joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c670
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x11c], 0
cmp dword [ebp + 0x10], 0xb
jne 0x41c6d8
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x120]
push eax
call fcn.0041d250
add esp, 0x18
jmp 0x41c8a2
cmp dword [ebp + 0xc], 0
jne 0x41c6fb
push 0x100
lea ecx, [ebp - 0x108]
push ecx
call fcn.00414160
add esp, 8
lea edx, [ebp - 0x108]
mov dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0
je 0x41c866
cmp dword [ebp + 0x10], 2
jne 0x41c80b
push 0x20
push 0
lea eax, [ebp - 0x14c]
push eax
call fcn.00465af0
add esp, 0xc
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 1
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x140], 0
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x14c]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x41c801
mov ecx, dword [ebp - 0x114]
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x10c], 0
je 0x41c7ff
mov edx, dword [ebp - 0x10c]
cmp dword [edx + 4], 2
jne 0x41c7be
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x124], ecx
movzx edx, word [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp - 0x124]
mov word [ecx + 2], ax
jmp 0x41c7ee
mov edx, dword [ebp - 0x10c]
cmp dword [edx + 4], 0x17
jne 0x41c7ee
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x128], ecx
movzx edx, word [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp - 0x128]
mov word [ecx + 2], ax
mov edx, dword [ebp - 0x10c]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x10c], eax
jmp 0x41c783
jmp 0x41c80b
mov dword [ebp - 0x11c], 1
cmp dword [ebp - 0x11c], 0
je 0x41c866
push 0
call fcn.0041c610
add esp, 4
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x41c835
mov eax, dword [ebp - 0x110]
jmp 0x41c8a2
mov ecx, dword [ebp - 0x110]
mov dword [ecx + 0x58], 0xffffff28
mov edx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x118]
mov dword [edx + 0x5c], eax
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, dword [ebp - 0x110]
jmp 0x41c8a2
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
call fcn.0041d250
add esp, 0x18
mov dword [ebp - 0x12c], eax
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret
Function at 0x424540
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x68]
push eax
call fcn.00425130
add esp, 4
mov dword [ebp - 0x1ac], eax
mov ecx, dword [ebp - 0x1ac]
push ecx
push 0x4e34c8
lea edx, [ebp - 0x68]
push edx
call fcn.00404080
add esp, 0xc
cmp dword [ebp - 0x1ac], 0
je 0x424593
mov eax, dword [ebp - 0x1ac]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x42459b
mov eax, dword [ebp + 0x18]
jmp 0x42465c
mov dword [ebp - 0x1b0], 0xffffffff
lea edx, [ebp - 0x1a8]
push edx
mov eax, dword [ebp - 0x1ac]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xffffffff
je 0x424659
lea ecx, [ebp - 0x1b4]
push ecx
lea edx, [ebp - 0x17c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00425fe0
add esp, 0xc
test eax, eax
je 0x424634
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x42460b
mov eax, dword [ebp - 0x1b4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00478950
add esp, 8
test eax, eax
jne 0x424634
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x1b4]
push edx
lea eax, [ebp - 0x17c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004260c0
add esp, 0x18
mov dword [ebp + 0x18], eax
lea edx, [ebp - 0x1a8]
push edx
mov eax, dword [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4245cc
mov ecx, dword [ebp - 0x1b0]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret
Function at 0x429d60
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b0
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x68]
push eax
call fcn.0042ba40
add esp, 4
mov dword [ebp - 0x1ac], eax
mov ecx, dword [ebp - 0x1ac]
push ecx
push 0x4e39bc
lea edx, [ebp - 0x68]
push edx
call fcn.00404080
add esp, 0xc
cmp dword [ebp - 0x1ac], 0
je 0x429db3
mov eax, dword [ebp - 0x1ac]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x429dbb
mov eax, dword [ebp + 0x18]
jmp 0x429e4d
mov dword [ebp - 0x1b0], 0xffffffff
lea edx, [ebp - 0x1a8]
push edx
mov eax, dword [ebp - 0x1ac]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xffffffff
je 0x429e4a
lea ecx, [ebp - 0x17c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042bc60
add esp, 8
test eax, eax
je 0x429e25
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x17c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042bce0
add esp, 0x18
mov dword [ebp + 0x18], eax
lea eax, [ebp - 0x1a8]
push eax
mov ecx, dword [ebp - 0x1b0]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x429de8
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret
Function at 0x439c70
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x5c], 0
mov eax, 1
ret
Function at 0x444d50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x58], 0x10000000
mov dword [ebp - 0x5c], 3
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x48]
push ecx
push 0
push 1
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov edx, dword [ebp - 0x50]
add edx, 0x10
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
push eax
push 0
call fcn.004166d0
add esp, 8
mov dword [ebp - 0x4c], eax
push 2
mov ecx, dword [ebp - 0x54]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
push 2
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAceEx]
push 1
lea ecx, [ebp - 0x7c]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
mov edx, dword [ebp - 0x4c]
push edx
push 1
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x64], ecx
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.004166b0
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret

Function at 0x4481b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x50], 0
push str.RLM_SKIP_UUID
call fcn.00482fd0
add esp, 4
test eax, eax
je 0x4481e2
mov eax, 1
jmp 0x44828a
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov byte [edx + ecx], 0
lea eax, [ebp - 0x60]
push eax
push 0
lea ecx, [ebp - 0x48]
push ecx
push 0x4482a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x44821e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x50], eax
jmp 0x448287
push str.RLM_UUID_THREAD_TIMEOUT
call fcn.00482fd0
add esp, 4
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x448245
mov edx, dword [ebp - 0x54]
push edx
call fcn.00479f10
add esp, 4
mov dword [ebp - 0x58], eax
jmp 0x44824c
mov dword [ebp - 0x58], 0xea60
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x448277
push 0x40
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00483980
add esp, 0xc
jmp 0x44827d
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret
Function at 0x44b0a0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 1
mov eax, dword [ebp + 0xc]
push eax
push str._s
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00404080
add esp, 0xc
mov edx, 1
test edx, edx
je 0x44b18e
cmp dword [ebp - 0x254], 0
je 0x44b126
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0xffffffff
jne 0x44b11a
jmp 0x44b18e
mov dword [ebp - 0x254], 0
jmp 0x44b140
lea edx, [ebp - 0x24c]
push edx
mov eax, dword [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x44b140
jmp 0x44b18e
push str.bootstat.dat
lea ecx, [ebp - 0x220]
push ecx
call fcn.00478950
add esp, 8
test eax, eax
jne 0x44b15a
jmp 0x44b0df
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x220]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0044afe0
add esp, 0x14
test eax, eax
je 0x44b189
mov dword [ebp - 0x258], 1
jmp 0x44b18e
jmp 0x44b0df
cmp dword [ebp - 0x250], 0xffffffff
je 0x44b1a4
mov ecx, dword [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret
Function at 0x44c560
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.00464c10
mov eax, dword [0x4efa64]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x44c5d5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x44c5d5
mov esi, dword [esp + 0x110]
push 2
call fcn.0046a210
add esp, 4
lea ecx, [esp + 0x114]
push ecx
push 0
push esi
push eax
call fcn.00403f50
push dword [eax + 4]
push dword [eax]
call fcn.00478760
add esp, 0x18
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00464bf6
add esp, 0x108
ret
lea eax, [esp + 0x114]
push eax
push 0
push dword [esp + 0x118]
lea eax, [esp + 0x14]
push 0xff
push eax
call fcn.00403f50
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.00478850
add esp, 0x1c
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x44c672
call fcn.0044c480
test eax, eax
je 0x44c672
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00464bf6
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.00464bf6
add esp, 0x108
ret

Function at 0x450e00
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x20
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.00465af0
add esp, 0xc
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 1
push 0x4f307c
lea ecx, [ebp - 0x24]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x450e44
jmp 0x450e4b
mov eax, 2
jmp 0x450e5b
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00450d80
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x45ee00
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x68], 0
mov dword [eax + 0x6c], 0x1c
mov eax, 1
ret

Function at 0x45f170
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x68], 0
mov dword [eax + 0x6c], 0x20
mov eax, 1
ret
Function at 0x46584d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x46588c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46588c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46588c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x46588c
cmp dword [ecx + 0x74], 0xe
jbe 0x46588c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x469e60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00469a80
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x469e92
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x4ba2cc]
call dword [ebp - 8]
jmp 0x469e9c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret

Function at 0x4893c0
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x1a
jbe 0x489456
call fcn.0048a010
mov dword [eax], 0xf
xor eax, eax
je 0x4893f0
mov dword [ebp - 0x14], 1
jmp 0x4893f7
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x489426
push str.__Invalid_Drive_Index___0_
push 0x4c2524
push 0
push 0x1f
push str.minkernelcrtsucrt_srcdesktopcrtmiscgetcwd.cpp
push 2
call fcn.00499480
add esp, 0x18
cmp eax, 1
jne 0x489426
int3
cmp dword [ebp - 0x18], 0
jne 0x489456
call fcn.0048a040
mov dword [eax], 0xd
push 0
push 0x1f
push str.minkernelcrtsucrt_srcdesktopcrtmiscgetcwd.cpp
push str.is_valid_drive
push str.__Invalid_Drive_Index___0_
call fcn.00499890
add esp, 0x14
xor eax, eax
jmp 0x4894af
cmp dword [ebp + 8], 0
jne 0x489463
mov eax, 1
jmp 0x4894af
mov eax, dword [ebp + 8]
add eax, 0x40
mov word [ebp - 0x10], ax
mov cx, word [ebp - 0x10]
mov word [ebp - 0xc], cx
mov edx, 0x3a
mov word [ebp - 0xa], dx
mov eax, 0x5c
mov word [ebp - 8], ax
xor ecx, ecx
mov word [ebp - 6], cx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4894a6
cmp dword [ebp - 0x1c], 1
jne 0x4894aa
xor eax, eax
jmp 0x4894af
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret
Function at 0x49a1f0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00499b00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49a224
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x4ba2cc]
call dword [ebp - 8]
jmp 0x49a22a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x49a280
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00499b40
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49a2b4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x4ba2cc]
call dword [ebp - 8]
jmp 0x49a2be
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x49a2d0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00499b60
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49a308
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x4ba2cc]
call dword [ebp - 8]
jmp 0x49a316
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8
Function at 0x49c9d0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00464c10
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x4f4298]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x49cba8
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x49caf7
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x49caf7
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x49cad5
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x49ca59
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x49cb61
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x49cbc8
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x49cba3
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x49cbc8
jmp 0x49ca32
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret
Function at 0x49cbe0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00464c10
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x4f4298]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x49cdcb
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x49cd16
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x49cd16
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x49ccf2
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x49cc69
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x49cd84
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x49cdeb
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x49cdc6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x49cdeb
jmp 0x49cc42
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret