joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eaa60
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x5c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4f76d0
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x61cf9c
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov dword [ebp - 0x20], 0x61cf9c
mov esi, dword [edi]
test esi, esi
jne 0x4eab05
mov ebx, dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4eab21
mov esi, eax
test ebx, ebx
je 0x4eaafd
push 4
push 0xc
call fcn.0043c290
add esp, 8
test eax, eax
je 0x4eabc9
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 0
mov ecx, eax
mov eax, dword [0x61cfcc]
nop word cs:[eax + eax]
nop dword [eax]
mov dword [ecx + 8], eax
lock cmpxchg dword [0x61cfcc], ecx
jne 0x4eaaf0
mov eax, esi
test esi, esi
xchg dword [edi], eax
je 0x4eab3e
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x5f78b8
push 0x2e
push str.assertion_failed:_key___c::TLS_OUT_OF_INDEXESlibrary_std_src_syswindows_thread_local_key.rs
call fcn.005707b0
add esp, 0xc
ud2
lea eax, [ebp - 0x68]
mov dword [ebp - 0x50], 0x5f6ad0
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x68], 0x5f6cb4
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x58], 0x5f5250
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x34], fcn.00505380
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x3c], 1
push eax
push ecx
call fcn.004e2ae0
add esp, 8
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
call fcn.00404730
mov ecx, 7
int 0x29
ud2
push 4
push 0xc
call fcn.00570650
add esp, 8
ud2
Function at 0x4ed160
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x4f77a0
lea eax, [esi + 0x50]
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
mov eax, dword [0x61c0fc]
test eax, eax
je 0x4ed1ac
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x4ed1c5
jmp 0x4ed1d5
push 0x61c0fc
call fcn.004eaa60
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4ed1d5
mov edi, eax
mov eax, dword [eax]
xor eax, 1
or eax, dword [edi + 4]
je 0x4ed270
mov eax, dword [0x61c0fc]
test eax, eax
je 0x4ed275
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4ed292
mov edi, eax
test eax, eax
jne 0x4ed240
push 8
push 0x20
call fcn.0043c290
add esp, 8
test eax, eax
je 0x4ed300
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x61c0fc
mov edi, eax
mov eax, dword [0x61c0fc]
test eax, eax
jne 0x4ed238
push 0x61c0fc
call fcn.004eaa60
add esp, 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xorps xmm0, xmm0
lea eax, [esi + 0x30]
movaps xmmword [esi + 0x30], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
jne 0x4ed2a7
movaps xmm0, xmmword [esi + 0x30]
mov dword [edi + 4], 0
mov dword [edi], 1
movups xmmword [edi + 8], xmm0
add edi, 8
jmp 0x4ed294
push 0x61c0fc
call fcn.004eaa60
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x4ed1f2
xor edi, edi
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xc], eax
lea eax, [esi + 8]
mov dword [esi + 0x18], 0x5f781c
mov dword [esi + 0x1c], 1
mov dword [esi + 8], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x10], eax
lea eax, [esi + 0x10]
mov dword [esi + 0x14], fcn.004dff60
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 1
lea eax, [esi + 0x18]
push 0x5f7848
push eax
call fcn.00570860
add esp, 8
ud2
push 8
push 0x20
call fcn.00570650
add esp, 8
ud2
Function at 0x4ed710
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x61c104]
test eax, eax
je 0x4ed729
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x4ed742
jmp 0x4ed751
push 0x61c104
call fcn.004eaa60
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4ed751
cmp dword [eax], 1
mov edi, eax
jne 0x4ed751
add edi, 4
mov eax, edi
pop esi
pop edi
ret
mov eax, dword [0x61c104]
test eax, eax
je 0x4ed770
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4ed788
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x4ed74c
jmp 0x4ed7c5
push 0x61c104
call fcn.004eaa60
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4ed765
push 4
push 0xc
call fcn.0043c290
add esp, 8
test eax, eax
je 0x4ed7fc
mov dword [eax], 0
mov dword [eax + 8], 0x61c104
mov esi, eax
mov eax, dword [0x61c104]
test eax, eax
jne 0x4ed7bd
push 0x61c104
call fcn.004eaa60
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 4]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
je 0x4ed74c
test ecx, ecx
je 0x4ed74c
lock dec dword [ecx]
jne 0x4ed74c
call fcn.004dca80
mov eax, edi
pop esi
pop edi
ret
push 4
push 0xc
call fcn.00570650
add esp, 8
ud2

Function at 0x4ede50
Capabilities:
Create directory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, edx
mov edx, ecx
mov ecx, esp
push eax
call fcn.004efee0
add esp, 4
mov ebx, dword [esp + 4]
cmp dword [esp], 1
mov ebp, dword [esp + 8]
jne 0x4ede83
mov esi, ebx
mov eax, ebx
shrd esi, ebp, 8
shr ebp, 8
mov edi, ebp
jmp 0x4eded0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4edeaa
mov al, 4
test ebp, ebp
je 0x4edea8
add ebp, ebp
je 0x4edea8
push 2
push ebp
push ebx
call fcn.0043c2a0
mov al, 4
add esp, 0xc
jmp 0x4eded0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edi, eax
shr edi, 8
shl esi, 0x18
test ebp, ebp
je 0x4edece
add ebp, ebp
je 0x4edece
push 2
push ebp
push ebx
call fcn.0043c2a0
add esp, 0xc
xor eax, eax
shld edi, esi, 8
shl esi, 8
movzx eax, al
or eax, esi
mov edx, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ee1b0
Capabilities:
Delete file

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x24]
mov ecx, esp
push dword [esp + 0x28]
call fcn.004efee0
add esp, 4
mov ebx, dword [esp + 4]
cmp dword [esp], 1
mov ebp, dword [esp + 8]
jne 0x4ee1e6
mov esi, ebx
mov eax, ebx
shrd esi, ebp, 8
shr ebp, 8
mov edi, ebp
jmp 0x4ee231
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4ee20b
mov al, 4
test ebp, ebp
je 0x4ee209
add ebp, ebp
je 0x4ee209
push 2
push ebp
push ebx
call fcn.0043c2a0
mov al, 4
add esp, 0xc
jmp 0x4ee231
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edi, eax
shr edi, 8
shl esi, 0x18
test ebp, ebp
je 0x4ee22f
add ebp, ebp
je 0x4ee22f
push 2
push ebp
push ebx
call fcn.0043c2a0
add esp, 0xc
xor eax, eax
shld edi, esi, 8
shl esi, 8
movzx eax, al
or eax, esi
mov edx, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4ee250
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4f77c0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov esi, dword fs:[0]
mov dword [ebp - 0x18], esi
mov dword fs:[0], ecx
lea ecx, [ebp - 0x38]
push eax
call fcn.004efee0
add esp, 4
mov ebx, dword [ebp - 0x34]
cmp dword [ebp - 0x38], 1
mov edi, dword [ebp - 0x30]
jne 0x4ee2ac
mov esi, ebx
mov edx, ebx
shrd esi, edi, 8
shr edi, 8
jmp 0x4ee38e
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x38]
push eax
call fcn.004efee0
add esp, 4
mov edx, dword [ebp - 0x34]
cmp dword [ebp - 0x38], 1
mov ebx, dword [ebp - 0x30]
jne 0x4ee2fc
mov esi, edx
shrd esi, ebx, 8
shr ebx, 8
mov edi, ebx
cmp dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x20]
jne 0x4ee373
jmp 0x4ee38e
push 1
mov dword [ebp - 0x28], edx
push edx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, dword [ebp - 0x24]
test eax, eax
je 0x4ee342
test ebx, ebx
je 0x4ee328
add ebx, ebx
je 0x4ee328
push 2
push ebx
push dword [ebp - 0x28]
call fcn.0043c2a0
add esp, 0xc
test esi, esi
je 0x4ee33e
add esi, esi
je 0x4ee33e
push 2
push esi
push dword [ebp - 0x20]
call fcn.0043c2a0
add esp, 0xc
mov dl, 4
jmp 0x4ee38e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edi, eax
shr edi, 8
shl esi, 0x18
test ebx, ebx
je 0x4ee368
add ebx, ebx
je 0x4ee368
push 2
push ebx
push dword [ebp - 0x28]
call fcn.0043c2a0
add esp, 0xc
xor edx, edx
cmp dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x20]
je 0x4ee38e
test eax, eax
je 0x4ee38e
mov ecx, dword [ebp - 0x24]
add ecx, ecx
je 0x4ee38e
push 2
push ecx
push eax
mov ebx, edx
call fcn.0043c2a0
mov edx, ebx
add esp, 0xc
mov ecx, dword [ebp - 0x18]
shld edi, esi, 8
movzx eax, dl
shl esi, 8
or eax, esi
mov edx, edi
mov dword fs:[0], ecx
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ee7c0
Capabilities:
Access peb ldr_data
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x34], 0x4f7800
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea ecx, [esi + 8]
mov eax, dword fs:[0]
mov dword [esi + 0x30], eax
lea eax, [esi + 0x30]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.004efee0
add esp, 4
mov edx, dword [esi + 0xc]
cmp dword [esi + 8], 1
mov ebx, dword [esi + 0x10]
jne 0x4ee826
mov dword [edi + 4], edx
mov dword [edi + 8], ebx
mov dword [edi], 1
jmp 0x4ee905
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 0x14]
mov dword [esi + 4], edx
mov dword [esi + 0x1c], edx
mov edx, dword [ebp + 0x14]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x38], 0
mov dword [esi + 0x24], ecx
lea ecx, [esi + 8]
push eax
call fcn.004efee0
add esp, 4
mov edi, dword [esi + 0xc]
cmp dword [esi + 8], 1
mov ebx, dword [esi + 0x10]
jne 0x4ee897
mov eax, dword [ebp + 8]
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov dword [eax], 1
mov ecx, dword [esi + 0x18]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 4]
test ecx, ecx
je 0x4ee905
test eax, eax
je 0x4ee905
add ecx, ecx
je 0x4ee905
push 2
push ecx
push eax
call fcn.0043c2a0
add esp, 0xc
jmp 0x4ee905
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push 0
push 0
lea eax, [esi + 8]
push eax
push 0x4ee980
push edi
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
je 0x4ee918
mov eax, dword [esi + 8]
mov edx, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
test ebx, ebx
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov dword [edx], 0
je 0x4ee8e9
add ebx, ebx
je 0x4ee8e9
push 2
push ebx
push edi
call fcn.0043c2a0
add esp, 0xc
mov eax, dword [esi + 0x18]
test eax, eax
je 0x4ee902
add eax, eax
je 0x4ee902
push 2
push eax
push dword [esi + 4]
call fcn.0043c2a0
add esp, 0xc
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
test ebx, ebx
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0
mov dword [ecx], 1
je 0x4ee86c
add ebx, ebx
je 0x4ee86c
push 2
push ebx
push edi
call fcn.0043c2a0
add esp, 0xc
jmp 0x4ee86c
Function at 0x4eeb30
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
mov ebx, 2
cmp dword [eax], 1
mov eax, 0x17
cmove ebx, eax
push 0x81
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.WS2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x4eeb72
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x4eebec
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x4eeb86
cmp eax, 0x2739
jne 0x4eebbd
push 1
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.WS2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x4eebb7
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x4eebcf
mov dword [esi + 4], edi
mov dword [esi], 0
jmp 0x4eebec
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], 1
jmp 0x4eebec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], 1
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4ef570
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4f7860
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x34]
add ecx, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], 0
call fcn.004d9ab0
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x24]
jne 0x4ef5dc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x28]
push 1
call fcn.0056fb00
add esp, 4
mov edx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x28]
mov word [ebx + edx*2], 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x4ef5fb
mov cl, 4
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x4ef614
jmp 0x4ef628
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov esi, eax
xor ecx, ecx
shr esi, 8
shl edi, 0x18
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4ef628
add eax, eax
je 0x4ef628
push 2
push eax
push ebx
mov ebx, ecx
call fcn.0043c2a0
mov ecx, ebx
add esp, 0xc
mov edx, dword [ebp - 0x18]
shld esi, edi, 8
shl edi, 8
movzx eax, cl
or eax, edi
mov dword fs:[0], edx
mov edx, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4f0450
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx + 0x10], 0
mov edi, edx
jne 0x4f052a
mov ebx, dword [edi + 0xc]
mov esi, ecx
mov edx, dword [ebx + 4]
test edx, edx
jne 0x4f047c
mov eax, dword [ebx + 8]
xor edx, edx
mov ecx, eax
neg ecx
cmp ecx, 0xf
jbe 0x4f04f7
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x4f0513
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx]
mov dword [esp], 0
mov ebx, esp
push ecx
push ebx
push edx
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4f04b5
mov eax, dword [esp]
mov ecx, 2
test eax, eax
jne 0x4f04ce
jmp 0x4f04da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x4f04da
cmp eax, 0x3e5
jne 0x4f04e9
mov ecx, 1
xor eax, eax
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], eax
mov byte [esi + 1], 1
jmp 0x4f04de
mov byte [esi + 1], 0
xor eax, eax
mov byte [esi], al
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov al, 1
jmp 0x4f04e0
mov edx, eax
mov ecx, ebx
push 0x10
call fcn.0056fa70
add esp, 4
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 8]
cmp edx, eax
jne 0x4f0487
mov ecx, ebx
push 1
call fcn.0056fa70
add esp, 4
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 8]
jmp 0x4f0487
add edi, 0x10
mov edx, esp
mov dword [esp], 0
mov ecx, edi
call fcn.0056f8a0
ud2
Function at 0x4f6480
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x61c110]
test eax, eax
je 0x4f6499
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x4f64b2
jmp 0x4f64c1
push 0x61c110
call fcn.004eaa60
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4f64c1
cmp dword [eax], 1
mov edi, eax
jne 0x4f64c1
add edi, 4
mov eax, edi
pop esi
pop edi
ret
mov eax, dword [0x61c110]
test eax, eax
je 0x4f64e0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4f64f8
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x4f64bc
jmp 0x4f6535
push 0x61c110
call fcn.004eaa60
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4f64d5
push 4
push 0x10
call fcn.0043c290
add esp, 8
test eax, eax
je 0x4f6573
mov dword [eax], 0
mov dword [eax + 0xc], 0x61c110
mov esi, eax
mov eax, dword [0x61c110]
test eax, eax
jne 0x4f652d
push 0x61c110
call fcn.004eaa60
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
je 0x4f64bc
test ecx, ecx
je 0x4f64bc
lock dec dword [ecx]
jne 0x4f64bc
call fcn.00435e70
mov eax, edi
pop esi
pop edi
ret
push 4
push 0x10
call fcn.00570650
add esp, 8
ud2

Function at 0x4f6590
Capabilities:
Enumerate pe sections
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
mov esi, dword [eax + 4]
movzx eax, word [eax + 8]
mov word [esp + 6], ax
mov eax, dword [0x61cfbc]
cmp eax, 3
jne 0x4f66ad
lea edi, [esp + 0x10]
mov edx, ebx
mov ecx, edi
push esi
call fcn.004de510
add esp, 4
cmp dword [esp + 0x10], 1
jne 0x4f660b
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4f65ef
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4f65ef
push 1
push eax
push ecx
call fcn.0043c2a0
add esp, 0xc
mov esi, dword [ebp + 8]
mov dword [esi + 8], 0x5f5f1c
mov dword [esi + 4], 0x1402
mov dword [esi], 1
jmp 0x4f66a3
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
xorps xmm0, xmm0
mov dword [esp + 0xc], 0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x18], 1
mov dword [esp + 8], eax
lea eax, [esp + 0xc]
push eax
push edi
push 0
push ebx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x4f6672
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, dword [ebp + 8]
mov ecx, eax
mov edx, eax
shr eax, 0x18
shr ecx, 8
shl edx, 0x18
mov byte [esi + 4], 0
mov byte [esi + 0xb], al
mov eax, 1
mov dword [esi + 5], edx
mov word [esi + 9], cx
jmp 0x4f668a
mov eax, dword [esp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
movzx eax, word [esp + 6]
mov word [esi + 0xc], ax
xor eax, eax
mov ecx, dword [esp + 8]
mov dword [esi], eax
mov byte [ebx], 0
test ecx, ecx
je 0x4f66a3
push 1
push ecx
push ebx
call fcn.0043c2a0
add esp, 0xc
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00570050
jmp 0x4f65bb
Function at 0x4f6790
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x61c118]
test eax, eax
je 0x4f67a8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x4f67c1
jmp 0x4f67cc
push 0x61c118
call fcn.004eaa60
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4f67cc
cmp dword [eax], 1
mov esi, eax
je 0x4f684d
mov eax, dword [0x61c118]
test eax, eax
je 0x4f67eb
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4f6803
xor esi, esi
cmp eax, 1
je 0x4f6850
mov esi, eax
jmp 0x4f6840
push 0x61c118
call fcn.004eaa60
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4f67e0
push 4
push 0xc
call fcn.0043c290
add esp, 8
test eax, eax
je 0x4f6854
mov dword [eax], 0
mov dword [eax + 8], 0x61c118
mov esi, eax
mov eax, dword [0x61c118]
test eax, eax
jne 0x4f6838
push 0x61c118
call fcn.004eaa60
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 1
mov dword [esi + 4], 0
add esi, 4
mov eax, esi
pop esi
ret
push 4
push 0xc
call fcn.00570650
add esp, 8
ud2
Function at 0x515200
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x51528c
push esi
call fcn.00529c40
add esp, 4
test al, al
jne 0x51528c
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x515223
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.00532b50
add esp, 0xc
test eax, eax
je 0x515257
sub eax, esi
push eax
push 0x2e
push esi
call fcn.00532b50
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x515259
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x515285
mov al, byte [esi]
push eax
call fcn.00523db0
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x515267
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x51f980
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 0x711], 0
je 0x51fa17
cmp dword [edi + 0x1b0], 0
je 0x51f9d1
push esi
push 1
push edi
call fcn.00510400
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1b0]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00510400
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov edx, dword [esp + 0xc]
mov ecx, edx
sub ecx, 0
je 0x51f9e6
sub ecx, 1
je 0x51f9e6
sub ecx, 1
jne 0x51fa17
push dword [edi + 0x148]
lea eax, [edx*2 + 0x579e60]
push 1
add eax, edx
push 2
push eax
call fcn.0054ec43
push dword [edi + 0x148]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.0054ec43
add esp, 0x20
xor eax, eax
pop edi
ret