joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45dcfb
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0xe0]
mov edx, dword [edx + 0xf0]
cmp edx, ecx
jb 0x45de8b
mov ebx, dword [edi + 0xec]
xor eax, eax
mov edx, esp
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [edx + 0x2c], eax
mov dword [edx], ecx
lea ecx, [esp + 0x30]
mov dword [edx + 4], 1
mov dword [ecx], eax
mov dword [ecx + 4], 4
mov dword [ecx + 8], edx
mov dword [edx + 8], ebx
mov dword [edx + 0x10], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x1c], eax
lea edx, [edi + 0x128]
push eax
push eax
push ecx
push edx
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x45de0f
cmp eax, 0x80090318
je 0x45de61
test eax, eax
jne 0x45de56
mov ecx, dword [esp + 0x14]
mov edx, dword [edi + 0xec]
mov ebp, dword [esp + 0xc]
mov eax, dword [edi + 0xf0]
mov dword [edi + 0xd8], 0
sub ecx, edx
mov ebx, ecx
add ebx, ebp
jb 0x45de95
cmp eax, ebx
jb 0x45dea1
lea eax, [edi + 0xd0]
add edx, ecx
mov ecx, eax
push ebp
call fcn.00402a58
add esp, 4
xor eax, eax
cmp dword [esp + 0x28], 5
mov dword [edi + 0xcc], eax
mov dword [edi + 0xc8], eax
mov edx, dword [edi + 0xe0]
jne 0x45dded
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0045dc69
mov eax, dword [edi + 0xe0]
xor ecx, ecx
or eax, dword [edi + 0xe4]
sete cl
mov dword [edi + 0x154], ecx
jmp 0x45de7e
cmp eax, 0x90317
je 0x45de6e
cmp eax, 0x90321
jne 0x45de56
mov dword [edi + 0x110], 0x10000
mov byte [edi + 0x114], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0xe0]
jne 0x45de41
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0045dc69
mov dword [edi + 0x154], 0
jmp 0x45de7e
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x45de83
cmp dword [esp + 0x10], 4
jne 0x45de75
mov eax, dword [esp + 0xc]
jmp 0x45de78
mov word [esi], 0x104
jmp 0x45de83
xor eax, eax
inc eax
mov dword [edi + 0x154], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5249d8
call fcn.004e8c40
mov edx, ebx
push 0x5249e8
call fcn.004e8e30
mov ecx, ebx
mov edx, eax
push 0x5249e8
call fcn.004e8c40
Function at 0x460581
Capabilities:
Connect socket
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa8
movzx eax, byte [edx + 0x48]
mov esi, edx
mov dword [esp + 0xc], ecx
test eax, eax
je 0x4605bb
cmp eax, 3
je 0x4606a3
mov ecx, str._async_fn__resumed_after_completionC:Usersigame.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_util_0.7.11_srcutilpoll_buf.rs
mov edx, 0x23
push 0x524210
call fcn.004e8ca0
mov eax, dword [esi + 0x20]
mov dword [esi + 0x24], eax
mov dword [esp + 8], eax
mov edx, dword [esi + 2]
movzx ebx, word [esi + 6]
cmp word [esi], 0
je 0x46062b
mov eax, dword [esi + 0x14]
movd xmm0, dword [esi + 0x10]
movq xmm1, qword [esi + 8]
shr edx, 0x10
lea edi, [esp + 0x34]
mov ecx, 0x19
movd xmm2, edx
movzx edx, word [esi + 0x1c]
pinsrw xmm2, ebx, 1
mov dword [esp + 4], eax
mov eax, dword [esi + 0x18]
punpcklqdq xmm1, xmm0
punpcklqdq xmm2, xmm1
rol dx, 8
shufps xmm2, xmm1, 0x98
mov ebx, edx
movups xmmword [edi - 0x14], xmm2
mov dword [edi - 4], eax
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, 0x1c
mov cx, 0x17
mov edx, dword [esp + 4]
jmp 0x460645
lea edi, [esp + 0x20]
xor eax, eax
mov ecx, 0x1e
rol bx, 8
rep stosd dword es:[edi], eax
mov eax, 0x10
mov cx, 2
lea edi, [esp + 0x18]
mov word [edi], cx
mov word [edi + 2], bx
mov dword [edi + 4], edx
mov dword [edi + 0x80], eax
push eax
push edi
push dword [esp + 0x10]
call dword [sym.imp.ws2_32.dll_connect]
test eax, eax
je 0x460692
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 0x10]
mov edi, eax
mov ecx, ebx
mov dword [ebx + 4], eax
mov dword [ebx], 0
call fcn.0040baa4
cmp al, 0xd
jne 0x4606f6
push ebx
call fcn.004015d7
add esp, 4
mov eax, dword [esi + 0x24]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov byte [esi + 0x44], 0
lea ebx, [esi + 0x28]
lea edi, [esp + 0x18]
mov ecx, edi
mov edx, ebx
push dword [ebp + 8]
call fcn.00460758
add esp, 4
cmp dword [edi], 0
je 0x4606c9
mov edx, dword [esp + 0xc]
xor ecx, ecx
mov al, 3
inc ecx
jmp 0x460717
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x28]
mov dword [esp + 4], ecx
mov ecx, ebx
mov dword [esp + 8], eax
mov ebx, edx
call fcn.00460563
mov ecx, edi
mov edi, dword [esp + 4]
mov eax, dword [esp + 8]
jmp 0x460703
xor ebx, ebx
push dword [esi + 0x24]
call dword [sym.imp.ws2_32.dll_closesocket]
xor eax, eax
mov edx, dword [esp + 0xc]
mov dword [edx + 4], eax
mov dword [edx + 8], ebx
mov dword [edx + 0xc], edi
mov dword [edx + 0x10], ecx
mov al, 1
xor ecx, ecx
mov dword [edx], ecx
mov byte [esi + 0x48], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46cedd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
movzx eax, byte [ecx + 0x60]
mov esi, ecx
cmp eax, 3
je 0x46ceff
test eax, eax
jne 0x46cf0d
mov ecx, esi
call fcn.00458e01
add esi, 0xc
mov ecx, esi
pop esi
jmp fcn.0044228f
lea ecx, [esi + 0x3c]
call fcn.0044228f
cmp dword [esi + 0x30], 2
jne 0x46cf0f
pop esi
ret
add esi, 0x30
mov ecx, esi
pop esi
jmp fcn.00458e01
Function at 0x47982a
Capabilities:
Get remote cert context via schannel

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
lea eax, [esp + 4]
mov esi, ecx
add edx, 0x128
mov dword [eax], 0
push eax
push 0x53
push edx
call dword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x47986b
cmp eax, 0x8009030e
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
jne 0x47989c
lea eax, [esp + 0x14]
push eax
jmp 0x4798b1
mov ebx, dword [esp + 4]
lea edi, [esp + 8]
mov ecx, edi
mov edx, dword [ebx + 4]
push dword [ebx + 8]
call fcn.00439535
add esp, 4
mov edi, dword [edi]
cmp edi, 0x80000000
jne 0x4798c0
lea eax, [esp + 0xc]
push eax
call fcn.004015d7
add esp, 4
jmp 0x4798cb
lea ecx, [esp + 0xc]
mov dword [ecx + 4], eax
mov dword [ecx], 0
mov dword [ecx - 4], 1
push ecx
call fcn.004015d7
add esp, 4
mov edi, 0x80000000
jmp 0x4798d5
mov eax, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
mov dword [esp], eax
push ebx
call dword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov eax, dword [esp]
mov dword [esi], edi
mov dword [esi + 4], eax
mov dword [esi + 8], ebp
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x479a56
Capabilities:
Get remote cert context via schannel

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
lea eax, [esp + 4]
mov esi, ecx
add edx, 0x68
mov dword [eax], 0
push eax
push 0x53
push edx
call dword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x479a94
cmp eax, 0x8009030e
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
jne 0x479ac5
lea eax, [esp + 0x14]
push eax
jmp 0x479ada
mov ebx, dword [esp + 4]
lea edi, [esp + 8]
mov ecx, edi
mov edx, dword [ebx + 4]
push dword [ebx + 8]
call fcn.00439535
add esp, 4
mov edi, dword [edi]
cmp edi, 0x80000000
jne 0x479ae9
lea eax, [esp + 0xc]
push eax
call fcn.004015d7
add esp, 4
jmp 0x479af4
lea ecx, [esp + 0xc]
mov dword [ecx + 4], eax
mov dword [ecx], 0
mov dword [ecx - 4], 1
push ecx
call fcn.004015d7
add esp, 4
mov edi, 0x80000000
jmp 0x479afe
mov eax, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
mov dword [esp], eax
push ebx
call dword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov eax, dword [esp]
mov dword [esi], edi
mov dword [esi + 4], eax
mov dword [esi + 8], ebp
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4847c2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov edi, edx
mov edx, dword [esp + 0x38]
lea ebp, [esp + 0x18]
mov dword [esp], ecx
mov ecx, ebp
push 0xb
call fcn.00471945
add esp, 4
lea eax, [esp + 4]
mov ecx, 0x800
xor esi, esi
mov dword [eax], 0x800
lea eax, [esp + 8]
mov dword [eax], esi
call fcn.004098ca
lea ecx, [esp + 0xc]
mov ebp, dword [ebp + 4]
mov ebx, edx
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov dword [ecx + 8], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 4]
push eax
push ebx
lea eax, [esp + 0x10]
push eax
push 0
push ebp
push edi
call esi
cmp eax, 0xea
jne 0x484852
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 4]
sub ecx, edx
cmp ecx, eax
jae 0x484815
lea ecx, [esp + 0xc]
push eax
call fcn.004e895e
add esp, 4
mov ebx, dword [esp + 0x10]
jmp 0x484815
test eax, eax
jne 0x484873
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
cmp eax, 0xb
jbe 0x48489e
mov ecx, dword [esp]
mov dword [ecx + 8], 0xde
jmp 0x484879
mov ecx, dword [esp]
mov dword [ecx + 8], eax
cmp dword [esp + 0xc], 0
mov dword [ecx + 4], 0
mov dword [ecx], 0x80000000
je 0x4848b5
push ebx
push 0
push dword [0x537fc8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4848b5
mov ecx, dword [esp + 0x14]
mov edx, dword [esp]
movsd xmm0, qword [esp + 0xc]
mov dword [edx + 8], ecx
movsd qword [edx], xmm0
mov byte [edx + 0xc], al
cmp dword [esp + 0x18], 0
je 0x4848ce
push dword [esp + 0x1c]
push 0
push dword [0x537fc8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x496996
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
xor eax, eax
cmp dword [edx + 0xc], 0x80000000
mov ebx, ecx
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0x40], 0x400010
je 0x4969f8
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
cmp dword [edx + 0x18], 0x80000000
je 0x496a23
mov eax, dword [edx + 0x20]
test eax, eax
je 0x496a1d
mov esi, dword [edx + 0x1c]
xor ecx, ecx
movzx edi, byte [esi]
inc esi
or ecx, dword [edi*4 + 0x52f460]
dec eax
jne 0x496a0d
jmp 0x496a1f
xor ecx, ecx
mov dword [esp + 0x30], ecx
mov ebp, dword [edx + 8]
xor esi, esi
mov dword [esp], ebx
test ebp, ebp
je 0x496a76
cmp ebp, 0x20000000
jae 0x496b00
mov ebx, dword [edx + 4]
mov al, byte [0x538038]
lea ecx, [ebp*4]
mov edx, 4
mov dword [esp + 0xc], ecx
call fcn.004018b0
test eax, eax
je 0x496b05
mov edi, eax
xor eax, eax
mov ecx, dword [ebx + eax*4]
mov dword [edi + eax*4], ecx
inc eax
cmp ebp, eax
jne 0x496a64
mov ebx, dword [esp]
mov eax, ebp
jmp 0x496a7d
mov edi, 4
xor eax, eax
lea ecx, [esp + 0x10]
mov dword [ecx + 4], eax
lea eax, [esp + 4]
mov dword [ecx + 8], edi
push esi
push eax
push esi
push esi
push ecx
push esi
push 2
push 0x527574
push esi
call dword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x496aae
mov dword [ebx + 4], eax
mov dword [ebx], 0
jmp 0x496ae5
mov esi, dword [esp + 4]
mov ebx, dword [esp + 8]
mov al, byte [0x538038]
mov ecx, 0x10
mov edx, 4
call fcn.004018b0
test eax, eax
je 0x496b13
mov edx, dword [esp]
xor ecx, ecx
inc ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
mov dword [eax + 0xc], ebx
mov dword [edx + 4], eax
mov byte [edx], 4
test ebp, ebp
je 0x496af8
push edi
push 0
push dword [0x537fc8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004019f0
mov edx, dword [esp + 0xc]
mov ecx, 4
call fcn.004e8800
mov ecx, 4
mov edx, 0x10
call fcn.004e8800
Function at 0x498142
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, ecx
lea eax, [esp + 0xc]
push 4
push eax
push dword [esp + 0x10]
push 0xffff
push edx
call dword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x498166
mov byte [esi], 4
jmp 0x498175
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
pop esi
ret
Function at 0x498490
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4c38b0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x537fe0]
test al, al
je 0x498661
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4984dc
cmp eax, 3
jne 0x49865a
mov ebx, dword [0x537fe4]
test ebx, ebx
je 0x49865a
mov dword [ebp - 0x20], 0
jmp 0x498507
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x498538
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4986ab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x498500
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x498500
test byte [ebp - 0x20], 1
je 0x49865a
mov ebx, dword [0x537fe4]
test ebx, ebx
je 0x49865a
mov dword [ebp - 0x20], 0
jmp 0x498567
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x498598
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4986ab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x498560
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x498560
test byte [ebp - 0x20], 1
je 0x49865a
mov ebx, dword [0x537fe4]
test ebx, ebx
je 0x49865a
mov dword [ebp - 0x20], 0
jmp 0x4985c7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4985f8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4986ab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4985c0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4985c0
test byte [ebp - 0x20], 1
je 0x49865a
mov ebx, dword [0x537fe4]
test ebx, ebx
je 0x49865a
mov dword [ebp - 0x20], 0
jmp 0x498627
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x498654
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4986ab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x498620
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x498620
test byte [ebp - 0x20], 1
jne 0x498674
movzx eax, byte [0x5338f0]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x537fe4]
jmp 0x49867f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x49865a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4986ab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49867c
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x49867c
mov dword [ebp - 0x10], 0
mov ecx, str.called__Option::unwrap____on_a__None__value
mov edx, 0x2b
push 0x529de8
call fcn.004e8ca0
add esp, 4
ud2
Function at 0x499480
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x537058]
test eax, eax
je 0x499538
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x4994ac
cmp dword [eax + 4], 0
mov edi, eax
je 0x4994ac
add edi, 8
jmp 0x499533
mov eax, dword [0x537058]
test eax, eax
je 0x499547
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x499531
mov esi, eax
test eax, eax
jne 0x499507
movzx eax, byte [0x538038]
mov ecx, 0xc
mov edx, 4
call fcn.004018b0
test eax, eax
je 0x499562
mov dword [eax], 0x537058
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x537058]
test eax, eax
je 0x499556
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x499533
test ecx, ecx
je 0x499533
lock dec dword [ecx]
jne 0x499533
call fcn.00499000
jmp 0x499533
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x537058
call fcn.004ec360
jmp 0x499490
mov ecx, 0x537058
call fcn.004ec360
jmp 0x4994ba
mov ecx, 0x537058
call fcn.004ec360
jmp 0x4994ff
mov ecx, 4
mov edx, 0xc
call fcn.004e8800
int3
Function at 0x49a200
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x49a254
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x49a277
test eax, eax
js 0x49a263
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x49a26f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x5296a0
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.00498ac0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.00498c20
mov ecx, 7
int 0x29
ud2
Function at 0x49a910
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x537048]
test eax, eax
je 0x49a9a8
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x49a936
cmp dword [eax + 4], 0
je 0x49a936
add eax, 8
pop esi
ret
mov eax, dword [0x537048]
test eax, eax
je 0x49a9b7
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x49a9a4
mov esi, eax
test eax, eax
jne 0x49a98d
movzx eax, byte [0x538038]
mov ecx, 0x10
mov edx, 4
call fcn.004018b0
test eax, eax
je 0x49a9d2
mov dword [eax], 0x537048
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x537048]
test eax, eax
je 0x49a9c6
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x537048
call fcn.004ec360
jmp 0x49a91f
mov ecx, 0x537048
call fcn.004ec360
jmp 0x49a940
mov ecx, 0x537048
call fcn.004ec360
jmp 0x49a985
mov ecx, 4
mov edx, 0x10
call fcn.004e8800
int3

Function at 0x49b760
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x34], 0x4c3a30
lea eax, [esi + 0x30]
mov ecx, dword fs:[0]
mov dword [esi + 0x30], ecx
mov dword fs:[0], eax
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x49b873
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
mov dword [esi], eax
call fcn.0049b910
mov ecx, eax
or ecx, edx
je 0x49b85f
push edx
push eax
push ebx
push dword [esi]
mov edi, edx
mov dword [esi + 0x20], edx
mov dword [esi + 0x1c], eax
call fcn.004e41c0
mov ecx, edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 4], edx
mov dword [esi + 0x24], eax
imul ecx, eax
mul edi
add edx, ecx
mov ecx, edi
imul ecx, dword [esi + 4]
add ecx, edx
mov edx, dword [esi]
sub edx, eax
sbb ebx, ecx
mov eax, edx
imul ecx, ebx, 0x3b9aca00
mov ebx, 0x3b9aca00
mul ebx
add edx, ecx
push dword [esi + 0x20]
push edi
push edx
push eax
call fcn.004e41c0
mov ebx, eax
mov eax, dword [esi + 0x24]
mov ecx, edx
mov edx, 0x3b9aca00
mul edx
mov edi, eax
imul eax, dword [esi + 4], 0x3b9aca00
add eax, edx
add edi, ebx
adc eax, ecx
push 0
push 0x3b9aca00
push eax
push edi
call fcn.004e41c0
imul ecx, eax, 0xc4653600
add ecx, edi
mov edi, dword [esi + 0x30]
mov dword fs:[0], edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.attempt_to_divide_by_zerocalled__Result::unwrap____on_an__Err__value
mov edx, 0x19
push 0x528f78
call fcn.004e8ca0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x38], 0
lea eax, [esi + 0x14]
mov ecx, 0x52e639
mov edx, 0x2b
push 0x529ee4
push 0x527b0c
push eax
call fcn.004e8f30
add esp, 0xc
ud2
Function at 0x4a12a0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x4a12ed
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x4a12fd
mov dword [esi + 4], 0
jmp 0x4a130f
cmp eax, 0x103
je 0x4a1327
test eax, eax
js 0x4a1318
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x4a1312
mov eax, esp
mov dword [esp + 0x1c], 0x5296a0
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.00498ac0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.00498c20
mov ecx, 7
int 0x29
ud2

Function at 0x4a32b0
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov ecx, esp
push dword [esp + 0x28]
call fcn.0049b090
add esp, 4
mov ecx, dword [esp]
mov edi, dword [esp + 4]
mov eax, dword [esp + 8]
cmp ecx, 0x80000000
je 0x4a3308
mov dword [esp], ecx
mov dword [esp + 4], edi
mov dword [esp + 8], eax
lea ecx, [esp + 0xc]
mov edx, esp
push 1
call fcn.004a1500
add esp, 4
mov ebx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
cmp ebx, 0x80000000
jne 0x4a3314
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
mov dword [esi], edi
add esp, 0x18
pop esi
pop edi
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4a332a
mov byte [esi], 4
test ebx, ebx
jne 0x4a333a
jmp 0x4a330d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x4a330d
push edi
push 0
push dword [0x537fc8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4a330d
Function at 0x4a4ac0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x537078]
test eax, eax
je 0x4a4b78
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x4a4aec
cmp dword [eax + 4], 0
mov edi, eax
je 0x4a4aec
add edi, 8
jmp 0x4a4b73
mov eax, dword [0x537078]
test eax, eax
je 0x4a4b87
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4a4b71
mov esi, eax
test eax, eax
jne 0x4a4b47
movzx eax, byte [0x538038]
mov ecx, 0xc
mov edx, 4
call fcn.004018b0
test eax, eax
je 0x4a4ba2
mov dword [eax], 0x537078
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x537078]
test eax, eax
je 0x4a4b96
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x4a4b73
test ecx, ecx
je 0x4a4b73
lock dec dword [ecx]
jne 0x4a4b73
call fcn.004a4bc0
jmp 0x4a4b73
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x537078
call fcn.004ec360
jmp 0x4a4ad0
mov ecx, 0x537078
call fcn.004ec360
jmp 0x4a4afa
mov ecx, 0x537078
call fcn.004ec360
jmp 0x4a4b3f
mov ecx, 4
mov edx, 0xc
call fcn.004e8800
int3