joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440b30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6b98
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x53132c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x13
mov esi, ecx
xor ebx, ebx
push str.CStubModule::showUI
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00404270
push 0x2e4
push str.StubModule.cpp
lea eax, [ebp - 0x2c]
push eax
push 0x53543c
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], ebx
call fcn.004119e0
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 4], 0xffffffff
jb 0x440bb1
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00458691
add esp, 4
mov edx, dword [esi + 0x254]
push 5
push edx
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x58]
call fcn.00411ac0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004587b6
mov esp, ebp
pop ebp
ret
Function at 0x446cd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x5358a0], 0
push esi
push edi
jne 0x446c46
call fcn.00446bb2
test eax, eax
je 0x446c8b
mov eax, dword [0x5358a0]
cmp eax, 1
jne 0x446c67
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x446c8b
jmp 0x446ccd
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x446ccd
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x446c8f
xor eax, eax
jmp 0x446ccd
mov eax, dword [esi]
push dword [0x5358a0]
call edi
mov edi, eax
test edi, edi
je 0x446cb1
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x446ccd
lea edi, [esi + 0xff0]
push esi
push dword [0x5358a0]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x446cb7
mov eax, esi
pop edi
pop esi
ret
jmp 0x446c32

Function at 0x4482f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x4482fc
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x448394
push esi
call fcn.00448770
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
cmp eax, 2
je 0x448379
cmp eax, 3
je 0x448379
cmp eax, 0x7b
je 0x448379
cmp eax, 0xf
je 0x448379
cmp eax, 0x15
je 0x448379
cmp eax, 0x57
je 0x448379
cmp eax, 0xa1
je 0x448379
cmp eax, 0x35
je 0x448379
cmp eax, 0x20
jne 0x44836e
mov eax, dword [0x535ce4]
mov dword [ecx], eax
mov edx, dword [0x535ce8]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x535ce4]
mov dword [ecx], eax
mov edx, dword [0x535ce8]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x535ce4]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x535ce8]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x4483c1
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret
Function at 0x4483d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x14], 8
jb 0x4483dc
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x448474
push esi
call fcn.00448770
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
cmp eax, 2
je 0x448459
cmp eax, 3
je 0x448459
cmp eax, 0x7b
je 0x448459
cmp eax, 0xf
je 0x448459
cmp eax, 0x15
je 0x448459
cmp eax, 0x57
je 0x448459
cmp eax, 0xa1
je 0x448459
cmp eax, 0x35
je 0x448459
cmp eax, 0x20
jne 0x44844e
mov eax, dword [0x535ce4]
mov dword [ecx], eax
mov edx, dword [0x535ce8]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x535ce4]
mov dword [ecx], eax
mov edx, dword [0x535ce8]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x535ce4]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x535ce8]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x4484a1
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0x4484f0
Capabilities:
Create directory

Disassembly:
sub esp, 8
push ebp
push esi
push edi
xor esi, esi
call fcn.00448770
mov ebp, eax
mov dword [esp + 0xc], esi
call fcn.00448770
mov edi, dword [esp + 0x1c]
cmp dword [edi + 0x14], 8
mov dword [esp + 0x10], eax
jb 0x44851a
mov eax, dword [edi]
jmp 0x44851c
mov eax, edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x44853d
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
mov byte [eax + 8], 1
pop ebp
add esp, 8
ret
call fcn.00448770
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x44858e
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x20]
push edi
push ecx
call fcn.004483d0
add esp, 0xc
cmp dword [esp + 0x1c], 3
jne 0x44858e
mov eax, dword [esp + 0x18]
mov edx, dword [0x535ce4]
mov ecx, dword [0x535ce8]
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
mov byte [eax + 8], 0
pop ebp
add esp, 8
ret
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
mov byte [eax + 8], 0
pop ebp
add esp, 8
ret
Function at 0x4485b0
Capabilities:
Create directory

Disassembly:
sub esp, 8
push ebp
push esi
push edi
xor esi, esi
call fcn.00448770
mov ebp, eax
mov dword [esp + 0xc], esi
call fcn.00448770
mov edi, dword [esp + 0x1c]
cmp dword [edi + 0x14], 0x10
mov dword [esp + 0x10], eax
jb 0x4485da
mov eax, dword [edi]
jmp 0x4485dc
mov eax, edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4485fd
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
mov byte [eax + 8], 1
pop ebp
add esp, 8
ret
call fcn.00448770
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x44864e
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x20]
push edi
push ecx
call fcn.004482f0
add esp, 0xc
cmp dword [esp + 0x1c], 3
jne 0x44864e
mov eax, dword [esp + 0x18]
mov edx, dword [0x535ce4]
mov ecx, dword [0x535ce8]
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
mov byte [eax + 8], 0
pop ebp
add esp, 8
ret
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
mov byte [eax + 8], 0
pop ebp
add esp, 8
ret

Function at 0x449780
Capabilities:
Get thread local storage value

Disassembly:
push ecx
mov eax, dword [0x535d38]
test eax, eax
je 0x449808
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call esi
test eax, eax
je 0x449807
mov ecx, dword [0x535d38]
test ecx, ecx
jne 0x4497a6
xor eax, eax
jmp 0x4497af
push ecx
call esi
mov ecx, dword [0x535d38]
cmp byte [eax + 0x18], 0
je 0x449807
test ecx, ecx
je 0x449807
push ecx
call esi
test eax, eax
je 0x449807
mov eax, dword [0x535d38]
test eax, eax
je 0x4497cc
push eax
call esi
mov eax, dword [eax + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x449807
mov eax, dword [0x535d38]
test eax, eax
je 0x4497e8
push eax
call esi
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x51ec3c
lea ecx, [esp + 0xb]
xor al, al
push ecx
mov byte [esp + 0xf], al
call fcn.0045869c
pop esi
pop ecx
ret
Function at 0x449fe0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4d7b50
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [0x535d38]
test eax, eax
jne 0x44a014
xor esi, esi
jmp 0x44a01d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x30], 0
test esi, esi
je 0x44a067
cmp dword [esi + 0x14], 0
jne 0x44a0a9
cmp dword [esi + 0x10], 0
jne 0x44a0b0
push 0x449580
push 0x535d30
call fcn.00449810
mov eax, dword [0x535d38]
add esp, 8
test eax, eax
je 0x44a15d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x30], 0xffffffff
test esi, esi
je 0x44a095
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x44a095
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
cmp dword [esi + 0x10], 0
je 0x44a0f0
nop
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x44a0de
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x44a0b0
cmp dword [esi + 0x14], 0
je 0x44a039
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x44a115
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x44a146
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x44a146
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x44a146
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x44a0fa
jmp 0x44a033
lea ecx, [esp + 0x18]
call fcn.004595e1
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], vtable.boost::thread_resource_error.0
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x34], 1
call fcn.00404b60
int3
Function at 0x44a250
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4d7ba8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x44a190
push 0
push 0
call fcn.00460fa7
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x44a2bb
lea ecx, [esp + 0x10]
call fcn.004595e1
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.00404b60
mov eax, dword [edi]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
test eax, eax
je 0x44a2de
cmp eax, 0xffffffff
je 0x44a2de
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x44bad0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7df6
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x53132c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push 1
mov esi, ecx
push 2
lea ecx, [ebp - 0xc8]
call fcn.004030f0
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push edi
lea edx, [ebp - 0xc8]
push edx
mov dword [ebp - 4], 0
call eax
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0xc8]
call fcn.004031f0
mov eax, dword [ebp - 0x2c]
mov esi, 0x10
cmp dword [ebp - 0x18], esi
jae 0x44bb49
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 0x18], esi
jb 0x44bb61
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00458691
add esp, 4
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
mov edx, dword [ecx + 4]
lea eax, [ebp - 0x78]
mov dword [ebp - 0x30], eax
mov dword [ebp + edx - 0xc8], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
lea ecx, [ebp - 0xc4]
mov dword [ebp - 4], 1
mov dword [ebp - 0xc4], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
call fcn.00403f90
lea ecx, [ebp - 0xc4]
call fcn.00402d90
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x78]
mov dword [ebp + ecx - 0xc8], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
push edx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x78], vtable.std::ios_base.0
call fcn.00447a81
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004587b6
mov esp, ebp
pop ebp
ret 4
Function at 0x44c5e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7f17
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x53132c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], eax
je 0x44c62e
mov dword [ebx], 0x4eaa68
mov dword [ebx + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov edx, dword [ebx]
mov edi, dword [edx + 4]
add edi, ebx
mov ecx, edi
call fcn.004016a0
lea esi, [ebx + 4]
push 0x20
mov ecx, edi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], 0
call fcn.00404910
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x44c67a
mov eax, dword [edi + 0xc]
or eax, 4
or eax, 4
push 0
push eax
mov ecx, edi
call fcn.00401560
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.004045c0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], 0
mov byte [esi + 0x49], 0
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
xor ecx, ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov dword [eax], ecx
mov edx, dword [esi + 0x34]
mov dword [edx], ecx
mov eax, dword [esi + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
mov dword [esi + 0x54], ecx
mov edx, dword [0x536f5c]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4528d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8d18
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x53132c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, esi
call edx
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 0
call fcn.0044aef0
mov eax, dword [esi + 0x30]
mov edx, dword [eax + 0xc]
lea ecx, [esi + 0x30]
call edx
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp esi, eax
je 0x45294d
lea ebx, [ebx]
mov ecx, esi
call fcn.0044aef0
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
mov ecx, esi
call edx
mov eax, dword [ebp - 0x18]
add esi, 8
cmp esi, eax
jne 0x452930
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x45297e
mov edi, eax
cmp esi, eax
je 0x452975
mov edi, edi
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
push 0
mov ecx, esi
call edx
add esi, 8
cmp esi, edi
jne 0x452960
mov esi, dword [ebp - 0x1c]
push esi
call fcn.00458691
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x454840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d90a4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x53132c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.log4cplus::Hierarchy.0
mov dword [ebp - 4], 4
call fcn.004528d0
mov eax, dword [esi + 8]
push eax
call fcn.00455130
add esp, 4
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.0044ae60
lea edi, [esi + 0x20]
mov dword [ebp - 0x14], edi
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push ecx
lea ecx, [ebp - 0x18]
push ecx
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.00453660
mov edi, dword [edi + 4]
push edi
call fcn.00458691
lea edi, [esi + 0x10]
add esp, 4
mov dword [ebp - 0x18], edi
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push ecx
lea edx, [ebp - 0x14]
push edx
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.00454400
mov edi, dword [edi + 4]
push edi
call fcn.00458691
mov ecx, dword [esi + 0xc]
add esp, 4
mov byte [ebp - 4], 0
test ecx, ecx
je 0x4548fa
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 1
call edx
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.004550b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4579e0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9628
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x53132c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x400
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], str.unknown
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x10], 0
call fcn.004577f0
mov edi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 4], esi
mov esi, edi
sub esi, ebx
lea ecx, [esi - 1]
push ecx
push ebx
call sub.WS2_32.dll_gethostname
mov dword [ebp - 0x18], eax
test eax, eax
je 0x457aba
cmp dword [ebp - 0x18], 0
je 0x457b13
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x271e
jne 0x457abe
lea eax, [esi + esi]
mov byte [ebp - 0x10], 0
cmp eax, esi
jbe 0x457a8b
lea edx, [ebp - 0x10]
sub eax, edi
push edx
add eax, ebx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00457850
mov edi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
jmp 0x457aa5
jae 0x457aa5
lea esi, [eax + ebx]
cmp esi, edi
je 0x457aa5
push 0
push edi
push esi
call fcn.00459280
mov edi, esi
add esp, 0xc
mov dword [ebp - 0x24], edi
mov esi, edi
sub esi, ebx
lea eax, [esi - 1]
push eax
push ebx
call sub.WS2_32.dll_gethostname
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x457a50
mov esi, ebx
jmp 0x457ac1
mov esi, dword [ebp - 0x14]
cmp dword [ebp - 0x18], 0
je 0x457b16
mov edi, dword [ebp + 8]
mov eax, esi
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x457ae0
sub eax, edx
push eax
push esi
mov ecx, edi
call fcn.00404270
test ebx, ebx
je 0x457aff
push ebx
call fcn.00458691
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x14]
cmp byte [ebp + 0xc], 0
je 0x457ac7
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x457b2d
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, esi
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x457b46
jmp 0x457ae7

Function at 0x457b90
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d965e
mov eax, dword fs:[0]
push eax
mov eax, dword [0x53132c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, 1
test byte [0x535f44], al
jne 0x457bf8
or dword [0x535f44], eax
mov ecx, 0x535f38
mov dword [ebp - 4], 0
call fcn.00455030
mov dword [0x535f38], 0x4eb1f4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x4e7300
mov dword [0x535f40], eax
call fcn.00459980
add esp, 4
mov eax, 0x535f38
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x457cb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9698
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x53132c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ecx + 8]
mov esi, dword [ebp + 8]
xor ebx, ebx
push eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x457df9
cmp dword [eax + 0x10], ebx
je 0x457df9
lea ecx, [ebp - 0x74]
push ecx
mov ecx, eax
call fcn.00457c10
push 1
lea edx, [ebp - 0x68]
push edx
mov ecx, eax
call fcn.00457c30
mov ecx, dword [eax]
cmp ecx, ebx
jne 0x457d2c
xor ecx, ecx
jmp 0x457d2e
mov ecx, dword [ecx]
mov eax, dword [eax + 8]
mov edx, dword [ecx + 8]
cmp edx, eax
ja 0x457d3a
sub eax, edx
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + eax*4]
push 0xffffffffffffffff
push ebx
add eax, 0x1c
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.00403b00
jmp 0x457e19
mov dword [ebp - 4], 0xffffffff
push ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push 0x51344e
mov ecx, esi
mov byte [esi], bl
call fcn.00404270
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004587b6
mov esp, ebp
pop ebp
ret 4

Function at 0x4587b6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x53132c]
jne 0x4587c0
repz ret
jmp fcn.0046267b