joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3390
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4ed910
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
cmp eax, 3
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
je 0x4c33ce
test eax, eax
jne 0x4c354a
mov ebx, dword [0x58bab4]
test ebx, ebx
je 0x4c354a
mov dword [ebp - 0x20], 0
jmp 0x4c33f7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4c3428
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4c359b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4c33f0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4c33f0
test byte [ebp - 0x20], 1
je 0x4c354a
mov ebx, dword [0x58bab4]
test ebx, ebx
je 0x4c354a
mov dword [ebp - 0x20], 0
jmp 0x4c3457
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4c3488
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4c359b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4c3450
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4c3450
test byte [ebp - 0x20], 1
je 0x4c354a
mov ebx, dword [0x58bab4]
test ebx, ebx
je 0x4c354a
mov dword [ebp - 0x20], 0
jmp 0x4c34b7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4c34e8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4c359b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4c34b0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4c34b0
test byte [ebp - 0x20], 1
je 0x4c354a
mov ebx, dword [0x58bab4]
test ebx, ebx
je 0x4c354a
mov dword [ebp - 0x20], 0
jmp 0x4c3517
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4c3544
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4c359b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4c3510
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4c3510
test byte [ebp - 0x20], 1
jne 0x4c3564
movzx eax, byte [0x587240]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x58bab4]
jmp 0x4c356f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4c354a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4c359b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4c356c
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x4c356c
mov dword [ebp - 0x10], 0
mov ecx, str.called__Option::unwrap____on_a__None__value
mov edx, 0x2b
push 0x558050
call fcn.0050d590
add esp, 4
ud2
Function at 0x4c3df0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4ed990
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x58b0dc]
test eax, eax
je 0x4c3ee2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4c3e46
cmp dword [eax], 0
mov edi, eax
je 0x4c3e46
add edi, 4
jmp 0x4c3ecf
mov eax, dword [0x58b0dc]
test eax, eax
je 0x4c3ef1
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4c3ecd
mov esi, eax
test eax, eax
jne 0x4c3e9e
mov ecx, 0x10
mov edx, 4
call fcn.00415e00
test eax, eax
je 0x4c3f0c
mov dword [eax], 0
mov dword [eax + 0xc], 0x58b0dc
mov esi, eax
mov eax, dword [0x58b0dc]
test eax, eax
je 0x4c3f00
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
je 0x4c3ecf
test ecx, ecx
je 0x4c3ecf
lock dec dword [ecx]
jne 0x4c3ecf
call fcn.004c3f60
jmp 0x4c3ecf
xor edi, edi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x58b0dc
call fcn.0050f990
jmp 0x4c3e2b
mov ecx, 0x58b0dc
call fcn.0050f990
jmp 0x4c3e54
mov ecx, 0x58b0dc
call fcn.0050f990
jmp 0x4c3e96
mov ecx, 0x10
mov edx, 4
mov dword [ebp - 0x10], 0
call fcn.0050d210
ud2

Function at 0x4c49a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x58b0b4]
test eax, eax
je 0x4c4a1d
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4c49bf
cmp byte [eax + 4], 0
mov esi, eax
jne 0x4c4a12
mov eax, dword [0x58b0b4]
test eax, eax
je 0x4c4a29
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4c4a17
mov esi, eax
test eax, eax
jne 0x4c4a0c
mov ecx, 8
mov edx, 4
call fcn.00415e00
test eax, eax
je 0x4c4a41
mov dword [eax], 0x58b0b4
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x58b0b4]
test eax, eax
je 0x4c4a35
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x4c4a19
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x58b0b4
call fcn.0050f990
jmp 0x4c49ab
mov ecx, 0x58b0b4
call fcn.0050f990
jmp 0x4c49c9
mov ecx, 0x58b0b4
call fcn.0050f990
jmp 0x4c4a04
mov ecx, 8
mov edx, 4
call fcn.0050d210
ud2
Function at 0x4c56c0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x50
mov eax, dword [esp + 0x5c]
mov esi, ecx
mov ecx, dword [esp + 0x60]
mov edi, edx
mov dword [esp], 0x103
mov dword [esp + 4], 0
mov edx, esp
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x4c5710
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp]
cmp eax, 0x103
je 0x4c5736
test eax, eax
js 0x4c5720
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x4c5730
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
mov dword [esi], 0
add esp, 0x50
pop esi
pop edi
ret
lea eax, [esp + 0x38]
mov dword [esp + 0x28], 0x556640
mov dword [esp + 0x2c], 2
mov dword [esp + 0x20], 0
lea esi, [esp + 0x18]
mov dword [esp + 8], 0
mov dword [esp + 0x40], 0x557a30
mov dword [esp + 0x44], 1
mov dword [esp + 0x38], 0
mov dword [esp + 0x48], str._rustc_90c541806f23a127002de5b4038be731ba1458calibrarycore_src_strpattern.rs
mov byte [esp + 0xc], 0
mov dword [esp + 0x4c], 0
lea ecx, [esp + 8]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x41a610
mov dword [esp + 0x30], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x34], 1
push eax
push ecx
push esi
call fcn.004c39b0
add esp, 0xc
cmp byte [esp + 0x18], 4
je 0x4c57ca
push esi
call fcn.004c3b00
add esp, 4
mov ecx, 7
int 0x29
ud2
Function at 0x4c5dd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x58b0ec]
test eax, eax
je 0x4c5e57
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4c5df1
cmp dword [eax], 0
je 0x4c5df1
add eax, 4
pop esi
ret
mov eax, dword [0x58b0ec]
test eax, eax
je 0x4c5e66
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4c5e53
mov esi, eax
test eax, eax
jne 0x4c5e41
mov ecx, 0xc
mov edx, 4
call fcn.00415e00
test eax, eax
je 0x4c5e7e
mov dword [eax], 0
mov dword [eax + 8], 0x58b0ec
mov esi, eax
mov eax, dword [0x58b0ec]
test eax, eax
je 0x4c5e72
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi], 1
lea eax, [esi + 4]
mov dword [esi + 4], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x58b0ec
call fcn.0050f990
jmp 0x4c5ddb
mov ecx, 0x58b0ec
call fcn.0050f990
jmp 0x4c5dfb
mov ecx, 0x58b0ec
call fcn.0050f990
jmp 0x4c5e39
mov ecx, 0xc
mov edx, 4
call fcn.0050d210
ud2
Function at 0x4cc1c0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x50
mov eax, dword [esp + 0x5c]
mov esi, ecx
mov ecx, dword [esp + 0x60]
mov edi, edx
mov dword [esp], 0x103
mov dword [esp + 4], 0
mov edx, esp
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x4cc209
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp]
cmp eax, 0xc0000011
jne 0x4cc219
mov dword [esi + 4], 0
jmp 0x4cc22b
cmp eax, 0x103
je 0x4cc246
test eax, eax
js 0x4cc234
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x50
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x4cc22e
lea eax, [esp + 0x38]
mov dword [esp + 0x28], 0x556640
mov dword [esp + 0x2c], 2
mov dword [esp + 0x20], 0
lea esi, [esp + 0x18]
mov dword [esp + 8], 0
mov dword [esp + 0x40], 0x557a30
mov dword [esp + 0x44], 1
mov dword [esp + 0x38], 0
mov dword [esp + 0x48], str._rustc_90c541806f23a127002de5b4038be731ba1458calibrarycore_src_strpattern.rs
mov byte [esp + 0xc], 0
mov dword [esp + 0x4c], 0
lea ecx, [esp + 8]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x41a610
mov dword [esp + 0x30], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x34], 1
push eax
push ecx
push esi
call fcn.004c39b0
add esp, 0xc
cmp byte [esp + 0x18], 4
je 0x4cc2da
push esi
call fcn.004c3b00
add esp, 4
mov ecx, 7
int 0x29
ud2

Function at 0x4cd4a0
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov esi, ecx
mov ecx, esp
push dword [esp + 0x30]
call fcn.004c6640
add esp, 4
cmp dword [esp], 0
je 0x4cd4c6
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
jmp 0x4cd4f7
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], edx
lea ecx, [esp + 0x10]
mov edx, esp
call fcn.004cc2f0
cmp dword [esp + 0x10], 0
je 0x4cd503
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], ecx
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x4cd521
mov byte [esi], 4
test ebx, ebx
jne 0x4cd53b
jmp 0x4cd4fc
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x4cd4fc
mov ecx, edi
mov edx, 2
call fcn.00415e60
jmp 0x4cd4fc
Function at 0x4cf060
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4edc60
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x58b0a4]
test eax, eax
je 0x4cf14b
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4cf0b6
cmp dword [eax], 0
mov edi, eax
je 0x4cf0b6
add edi, 4
jmp 0x4cf138
mov eax, dword [0x58b0a4]
test eax, eax
je 0x4cf15a
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4cf136
mov esi, eax
test eax, eax
jne 0x4cf10e
mov ecx, 0xc
mov edx, 4
call fcn.00415e00
test eax, eax
je 0x4cf175
mov dword [eax], 0
mov dword [eax + 8], 0x58b0a4
mov esi, eax
mov eax, dword [0x58b0a4]
test eax, eax
je 0x4cf169
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 4]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
je 0x4cf138
test ecx, ecx
je 0x4cf138
lock dec dword [ecx]
jne 0x4cf138
call fcn.004cf1b0
jmp 0x4cf138
xor edi, edi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x58b0a4
call fcn.0050f990
jmp 0x4cf09b
mov ecx, 0x58b0a4
call fcn.0050f990
jmp 0x4cf0c4
mov ecx, 0x58b0a4
call fcn.0050f990
jmp 0x4cf106
mov ecx, 0xc
mov edx, 4
mov dword [ebp - 0x10], 0
call fcn.0050d210
ud2
Function at 0x4cf730
Capabilities:
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1a8
mov edi, dword [edx]
mov ebp, dword [edx + 4]
movzx ebx, word [edx + 8]
mov eax, dword [0x58baac]
mov esi, ecx
cmp eax, 3
jne 0x4cf84b
cmp ebp, 0x17f
ja 0x4cf85c
mov dword [esp + 4], ebx
lea ebx, [esp + 0x28]
push ebp
push edi
push ebx
call fcn.005010b0
add esp, 0xc
lea edi, [ebp + 1]
cmp ebp, 6
mov byte [esp + ebp + 0x28], 0
ja 0x4cf7a6
lea eax, [ebp + 1]
xor edx, edx
nop word cs:[eax + eax]
nop
cmp byte [esp + edx + 0x28], 0
je 0x4cf7bb
inc edx
cmp eax, edx
jne 0x4cf790
xor eax, eax
mov edx, edi
test eax, eax
jne 0x4cf7c4
jmp 0x4cf812
lea edx, [esp + 0x28]
xor ecx, ecx
push edi
call fcn.0041ac30
add esp, 4
test eax, eax
jne 0x4cf7c4
jmp 0x4cf812
mov eax, 1
test eax, eax
je 0x4cf812
cmp edx, ebp
jne 0x4cf812
xorps xmm0, xmm0
mov eax, esp
mov dword [esp], 0
lea ecx, [esp + 8]
movups xmmword [esp + 8], xmm0
movups xmmword [esp + 0x18], xmm0
mov dword [esp + 0x10], 1
push eax
push ecx
push 0
push ebx
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x4cf82b
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, 1
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], ecx
jmp 0x4cf840
mov eax, dword [0x557150]
mov ecx, dword [0x557154]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 1
jmp 0x4cf840
mov eax, dword [esp]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov eax, dword [esp + 4]
mov word [esi + 0xc], ax
xor eax, eax
mov dword [esi], eax
add esp, 0x1a8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0050ff20
cmp ebp, 0x17f
jbe 0x4cf75f
mov ecx, esi
mov edx, edi
push ebx
push ebp
call fcn.0050ff70
add esp, 0x1b0
jmp 0x4cf846

Function at 0x4d02f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4edcc0
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, edx
mov dword [ebp - 0x24], ecx
mov ecx, 8
mov edx, 4
mov eax, dword fs:[0]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], edi
call fcn.00415e00
test eax, eax
je 0x4d03cf
mov dword [eax], ebx
mov dword [eax + 4], edi
push 0
push 0x10000
mov dword [ebp - 0x20], eax
push eax
push 0x4d0460
push esi
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x4d0371
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 4], eax
mov byte [ecx], 4
jmp 0x4d03be
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x10], 1
push eax
call dword [ecx]
add esp, 4
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 4]
cmp dword [eax + 4], 0
je 0x4d03a2
mov ecx, dword [ebp - 0x20]
mov edx, dword [eax + 8]
mov ecx, dword [ecx]
call fcn.00415e60
mov ecx, dword [ebp - 0x20]
mov edx, 4
call fcn.00415e60
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 4], eax
mov dword [ecx], 0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 8
mov edx, 4
mov dword [ebp - 0x10], 0
call fcn.0050d210
ud2
Function at 0x4d0580
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x4edce0
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x4d05fe
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
lea edx, [esi + 8]
lea ecx, [esi + 0x28]
mov dword [esi + 0x38], 0x557c50
mov dword [esi + 0x3c], 1
mov dword [esi + 0x30], 0
mov dword [esi + 0xc], eax
mov dword [esi + 8], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x40], ecx
lea ecx, [esi + 0x30]
mov edx, 0x557c7c
mov dword [esi + 0x2c], fcn.004ca230
mov dword [esi + 0x44], 1
call fcn.0050d4d0
ud2

Function at 0x4d4450
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x58b094]
test eax, eax
je 0x4d4555
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4d4481
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x4d454a
mov eax, dword [0x58b094]
test eax, eax
je 0x4d4564
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4d4527
mov esi, eax
test eax, eax
jne 0x4d44e8
mov ecx, 0x20
mov edx, 8
call fcn.00415e00
test eax, eax
je 0x4d4582
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x58b094
mov esi, eax
mov eax, dword [0x58b094]
test eax, eax
je 0x4d4573
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [ebp + 8]
test eax, eax
je 0x4d4507
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
cmp ecx, 1
je 0x4d4539
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x4d452b
movaps xmm0, xmmword [esp]
jmp 0x4d4539
xor esi, esi
jmp 0x4d454d
lea ecx, [esp + 0x10]
call fcn.004d0580
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x58b094
call fcn.0050f990
jmp 0x4d4468
mov ecx, 0x58b094
call fcn.0050f990
jmp 0x4d448f
mov ecx, 0x58b094
call fcn.0050f990
jmp 0x4d44e0
mov ecx, 0x20
mov edx, 8
call fcn.0050d210
ud2
Function at 0x4d9b03
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov esi, ecx
lea edi, [esp + 0x40]
xorps xmm0, xmm0
movaps xmmword [edi], xmm0
movaps xmmword [edi + 0x30], xmm0
movaps xmmword [edi + 0x20], xmm0
movaps xmmword [edi + 0x10], xmm0
mov dword [edi], 0x40
push edi
call sub.kernel32.dll_GlobalMemoryStatusEx
movsd xmm0, qword [edi + 8]
mov eax, esp
and dword [eax + 0x34], 0
and dword [eax + 0x30], 0
movsd qword [esi + 0x90], xmm0
movsd xmm0, qword [edi + 0x10]
movsd qword [esi + 0x98], xmm0
xorps xmm0, xmm0
movaps xmmword [eax + 0x20], xmm0
movaps xmmword [eax + 0x10], xmm0
movaps xmmword [eax], xmm0
push 0x38
push eax
call sub.psapi.dll_GetPerformanceInfo
cmp eax, 1
jne 0x4d9bcc
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
xor edi, edi
sub edx, eax
cmovb edx, edi
sub ebx, eax
mov eax, ecx
cmovb ebx, edi
mul edx
mov edx, 0
cmovo edx, edx
mov dword [esi + 0xa4], edx
mov edx, 0xffffffff
cmovo eax, edx
mov dword [esi + 0xa0], eax
mov eax, ecx
mov ecx, 0xffffffff
mul ebx
cmovo eax, ecx
cmovo edi, edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xa8], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4da85f
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, ecx
lea edi, [ecx + 0x38]
imul ebx, edx, 0x50
test ebx, ebx
je 0x4da8af
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
je 0x4da8a4
and dword [esp], 0
and dword [esp + 4], 0
mov eax, esp
push eax
push 0
push 0
push dword [edi]
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x4da8a4
movsd xmm0, qword [esp]
movsd qword [edi - 0x20], xmm0
add esi, 0x50
add edi, 0x50
add ebx, 0xffffffb0
jmp 0x4da873
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4db2e6
Capabilities:
Reference wmi statements

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
and dword [esp], 0
cmp dword [edx + 8], 0
mov esi, edx
mov edi, ecx
je 0x4db375
push 0x558bc6
call sub.oleaut32.dll_SysAllocString
mov ebx, eax
push str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov ecx, dword [esi + 0xc]
mov ebp, eax
mov edx, esp
mov eax, dword [ecx]
push edx
push 0
push 0x30
push ebp
push ebx
push ecx
call dword [eax + 0x50]
mov dword [esp + 4], eax
push ebx
call sub.oleaut32.dll_SysFreeString
push ebp
call sub.oleaut32.dll_SysFreeString
cmp dword [esp + 4], 0
js 0x4db375
mov ebx, dword [esp]
lea ecx, [esi + 0x10]
call fcn.004d7fde
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], ebx
movsd xmm1, qword [esi + 8]
mov eax, dword [esi + 0x18]
movsd xmm0, qword [esi]
movsd qword [edi + 8], xmm1
movsd xmm1, qword [esi + 0x10]
mov dword [edi + 0x18], eax
movsd qword [edi], xmm0
movsd qword [edi + 0x10], xmm1
jmp 0x4db382
mov ecx, esi
mov dword [edi], 2
call fcn.004d7f61
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4db8e5
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [ecx]
test eax, eax
je fcn.0050f990
dec eax
ret

Function at 0x4dc44c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov esi, ecx
mov ecx, 0x58b110
call fcn.004db8e5
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4dc484
mov ebx, eax
mov eax, dword [eax]
or eax, dword [ebx + 4]
je 0x4dc484
add ebx, 8
jmp 0x4dc53a
mov ecx, 0x58b110
call fcn.004db8e5
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4dc4f7
mov ebx, eax
test eax, eax
jne 0x4dc4cd
push 0x50
pop ecx
push 8
pop edx
call fcn.00423cc6
and dword [eax + 4], 0
and dword [eax], 0
mov ecx, 0x58b110
mov ebx, eax
mov dword [eax + 0x48], 0x58b110
call fcn.004db8e5
push ebx
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x4dc502
push 0x12
pop ecx
mov eax, esp
mov edx, esi
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
and dword [edx], 0
and dword [edx + 4], 0
or ecx, dword [eax + 4]
je 0x4dc4fb
lea esi, [esp + 8]
push 0x10
pop ecx
lea edi, [esp + 0x48]
jmp 0x4dc50e
xor ebx, ebx
jmp 0x4dc53a
mov ecx, esp
call fcn.004db8f1
push 0x10
pop ecx
lea edi, [esp + 0x48]
mov esi, 0x559d00
rep movsd dword es:[edi], dword [esi]
push 0x12
pop ecx
mov eax, esp
mov esi, ebx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebx], 1
and dword [ebx + 4], 0
add ebx, 8
push 0x10
pop ecx
lea esi, [esp + 0x48]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
call fcn.004db8f1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4e04a2
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x4e04a4
test al, 1
je 0x4e04bb
test al, 2
jne 0x4e04ca
xor eax, 3
ret
push 0x23
pop edx
mov ecx, str.assertion_failed:_prev.is_running__
push 0x55add8
jmp 0x4e04d7
push 0x25
pop edx
mov ecx, 0x55ade8
push 0x55ae10
call fcn.0050d590
pop eax
ud2

Function at 0x4e0bfe
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push eax
mov bl, byte [esp + 0x10]
mov esi, ecx
mov ecx, edx
call fcn.004dfec5
mov eax, dword [eax + 4]
movzx ecx, bl
mov edx, esp
mov dword [edx], ecx
push 4
push edx
push 1
push 6
push eax
call sub.ws2_32.dll_setsockopt
mov cl, 4
cmp eax, 0xffffffff
jne 0x4e0c40
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
and word [esi + 1], 0
xor ecx, ecx
mov byte [esi + 3], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 4
pop esi
pop ebx
ret