joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462660
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x530f98]
xor ecx, ebp
mov dword [ebp - 0xc], ecx
cmp eax, 3
jne 0x46276c
mov eax, dword [0x534640]
cmp eax, 1
je 0x4626f1
mov esi, 2
mov edi, dword [sym.imp.KERNEL32.dll_SwitchToThread]
xor eax, eax
lock cmpxchg dword [0x534640], esi
cmp eax, 2
jne 0x4626a7
call edi
jmp 0x462694
cmp eax, 1
je 0x4626f1
test eax, eax
jne 0x46277f
push 0x400
push 0x53464c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov esi, 1
mov ecx, 1
test eax, eax
je 0x4626e5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x534648], eax
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [0x534644], ecx
xchg dword [0x534640], esi
cmp dword [0x534644], 0
jne 0x46276c
push dword [0x534648]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46276c
mov esi, eax
push 0x53464c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x53466c]
mov dword [ebp - 0x10], eax
movsd xmm0, qword [0x534664]
movsd qword [ebp - 0x18], xmm0
push 0x53464c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x462745
push dword [esi]
call eax
add esp, 4
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x462754
push dword [esi + 4]
call eax
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x462763
push dword [esi + 8]
call eax
add esp, 4
push esi
call fcn.0044c180
add esp, 4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004af401
add esp, 0x10
pop esi
pop edi
pop ebp
ret 0xc
call fcn.004c9a66
int3
Function at 0x4725e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x530f98]
xor eax, ebp
mov dword [esp + 0x18], eax
mov edi, dword [ecx + 0x38]
test edi, edi
jne 0x472683
mov esi, ecx
mov dword [esp + 0x10], 0
mov byte [esp + 0x13], 9
mov dword [esp + 0xc], 0x65647261
mov dword [esp + 8], 0x63736964
mov word [esp + 0x10], 0x64
push 0x40
call fcn.004af396
add esp, 4
mov ebx, eax
lea eax, [esp + 8]
mov edi, esp
mov ecx, esi
push eax
push edi
call fcn.004724f0
mov ecx, ebx
push edi
push dword [esi + 0x28]
lea eax, [esp + 0x10]
push eax
call fcn.00472a30
mov edi, dword [esi + 0x38]
mov dword [esi + 0x38], ebx
test edi, edi
je 0x47266d
mov ecx, edi
call fcn.00472a80
push edi
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x13], 0
jns 0x472680
push dword [esp + 8]
call fcn.004af3c6
add esp, 4
mov edi, dword [esi + 0x38]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.004af401
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4731e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, ecx
mov eax, dword [0x530f98]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x24], edx
push edx
push ecx
push edi
call fcn.0043a340
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x47320f
mov edi, dword [ebp - 0x1c]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
jns 0x47322d
push dword [ebp - 0x1c]
call fcn.004af3c6
add esp, 4
cmp dword [ebp + 8], 0
je 0x47330c
test esi, esi
je 0x47330c
mov dword [ebp - 0x20], esi
add esi, esi
mov ecx, 0xffffffff
cmovae ecx, esi
push ecx
call fcn.004af3f3
add esp, 4
mov edi, eax
lea esi, [ebp - 0x1c]
push dword [ebp - 0x24]
push ebx
push esi
call fcn.0043a340
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x473270
mov esi, dword [ebp - 0x1c]
push dword [ebp - 0x20]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x47328c
push dword [ebp - 0x1c]
call fcn.004af3c6
add esp, 4
cmp word [edi], 0
mov esi, dword [ebp + 8]
je 0x4732af
xor ecx, ecx
nop word [eax + eax]
lea eax, [ecx + 1]
cmp word [edi + ecx*2 + 2], 0
mov ecx, eax
jne 0x4732a0
jmp 0x4732b1
xor eax, eax
lea ecx, [ebp - 0x1c]
push eax
push edi
push ecx
call fcn.0043a7c0
add esp, 0xc
cmp byte [esi + 0xb], 0
js 0x4732ce
mov byte [esi], 0
mov byte [esi + 0xb], 0
jmp 0x4732f1
mov eax, dword [esi]
mov byte [eax], 0
mov dword [esi + 4], 0
cmp byte [esi + 0xb], 0
jns 0x4732f1
push dword [esi]
call fcn.004af3c6
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [esi + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [esi], xmm0
push edi
call fcn.004af3fc
add esp, 4
mov esi, dword [ebp - 0x20]
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af401
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47acf0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + 0x3c]
movzx edx, word [ecx + eax + 6]
test edx, edx
je 0x47ad3d
add eax, ecx
movzx esi, word [eax + 0x14]
lea edi, [eax + esi]
add edi, 0x18
xor ebx, ebx
xor esi, esi
test edi, edi
je 0x47ad3d
mov eax, dword [edi + ebx + 0xc]
test eax, eax
je 0x47ad2a
add eax, ecx
cmp eax, dword [ebp + 8]
jbe 0x47ad2c
jmp 0x47ad35
xor eax, eax
add eax, dword [edi + ebx + 8]
cmp eax, dword [ebp + 8]
ja 0x47ad46
inc esi
add ebx, 0x28
cmp esi, edx
jb 0x47ad15
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
add edi, ebx
mov eax, edi
jmp 0x47ad3f

Function at 0x47adea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x47aecc
mov ebx, ecx
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx + 0x74], 0
je 0x47aecc
cmp word [eax + edx + 0x14], 0x68
jb 0x47aecc
mov esi, dword [ebx]
mov ecx, ebx
push dword [eax + edx + 0x78]
call dword [esi + 4]
test eax, eax
je 0x47aecc
mov esi, eax
mov eax, dword [ebp + 8]
cmp eax, 0xffff
ja 0x47ae44
mov word [edi], ax
jmp 0x47aef9
mov eax, dword [ebx]
mov ecx, ebx
push dword [esi + 0x20]
call dword [eax + 4]
mov edx, eax
mov eax, dword [esi + 0x18]
lea ecx, [eax*4]
test ecx, ecx
je 0x47aecc
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], ebx
lea edi, [edx + eax*4]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], edx
mov ebx, edx
mov eax, edi
sub eax, ebx
mov ecx, eax
sar ecx, 2
shr eax, 0x1f
add eax, ecx
and eax, 0xfffffffe
lea esi, [ebx + eax*2]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
push dword [esi]
call dword [eax + 4]
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x47aea9
mov edx, dword [ebp - 0x1c]
cmp cl, byte [eax]
jne 0x47aeab
inc eax
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x47ae9d
xor ecx, ecx
movzx ecx, cl
movzx eax, byte [eax]
mov edx, ecx
sub edx, eax
test edx, edx
lea edx, [esi + 4]
cmovg ebx, edx
cmovle edi, esi
cmp ecx, eax
je 0x47aed8
xor eax, eax
cmp ebx, edi
jne 0x47ae73
jmp 0x47aece
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
mov edi, dword [ebp - 0x18]
push dword [edi + 0x24]
call dword [eax + 4]
sub esi, dword [ebp - 0x14]
sar esi, 1
movzx eax, word [eax + esi]
add ax, word [edi + 0x10]
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
mov al, 1
jmp 0x47aece
Function at 0x47d902
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [0x530f98]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0x38], 0
je 0x47da14
mov esi, ecx
lea edx, [ecx + 0x30]
lea eax, [ebp - 0x58]
lea edi, [ebp - 0x5c]
mov ecx, edi
push eax
push 2
call fcn.0047da3b
add esp, 8
mov edx, dword [edi]
test edx, edx
je 0x47da1b
mov dword [ebp - 0x64], esi
cmp dword [edx], 0
je 0x47da00
mov eax, dword [ebp - 0x64]
add eax, 0x18
mov dword [ebp - 0x6c], eax
xor eax, eax
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x60], eax
test dword [edx + eax*8 + 8], 0xc0000020
jne 0x47d9f4
cmp dword [ebp + 8], 0
je 0x47d9b8
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [eax + 4], ecx
je 0x47d9b8
xor ebx, ebx
xor edi, edi
mov eax, dword [ebp - 0x60]
mov esi, dword [edx + eax*8 + 4]
add ecx, ebx
call fcn.0047e566
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov edx, dword [ebp - 0x68]
test eax, eax
jne 0x47d9f4
inc edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 2
imul eax, eax, 0xf0f0f0f1
add ebx, 0x44
cmp edi, eax
jb 0x47d980
lea ebx, [ebp - 0x54]
mov ecx, ebx
mov eax, dword [ebp - 0x60]
push dword [edx + eax*8 + 4]
call fcn.0047e204
mov esi, dword [ebp - 0x64]
mov edi, dword [esi + 0x1c]
cmp edi, dword [esi + 0x20]
jae 0x47d9e8
push 0x44
push ebx
push edi
call fcn.004b80c0
add esp, 0xc
add edi, 0x44
mov dword [esi + 0x1c], edi
jmp 0x47d9f1
mov ecx, dword [ebp - 0x6c]
push ebx
call fcn.004743ec
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x60]
inc eax
cmp eax, dword [edx]
jb 0x47d95b
mov dword [ebp - 0x5c], 0
push edx
call fcn.004af3fc
add esp, 4
xor esi, esi
jmp 0x47da25
mov esi, 0x3f0
jmp 0x47da25
mov esi, dword [ebp - 0x58]
mov dword [ebp - 0x5c], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af401
mov eax, esi
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x481aea
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
call fcn.00458730
test al, al
je 0x481b0e
push 0x32
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea edi, [esi + 0x20]
mov ecx, edi
push 0
call fcn.00481b70
mov eax, dword [esi + 0x30]
test eax, eax
je 0x481b2d
mov dword [esi + 0x34], eax
push eax
call fcn.004af3c6
add esp, 4
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x2c], 0
test eax, eax
je 0x481b44
push eax
call fcn.00443fc0
add esp, 4
mov ecx, edi
push 0
call fcn.00481b70
lea ecx, [esi + 0x18]
call fcn.0040f796
lea ecx, [esi + 0x14]
call fcn.0040f796
lea ecx, [esi + 0x10]
call fcn.0040f796
mov ecx, esi
pop esi
pop edi
pop ebp
jmp fcn.00458690
Function at 0x4886a2
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0x2c]
mov eax, dword [ebp + 8]
mov ecx, dword [0x530f98]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov dword [edx], 0xffffffff
cmp eax, 3
jne 0x488722
mov edx, dword [ebp + 0x28]
mov esi, dword [ebp + 0x10]
cmp byte [esi + 0xb], 0
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
jns 0x4886e1
mov esi, dword [esi]
mov ebx, dword [ebx]
push 0
push edx
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
je 0x488733
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
lea ecx, [ebp - 0x14]
push 3
push edi
push edi
push ecx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb edi, edi
lea eax, [ebp - 0x14]
or edi, dword [eax]
jmp 0x488736
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af401
mov eax, 5
jmp 0x488752
xor edi, edi
dec edi
mov eax, dword [ebp + 0x2c]
mov dword [eax], edi
xor eax, eax
cmp edi, 0xffffffff
sete al
lea esi, [eax + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af401
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x488a50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov ecx, dword [ebp + 8]
mov eax, dword [0x530f98]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ecx - 5]
mov edi, 5
cmp eax, 1
ja 0x488b93
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
movups xmmword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x54], 0x44
cmp byte [eax + 0xb], 0
jns 0x488a9f
mov eax, dword [eax]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004cc59d
add esp, 4
movzx edx, byte [edi + 0xb]
test dl, dl
jns 0x488ab8
mov edx, dword [edi + 4]
mov edi, dword [edi]
mov ebx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
test edx, edx
cmove edi, edx
cmp byte [esi + 0xb], 0
jns 0x488acb
mov esi, dword [esi]
mov ecx, dword [ecx]
mov dword [ebp - 0x5c], ecx
sub esp, 0x28
mov dword [esp + 0x24], ebx
lea ecx, [ebp - 0x54]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edi
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [ebp - 0x58], eax
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, 5
test eax, eax
je 0x488b83
mov eax, dword [ebp + 8]
cmp eax, 6
mov eax, 0x1fffff
mov esi, 0x101c01
cmove esi, eax
mov eax, dword [ebx]
mov dword [ebp - 0x60], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push 0
push esi
push ebx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x488b7a
cmp dword [ebp + 8], 6
mov esi, 0x100c43
mov eax, 0x1fffff
cmove esi, eax
mov edi, dword [ebx + 4]
add ebx, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push 0
push esi
push ebx
push dword [ebp - 0x5c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea edi, [ecx + ecx*4]
jmp 0x488b83
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x488b93
push eax
call fcn.00443fc0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af401
mov eax, edi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x488ba8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x20]
mov ebx, dword [ebp + 8]
movups xmm0, xmmword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
xor edx, edx
mov dword [edi], edx
mov ecx, dword [ebx]
sub esp, 0x1c
mov dword [esp + 0x18], eax
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edx
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x488c07
mov esi, eax
mov ebx, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 3
xor ecx, ecx
push ecx
push ecx
push edi
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [ecx + ecx*4]
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x48b088
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov ebx, ecx
mov al, byte [ebp + 8]
mov ecx, dword [0x530f98]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
test al, al
je 0x48b0d8
xor esi, esi
inc esi
mov edi, 0x4f4c12
mov ecx, ebx
push 0
push 0x48fbf0
push esi
push str.NtMapViewOfSection
push edi
call fcn.0048ac1e
mov ecx, ebx
push esi
push 0x48fdd0
push esi
push str.NtUnmapViewOfSection
push edi
call fcn.0048ac1e
jmp 0x48b0e2
cmp dword [ebx + 0xc], 0
je 0x48b1dc
mov eax, dword [ebx]
mov edi, dword [eax]
sub esp, 0x14
movaps xmm0, xmmword [0x4f4bf0]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov esi, dword [ebx + 0xc]
shl esi, 6
lea eax, [esi + 0x50]
mov dword [ebp - 0x70], eax
push eax
call fcn.0048aaf4
add esp, 4
mov dword [ebp - 0x74], ebx
mov ebx, eax
mov eax, 0xfffff000
mov ecx, ebx
and ecx, eax
add ecx, dword [ebp - 0x6c]
add esi, 0x104f
and esi, eax
push 0x40
push 0x1000
push esi
push ecx
mov dword [ebp - 0x6c], edi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test eax, eax
je 0x48b1f4
mov edi, eax
and ebx, 0xfff
add edi, ebx
lea esi, [ebp - 0x60]
mov ebx, dword [ebp - 0x70]
mov dword [esi], ebx
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x10
push 0xa8
push eax
push 0x534cbc
call fcn.004b8bc0
add esp, 0xc
mov ecx, dword [ebp - 0x74]
push esi
push ebx
push edi
call fcn.0048b41a
mov ebx, eax
test eax, eax
jne 0x48b1de
lea eax, [ebp - 0x64]
push eax
push 0x10
push esi
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, 0x2a
test eax, eax
je 0x48b1de
cmp dword [ebp - 0x64], 0x10
jne 0x48b1de
lea eax, [ebp - 0x68]
push eax
push 0x20
push dword [ebp - 0x70]
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push 0xa8
push 0x534cbc
push str.g_originals
call fcn.00481f1a
mov ebx, eax
jmp 0x48b1de
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af401
mov eax, ebx
add esp, 0x68
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3
Function at 0x4903f2
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x208
mov esi, ecx
mov eax, dword [0x530f98]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 1
jne 0x4904a6
mov edi, 0x200
xor ebx, ebx
push 0xffffffffffffffff
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
je 0x4904a8
cmp eax, 0x102
je 0x4904a8
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
je 0x4904a6
mov eax, dword [esi]
lea ecx, [ebp - 0x214]
push ecx
push edi
lea ecx, [ebp - 0x210]
push ecx
push dword [esi + 4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
setne al
cmp dword [ebp - 0x214], edi
sete bl
and bl, al
cmp bl, 1
jne 0x49048b
mov eax, dword [esi]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
test eax, eax
jne 0x4904a6
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
setne cl
not bl
test bl, cl
jne 0x490423
test eax, eax
setne bl
jmp 0x4904a8
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af401
mov eax, ebx
add esp, 0x208
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x494e1c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
xor ebx, ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
sub esp, 0x18
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edx
movaps xmm0, xmmword [0x4f31a0]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, esi
push eax
call fcn.0040f75a
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x494e6a
push edi
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4b2e5c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4b2eab
mov esi, dword [ebp + 0x18]
lea eax, [ebp + 0x10]
push edi
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b2eab
cmp esi, dword [ebp + 0x10]
je 0x4b2ea6
push 0x4eecd8
push 1
push edi
push edi
call fcn.004b1d5d
jmp 0x4b2eb9
xor eax, eax
inc eax
jmp 0x4b2ebe
mov eax, 0x4eecd8
push eax
push eax
push edi
push edi
call fcn.004b1d40
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x4b309e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4b30c8
mov eax, 0x4eecd8
push eax
push eax
push 0
push 0
call fcn.004b1d40
add esp, 0x10
xor eax, eax
pop ebp
ret
xor eax, eax
inc eax
pop ebp
ret
Function at 0x4b40ad
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x4b4b1c
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x4b532f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebx]
add ecx, 8
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x5a8]
mov dword [ecx + 0x5b0], eax
call fcn.004b5654
mov edi, eax
test edi, edi
je 0x4b53ba
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jne 0x4b536a
mov esi, edi
jmp 0x4b53a6
push dword [edi]
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x4b539f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4b5392
mov ecx, dword [ebx]
push edi
add ecx, 8
call fcn.004b561f
jmp 0x4b53a6
push 0x4f5038
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4b53a6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx]
add ecx, 8
call fcn.004b5654
mov edi, eax
test edi, edi
jne 0x4b535f
test esi, esi
jne 0x4b53cf
mov ecx, dword [ebx]
add ecx, 8
call fcn.004b5570
mov esi, eax
test esi, esi
je 0x4b53cf
mov eax, dword [ebp - 4]
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4b53d6
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x4e25bb
call fcn.004b16aa
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [esi], 0
lea ecx, [esi + 8]
or dword [esi + 4], 0xffffffff
call fcn.004b5537
and dword [ebp - 4], 0
and dword [esi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4b5422
mov eax, dword [ebp + 8]
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004b1786
ret 4
push 0x52e614
lea eax, [ebp + 8]
mov dword [ebp + 8], 2
push eax
call fcn.004b65dc
int3

Function at 0x4d89f7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d8c40

Function at 0x4dcd7e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004dcd89