joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4b20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x3c
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x54]
lea ebp, [esp + 0x2c]
lea edi, [esp + 0x28]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call esi
sub esp, 0x18
test eax, eax
jne 0x4d4bfa
cmp dword [esp + 0x28], 7
jne 0x4d4bfa
call fcn.004cebd0
mov ebx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp], ebx
add eax, 2
mov dword [esp + 4], eax
call fcn.004cea60
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call esi
sub esp, 0x18
test eax, eax
jne 0x4d4c04
cmp dword [esp + 0x28], 7
jne 0x4d4c04
mov eax, dword [esp + 0x2c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.004ceb00
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.004ceb90
test al, al
jne 0x4d4bd3
lea eax, [ebx + 0xc]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004ccf10
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
xor ebx, ebx
call fcn.004cebf0
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4d4ce0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x12c
mov eax, dword [esp + 0x148]
mov ebx, dword [esp + 0x140]
mov esi, dword [esp + 0x144]
mov ebp, dword [esp + 0x14c]
test al, al
mov edi, eax
jne 0x4d4da0
xor eax, eax
test ebx, ebx
mov dword [esi], 0x4c
je 0x4d4d22
cmp byte [ebx], 0
cmovne eax, ebx
mov dword [esi + 0x2c], eax
mov eax, ebp
mov dword [esp], esi
test al, al
je 0x4d4d83
call dword [sym.imp.COMDLG32.DLL_GetSaveFileNameA]
sub esp, 4
test eax, eax
setne al
mov esi, eax
test ebx, ebx
je 0x4d4d60
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
sub eax, 1
sub esp, 8
cmp eax, 0x102
ja 0x4d4d95
mov eax, edi
test al, al
je 0x4d4d76
lea eax, [esp + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
sub esp, 4
add esp, 0x12c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.COMDLG32.DLL_GetOpenFileNameA]
sub esp, 4
test eax, eax
setne al
mov esi, eax
jmp 0x4d4d3e
mov byte [ebx], 0
jmp 0x4d4d60
lea eax, [esp + 0x1c]
mov dword [esp], 0x104
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
sub eax, 1
sub esp, 8
cmp eax, 0x102
setbe al
mov edi, eax
jmp 0x4d4d10
Function at 0x4d4e20
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push ebx
sub esp, 0x14
movzx ebx, byte [0x5221a0]
test bl, bl
je 0x4d4e40
movzx ebx, byte [0x522198]
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
mov dword [esp], str.advapi32.dll
mov byte [0x5221a0], 1
call fcn.004d4420
test eax, eax
mov dword [0x52219c], eax
je 0x4d4f6c
mov dword [esp + 4], str.GetSecurityInfo
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
sub esp, 8
test eax, eax
mov dword [0x5226fc], eax
je 0x4d4f6c
mov eax, dword [0x52219c]
test eax, eax
je 0x4d4f80
mov dword [esp + 4], str.SetSecurityInfo
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
mov dword [0x522700], eax
je 0x4d4f6c
mov eax, dword [0x52219c]
test eax, eax
je 0x4d4fa0
mov dword [esp + 4], str.OpenProcessToken
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
mov dword [0x5226ec], eax
je 0x4d4f6c
mov eax, dword [0x52219c]
test eax, eax
je 0x4d4f90
mov dword [esp + 4], str.GetTokenInformation
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
mov dword [0x5226f8], eax
je 0x4d4f6c
mov eax, dword [0x52219c]
test eax, eax
je 0x4d4fb0
mov dword [esp + 4], str.InitializeSecurityDescriptor
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
mov dword [0x5226f4], eax
je 0x4d4f6c
mov eax, dword [0x52219c]
test eax, eax
je 0x4d4fc0
mov dword [esp + 4], str.SetSecurityDescriptorOwner
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
mov dword [0x5226f0], eax
je 0x4d4f6c
mov eax, dword [0x52219c]
test eax, eax
je 0x4d4fd0
mov dword [esp + 4], str.SetEntriesInAclA
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
mov dword [0x5226e8], eax
setne bl
mov byte [0x522198], bl
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
mov dword [0x522700], 0
jmp 0x4d4f6c
mov dword [0x5226f8], 0
jmp 0x4d4f6c
mov dword [0x5226ec], 0
jmp 0x4d4f6c
mov dword [0x5226f4], 0
jmp 0x4d4f6c
mov dword [0x5226f0], 0
jmp 0x4d4f6c
mov dword [0x5226e8], 0
jmp 0x4d4f6c
Function at 0x4d7360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x68]
mov edi, dword [esp + 0x6c]
mov ebx, dword [esp + 0x70]
call fcn.004d72d0
test eax, eax
je 0x4d7560
test edi, edi
mov ebp, eax
js 0x4d7540
mov dword [esp + 0x20], ebx
mov ecx, 0
je 0x4d7409
lea eax, [esi + edi*2]
mov dword [esp + 0x24], eax
jmp 0x4d73c2
cmp dword [esp + 0x74], ecx
jle 0x4d74b0
lea eax, [ebx + 1]
mov byte [ebx], dl
mov ecx, eax
sub ecx, dword [esp + 0x20]
mov ebx, eax
add esi, 2
cmp dword [esp + 0x24], esi
je 0x4d7409
movzx eax, word [esi]
mov edx, dword [ebp + 4]
movzx ecx, ah
mov edx, dword [edx + ecx*4]
mov ecx, ebx
sub ecx, dword [esp + 0x20]
test edx, edx
je 0x4d73e3
movzx edi, al
movzx edx, byte [edx + edi]
test dl, dl
jne 0x4d73a2
cmp ax, 0x7f
ja 0x4d7413
cmp dword [esp + 0x74], ecx
jle 0x4d74e0
lea edx, [ebx + 1]
add esi, 2
mov byte [ebx], al
mov ecx, edx
sub ecx, dword [esp + 0x20]
cmp dword [esp + 0x24], esi
mov ebx, edx
jne 0x4d73c2
add esp, 0x4c
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x78]
test eax, eax
je 0x4d7495
mov eax, dword [esp + 0x78]
cmp byte [eax], 0
je 0x4d73b9
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], esi
mov ebp, ebx
mov esi, eax
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x74]
jmp 0x4d7451
movzx ecx, byte [esi]
add ebp, 1
add esi, 1
mov byte [ebp - 1], cl
cmp byte [esi], 0
je 0x4d7480
mov ecx, ebp
sub ecx, edi
cmp ecx, ebx
jl 0x4d7440
mov dword [esp + 8], 0x504
mov dword [esp + 4], str._MoTTY_windows_unicode.c
mov dword [esp], str.p___mbstr___mblen
call fcn.004d8b40
jmp 0x4d7440
mov ebx, ebp
mov esi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov ecx, ebx
sub ecx, dword [esp + 0x20]
jmp 0x4d73b9
cmp dword [esp + 0x74], ecx
jle 0x4d7510
lea eax, [ebx + 1]
mov byte [ebx], 0x2e
mov ecx, eax
mov ebx, eax
sub ecx, dword [esp + 0x20]
jmp 0x4d73b9
mov dword [esp + 8], 0x4ff
mov dword [esp + 4], str._MoTTY_windows_unicode.c
mov dword [esp], str.p___mbstr___mblen
mov byte [esp + 0x28], dl
call fcn.004d8b40
movzx edx, byte [esp + 0x28]
jmp 0x4d73ac
mov dword [esp + 8], 0x501
mov dword [esp + 4], str._MoTTY_windows_unicode.c
mov dword [esp], str.p___mbstr___mblen
mov dword [esp + 0x28], eax
call fcn.004d8b40
mov eax, dword [esp + 0x28]
jmp 0x4d73f3
mov dword [esp + 8], 0x507
mov dword [esp + 4], str._MoTTY_windows_unicode.c
mov dword [esp], str.p___mbstr___mblen
call fcn.004d8b40
lea eax, [ebx + 1]
mov byte [ebx], 0x2e
mov ecx, eax
mov ebx, eax
sub ecx, dword [esp + 0x20]
jmp 0x4d73b9
xor edi, edi
add edi, 1
cmp word [esi + edi*2 - 2], 0
jne 0x4d7542
mov dword [esp + 0x20], ebx
jmp 0x4d7399
lea eax, [esp + 0x3c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov ecx, eax
add esp, 0x4c
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4d75e0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x522204]
test eax, eax
je 0x4d75f0
repz ret
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x4d7636
mov dword [esp + 0xc], eax
mov eax, dword [0x522204]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 8], 1
mov dword [esp + 4], 0x522200
mov dword [esp], eax
call fcn.004cd6f0
mov dword [0x522204], eax
mov edx, dword [0x522200]
mov dword [esp], eax
mov dword [esp + 4], edx
call ebx
sub esp, 8
cmp dword [0x522200], eax
jbe 0x4d7600
mov eax, dword [0x522204]
add esp, 0x28
pop ebx
ret

Function at 0x4d7b60
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x52256c]
test esi, esi
jle 0x4d7c70
mov edi, dword [0x522570]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x4d7b94
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x4d7c15
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x4d7b80
mov dword [esp], eax
mov ebx, eax
call fcn.004d83a0
test eax, eax
mov edi, eax
je 0x4d7c97
mov eax, dword [0x522570]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004d84a0
add eax, dword [edi + 0xc]
mov edx, dword [0x522570]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4d7c77
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4d7c0e
sub eax, 4
and eax, 0xfffffffb
jne 0x4d7c20
add dword [0x52256c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x522570]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4d7c0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004de7d0
lea esi, [esi]
xor esi, esi
jmp 0x4d7b9e
mov eax, dword [0x522570]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004de7d0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004de7d0
mov esi, esi
lea edi, [edi]
Function at 0x4d8020
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x522590
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x522588]
sub esp, 4
test ebx, ebx
je 0x4d8075
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4d806e
test esi, esi
je 0x4d806e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4d8050
mov dword [esp], 0x522590
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4da0c0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x4df1ac], eax
je 0x4da0d7
add esp, 0xc
ret
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4da5d0
Capabilities:
Print debug messages

Disassembly:
test eax, eax
je 0x4da600
push edi
push esi
push ebx
mov ebx, eax
add esp, 0xffffff80
mov dword [esp], eax
call fcn.004dd470
cmp eax, 1
je 0x4da602
mov dword [ebx], 0xffffffff
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
ret
repz ret
lea ebx, [esp + 0x15]
mov esi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
xor eax, eax
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x3d]
mov ecx, 0x43
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
mov eax, 0x27
jne 0x4da655
jmp 0x4da672
cmp eax, 0x6a
je 0x4da663
add eax, 1
cmp byte [ebx + eax], 0
jne 0x4da650
cmp eax, 0x6a
jne 0x4da672
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sub.msvcrt.dll_abort
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + eax + 0x16], 0
jmp 0x4da663
Function at 0x4da710
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [0x522608], 1
je 0x4da725
call fcn.004da680
mov eax, dword [0x4df1ac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x4da750
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004da520
mov esi, eax
mov eax, dword [entry3]
test eax, eax
je 0x4da73c
test esi, esi
je 0x4da73c
mov dword [esi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x18], eax
lea eax, [esi + 0x38]
sub esp, 0x10
mov dword [esi + 0x1c], 0xffffffff
call fcn.004da5d0
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esi + 0x64], 0
mov dword [esi + 0x14], 0
call ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call ebx
lea edx, [esi + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebp
mov dword [esp + 0xc], edx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x4da852
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x6c], eax
movzx eax, byte [esi + 0x20]
sub esp, 4
mov dword [esi + 0x68], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [esi + 0x20], al
mov eax, dword [0x4df1ac]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x4da852
add esp, 0x2c
mov ebx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll_abort
mov esi, esi
lea edi, [edi]
Function at 0x4da990
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4da9c0
mov edi, dword [esp + 0x28]
test edi, edi
je 0x4daa61
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x4daa90
cmp eax, 3
jne 0x4da9aa
mov eax, dword [0x4df1ac]
cmp eax, 0xffffffff
je 0x4da9aa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x4da9aa
test byte [eax + 0x20], 0x30
je 0x4daab2
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x4dabb4
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4daa34
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x4daa26
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.004d9e30
lea eax, [ebx + 0x38]
call fcn.004da5d0
mov esi, dword [ebx + 0xb0]
test esi, esi
jne 0x4dab39
mov eax, ebx
call fcn.004da2c0
jmp 0x4dab39
mov eax, dword [0x5225e4]
test eax, eax
je 0x4da9aa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x5225e4], 0
sub esp, 4
jmp 0x4da9aa
mov dword [esp + 4], 0x4d9fe0
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x5225e4], eax
jmp 0x4da9aa
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x4dab60
test eax, eax
je 0x4daad0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
jne 0x4dab90
test byte [ebx + 0x24], 4
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
je 0x4daba0
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x4dab15
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call fcn.004d9e30
mov eax, esi
call fcn.004da5d0
mov ecx, dword [ebx + 0xb0]
test ecx, ecx
je 0x4daa55
mov eax, dword [0x4df1ac]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x4da9aa
test eax, eax
je 0x4dab70
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.004d9e30
lea eax, [ebx + 0x38]
call fcn.004da5d0
jmp 0x4da9aa
call fcn.004da8a0
jmp 0x4daaec
mov dword [esp], edi
call fcn.004d9e30
mov eax, esi
call fcn.004da5d0
jmp 0x4da9aa
call fcn.004da8a0
jmp 0x4daa02
Function at 0x4db530
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.004da710
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x4db5b2
test byte [ebx + 0x20], 0x30
jne 0x4db566
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_longjmp
mov eax, dword [0x4df1ac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
push edx
mov ebx, eax
je 0x4db5a9
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x4db5f6
test eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x68], 1
je 0x4db59c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x4db5b9
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call fcn.004da8a0
jmp 0x4db54d
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x14], 0
je 0x4db61d
mov eax, dword [0x4df1ac]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x4db5a9
test eax, eax
mov dword [ebx], 0xdeadbeef
je 0x4db60a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jne 0x4db5dc
mov eax, ebx
call fcn.004da2c0
jmp 0x4db5dc

Function at 0x4de7d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004d9830
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004d9830
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
pop ebp
jmp fcn.004014e0
Function at 0x10001010
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
jmp 0x10001158
call 0x10001025
mov dword [esp], ebx
push 0xd62cdba6
add esp, 4
push 0xfbb0080c
add esp, 4
push esi
push 0x58997e11
add esp, 4
push 0x69ade5fd
add esp, 4
push edi
sub esp, 4
mov dword [esp], 0xd3c8bad0
add esp, 4
xor edx, edx
mov esi, dword fs:[edx + 0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0xc]
lodsd eax, dword [esi]
mov esi, dword [eax]
mov edi, dword [esi + 0x18]
mov ebx, dword [edi + 0x3c]
mov ebx, dword [edi + ebx + 0x78]
mov esi, dword [edi + ebx + 0x20]
add esi, edi
mov ecx, dword [edi + ebx + 0x24]
add ecx, edi
sub esp, 4
mov dword [esp], 0x8c4f2d7
add esp, 4
call 0x1000108e
mov dword [esp], ebp
movzx ebp, word [ecx + edx*2]
inc edx
lodsd eax, dword [esi]
cmp dword [edi + eax], 0x74726956
jne 0x10001091
cmp dword [edi + eax + 9], 0x636f6c
jne 0x10001091
mov esi, dword [edi + ebx + 0x1c]
add esi, edi
add edi, dword [esi + ebp*4]
xchg dword [esp], ebp
add esp, 4
sub esp, 4
mov dword [esp], 0x70ca2852
add esp, 4
push eax
mov eax, 0x40
xchg dword [esp], eax
sub esp, 4
mov dword [esp], 0x641310a5
add esp, 4
mov dword [esp - 4], 0x3000
sub esp, 4
call 0x100010ec
mov dword [esp], 0x1364b0
mov eax, eax
push 0x4c0ac8a0
add esp, 4
push 0
push ecx
add esp, 4
push 0x6628cb7
add esp, 4
call 0x10001110
xchg dword [esp], eax
add eax, 0xb
xchg dword [esp], eax
jmp edi
push ebx
push 0xdcfbc9f7
add esp, 4
nop
call 0x10001167
mov dword [esp], esi
mov eax, eax
sub esp, 4
mov dword [esp], edi
push 0xb9b3e0f9
add esp, 4
nop
mov ecx, 0x989680
fadd st(5)
push 0x815fdb2b
add esp, 4
mov eax, 0x8e6bb8d9
push ecx
add esp, 4
inc dword [0x1013e4b0]
sub esp, 4
mov dword [esp], 0xc5ee22bc
add esp, 4
push 0xb133e804
add esp, 4
dec ecx
push 0xe1afc428
add esp, 4
test ecx, ecx
jne 0x10001180
cmp dword [0x1013e4b0], 0x989680
jne 0x100012ee
push 0x8a2036fd
add esp, 4
call 0x100011d8
add dword [esp], 9
jmp 0x10001020
sub esp, 4
mov dword [esp], 0xfce2a953
add esp, 4
add esp, 4
mov edi, dword [esp - 4]
push ecx
add esp, 4
add esp, 4
mov esi, dword [esp - 4]
nop
nop
add esp, 4
mov ebx, dword [esp - 4]
push ecx
add esp, 4
ret
Function at 0x100129b4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100129e1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100129df
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
jmp 0x100129fb
push 0x1b8c
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x1001a251
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001a281
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001a27f
push 0xb13
call dword [sym.imp.USER32.dll_GetKeyboardType]
jmp 0x1001a29b
push 0x1b8c
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x10026ac8
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10026b02
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
movzx eax, word [eax]
and eax, 0xfff
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x10026b2a
push 0
push 0x2385
push 0x417
push 0x39d
push 0x1c76
push 0x189f
push 0x24ff
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov esp, ebp
pop ebp
ret

Function at 0x10029460
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100294ab
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0x14
jmp 0x10029490
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x10
jle 0x100294a9
mov dword [ebp - 0xc], 0xfffffff6
cmp dword [ebp - 0xc], 0
je 0x100294a7
jmp 0x100294a9
jmp 0x10029485
jmp 0x100294c5
push 0x1b8c
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret