmp eax, 1
jne case.default.0x4bef01
mov eax, dword [0x4f6380]
test eax, eax
je 0x4bf042
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call fcn.004ea142
add esp, 4
mov eax, esi
test esi, esi
jne 0x4bf030
mov dword [0x4f6380], 0
mov dword [0x4f6364], 0
push 0x4f6368
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4bf190
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x4eb004]
xor eax, eax
cmp word [esi], 0x5a4d
jne 0x4bf1f6
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x4bf1f6
add esi, ecx
cmp word [esi + 0x18], 0x10b
jne 0x4bf1f6
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x4bf1f6
mov edx, dword [esp + 0xc]
sub edx, dword [0x4eb004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x4bf1e6
add esi, 0x28
dec ecx
je 0x4bf1f6
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x4bf1e0
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x4bf1e0
mov eax, esi
pop esi
pop edi
ret

Function at 0x4bf3f0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x4f7323], 1
jne 0x4bf40f
test byte [0x4f7322], 1
jne 0x4bf42e
jmp 0x4bf45b
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x4f7323], 1
test eax, eax
setne byte [0x4f7322]
je 0x4bf45b
mov ebx, dword [fcn.004bf070]
push 2
call ebx
add esp, 4
push edi
push esi
push str.libunwind:___unw_init_local_cursor_p__context_p__n
push eax
call fcn.004c3d30
add esp, 0x10
push 2
call ebx
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov dword [esi], 0x4edd2c
mov dword [esi + 4], 0x4f7318
movups xmm0, xmmword [edi]
movups xmm1, xmmword [edi + 0x10]
movups xmmword [esi + 8], xmm0
movups xmmword [esi + 0x18], xmm1
movups xmm0, xmmword [edi + 0x20]
movups xmmword [esi + 0x28], xmm0
movups xmm0, xmmword [edi + 0x30]
movups xmmword [esi + 0x38], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x48], xmm0
movups xmmword [esi + 0x58], xmm0
movups xmmword [esi + 0x62], xmm0
mov ecx, esi
push 0
call fcn.004c0870
xor eax, eax
pop esi
pop edi
pop ebx
ret

Function at 0x4bf4b0
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x4f7323], 1
jne 0x4bf4c3
movzx eax, byte [0x4f7322]
and al, 1
ret
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x4f7322]
mov byte [0x4f7323], 1
and al, 1
ret

Function at 0x4bf4f0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x4f7323], 1
jne 0x4bf514
test byte [0x4f7322], 1
jne 0x4bf533
jmp 0x4bf561
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x4f7323], 1
test eax, eax
setne byte [0x4f7322]
je 0x4bf561
mov edi, dword [fcn.004bf070]
push 2
call edi
add esp, 4
push ebx
push ebp
push esi
push str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
push eax
call fcn.004c3d30
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x4f3688]
mov ecx, esi
push ebp
call edi
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x4bf594
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x4f3688]
mov ecx, esi
push ebp
call edi
mov dword [ebx], eax
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret