joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479155
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
mov eax, 0x6b0214
call fcn.00651da4
sub esp, 0x40
push ebx
push edi
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
push 0x6d7bd0
push 1
push ebx
push 0x6d7bc0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x47928b
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push edx
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 2
call dword [ecx + 0x1c]
mov edi, eax
test edi, edi
js 0x47927a
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push edx
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 5
call dword [ecx + 0x1c]
mov edi, eax
test edi, edi
js 0x479269
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push edx
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 9
call dword [ecx + 0x50]
mov edi, eax
mov eax, dword [ebp - 0x10]
test edi, edi
js 0x47925b
test eax, eax
jne 0x4791f1
mov edi, 0x80004005
jmp 0x47925b
push dword [ebp + 8]
lea ecx, [ebp - 0x4c]
call fcn.00428153
push eax
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x12
push eax
call fcn.0043b84e
cmp dword [eax + 0x14], 8
jb 0x479212
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp + 8], esi
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.004284eb
push ebx
push 1
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x14
call fcn.004284eb
mov eax, dword [ebp - 0x10]
test esi, esi
jne 0x479247
mov edi, 0x8007000e
jmp 0x47925a
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x24]
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x10]
pop esi
mov byte [ebp - 4], 0x19
test eax, eax
je 0x479269
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0x1a
test eax, eax
je 0x47927a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 0x1b
test eax, eax
je 0x47928b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], 0x1c
test eax, eax
je 0x47929f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x47a55c
Capabilities:
Check if file exists
Get common file path
Get disk information

Disassembly:
mov eax, 0x6af091
call fcn.00651da4
sub esp, 0x414
push ebx
push esi
push edi
push 0x104
xor ecx, ecx
lea eax, [ebp - 0x218]
push eax
push ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push 0x6d31cc
push eax
lea eax, [ebp - 0x420]
push eax
call ebx
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
call fcn.00428153
and dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x10], 1
jb 0x47a5d2
mov eax, dword [edi]
jmp 0x47a5d4
mov eax, edi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
test eax, eax
setne al
test al, al
jne 0x47a68e
push str..old
call fcn.004287c6
pop ecx
push eax
push str..old
mov ecx, edi
call fcn.004285c7
cmp dword [edi + 0x14], 8
jb 0x47a60c
mov eax, dword [edi]
jmp 0x47a60e
mov eax, edi
push eax
call esi
test eax, eax
setne al
test al, al
jne 0x47a68e
push 1
push 0x1a
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x47a686
call fcn.00490f1c
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call ebx
mov esi, eax
push esi
call fcn.004287c6
pop ecx
push eax
push esi
mov ecx, edi
call fcn.004286de
cmp dword [edi + 0x14], 8
jb 0x47a663
mov eax, dword [edi]
jmp 0x47a665
mov eax, edi
push 0x6d31cc
push eax
lea eax, [ebp - 0x420]
push eax
call ebx
mov esi, eax
push esi
call fcn.004287c6
pop ecx
push eax
push esi
mov ecx, edi
call fcn.004286de
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
jmp 0x47a6ac
cmp dword [edi + 0x14], 8
jb 0x47a698
mov eax, dword [edi]
jmp 0x47a69a
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
mov ecx, dword [ebp + 0xc]
cmp eax, 2
sete dl
or byte [ecx], dl
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x47e7e8
Capabilities:
Reference l3 dns server

Disassembly:
mov eax, 0x6b0539
call fcn.00651da4
sub esp, 0x80
cmp byte [ebp + 8], 2
push esi
jne 0x47e85b
mov eax, dword fs:[0x2c]
mov ecx, dword [0x7f8ad8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x7c64c8]
cmp eax, dword [ecx + 4]
jle 0x47e847
mov esi, 0x7c64c8
push esi
call fcn.00651f0b
cmp dword [0x7c64c8], 0xffffffff
pop ecx
jne 0x47e847
push str.4.2.2.1
call dword [sym.imp.WS2_32.dll_inet_addr]
push esi
mov dword [0x7c64c4], eax
call fcn.00651ecc
pop ecx
push dword [ebp + 0xc]
push dword [0x7c64c4]
call dword [0x7c64ac]
jmp 0x47e8e0
cmp dword [0x7c64b0], 0
jne 0x47e86b
mov eax, 0x2741
jmp 0x47e8e0
mov eax, dword fs:[0x2c]
xor esi, esi
mov ecx, dword [0x7f8ad8]
push ebx
mov ebx, 0x7c64cc
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x7c64e0]
cmp eax, dword [ecx + 4]
jle 0x47e8c0
push edi
mov edi, 0x7c64e0
push edi
call fcn.00651f0b
cmp dword [0x7c64e0], 0xffffffff
pop ecx
jne 0x47e8bf
push esi
push str.2001:db8::1428:57ab
push ebx
mov dword [ebp - 4], esi
call fcn.004c8ebb
or dword [ebp - 4], 0xffffffff
push edi
call fcn.00651ecc
pop ecx
pop edi
push esi
lea eax, [ebp - 0x8c]
mov ecx, ebx
push eax
call fcn.00476cab
push dword [ebp + 0xc]
lea eax, [ebp - 0x8c]
push eax
call dword [0x7c64b0]
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x47ea60
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
call fcn.0047ed83
test al, al
je 0x47eabc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.0047e7e8
test eax, eax
jne 0x47eabc
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push dword [ebp + 0xc]
push eax
call fcn.0047e966
lea ecx, [ebp - 0x18]
call fcn.0046515a
test al, al
jne 0x47eabc
lea ecx, [ebp - 0x18]
call fcn.004c8e4b
test al, al
jne 0x47eabc
mov eax, dword [ebp + 8]
push esi
push edi
push 5
pop ecx
lea esi, [ebp - 0x18]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
jmp 0x47eb1c
cmp byte [ebp + 0xc], 2
jne 0x47eb11
push 0x100
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x47eb11
cmp word [eax + 8], 2
jne 0x47eb11
cmp word [eax + 0xa], 4
jne 0x47eb11
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x47eb11
push 0
push dword [eax]
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [ebp + 8]
push eax
call fcn.004c86e3
jmp 0x47eb19
mov ecx, dword [ebp + 8]
call fcn.004c8749
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x47ed83
Capabilities:
Link many functions at runtime

Disassembly:
push ecx
cmp dword [0x7c649c], 0
push esi
jne 0x47ee92
push str.Iphlpapi.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [0x7c649c], eax
test eax, eax
jne 0x47edad
xor al, al
jmp 0x47ee94
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.GetAdaptersInfo
push eax
call esi
mov dword [0x7c64a0], eax
test eax, eax
jne 0x47edd9
push dword [0x7c649c]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
and dword [0x7c649c], 0
jmp 0x47eda6
push str.GetIfTable
push dword [0x7c649c]
call esi
mov dword [0x7c64a4], eax
test eax, eax
je 0x47edc4
push str.GetIfEntry
push dword [0x7c649c]
call esi
mov dword [0x7c64a8], eax
test eax, eax
je 0x47edc4
push str.GetBestInterface
push dword [0x7c649c]
call esi
mov dword [0x7c64ac], eax
test eax, eax
je 0x47edc4
push str.GetBestInterfaceEx
push dword [0x7c649c]
call esi
push str.GetIpAddrTable
push dword [0x7c649c]
mov dword [0x7c64b0], eax
call esi
mov dword [0x7c64b4], eax
test eax, eax
je 0x47edc4
push str.GetAdaptersAddresses
push dword [0x7c649c]
call esi
push 0x6e27e4
push dword [0x7c649c]
mov dword [0x7c64b8], eax
call esi
push str.NotifyIpInterfaceChange
push dword [0x7c649c]
mov dword [0x7c64bc], eax
call esi
mov dword [0x7c64c0], eax
test eax, eax
je 0x47ee92
lea ecx, [esp + 4]
push ecx
push 0
push 0x79e860
push 0x47ed79
push 2
call eax
mov al, 1
pop esi
pop ecx
ret
Function at 0x47f06e
Capabilities:
Get process image filename
List tcp connections and listeners

Disassembly:
sub esp, 0x234
push ebp
xor ebp, ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 4], ebp
call fcn.0047ed83
test al, al
jne 0x47f0a3
mov eax, dword [esp + 0x23c]
xor ecx, ecx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ebp
mov word [eax], cx
jmp 0x47f1de
push esi
push edi
push 0x1c
pop esi
push esi
call fcn.0045c47c
push ebp
push 4
push 2
mov edi, eax
mov dword [esp + 0x18], esi
push 1
lea eax, [esp + 0x1c]
push eax
push edi
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
cmp eax, 0x7a
jne 0x47f0de
push 1
push edi
call fcn.0045c46f
push dword [esp + 0xc]
call fcn.0045c47c
mov edi, eax
push 0x208
lea eax, [esp + 0x3c]
push ebp
push eax
call fcn.0066c620
add esp, 0xc
lea eax, [esp + 0xc]
push ebp
push 4
push 2
push 1
push eax
push edi
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
test eax, eax
jne 0x47f1bc
push ebx
mov ebx, ebp
cmp dword [edi], ebp
jle 0x47f1bb
lea ebp, [edi + 0xc]
movzx eax, word [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [esp + 0x14], eax
movzx eax, word [ebp]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [esp + 0x24c]
movzx esi, ax
mov eax, dword [ebp + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
push eax
call fcn.00476b1f
movzx eax, word [eax + 0x10]
cmp esi, eax
jne 0x47f183
mov ecx, dword [esp + 0x24c]
call fcn.00476d9a
cmp eax, dword [esp + 0x14]
jne 0x47f183
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x1c], eax
je 0x47f18d
inc ebx
add ebp, 0x18
cmp ebx, dword [edi]
jl 0x47f119
jmp 0x47f1bb
push dword [esp + 0x20]
push 0
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x47f1bb
push 0x104
lea eax, [esp + 0x40]
push eax
push esi
call sub.KERNEL32.DLL_K32GetProcessImageFileNameW
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebx
push 1
push edi
call fcn.0045c46f
mov ecx, dword [esp + 0x244]
lea eax, [esp + 0x38]
push eax
call fcn.00428153
mov eax, dword [esp + 0x244]
pop edi
pop esi
pop ebp
add esp, 0x234
ret 8
Function at 0x482612
Capabilities:
Delete file

Disassembly:
mov eax, 0x6aadef
call fcn.00651da4
sub esp, 0x30
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x68]
cmp dword [eax + 0x14], 8
jb 0x48262e
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0047014f
lea eax, [esi + 0xcc]
xor edi, edi
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], edi
call fcn.0042812e
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], edi
je 0x482668
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x482661
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp dword [esi + 0x78], edi
je 0x48267f
cmp dword [ebp - 0x28], 8
mov eax, dword [ebp - 0x3c]
jae 0x482679
lea eax, [ebp - 0x3c]
push eax
call fcn.0045d23f
push edi
push 1
lea ecx, [ebp - 0x24]
mov dword [esi + 0x64], 4
call fcn.004284eb
push edi
push 1
lea ecx, [ebp - 0x3c]
call fcn.004284eb
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x482b90
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x7c62a6], 0
je 0x482ba0
mov eax, 0x80004005
jmp 0x482bd7
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov ecx, esi
sub ecx, 0
je 0x482bd4
dec ecx
sub ecx, 1
je 0x482bd4
push dword [esp + 0xc]
push esi
push str.RegKey::DeleteKey_fail___d_:__s_n
call fcn.0047995d
add esp, 0xc
mov eax, esi
jmp 0x482bd6
xor eax, eax
pop esi
ret 8

Function at 0x482bda
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x7c62a6], 0
je 0x482be7
xor al, al
jmp 0x482c18
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, eax
sub ecx, 0
je 0x482c16
dec ecx
sub ecx, 1
je 0x482c16
push dword [esp + 8]
push eax
push str.RegKey::DeleteTree_fail___d_:__s_n
call fcn.0047995d
add esp, 0xc
jmp 0x482be3
mov al, 1
ret 8

Function at 0x482c1b
Capabilities:
Delete registry value

Disassembly:
cmp byte [0x7c62a6], 0
je 0x482c28
xor al, al
jmp 0x482c5a
push esi
push dword [esp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
je 0x482c52
cmp esi, 2
je 0x482c52
push esi
push dword [esp + 0xc]
push str.RegKey:_Could_not_delete_value__s:__d_n
call fcn.0047995d
add esp, 0xc
xor eax, eax
test esi, esi
pop esi
sete al
ret 4
Function at 0x482c5d
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x6b0a84
call fcn.00651da4
sub esp, 0x218
and dword [ebp - 4], 0
and dword [ebp - 0x1c], 0
push ebx
push esi
push edi
mov ebx, 0x104
mov edi, ecx
push 0x208
mov dword [ebp - 0x14], ebx
call fcn.006520e5
pop ecx
mov esi, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x10]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 0xc]
push dword [edi]
call ebx
mov dword [ebp - 0x18], eax
cmp eax, 0xea
jne 0x482d00
push esi
call fcn.00651dd2
mov eax, dword [ebp - 0x10]
xor ecx, ecx
inc eax
push 2
pop edx
mov dword [ebp - 0x10], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.006520e5
pop ecx
pop ecx
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 0xc]
push dword [edi]
call ebx
mov dword [ebp - 0x18], eax
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x6d2128
call fcn.00428153
push 0x6d2128
lea ecx, [edi + 0x18]
mov dword [ebp - 4], 1
call fcn.00428153
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 1
jne 0x482d67
lea eax, [ebp - 0x224]
push eax
call fcn.004287c6
pop ecx
push eax
lea eax, [ebp - 0x224]
mov ecx, edi
push eax
call fcn.004286de
cmp dword [ebp - 0x10], 0
je 0x482d67
push esi
call fcn.004287c6
pop ecx
push eax
push esi
lea ecx, [edi + 0x18]
call fcn.004286de
push esi
call fcn.00651dd2
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x482e8d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 4], eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
lea eax, [ebp + 0x14]
push eax
push esi
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov eax, dword [ebp + 0x10]
jne 0x482ebe
cmp dword [ebp + 0x14], eax
jne 0x482ebe
inc esi
cmp eax, 1
jne 0x482ece
xor eax, eax
cmp dword [ebp + 0x14], 2
sete al
or esi, eax
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x482eda
mov eax, dword [ebp - 4]
mov dword [ecx], eax
test esi, esi
pop esi
setne al
mov esp, ebp
pop ebp
ret 0x14

Function at 0x483348
Capabilities:
Set registry value

Disassembly:
cmp byte [0x7c62a6], 0
je 0x483355
xor al, al
jmp 0x483391
push esi
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push dword [esp + 0x18]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x483389
push esi
push dword [esp + 0x10]
push dword [esp + 0x10]
push str.RegKey:_Could_not_write_DWORD_valuename__s_value__d__Error__d_n
call fcn.0047995d
add esp, 0x10
xor eax, eax
test esi, esi
pop esi
sete al
ret 8
Function at 0x483394
Capabilities:
Set registry value

Disassembly:
cmp byte [0x7c62a6], 0
je 0x4833a2
or eax, 0xffffffff
jmp 0x4833bc
push dword [esp + 0x10]
push dword [esp + 0xc]
push dword [esp + 0x14]
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 0x10

Function at 0x485389
Capabilities:
Check mutex on windows

Disassembly:
mov eax, 0x6b0ef8
call fcn.00651da4
push ecx
cmp byte [0x7c654d], 0
je 0x4853a4
mov al, 1
jmp 0x485430
push esi
push edi
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp byte [0x7c654d], 0
jne 0x48542c
push 0x10
mov dword [0x7c6548], esi
call fcn.00651ae6
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x4853e6
mov ecx, eax
call fcn.00484d09
jmp 0x4853e8
mov eax, edi
or dword [ebp - 4], 0xffffffff
cmp dword [0x7c6540], 0
mov dword [0x7c653c], eax
je 0x4853fe
xor al, al
jmp 0x48542e
add eax, 8
push eax
push edi
push edi
push 0x484d61
push edi
push edi
push str.BenchThread::BenchThreadRunner
call fcn.00467d87
mov ecx, dword [0x7c653c]
push esi
mov byte [0x7c654d], 1
mov dword [ecx + 0xc], eax
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x48a6e6
Capabilities:
Create directory

Disassembly:
mov eax, 0x6b12d7
call fcn.00651da4
sub esp, 0x20
push ebx
lea eax, [ebp - 0x2c]
push eax
call fcn.00480de1
mov eax, dword [ebp - 0x2c]
xor ebx, ebx
cmp dword [ebp - 0x18], 8
mov dword [ebp - 4], ebx
jae 0x48a70e
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.0042812e
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
mov ecx, 0x7c6f94
call fcn.0042a797
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004862bb
push 0x7c6cb4
call fcn.0048c07a
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004284eb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x498680
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push 0x6c078965
push dword [esp + 0xc]
or dword [esi + 0x1384], 0xffffffff
call fcn.004b9410
mov eax, esi
pop esi
ret 4
Function at 0x498d8e
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x6b1b13
call fcn.00651da4
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.0042812e
and dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.0042812e
mov eax, dword [esi + 0x30]
lea ecx, [edi + 0x5c]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov al, byte [esi + 0x58]
mov byte [edi + 0x58], al
mov al, byte [esi + 0x59]
mov byte [edi + 0x59], al
mov al, byte [esi + 0x5a]
mov byte [edi + 0x5a], al
lea eax, [esi + 0x5c]
push eax
mov byte [ebp - 4], 1
call fcn.0042812e
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
mov eax, dword [esi + 0x78]
mov dword [edi + 0x78], eax
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x7c], eax
mov eax, dword [esi + 0x80]
mov dword [edi + 0x80], eax
mov eax, dword [esi + 0x84]
mov dword [edi + 0x84], eax
mov al, byte [edi + 0x88]
xor al, byte [esi + 0x88]
and al, 1
mov byte [ebp - 4], 2
xor byte [edi + 0x88], al
mov al, byte [edi + 0x88]
mov cl, byte [esi + 0x88]
xor cl, al
and cl, 2
xor cl, al
mov byte [edi + 0x88], cl
mov al, byte [esi + 0x88]
xor al, cl
and al, 4
xor al, cl
mov byte [edi + 0x88], al
mov cl, byte [esi + 0x88]
xor cl, al
and cl, 8
xor cl, al
mov byte [edi + 0x88], cl
mov al, byte [esi + 0x88]
xor al, cl
and al, 0x10
xor al, cl
mov byte [edi + 0x88], al
lea ecx, [edi + 0xa0]
mov eax, dword [esi + 0x8c]
mov dword [edi + 0x8c], eax
mov eax, dword [esi + 0x90]
mov dword [edi + 0x90], eax
mov eax, dword [esi + 0x94]
mov dword [edi + 0x94], eax
mov eax, dword [esi + 0x98]
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x9c]
mov dword [edi + 0x9c], eax
lea eax, [esi + 0xa0]
push eax
call fcn.0040fa4b
lea eax, [esi + 0xb8]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0xb8]
call fcn.0040fa4b
mov al, byte [esi + 0xd0]
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0xd0], al
mov eax, dword [esi + 0xd4]
mov dword [edi + 0xd4], eax
mov eax, dword [esi + 0xd8]
mov dword [edi + 0xd8], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b3edb
Capabilities:
Copy file
Delete file
Move file

Disassembly:
sub esp, 0x28
push esi
push 0x80
push 5
push dword [esp + 0x38]
mov esi, ecx
call fcn.0045d9b9
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x4b3f01
xor al, al
jmp 0x4b402b
lea ecx, [esp + 0xc]
push ecx
push eax
call fcn.0045d97f
test eax, eax
je 0x4b3f1c
lea eax, [esp + 8]
push eax
call fcn.0045d949
jmp 0x4b3efa
push ebp
push edi
push dword [esp + 0x18]
mov ecx, esi
push dword [esp + 0x18]
call fcn.004b3492
mov eax, dword [esi + 0x238]
xor ebp, ebp
sub eax, dword [esi + 0x234]
mov edi, ebp
sar eax, 3
test eax, eax
je 0x4b3f60
push edi
mov ecx, esi
call fcn.004b06ad
mov eax, dword [esi + 0x238]
inc edi
sub eax, dword [esi + 0x234]
sar eax, 3
cmp edi, eax
jb 0x4b3f44
mov ecx, dword [esi + 0x73c]
mov eax, dword [esi + 0x740]
add ecx, 0x3fff
adc eax, ebp
shrd ecx, eax, 0xe
shr eax, 0xe
lea eax, [esp + 0x10]
mov dword [esi + 0xf0], ecx
push eax
call fcn.0045d949
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
call fcn.004a4e07
cmp dword [eax + 0x14], 8
jb 0x4b3f9f
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push ebp
push 1
lea ecx, [esp + 0x28]
call fcn.004284eb
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.004a4e07
cmp byte [esp + 0x40], 0
je 0x4b3fdb
cmp dword [eax + 0x14], 8
jb 0x4b3fce
mov eax, dword [eax]
push eax
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
jmp 0x4b3ff0
cmp dword [eax + 0x14], 8
jb 0x4b3fe3
mov eax, dword [eax]
push 1
push eax
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov ebx, eax
lea ecx, [esp + 0x20]
push ebp
neg ebx
push 1
sbb bl, bl
call fcn.004284eb
add bl, 1
je 0x4b400b
xor al, al
jmp 0x4b4028
mov ecx, esi
mov byte [esp + 0x13], 1
call fcn.004a3948
lea ecx, [esp + 0x13]
push dword [eax + 0x20]
push ecx
mov ecx, eax
call fcn.00504549
mov al, 1
pop ebx
pop edi
pop ebp
pop esi
add esp, 0x28
ret 8

Function at 0x4b6824
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
mov ebp, SysReAllocString
lea edi, [esi + 0x9c4]
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, ebp
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x4b683a
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, ebp
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x4b6876
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, ebp
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], ebx
pop esi
pop ebp
pop ebx
ret