joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499180
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x537058]
test eax, eax
je 0x499238
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x4991ac
cmp dword [eax + 4], 0
mov edi, eax
je 0x4991ac
add edi, 8
jmp 0x499233
mov eax, dword [0x537058]
test eax, eax
je 0x499247
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x499231
mov esi, eax
test eax, eax
jne 0x499207
movzx eax, byte [0x538038]
mov ecx, 0xc
mov edx, 4
call fcn.00439850
test eax, eax
je 0x499262
mov dword [eax], 0x537058
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x537058]
test eax, eax
je 0x499256
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x499233
test ecx, ecx
je 0x499233
lock dec dword [ecx]
jne 0x499233
call fcn.00498d00
jmp 0x499233
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x537058
call fcn.004ec0d0
jmp 0x499190
mov ecx, 0x537058
call fcn.004ec0d0
jmp 0x4991ba
mov ecx, 0x537058
call fcn.004ec0d0
jmp 0x4991ff
mov ecx, 4
mov edx, 0xc
call fcn.004e8590
int3
Function at 0x499f00
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x499f54
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x499f77
test eax, eax
js 0x499f63
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x499f6f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x529610
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.004987c0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.00498920
mov ecx, 7
int 0x29
ud2
Function at 0x49a610
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x537048]
test eax, eax
je 0x49a6a8
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x49a636
cmp dword [eax + 4], 0
je 0x49a636
add eax, 8
pop esi
ret
mov eax, dword [0x537048]
test eax, eax
je 0x49a6b7
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x49a6a4
mov esi, eax
test eax, eax
jne 0x49a68d
movzx eax, byte [0x538038]
mov ecx, 0x10
mov edx, 4
call fcn.00439850
test eax, eax
je 0x49a6d2
mov dword [eax], 0x537048
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x537048]
test eax, eax
je 0x49a6c6
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x537048
call fcn.004ec0d0
jmp 0x49a61f
mov ecx, 0x537048
call fcn.004ec0d0
jmp 0x49a640
mov ecx, 0x537048
call fcn.004ec0d0
jmp 0x49a685
mov ecx, 4
mov edx, 0x10
call fcn.004e8590
int3

Function at 0x49b460
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x34], 0x4c37c0
lea eax, [esi + 0x30]
mov ecx, dword fs:[0]
mov dword [esi + 0x30], ecx
mov dword fs:[0], eax
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x49b573
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
mov dword [esi], eax
call fcn.0049b610
mov ecx, eax
or ecx, edx
je 0x49b55f
push edx
push eax
push ebx
push dword [esi]
mov edi, edx
mov dword [esi + 0x20], edx
mov dword [esi + 0x1c], eax
call fcn.004e3d00
mov ecx, edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 4], edx
mov dword [esi + 0x24], eax
imul ecx, eax
mul edi
add edx, ecx
mov ecx, edi
imul ecx, dword [esi + 4]
add ecx, edx
mov edx, dword [esi]
sub edx, eax
sbb ebx, ecx
mov eax, edx
imul ecx, ebx, 0x3b9aca00
mov ebx, 0x3b9aca00
mul ebx
add edx, ecx
push dword [esi + 0x20]
push edi
push edx
push eax
call fcn.004e3d00
mov ebx, eax
mov eax, dword [esi + 0x24]
mov ecx, edx
mov edx, 0x3b9aca00
mul edx
mov edi, eax
imul eax, dword [esi + 4], 0x3b9aca00
add eax, edx
add edi, ebx
adc eax, ecx
push 0
push 0x3b9aca00
push eax
push edi
call fcn.004e3d00
imul ecx, eax, 0xc4653600
add ecx, edi
mov edi, dword [esi + 0x30]
mov dword fs:[0], edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.attempt_to_divide_by_zerocalled__Result::unwrap____on_an__Err__value
mov edx, 0x19
push 0x528ee8
call fcn.004e8a30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x38], 0
lea eax, [esi + 0x14]
mov ecx, 0x52e579
mov edx, 0x2b
push 0x529e54
push 0x527a7c
push eax
call fcn.004e8cc0
add esp, 0xc
ud2
Function at 0x4a0fa0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x4a0fed
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x4a0ffd
mov dword [esi + 4], 0
jmp 0x4a100f
cmp eax, 0x103
je 0x4a1027
test eax, eax
js 0x4a1018
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x4a1012
mov eax, esp
mov dword [esp + 0x1c], 0x529610
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.004987c0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.00498920
mov ecx, 7
int 0x29
ud2

Function at 0x4a2fb0
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov ecx, esp
push dword [esp + 0x28]
call fcn.0049ad90
add esp, 4
mov ecx, dword [esp]
mov edi, dword [esp + 4]
mov eax, dword [esp + 8]
cmp ecx, 0x80000000
je 0x4a3008
mov dword [esp], ecx
mov dword [esp + 4], edi
mov dword [esp + 8], eax
lea ecx, [esp + 0xc]
mov edx, esp
push 1
call fcn.004a1200
add esp, 4
mov ebx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
cmp ebx, 0x80000000
jne 0x4a3014
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
mov dword [esi], edi
add esp, 0x18
pop esi
pop edi
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4a302a
mov byte [esi], 4
test ebx, ebx
jne 0x4a303a
jmp 0x4a300d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x4a300d
push edi
push 0
push dword [0x537fc8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4a300d
Function at 0x4a47c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x537078]
test eax, eax
je 0x4a4878
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x4a47ec
cmp dword [eax + 4], 0
mov edi, eax
je 0x4a47ec
add edi, 8
jmp 0x4a4873
mov eax, dword [0x537078]
test eax, eax
je 0x4a4887
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4a4871
mov esi, eax
test eax, eax
jne 0x4a4847
movzx eax, byte [0x538038]
mov ecx, 0xc
mov edx, 4
call fcn.00439850
test eax, eax
je 0x4a48a2
mov dword [eax], 0x537078
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x537078]
test eax, eax
je 0x4a4896
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x4a4873
test ecx, ecx
je 0x4a4873
lock dec dword [ecx]
jne 0x4a4873
call fcn.004a48c0
jmp 0x4a4873
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x537078
call fcn.004ec0d0
jmp 0x4a47d0
mov ecx, 0x537078
call fcn.004ec0d0
jmp 0x4a47fa
mov ecx, 0x537078
call fcn.004ec0d0
jmp 0x4a483f
mov ecx, 4
mov edx, 0xc
call fcn.004e8590
int3
Function at 0x4a4e80
Capabilities:
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1a8
mov edi, dword [edx]
mov ebp, dword [edx + 4]
movzx ebx, word [edx + 8]
mov eax, dword [0x537fcc]
mov esi, ecx
cmp eax, 3
jne 0x4a500b
cmp ebp, 0x17f
ja 0x4a501c
lea eax, [esp + 0x28]
push ebp
push edi
mov edi, eax
push eax
call fcn.004e4a90
add esp, 0xc
lea eax, [ebp + 1]
cmp ebp, 6
mov byte [esp + ebp + 0x28], 0
ja 0x4a4ee5
xor edx, edx
nop
cmp byte [esp + edx + 0x28], 0
je 0x4a4f7f
inc edx
cmp eax, edx
jne 0x4a4ed0
jmp 0x4a4fd5
lea ecx, [esp + 0x2b]
and ecx, 0xfffffffc
sub ecx, edi
je 0x4a4f18
je 0x4a4f18
xor edx, edx
nop word cs:[eax + eax]
nop
cmp byte [esp + edx + 0x28], 0
je 0x4a4f7f
inc edx
cmp ecx, edx
jne 0x4a4f00
lea edx, [ebp - 7]
mov dword [esp], ebx
cmp ecx, edx
jbe 0x4a4f20
jmp 0x4a4f5e
mov dword [esp], ebx
lea edx, [ebp - 7]
xor ecx, ecx
movdqa xmm0, xmmword [0x4ee3a0]
movdqa xmm1, xmmword [0x4ee3b0]
movq xmm2, qword [esp + ecx + 0x28]
movdqa xmm3, xmm2
paddd xmm3, xmm0
pandn xmm2, xmm3
pand xmm2, xmm1
movd edi, xmm2
pshufd xmm2, xmm2, 0x55
movd ebx, xmm2
or ebx, edi
jne 0x4a4f5e
add ecx, 8
cmp ecx, edx
jbe 0x4a4f30
mov ebx, dword [esp]
sub eax, ecx
je 0x4a4fd5
lea edi, [esp + ecx + 0x28]
xor edx, edx
nop dword [eax + eax]
cmp byte [edi + edx], 0
je 0x4a4f7d
inc edx
cmp eax, edx
jne 0x4a4f70
jmp 0x4a4fd5
add edx, ecx
cmp edx, ebp
jne 0x4a4fd5
pxor xmm0, xmm0
lea eax, [esp + 4]
mov dword [esp + 4], 0
lea ecx, [esp + 8]
movdqu xmmword [esp + 8], xmm0
movdqu xmmword [esp + 0x18], xmm0
mov dword [esp + 0x10], 1
push eax
push ecx
push 0
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x4a4fee
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
jmp 0x4a4ffe
mov eax, dword [0x528c28]
mov ecx, dword [0x528c2c]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 1
jmp 0x4a5000
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
xor eax, eax
mov word [esi + 0xc], bx
mov dword [esi], eax
add esp, 0x1a8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004ec550
cmp ebp, 0x17f
jbe 0x4a4eaf
mov ecx, esi
mov edx, edi
push ebx
push ebp
call fcn.004ec5a0
add esp, 0x1b0
jmp 0x4a5006
Function at 0x4ac0f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.0049ad90
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp edx, 0x80000000
jne 0x4ac12e
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], 0x80000000
jmp 0x4ac150
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.004ac020
mov ebx, dword [esp]
cmp ebx, 0x80000000
jne 0x4ac165
mov ecx, esp
call fcn.0049af50
mov dword [esi], 0x80000000
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [esp + 4]
mov ebp, dword [esp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ac183
mov dword [esi], ebx
mov dword [esi + 4], edi
mov dword [esi + 8], ebp
jmp 0x4ac15d
test ebx, ebx
mov dword [esi], 0x80000000
je 0x4ac15d
push edi
push 0
push dword [0x537fc8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4ac15d
Function at 0x4adf20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4c3a60
mov esi, edx
mov edi, ecx
mov ecx, 8
mov edx, 4
mov eax, dword fs:[0]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword fs:[0], eax
movzx eax, byte [0x538038]
call fcn.00439850
test eax, eax
je 0x4ae016
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
push 0
push 0x10000
push ebx
push 0x4ae0e0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4adf9d
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x4ae005
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], eax
push eax
mov dword [ebp - 0x24], ecx
call dword [ecx]
add esp, 4
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
cmp dword [eax + 4], 0
je 0x4adfea
cmp dword [eax + 8], 9
jae 0x4adfd5
mov eax, dword [ebp - 0x20]
jmp 0x4adfdb
mov eax, dword [ebp - 0x20]
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x537fc8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push 0
push dword [0x537fc8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 8
mov dword [ebp - 0x10], 0
call fcn.004e8590
ud2
Function at 0x4ae550
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1038
call fcn.004e3cd0
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4c3a90
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], edx
lea esi, [ebp - 0x1044]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x1000
push 0
push esi
call fcn.004e4930
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push 0x4a5d90
push eax
push 0x1000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x4ae6a4
mov ebx, dword [sym.imp.KERNEL32.dll_SleepEx]
mov dword [ebp - 0x20], edi
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x4ae5da
cmp dword [ebp - 0x2c], 0
jne 0x4ae6b5
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x4ae6b5
cmp esi, 0x1000
ja 0x4ae6f1
xor edi, edi
nop dword [eax]
mov eax, esi
sub eax, edi
jb 0x4ae6d7
xorps xmm0, xmm0
lea edx, [ebp - 0x30]
lea ecx, [ebp + edi - 0x1044]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], edx
push 0x4a5d90
lea edx, [ebp - 0x44]
push edx
push eax
push ecx
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
je 0x4ae6ac
nop dword [eax]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x4ae650
cmp dword [ebp - 0x2c], 0
jne 0x4ae6b2
add edi, dword [ebp - 0x28]
cmp edi, esi
jne 0x4ae610
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
push 0x4a5d90
lea eax, [ebp - 0x44]
push eax
push 0x1000
lea eax, [ebp - 0x1044]
push eax
mov edi, dword [ebp - 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x4ae5da
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4ae6b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push dword [ebp - 0x24]
call esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1038
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, edi
mov edx, esi
push 0x52987c
call fcn.004e8bc0
add esp, 4
jmp 0x4ae70c
mov dword [ebp - 0x10], 0
mov ecx, esi
mov edx, 0x1000
push 0x52987c
call fcn.004e89d0
add esp, 4
ud2
Function at 0x4ae800
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x4c3ab0
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x4ae87e
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esi + 8]
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], 0x5299a8
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x30]
mov edx, 0x5299d4
mov dword [esi + 0x2c], fcn.0049fe90
mov dword [esi + 0x3c], 1
call fcn.004e88e0
ud2

Function at 0x4b0010
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx], 0
mov edi, edx
jne 0x4b00d6
mov ebx, dword [edi + 0xc]
mov esi, ecx
mov edx, dword [ebx]
test edx, edx
jne 0x4b003d
mov eax, dword [ebx + 8]
xor edx, edx
lea ecx, [eax + 0xf]
cmp ecx, 0xf
jbe 0x4b00c1
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x4b00ae
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx + 4]
mov dword [esp], 0
mov ebx, esp
push ecx
push ebx
push edx
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b0074
mov eax, dword [esp]
mov ecx, 2
test eax, eax
jne 0x4b0092
jmp 0x4b0086
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4b008d
cmp eax, 0x6d
jne 0x4b00a3
mov word [esi], 4
jmp 0x4b009c
mov ecx, 1
mov dword [edi], ecx
mov dword [edi + 4], eax
mov word [esi], 0x104
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov dword [esi], 0
mov dword [esi + 4], eax
jmp 0x4b009c
mov ecx, ebx
push 1
call fcn.004ec3f0
add esp, 4
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
jmp 0x4b0044
mov edx, eax
mov ecx, ebx
push 0x10
call fcn.004ec3f0
add esp, 4
mov edx, dword [ebx]
jmp 0x4b003d
mov edx, esp
mov ecx, edi
mov dword [esp], 0
call fcn.004ec670
int3
Function at 0x4b3060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4c3bb0
mov ebx, ecx
mov esi, edx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
test edi, edi
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
je 0x4b30c1
js 0x4b312d
movzx eax, byte [0x538038]
mov ecx, edi
mov edx, 1
call fcn.00439850
test eax, eax
jne 0x4b30c6
mov ecx, 1
mov edx, edi
call fcn.004e8590
mov eax, 1
push edi
push esi
mov dword [ebp - 0x20], eax
push eax
call fcn.004e4a90
add esp, 0xc
mov edx, dword [ebx + 0x30]
cmp edx, dword [ebx + 0x28]
jne 0x4b30f7
lea ecx, [ebx + 0x28]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], ebx
call fcn.004b3170
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp + 8]
mov edx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x2c]
mov esi, dword [ebp - 0x20]
lea ecx, [edx + edx*4]
inc edx
mov dword [eax + ecx*4], 0
mov dword [eax + ecx*4 + 4], edi
mov dword [eax + ecx*4 + 8], esi
mov dword [eax + ecx*4 + 0xc], edi
mov byte [eax + ecx*4 + 0x10], 0
mov dword [ebx + 0x30], edx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00401890
nop word cs:[eax + eax]
nop dword [eax]
push ebp
sub esp, 0xc
add ebp, 0xc
cmp dword [ebp + 8], 0
je 0x4b315e
push dword [ebp - 0x20]
push 0
push dword [0x537fc8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 0xc
pop ebp
ret
Function at 0x4b32d0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
movzx eax, byte [edx]
mov esi, ecx
cmp al, 4
jne 0x4b3344
mov ebp, dword [edx + 4]
mov eax, dword [0x537fcc]
cmp eax, 3
jne 0x4b3441
cmp word [ebp], 0
mov eax, 2
mov ebx, 0x17
cmove ebx, eax
push 0x81
push 0
push 0
push 0
push 2
push ebx
call dword [sym.imp.ws2_32.dll_WSASocketW]
mov edi, eax
cmp eax, 0xffffffff
je 0x4b3360
cmp word [ebp], 0
je 0x4b33ba
movups xmm0, xmmword [ebp + 4]
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0x14]
add ebp, 0x1c
mov eax, 0x1c
mov bx, 0x17
jmp 0x4b33cc
movzx ecx, byte [edx + 3]
movzx edi, word [edx + 1]
mov edx, dword [edx + 4]
mov byte [esi + 3], cl
mov word [esi + 1], di
mov byte [esi], al
mov dword [esi + 4], edx
jmp 0x4b3439
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x4b3378
cmp eax, 0x2726
jne 0x4b3429
push 1
push 0
push 0
push 0
push 2
push ebx
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x4b3423
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x4b331e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
mov eax, ebx
jmp 0x4b3429
lea ecx, [ebp + 2]
add ebp, 6
mov eax, 0x10
mov bx, 2
xorps xmm0, xmm0
movzx ebp, word [ebp]
mov ecx, dword [ecx]
mov word [esp], bx
rol bp, 8
mov word [esp + 2], bp
mov dword [esp + 4], ecx
movups xmmword [esp + 8], xmm0
mov dword [esp + 0x18], edx
mov ecx, esp
push eax
push ecx
push edi
call dword [sym.imp.ws2_32.dll_bind]
cmp eax, 0xffffffff
je 0x4b3404
mov dword [esi + 4], edi
mov byte [esi], 4
jmp 0x4b3439
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov byte [esi], 0
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
jmp 0x4b3439
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov byte [esi], 0
mov dword [esi + 4], eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004ec550
jmp 0x4b32f1