joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47eb20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4aa030
mov dword [ebp - 0x28], ecx
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x30], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jae 0x47ebb0
jmp 0x47eb9e
jbe 0x47ec3c
cmp esi, 0x201
jae 0x47ebb0
mov dword [ebp - 0x2c], 0x200
lea ebx, [ebp - 0x44c]
mov edi, esi
jmp 0x47ebeb
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x47ebdc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
mov edx, edi
push esi
call fcn.004cb130
add esp, 4
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x47ec0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x47ec74
cmp esi, edi
jne 0x47eb90
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x47ecaf
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x47eb9e
jmp 0x47ebb0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
cmp esi, edx
ja 0x47eccf
lea ecx, [ebp - 0x4c]
mov edx, ebx
push esi
call fcn.0047f3b0
add esp, 4
movsd xmm0, qword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
movsd xmm1, qword [ebp - 0x44]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
jmp 0x47ec87
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x28]
mov byte [ecx], 0
mov dword [ecx + 4], eax
mov byte [ecx + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x47ec9b
mov ecx, dword [ebp - 0x24]
mov edx, 2
call fcn.00425c30
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, str.internal_error:_entered_unreachable_codeC:UsersAdministrator.WIN7_2021OVWRCZ.cargo_registry_srcmirrors.ustc.edu.cn_12df342d903acd47webpki_0.22.0_srccalendar.rs
mov edx, 0x28
push 0x4ebc3c
call fcn.004c88c0
add esp, 4
jmp 0x47ecde
mov ecx, esi
push 0x4ebc2c
call fcn.004c8850
add esp, 4
ud2
Function at 0x485540
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x48558d
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x48559d
mov dword [esi + 4], 0
jmp 0x4855af
cmp eax, 0x103
je 0x4855c7
test eax, eax
js 0x4855b8
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x4855b2
mov eax, esp
mov dword [esp + 0x1c], 0x4eb388
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0047ad20
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0047ae70
mov ecx, 7
int 0x29
ud2

Function at 0x489170
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x53c0e0]
test eax, eax
je 0x489228
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x48919c
cmp dword [eax + 4], 0
mov edi, eax
je 0x48919c
add edi, 8
jmp 0x489223
mov eax, dword [0x53c0e0]
test eax, eax
je 0x489237
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x489221
mov esi, eax
test eax, eax
jne 0x4891f7
movzx eax, byte [0x53cbf0]
mov ecx, 0xc
mov edx, 4
call fcn.00425bd0
test eax, eax
je 0x489252
mov dword [eax], 0x53c0e0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x53c0e0]
test eax, eax
je 0x489246
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x489223
test ecx, ecx
je 0x489223
lock dec dword [ecx]
jne 0x489223
call fcn.00489270
jmp 0x489223
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x53c0e0
call fcn.004cae20
jmp 0x489180
mov ecx, 0x53c0e0
call fcn.004cae20
jmp 0x4891aa
mov ecx, 0x53c0e0
call fcn.004cae20
jmp 0x4891ef
mov ecx, 4
mov edx, 0xc
call fcn.004c8580
ud2
Function at 0x48a7b0
Capabilities:
Create udp socket

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x10]
test dx, dx
mov eax, 2
mov ebx, 0x17
mov esi, ecx
cmove ebx, eax
push 0x81
push 0
push 0
push 0
push edi
push ebx
call sub.WS2_32.dll_WSASocketW
cmp eax, 0xffffffff
je 0x48a7ea
mov dword [esi + 4], eax
mov byte [esi], 4
pop esi
pop edi
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x48a7fe
cmp eax, 0x2739
jne 0x48a827
push 1
push 0
push 0
push 0
push edi
push ebx
call sub.WS2_32.dll_WSASocketW
cmp eax, 0xffffffff
je 0x48a82f
mov edi, eax
push 0
push 1
push eax
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
je 0x48a840
mov dword [esi + 4], edi
jmp 0x48a7e3
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x48a7e6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x48a7e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edx, eax
shr eax, 0x18
mov byte [esi], 0
shr ecx, 8
shl edx, 0x18
mov byte [esi + 7], al
mov dword [esi + 1], edx
mov word [esi + 5], cx
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x48a7e6

Function at 0x48a870
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x28]
xor edi, edi
mov esi, ecx
cmp ebp, 0x3b9aca00
je 0x48a8ce
mov eax, dword [esp + 0x24]
mov ebx, 0x3e8
mov dword [esp], edx
mul ebx
mov edi, eax
mov eax, dword [esp + 0x20]
seto cl
mul ebx
mov ebx, edx
mov dword [esp + 4], eax
add ebx, edi
mov edi, 0xffffffff
setb al
or al, cl
jne 0x48a8cb
mov ecx, 0x431bde83
mov eax, ebp
mul ecx
mov eax, dword [esp + 4]
shr edx, 0x12
add eax, edx
adc ebx, 0
jae 0x48a90f
mov edx, dword [esp]
mov dword [esp + 8], edi
lea eax, [esp + 8]
push 4
push eax
push 0x1005
push 0xffff
push edx
call sub.WS2_32.dll_setsockopt
mov cl, 4
cmp eax, 0xffffffff
jne 0x48a905
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, eax
imul eax, ebp, 0x68c26139
xor ecx, ecx
ror eax, 6
cmp eax, 0x10c7
setae cl
add edx, ecx
mov eax, edx
mov edx, dword [esp]
adc ebx, 0
jb 0x48a8ce
xor edi, edi
neg ebx
sbb edi, edi
or edi, eax
jne 0x48a8ce
mov byte [esi], 2
mov dword [esi + 4], 0x4eb404
jmp 0x48a907

Function at 0x48a950
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x10]
mov esi, ecx
mov eax, dword [ebx + 4]
mov edi, dword [ebx + 8]
mov ecx, eax
sub ecx, edi
jb 0x48a9b4
cmp ecx, 0x7fffffff
mov eax, SysReAllocString
cmovb eax, ecx
mov ecx, dword [ebx]
add ecx, edi
push 0
push eax
push ecx
push edx
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
je 0x48a998
add eax, edi
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 0xc]
cmp ecx, eax
cmova eax, ecx
mov dword [ebx + 0xc], eax
jmp 0x48a9a5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x48a9ac
mov byte [esi], 4
pop esi
pop edi
pop ebx
ret
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x48a9a8
mov ecx, edi
mov edx, eax
push 0x4ea428
call fcn.004c87e0
add esp, 4
ud2
Function at 0x48a9d0
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp], 0
mov edi, esp
push 0
push 0
push 0
push edi
push ecx
push eax
push edx
call sub.WS2_32.dll_WSASend
cmp eax, 0xffffffff
je 0x48aa05
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x48aa14
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
add esp, 4
pop esi
pop edi
ret

Function at 0x48aa20
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov eax, dword [esp + 0xc]
mov esi, ecx
mov ecx, SysReAllocString
cmp eax, 0x7fffffff
cmovb ecx, eax
push 0
push ecx
push dword [esp + 0x10]
push edx
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x48aa4e
mov dword [esi + 4], eax
mov byte [esi], 4
pop esi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov byte [esi], 0
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
pop esi
ret

Function at 0x48aa70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov eax, dword [esp + 0xc]
mov esi, ecx
mov ecx, SysReAllocString
cmp eax, 0x7fffffff
cmovb ecx, eax
push 0
push ecx
push dword [esp + 0x10]
push edx
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
jne 0x48aaa8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 0x274a
jne 0x48aab0
mov dword [esi + 4], eax
mov byte [esi], 4
pop esi
ret
mov byte [esi], 0
mov dword [esi + 4], ecx
pop esi
ret
Function at 0x490c80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.0047d8b0
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test edx, edx
je 0x490ce5
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.00490e00
mov edi, dword [esp]
test edi, edi
je 0x490cf4
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x490d09
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebp
jmp 0x490d01
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], 0
mov ecx, esp
call fcn.0047da80
mov dword [esi], 0
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
mov dword [esi], 0
je 0x490d01
mov ecx, edi
mov edx, 2
call fcn.00425c30
jmp 0x490d01
Function at 0x4926d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4aa330
mov esi, edx
mov edi, ecx
mov ecx, 8
mov edx, 4
mov eax, dword fs:[0]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword fs:[0], eax
movzx eax, byte [0x53cbf0]
call fcn.00425bd0
test eax, eax
je 0x4927ac
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
push 0
push 0x10000
push ebx
push 0x492ae0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x49274d
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x49279b
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], eax
push eax
mov dword [ebp - 0x24], ecx
call dword [ecx]
add esp, 4
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
cmp dword [eax + 4], 0
je 0x492782
mov edx, dword [eax + 8]
mov ecx, dword [ebp - 0x20]
call fcn.00425c30
mov ecx, dword [ebp - 0x28]
mov edx, 4
call fcn.00425c30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 8
mov dword [ebp - 0x10], 0
call fcn.004c8580
ud2
Function at 0x492f30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x103c
call fcn.004b9ee0
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4aa380
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], edx
lea ebx, [ebp - 0x1048]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x1000
push 0
push ebx
call fcn.004bae60
add esp, 0xc
xorps xmm0, xmm0
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], eax
push 0x48b0a0
push edi
push 0x1000
push ebx
mov dword [ebp - 0x20], esi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x493083
mov ebx, dword [sym.imp.KERNEL32.dll_SleepEx]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x34], 0
je 0x492fba
cmp dword [ebp - 0x30], 0
jne 0x493089
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x493089
cmp ecx, 0x1000
mov dword [ebp - 0x24], ecx
ja 0x4930c8
xor esi, esi
nop dword [eax]
mov eax, ecx
sub eax, esi
jb 0x4930ad
xorps xmm0, xmm0
lea edx, [ebp - 0x34]
lea ecx, [ebp + esi - 0x1048]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], edx
push 0x48b0a0
push edi
push eax
push ecx
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
je 0x493083
nop word [eax + eax]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x34], 0
je 0x493030
cmp dword [ebp - 0x30], 0
jne 0x493089
add esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
cmp esi, ecx
jne 0x492ff0
xorps xmm0, xmm0
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], eax
push 0x48b0a0
push edi
push 0x1000
lea eax, [ebp - 0x1048]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x492fba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x20]
call esi
push dword [ebp - 0x28]
call esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x103c
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0x4eb650
call fcn.004c8a60
add esp, 4
jmp 0x4930e1
mov dword [ebp - 0x10], 0
mov edx, 0x1000
push 0x4eb650
call fcn.004c8850
add esp, 4
ud2
Function at 0x493140
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x4aa390
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x4931be
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esi + 8]
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], 0x4eb77c
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x30]
mov edx, 0x4eb7a8
mov dword [esi + 0x2c], fcn.00483320
mov dword [esi + 0x3c], 1
call fcn.004c8740
ud2

Function at 0x4948c0
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx], 0
mov edi, edx
jne 0x494988
mov ebx, dword [edi + 0xc]
mov esi, ecx
mov edx, dword [ebx + 4]
test edx, edx
jne 0x4948ee
mov eax, dword [ebx + 8]
xor edx, edx
lea ecx, [eax + 0xf]
cmp ecx, 0xf
jbe 0x494972
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x49495e
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx]
mov dword [esp], 0
mov ebx, esp
push ecx
push ebx
push edx
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x494924
mov eax, dword [esp]
mov ecx, 2
test eax, eax
jne 0x494942
jmp 0x494936
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x49493d
cmp eax, 0x6d
jne 0x494953
mov word [esi], 4
jmp 0x49494c
mov ecx, 1
mov dword [edi], ecx
mov dword [edi + 4], eax
mov word [esi], 0x104
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov dword [esi], 0
mov dword [esi + 4], eax
jmp 0x49494c
mov ecx, ebx
push 1
call fcn.004cb1d0
add esp, 4
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 8]
jmp 0x4948f5
mov edx, eax
mov ecx, ebx
push 0x10
call fcn.004cb1d0
add esp, 4
mov edx, dword [ebx + 4]
jmp 0x4948ee
mov edx, esp
mov ecx, edi
mov dword [esp], 0
call fcn.004cb560
ud2
Function at 0x494f40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x53c0c0]
test eax, eax
je 0x494fc4
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x494f5f
cmp byte [eax + 4], 0
mov esi, eax
jne 0x494fb9
mov eax, dword [0x53c0c0]
test eax, eax
je 0x494fd3
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x494fbe
mov esi, eax
test eax, eax
jne 0x494fb3
movzx eax, byte [0x53cbf0]
mov ecx, 8
mov edx, 4
call fcn.00425bd0
test eax, eax
je 0x494feb
mov dword [eax], 0x53c0c0
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x53c0c0]
test eax, eax
je 0x494fdf
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x494fc0
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x53c0c0
call fcn.004cae20
jmp 0x494f4b
mov ecx, 0x53c0c0
call fcn.004cae20
jmp 0x494f69
mov ecx, 0x53c0c0
call fcn.004cae20
jmp 0x494fab
mov ecx, 4
mov edx, 8
call fcn.004c8580
ud2
Function at 0x498720
Capabilities:
Connect socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x30]
mov esi, ecx
movzx ecx, byte [eax]
cmp cl, 4
jne 0x498756
mov eax, dword [eax + 4]
cmp word [eax], 0
je 0x49876f
movups xmm0, xmmword [eax + 4]
mov ebx, dword [eax + 0x18]
lea edi, [eax + 0x14]
add eax, 0x1c
mov ecx, 0x1c
mov bp, 0x17
jmp 0x498781
movzx edx, byte [eax + 3]
movzx edi, word [eax + 1]
mov eax, dword [eax + 4]
mov byte [esi + 3], dl
mov word [esi + 1], di
mov byte [esi], cl
mov dword [esi + 4], eax
jmp 0x4987c4
lea edi, [eax + 2]
add eax, 6
mov ecx, 0x10
mov bp, 2
xorps xmm0, xmm0
movzx eax, word [eax]
mov edi, dword [edi]
mov word [esp], bp
rol ax, 8
mov word [esp + 2], ax
mov dword [esp + 4], edi
movups xmmword [esp + 8], xmm0
mov dword [esp + 0x18], ebx
mov eax, esp
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x4987b5
mov byte [esi], 4
jmp 0x4987c4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4987f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x53c0d0]
test eax, eax
je 0x49887a
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x498815
cmp dword [eax + 4], 0
mov edi, eax
je 0x498815
add edi, 8
jmp 0x49882d
mov eax, dword [0x53c0d0]
test eax, eax
je 0x498889
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
cmp eax, 1
jne 0x498832
mov eax, edi
pop esi
pop edi
ret
mov esi, eax
test eax, eax
jne 0x49889e
movzx eax, byte [0x53cbf0]
mov ecx, 0xc
mov edx, 4
call fcn.00425bd0
test eax, eax
je 0x4988d8
mov dword [eax], 0x53c0d0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x53c0d0]
test eax, eax
jne 0x498895
mov ecx, 0x53c0d0
call fcn.004cae20
jmp 0x498896
mov ecx, 0x53c0d0
call fcn.004cae20
jmp 0x4987fc
mov ecx, 0x53c0d0
call fcn.004cae20
jmp 0x49881f
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.004cb5c0
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x49882d
test ecx, ecx
je 0x49882d
lock dec dword [ecx]
jne 0x49882d
call fcn.00492870
jmp 0x49882d
mov ecx, 4
mov edx, 0xc
call fcn.004c8580
ud2
Function at 0x498a60
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x53c0f0]
test eax, eax
je 0x498b45
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x498a91
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x498b3a
mov eax, dword [0x53c0f0]
test eax, eax
je 0x498b54
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x498b17
mov esi, eax
test eax, eax
jne 0x498af7
movzx eax, byte [0x53cbf0]
mov ecx, 0x20
mov edx, 8
call fcn.00425bd0
test eax, eax
je 0x498b6f
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x53c0f0
mov esi, eax
mov eax, dword [0x53c0f0]
test eax, eax
je 0x498b63
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x498b1b
movaps xmm0, xmmword [esp]
jmp 0x498b29
xor esi, esi
jmp 0x498b3d
lea ecx, [esp + 0x10]
call fcn.00493140
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x53c0f0
call fcn.004cae20
jmp 0x498a78
mov ecx, 0x53c0f0
call fcn.004cae20
jmp 0x498a9f
mov ecx, 0x53c0f0
call fcn.004cae20
jmp 0x498aef
mov ecx, 8
mov edx, 0x20
call fcn.004c8580
ud2
Function at 0x49cf14
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov esi, ecx
lea edi, [esp + 0x40]
xorps xmm0, xmm0
movaps xmmword [edi], xmm0
movaps xmmword [edi + 0x30], xmm0
movaps xmmword [edi + 0x20], xmm0
movaps xmmword [edi + 0x10], xmm0
mov dword [edi], 0x40
push edi
call sub.KERNEL32.dll_GlobalMemoryStatusEx
movsd xmm0, qword [edi + 8]
mov eax, esp
and dword [eax + 0x34], 0
and dword [eax + 0x30], 0
movsd qword [esi + 0x40], xmm0
movsd xmm0, qword [edi + 0x10]
movsd qword [esi + 0x48], xmm0
xorps xmm0, xmm0
movaps xmmword [eax + 0x20], xmm0
movaps xmmword [eax + 0x10], xmm0
movaps xmmword [eax], xmm0
push 0x38
push eax
call sub.PSAPI.DLL_GetPerformanceInfo
cmp eax, 1
jne 0x49cfcb
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
xor edi, edi
sub edx, eax
cmovb edx, edi
sub ebx, eax
mov eax, ecx
cmovb ebx, edi
mul edx
mov edx, 0
cmovo edx, edx
mov dword [esi + 0x54], edx
mov edx, 0xffffffff
cmovo eax, edx
mov dword [esi + 0x50], eax
mov eax, ecx
mov ecx, 0xffffffff
mul ebx
cmovo eax, ecx
cmovo edi, edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x58], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49dcb3
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, ecx
lea edi, [ecx + 0x20]
imul ebx, edx, 0x50
test ebx, ebx
je 0x49dd03
mov eax, dword [esi + 0x18]
or eax, dword [esi + 0x1c]
je 0x49dcf8
and dword [esp + 4], 0
and dword [esp], 0
mov eax, esp
push eax
push 0
push 0
push dword [edi + 0x14]
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x49dcf8
movsd xmm0, qword [esp]
movsd qword [edi], xmm0
add esi, 0x50
add edi, 0x50
add ebx, 0xffffffb0
jmp 0x49dcc7
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret