joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46132b
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov ebx, edx
mov ebp, ecx
mov edx, dword [edx]
add edx, 8
lea esi, [esp + 0x10]
mov ecx, esi
call fcn.00412ae4
cmp dword [esi], 0
jne 0x4614fb
mov edi, dword [esp + 0x14]
mov al, byte [esp + 0x18]
mov byte [esp + 3], al
mov ecx, dword [edi + 0x18c]
mov edx, dword [edi + 0x190]
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.0041095c
add esp, 8
mov ebx, eax
movzx eax, byte [eax + 0x20]
cmp eax, 5
ja 0x461455
mov ecx, eax
add cl, 0xfd
xor edx, edx
inc edx
cmp cl, 3
movzx ecx, cl
cmovae ecx, edx
cmp cl, 2
je 0x4613af
movzx ecx, cl
cmp ecx, 1
jne 0x461455
test eax, eax
je 0x4613c0
cmp eax, 1
jne 0x4613c5
add ebx, 0x24
mov eax, dword [ebx]
mov byte [ebp], 5
mov dword [ebp + 4], eax
jmp 0x46148d
add ebx, 0x28
jmp 0x4613b2
mov al, byte [ebx + 0x21]
mov byte [esp + 8], al
cmp dword [ebx + 0x24], 0x80000000
jne 0x4613dc
mov eax, 0x80000000
jmp 0x4613f8
mov edx, ebx
add edx, 0x24
lea esi, [esp + 0x10]
mov ecx, esi
call fcn.00401b60
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xc], ecx
mov esi, dword [esi + 8]
lea edx, [esp + 0x10]
mov cl, byte [esp + 8]
mov byte [edx + 1], cl
mov dword [edx + 4], eax
mov eax, dword [esp + 0xc]
mov dword [edx + 8], eax
mov dword [edx + 0xc], esi
mov byte [edx], 2
lea esi, [esp + 0x34]
mov ecx, esi
call fcn.00419473
mov dl, byte [esi]
movzx eax, word [esi + 1]
mov word [esp + 4], ax
mov al, byte [esi + 3]
mov byte [esp + 6], al
mov ecx, dword [esi + 4]
mov eax, dword [esi + 8]
movsd xmm0, qword [esi + 0xc]
movsd qword [esp + 0x28], xmm0
mov esi, dword [esi + 0x14]
mov dword [esp + 0x30], esi
cmp dl, 5
jne 0x4614a3
test ecx, ecx
jne 0x4613b4
mov dword [esp + 8], edi
mov edi, ebp
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push dword [eax + 4]
call dword [ecx]
add esp, 4
mov esi, eax
mov ebp, edx
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x46147d
push dword [ebx + 0x44]
call dword [eax + 0xc]
add esp, 4
mov dword [ebx + 0x40], esi
mov dword [ebx + 0x44], ebp
mov ebp, edi
mov edi, dword [esp + 8]
mov byte [ebp], 6
mov al, byte [esp + 3]
movzx edx, al
mov ecx, edi
call fcn.00426b01
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dh, byte [esp + 6]
mov byte [esp + 0x36], dh
movzx esi, word [esp + 4]
mov word [esp + 0x34], si
movsd xmm0, qword [esp + 0x28]
movsd qword [esp + 0x10], xmm0
mov esi, dword [esp + 0x30]
mov dword [esp + 0x18], esi
cmp dl, 6
je 0x461489
mov byte [ebp], dl
movzx edx, word [esp + 0x34]
mov word [ebp + 1], dx
mov dl, byte [esp + 0x36]
mov byte [ebp + 3], dl
mov dword [ebp + 4], ecx
mov dword [ebp + 8], eax
movsd xmm0, qword [esp + 0x10]
movsd qword [ebp + 0xc], xmm0
mov eax, dword [esp + 0x18]
mov dword [ebp + 0x14], eax
jmp 0x46148d
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x18]
lea esi, [esp + 0x34]
mov dword [esi], eax
mov byte [esi + 4], cl
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
push 0x4f5b4c
push 0x4f5eb0
push esi
call fcn.004cbc80
Function at 0x47e18e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x50], 2
mov dword [esp + 0x60], 0
mov ecx, dword [eax + 0x100]
mov dword [eax + 0x100], 3
cmp ecx, 3
jne 0x47e1d7
lea ecx, [esp + 0x48]
call fcn.0046af66
xor ebx, ebx
jmp 0x47e39c
mov dword [esp + 0x68], ecx
movups xmm0, xmmword [eax + 0x104]
movups xmm1, xmmword [eax + 0x114]
movups xmmword [esp + 0x7c], xmm1
movups xmm1, xmmword [eax + 0x124]
movups xmmword [esp + 0x8c], xmm1
movups xmmword [esp + 0x6c], xmm0
mov eax, dword [eax + 0x134]
mov dword [esp + 0x9c], eax
mov ebx, dword [esp + 0x88]
mov ecx, dword [esp + 0x8c]
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x3c], 0
cmp eax, 1
je 0x47e23e
cmp eax, 2
jne 0x47e3a6
lea ecx, [esp + 0x68]
jmp 0x47e355
mov edi, edx
mov dword [esp + 8], ecx
mov ah, byte [esp + 0x90]
mov edx, dword [esp + 0x98]
movzx ecx, word [esp + 0x9c]
mov al, byte [esp + 0x9e]
mov dword [esp + 0x28], edx
movups xmm0, xmmword [esp + 0x68]
movaps xmmword [esp + 0x10], xmm0
movsd xmm0, qword [esp + 0x78]
movsd qword [esp + 0x20], xmm0
mov byte [esp + 0x2e], al
mov word [esp + 0x2c], cx
mov edx, dword [esp + 0x10]
cmp edx, 2
je 0x47e351
cmp edx, 1
jne 0x47e2b9
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x1c]
sub edx, ebx
mov ebx, dword [esp + 0xc]
sbb ecx, 0
jae 0x47e351
neg edx
jmp 0x47e2bd
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x47e351
mov edx, dword [ebp + 8]
mov dword [esp + 0x40], ebx
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x3c], edx
test ah, ah
je 0x47e2e2
or al, 1
mov byte [esp + 0x2e], al
movaps xmm0, xmmword [esp + 0x10]
movaps xmm1, xmmword [esp + 0x20]
lea eax, [esp + 0xa0]
movups xmmword [eax + 0x18], xmm1
movups xmmword [eax + 8], xmm0
mov byte [eax], 0
mov ecx, dword [edx + 0x34]
mov edx, dword [edx + 0x38]
push dword [esp + 8]
push ebx
call fcn.0041095c
add esp, 8
lea ecx, [eax + 0x64]
mov edx, edi
lea eax, [esp + 0xa0]
push eax
call fcn.0044646a
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x38]
push dword [esp + 8]
push ebx
call fcn.004109ce
add esp, 8
cmp dword [eax + 0x3c], 0
jle 0x47e34d
lea edx, [esp + 0x3c]
mov ecx, esi
call fcn.004122d7
mov bl, 1
jmp 0x47e35c
lea ecx, [esp + 0x10]
call fcn.0046ae58
xor ebx, ebx
mov eax, dword [esp + 0x50]
cmp eax, 2
je 0x47e393
test eax, eax
je 0x47e37f
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x58]
mov edx, dword [eax + 8]
dec edx
and edx, 0xfffffff8
add ecx, edx
add ecx, 8
jmp 0x47e387
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x58]
lea edx, [esp + 0x48]
push edx
push ecx
call dword [eax + 0x34]
add esp, 8
lea ecx, [esp + 0x48]
call fcn.0046af66
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.wasnt_expecting_a_frame_to_reclaim
mov edx, 0x23
push 0x4f7088
call fcn.004cf119
Function at 0x47e96a
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, ecx
mov eax, dword [edx]
mov edi, dword [edx + 4]
mov ecx, eax
xor ecx, 3
or ecx, edi
mov bh, byte [edx + 8]
mov bl, byte [edx + 9]
mov ecx, dword [ebp + 8]
jne 0x47e9a3
call fcn.004281b0
xor eax, eax
mov ecx, 3
jmp 0x47ea8a
mov byte [esp + 7], bl
mov byte [esp + 6], bh
lea ebx, [esp + 0x4a]
mov dword [ebx - 6], edi
mov dword [ebx - 0xa], eax
mov ah, byte [ecx]
mov al, byte [ecx + 1]
mov byte [esp + 0xc], al
movups xmm0, xmmword [ecx + 0x1c]
movups xmm1, xmmword [ecx + 0x13]
movups xmm2, xmmword [ecx + 3]
mov al, byte [ecx + 2]
mov byte [esp + 8], al
mov al, byte [esp + 6]
mov byte [ebx - 2], al
mov al, byte [esp + 7]
mov byte [ebx - 1], al
movups xmmword [esp + 0x29], xmm0
movaps xmmword [esp + 0x20], xmm1
add edx, 0xa
movaps xmmword [esp + 0x10], xmm2
push 0x7e
push edx
push ebx
mov bl, ah
call fcn.004b64b0
add esp, 0xc
cmp bl, 3
jne 0x47ea1e
lea ecx, [esp + 0x40]
call fcn.0040fe18
xor eax, eax
mov ecx, 3
mov bl, byte [esp + 8]
mov bh, byte [esp + 0xc]
jmp 0x47ea8a
lea edi, [esp + 0x80]
mov ecx, edi
call fcn.004281b0
mov byte [edi], bl
mov al, byte [esp + 0xc]
mov byte [edi + 1], al
mov al, byte [esp + 8]
mov byte [edi + 2], al
movaps xmm0, xmmword [esp + 0x10]
movaps xmm1, xmmword [esp + 0x20]
movups xmmword [edi + 3], xmm0
movups xmmword [edi + 0x13], xmm1
movups xmm0, xmmword [esp + 0x29]
movups xmmword [edi + 0x1c], xmm0
mov eax, dword [edi - 0x40]
mov dword [esp + 0xc], eax
mov eax, dword [edi - 0x3c]
mov dword [esp + 8], eax
mov bh, byte [edi - 0x38]
mov bl, byte [edi - 0x37]
lea eax, [esp + 0xce]
push 0x7e
lea ecx, [esp + 0x4e]
push ecx
push eax
call fcn.004b64b0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add esp, 0xc
mov dword [esi], ecx
mov dword [esi + 4], eax
mov byte [esi + 8], bh
mov byte [esi + 9], bl
add esi, 0xa
lea eax, [esp + 0xce]
push 0x7e
push eax
push esi
call fcn.004b64b0
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x484db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ecx + 0x20], 9
jne 0x484db7
ret
Function at 0x491471
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, ecx
lea eax, [esp + 0xc]
push 4
push eax
push dword [esp + 0x10]
push 0xffff
push edx
call dword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x491495
mov byte [esi], 4
jmp 0x4914a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
pop esi
ret
Function at 0x491910
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4ac990
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x530ad4]
test al, al
je 0x491ae1
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x49195c
cmp eax, 3
jne 0x491ada
mov ebx, dword [0x530ad8]
test ebx, ebx
je 0x491ada
mov dword [ebp - 0x20], 0
jmp 0x491987
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4919b8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x491b2b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x491980
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x491980
test byte [ebp - 0x20], 1
je 0x491ada
mov ebx, dword [0x530ad8]
test ebx, ebx
je 0x491ada
mov dword [ebp - 0x20], 0
jmp 0x4919e7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x491a18
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x491b2b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4919e0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4919e0
test byte [ebp - 0x20], 1
je 0x491ada
mov ebx, dword [0x530ad8]
test ebx, ebx
je 0x491ada
mov dword [ebp - 0x20], 0
jmp 0x491a47
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x491a78
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x491b2b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x491a40
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x491a40
test byte [ebp - 0x20], 1
je 0x491ada
mov ebx, dword [0x530ad8]
test ebx, ebx
je 0x491ada
mov dword [ebp - 0x20], 0
jmp 0x491aa7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x491ad4
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x491b2b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x491aa0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x491aa0
test byte [ebp - 0x20], 1
jne 0x491af4
movzx eax, byte [0x52c700]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x530ad8]
jmp 0x491aff
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x491ada
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x491b2b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x491afc
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x491afc
mov ecx, 0x4fbcc0
mov dword [ebp - 0x10], 0
call fcn.004cbd00
ud2
Function at 0x492480
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4aca10
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x530048]
test eax, eax
je 0x49258a
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x4924d5
cmp dword [eax + 4], 0
je 0x4924d5
add eax, 8
jmp 0x492578
mov eax, dword [0x530048]
test eax, eax
je 0x492599
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x492576
test eax, eax
jne 0x492546
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x530048
xor ecx, ecx
mov edx, 0xc
movzx eax, byte [0x530b2c]
call fcn.0049cbc0
test eax, eax
je 0x4925ba
mov ecx, dword [ebp - 0x20]
mov dword [eax + 8], ecx
movsd xmm0, qword [ebp - 0x28]
movsd qword [eax], xmm0
mov ecx, dword [0x530048]
test ecx, ecx
je 0x4925a8
dec ecx
push eax
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
mov edx, eax
add eax, 8
mov ecx, dword [edx + 8]
cmp dword [edx + 4], 0
mov dword [edx + 4], 1
mov dword [edx + 8], 0
je 0x492578
test ecx, ecx
je 0x492578
lock dec dword [ecx]
jne 0x492578
mov esi, eax
call fcn.00492600
mov eax, esi
jmp 0x492578
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x530048
call fcn.004ce4f0
jmp 0x4924bb
mov ecx, 0x530048
call fcn.004ce4f0
jmp 0x4924e3
mov ecx, 0x530048
mov esi, eax
call fcn.004ce4f0
mov ecx, eax
mov eax, esi
jmp 0x49253a
mov ecx, 4
mov edx, 0xc
mov dword [ebp - 0x10], 0
call fcn.004cb610
ud2

Function at 0x492f90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x530058]
test eax, eax
je 0x49300e
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x492fad
cmp byte [eax + 4], 0
jne 0x493005
mov eax, dword [0x530058]
test eax, eax
je 0x49301a
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x49300a
test eax, eax
jne 0x492fff
movzx eax, byte [0x530b2c]
xor ecx, ecx
mov edx, 8
call fcn.0049cbc0
test eax, eax
je 0x493038
mov dword [eax], 0x530058
mov byte [eax + 4], 0
mov ecx, dword [0x530058]
test ecx, ecx
je 0x493026
dec ecx
push eax
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
mov word [eax + 4], 1
add eax, 5
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x530058
call fcn.004ce4f0
jmp 0x492f9b
mov ecx, 0x530058
call fcn.004ce4f0
jmp 0x492fb7
mov ecx, 0x530058
mov esi, eax
call fcn.004ce4f0
mov ecx, eax
mov eax, esi
jmp 0x492ff3
mov ecx, 4
mov edx, 8
call fcn.004cb610
int3
Function at 0x493e40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x530038]
test eax, eax
je 0x493ed8
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x493e66
cmp dword [eax + 4], 0
je 0x493e66
add eax, 8
pop esi
ret
mov eax, dword [0x530038]
test eax, eax
je 0x493ee7
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x493ed4
test eax, eax
jne 0x493ebb
movzx eax, byte [0x530b2c]
xor ecx, ecx
mov edx, 0x10
call fcn.0049cbc0
test eax, eax
je 0x493f08
mov dword [eax], 0x530038
mov dword [eax + 4], 0
mov ecx, dword [0x530038]
test ecx, ecx
je 0x493ef6
dec ecx
push eax
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
mov ecx, eax
mov dword [eax + 4], 1
add eax, 8
mov dword [ecx + 8], 0
mov byte [ecx + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x530038
call fcn.004ce4f0
jmp 0x493e4f
mov ecx, 0x530038
call fcn.004ce4f0
jmp 0x493e70
mov ecx, 0x530038
mov esi, eax
call fcn.004ce4f0
mov ecx, eax
mov eax, esi
jmp 0x493eaf
mov ecx, 4
mov edx, 0x10
call fcn.004cb610
int3
Function at 0x49a1a0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x49a1ed
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x49a1fd
mov dword [esi + 4], 0
jmp 0x49a20f
cmp eax, 0x103
je 0x49a227
test eax, eax
js 0x49a218
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x49a212
mov eax, esp
mov dword [esp + 0x1c], 0x4fb7cc
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.00491f20
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.00492080
mov ecx, 7
int 0x29
ud2

Function at 0x49b1a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4acc50
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x530068]
test eax, eax
je 0x49b2aa
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x49b1f5
cmp dword [eax + 4], 0
je 0x49b1f5
add eax, 8
jmp 0x49b298
mov eax, dword [0x530068]
test eax, eax
je 0x49b2b9
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x49b296
test eax, eax
jne 0x49b266
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x530068
xor ecx, ecx
mov edx, 0xc
movzx eax, byte [0x530b2c]
call fcn.0049cbc0
test eax, eax
je 0x49b2da
mov ecx, dword [ebp - 0x20]
mov dword [eax + 8], ecx
movsd xmm0, qword [ebp - 0x28]
movsd qword [eax], xmm0
mov ecx, dword [0x530068]
test ecx, ecx
je 0x49b2c8
dec ecx
push eax
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
mov edx, eax
add eax, 8
mov ecx, dword [edx + 8]
cmp dword [edx + 4], 0
mov dword [edx + 4], 1
mov dword [edx + 8], 0
je 0x49b298
test ecx, ecx
je 0x49b298
lock dec dword [ecx]
jne 0x49b298
mov esi, eax
call fcn.0049b320
mov eax, esi
jmp 0x49b298
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x530068
call fcn.004ce4f0
jmp 0x49b1db
mov ecx, 0x530068
call fcn.004ce4f0
jmp 0x49b203
mov ecx, 0x530068
mov esi, eax
call fcn.004ce4f0
mov ecx, eax
mov eax, esi
jmp 0x49b25a
mov ecx, 4
mov edx, 0xc
mov dword [ebp - 0x10], 0
call fcn.004cb610
ud2
Function at 0x49bc40
Capabilities:
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1a8
mov edi, dword [edx]
mov ebp, dword [edx + 4]
movzx ebx, word [edx + 8]
mov eax, dword [0x530acc]
mov esi, ecx
cmp eax, 3
jne 0x49bdcb
cmp ebp, 0x17f
ja 0x49bddc
lea eax, [esp + 0x28]
push ebp
push edi
mov edi, eax
push eax
call fcn.004b64b0
add esp, 0xc
lea eax, [ebp + 1]
cmp ebp, 6
mov byte [esp + ebp + 0x28], 0
ja 0x49bca5
xor edx, edx
nop
cmp byte [esp + edx + 0x28], 0
je 0x49bd3f
inc edx
cmp eax, edx
jne 0x49bc90
jmp 0x49bd95
lea ecx, [esp + 0x2b]
and ecx, 0xfffffffc
sub ecx, edi
je 0x49bcd8
xor edx, edx
nop word cs:[eax + eax]
nop dword [eax]
cmp byte [esp + edx + 0x28], 0
je 0x49bd3f
inc edx
cmp ecx, edx
jne 0x49bcc0
lea edx, [ebp - 7]
mov dword [esp], ebx
cmp ecx, edx
jbe 0x49bcde
jmp 0x49bd1b
lea edx, [ebp - 7]
mov dword [esp], ebx
movdqa xmm0, xmmword [0x4d0350]
movdqa xmm1, xmmword [0x4d0360]
nop
movq xmm2, qword [esp + ecx + 0x28]
movdqa xmm3, xmm2
paddd xmm3, xmm0
pandn xmm2, xmm3
pand xmm2, xmm1
pextrd edi, xmm2, 1
movd ebx, xmm2
or ebx, edi
jne 0x49bd1b
add ecx, 8
cmp ecx, edx
jbe 0x49bcf0
mov ebx, dword [esp]
sub eax, ecx
je 0x49bd95
lea edi, [esp + ecx + 0x28]
xor edx, edx
nop dword [eax + eax]
cmp byte [edi + edx], 0
je 0x49bd3d
inc edx
cmp eax, edx
jne 0x49bd30
jmp 0x49bd95
add edx, ecx
cmp edx, ebp
jne 0x49bd95
pxor xmm0, xmm0
lea eax, [esp + 4]
mov dword [esp + 4], 0
lea ecx, [esp + 8]
movdqu xmmword [esp + 8], xmm0
movdqu xmmword [esp + 0x18], xmm0
mov dword [esp + 0x10], 1
push eax
push ecx
push 0
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x49bdae
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
jmp 0x49bdbe
mov eax, dword [0x4faef0]
mov ecx, dword [0x4faef4]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 1
jmp 0x49bdc0
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
xor eax, eax
mov word [esi + 0xc], bx
mov dword [esi], eax
add esp, 0x1a8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004cea80
cmp ebp, 0x17f
jbe 0x49bc6f
mov ecx, esi
mov edx, edi
push ebx
push ebp
call fcn.004cead0
add esp, 0x1b0
jmp 0x49bdc6
Function at 0x49c4d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4acca0
mov esi, edx
mov edi, ecx
xor ecx, ecx
mov edx, 8
mov eax, dword fs:[0]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword fs:[0], eax
movzx eax, byte [0x530b2c]
call fcn.0049cbc0
test eax, eax
je 0x49c5c3
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
push 0
push 0x10000
push ebx
push 0x49c650
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x49c54a
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x49c5b2
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], eax
push eax
mov dword [ebp - 0x24], ecx
call dword [ecx]
add esp, 4
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
cmp dword [eax + 4], 0
je 0x49c597
cmp dword [eax + 8], 9
jae 0x49c582
mov eax, dword [ebp - 0x20]
jmp 0x49c588
mov eax, dword [ebp - 0x20]
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x530ac8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push 0
push dword [0x530ac8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 8
mov dword [ebp - 0x10], 0
call fcn.004cb610
ud2

Function at 0x49c7b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x4accc0
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x30], xmm0
lea eax, [esi + 0x30]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x49c818
movaps xmm0, xmmword [esi + 0x30]
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
movups xmmword [edi], xmm0
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esi + 8]
lea ecx, [esi + 0x10]
mov dword [esi + 0x18], 0x4fb8f4
mov dword [esi + 0x1c], 1
mov dword [esi + 0x28], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x10], edx
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x18]
mov edx, 0x4fb924
mov dword [esi + 0x14], fcn.00499650
mov dword [esi + 0x24], 1
call fcn.004cb8c0
ud2