joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4416e7
Capabilities:
Get system information on windows

Disassembly:
push esi
sub esp, 0x24
mov esi, esp
xorps xmm0, xmm0
and dword [esi + 0x20], 0
movups xmmword [esi + 0x10], xmm0
movups xmmword [esi], xmm0
push esi
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esi + 0x14]
add esp, 0x24
pop esi
ret
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
test ecx, ecx
je 0x4416fe
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [esp + 0xc]
mov edx, str.RAYON_NUM_THREADSRAYON_RS_NUM_CPUSThreadPoolBuildError
mov ecx, esi
push 0x11
call fcn.004c6fe0
pop eax
mov edi, esp
mov edx, esi
mov ecx, edi
call fcn.00441a9f
mov edi, dword [edi + 4]
test edi, edi
je 0x44174a
mov ebp, dword [esp]
lea esi, [esp + 0xc]
mov edx, edi
mov ecx, esi
push dword [esp + 8]
call fcn.0041e860
pop eax
mov bl, byte [esi]
mov esi, dword [esi + 4]
mov ecx, ebp
mov edx, edi
call fcn.0049160f
test bl, bl
je 0x441796
lea esi, [esp + 0xc]
mov edx, 0x5387a5
mov ecx, esi
push 0x11
call fcn.004c6fe0
pop eax
mov edi, esp
mov edx, esi
mov ecx, edi
call fcn.00441a9f
mov edi, dword [edi + 4]
test edi, edi
je 0x44179e
mov ebp, dword [esp]
lea esi, [esp + 0xc]
mov edx, edi
mov ecx, esi
push dword [esp + 8]
call fcn.0041e860
pop eax
mov bl, byte [esi]
mov esi, dword [esi + 4]
mov ecx, ebp
mov edx, edi
call fcn.0049160f
test bl, bl
jne 0x44179e
test esi, esi
jne 0x4416f4
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
jmp 0x43cd9a

Function at 0x441c8b
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
mov ecx, 0x5b705c
call fcn.004d7bff
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x441cb4
cmp dword [eax], 0
je 0x441cb4
add eax, 4
jmp 0x441d3f
mov ecx, 0x5b705c
call fcn.004d7bff
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x441d3d
mov edi, eax
test eax, eax
jne 0x441cf9
push 0x14
pop ecx
push 4
pop edx
call fcn.00422855
and dword [eax], 0
mov ecx, 0x5b705c
mov edi, eax
mov dword [eax + 0x10], 0x5b705c
call fcn.004d7bff
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x441d1a
mov eax, dword [esi]
and dword [esi], 0
test eax, eax
je 0x441d1a
movzx eax, word [esi + 0xa]
mov ebp, dword [esi + 4]
mov dl, byte [esi + 8]
mov bl, byte [esi + 9]
mov ecx, dword [esi + 0xc]
mov esi, eax
jmp 0x441d22
xor ecx, ecx
xor ebx, ebx
xor edx, edx
xor ebp, ebp
mov dword [edi], 1
mov dword [edi + 4], ebp
mov byte [edi + 8], dl
mov byte [edi + 9], bl
mov word [edi + 0xa], si
lea eax, [edi + 4]
mov dword [edi + 0xc], ecx
jmp 0x441d3f
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x465fe7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x150
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [esp + 0x78], 2
and dword [esp + 0x88], 0
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x50], 3
cmp ecx, 3
je 0x46614a
lea eax, [esp + 0x3c]
add esi, 0x54
mov dword [eax - 4], ecx
push 0xd
pop ecx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x1c]
mov edi, dword [eax + 0x20]
mov eax, dword [ebx + 0x10]
and dword [ebx + 0x10], 0
cmp eax, 1
je 0x466053
cmp eax, 2
jne 0x466168
lea ecx, [esp + 0x38]
jmp 0x466145
mov al, byte [esp + 0x60]
movsd xmm1, qword [esp + 0x40]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 8], edx
movsd xmm0, qword [esp + 0x38]
mov esi, dword [esp + 0x68]
movzx edx, word [esp + 0x6c]
mov byte [esp + 3], al
mov al, byte [esp + 0x6e]
movsd qword [ecx + 8], xmm1
movsd xmm1, qword [esp + 0x48]
movsd qword [ecx], xmm0
movsd qword [ecx + 0x10], xmm1
mov dword [ecx + 0x18], esi
mov byte [ecx + 0x1e], al
mov byte [esp + 2], al
mov word [ecx + 0x1c], dx
call fcn.00455735
test eax, eax
je 0x466141
mov ecx, dword [esp + 4]
cmp byte [esp + 3], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
je 0x4660d3
mov al, byte [esp + 2]
or al, 1
mov byte [esp + 0x36], al
movsd xmm1, qword [esp + 0x28]
lea edi, [esp + 0x90]
movsd xmm0, qword [esp + 0x30]
movsd xmm2, qword [esp + 0x18]
lea esi, [esp + 0xc]
mov ecx, esi
movsd qword [edi + 0x18], xmm1
movsd xmm1, qword [esp + 0x20]
movsd qword [edi + 0x20], xmm0
movsd qword [edi + 8], xmm2
movsd qword [edi + 0x10], xmm1
mov byte [edi], 0
call fcn.0042110c
mov edx, dword [esp + 8]
lea ecx, [eax + 0x78]
push edi
call fcn.004669b9
pop eax
mov ecx, esi
call fcn.00421124
cmp dword [eax + 0x24], 0
jle 0x46613d
add ebx, 0x1c
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.00422287
mov bl, 1
jmp 0x46614c
lea ecx, [esp + 0x18]
call fcn.0045263c
xor ebx, ebx
lea esi, [esp + 0x70]
mov ecx, esi
call fcn.0042230b
mov ecx, esi
call fcn.0042231c
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x23
pop edx
mov ecx, str.wasnt_expecting_a_frame_to_reclaim
push 0x539b4c
call fcn.0050ceed
pop eax
ud2
Function at 0x46e761
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0x34]
mov edx, dword [edx + 0x38]
push 0x53c5cc
push dword [edi + 0x28]
call fcn.0046d6f7
pop ecx
pop ecx
test eax, eax
mov ecx, esp
cmove edx, eax
and dword [ecx + 0x24], 0
and dword [ecx + 0x28], 0
and dword [ecx + 0x2c], 0
mov dword [ecx], edx
mov dword [ecx + 4], 1
mov dword [ecx + 8], eax
lea eax, [esp + 0x30]
and dword [ecx + 0x10], 0
and dword [ecx + 0xc], 0
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
and dword [ecx + 0x20], 0
and dword [ecx + 0x1c], 0
and dword [eax], 0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
push 0
push 0
push eax
push edi
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x46e892
test eax, eax
je 0x46e82a
cmp eax, 0x90317
je 0x46e88b
cmp eax, 0x90321
jne 0x46e89f
mov dword [edi + 0x58], 0x10000
mov byte [edi + 0x5c], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x28]
jne 0x46e815
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0046e716
and dword [edi + 0x9c], 0
jmp 0x46e8b0
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x34]
mov ebp, dword [esp + 0xc]
mov edx, dword [edi + 0x38]
and dword [edi + 0x20], 0
lea ebx, [edi + 0x18]
sub eax, ecx
add ebp, eax
push ebp
push eax
call fcn.0046e8bd
pop ecx
pop ecx
add edx, eax
mov ecx, ebx
push eax
call fcn.00416a75
pop eax
and dword [edi + 0x14], 0
and dword [edi + 0x10], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x28]
jne 0x46e86f
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0046e716
mov eax, dword [edi + 0x28]
xor ecx, ecx
or eax, dword [edi + 0x2c]
sete cl
mov dword [edi + 0x9c], ecx
jmp 0x46e8b0
mov word [esi], 0x104
jmp 0x46e8b5
cmp dword [esp + 0x10], 4
jne 0x46e8a7
mov eax, dword [esp + 0xc]
jmp 0x46e8aa
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x46e8b5
xor eax, eax
inc eax
mov dword [edi + 0x9c], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46eb0a
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0xf4]
mov edx, dword [edx + 0xf8]
push 0x53c5cc
push dword [edi + 0xe8]
call fcn.0046d6f7
pop ecx
pop ecx
test eax, eax
mov ecx, esp
cmove edx, eax
and dword [ecx + 0x24], 0
and dword [ecx + 0x28], 0
and dword [ecx + 0x2c], 0
mov dword [ecx], edx
mov dword [ecx + 4], 1
mov dword [ecx + 8], eax
lea eax, [esp + 0x30]
and dword [ecx + 0x10], 0
and dword [ecx + 0xc], 0
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
and dword [ecx + 0x20], 0
and dword [ecx + 0x1c], 0
and dword [eax], 0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
lea ecx, [edi + 0xc0]
push 0
push 0
push eax
push ecx
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x46ec6e
test eax, eax
je 0x46ebeb
cmp eax, 0x90317
je 0x46ec67
cmp eax, 0x90321
jne 0x46ec7b
mov dword [edi + 0x118], 0x10000
mov byte [edi + 0x11c], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0xe8]
jne 0x46ebd6
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0046eab3
and dword [edi + 0x144], 0
jmp 0x46ec8c
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0xf4]
mov ebp, dword [esp + 0xc]
mov edx, dword [edi + 0xf8]
and dword [edi + 0xe0], 0
lea ebx, [edi + 0xd8]
sub eax, ecx
add ebp, eax
push ebp
push eax
call fcn.0046e8bd
pop ecx
pop ecx
add edx, eax
mov ecx, ebx
push eax
call fcn.00416a75
pop eax
and dword [edi + 0xd4], 0
and dword [edi + 0xd0], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0xe8]
jne 0x46ec45
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0046eab3
mov eax, dword [edi + 0xe8]
xor ecx, ecx
or eax, dword [edi + 0xec]
sete cl
mov dword [edi + 0x144], ecx
jmp 0x46ec8c
mov word [esi], 0x104
jmp 0x46ec91
cmp dword [esp + 0x10], 4
jne 0x46ec83
mov eax, dword [esp + 0xc]
jmp 0x46ec86
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x46ec91
xor eax, eax
inc eax
mov dword [edi + 0x144], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46eccc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov esi, edx
mov dword [edx + 0x78], eax
call fcn.0046ee81
mov ebp, edx
lea edi, [esp + 8]
mov dword [esp], eax
mov dword [esp + 0x24], edx
mov ecx, esi
call fcn.0046ef21
test edx, edx
jne 0x46ed85
mov ecx, edi
mov edx, esi
call fcn.0046d9f6
mov eax, dword [esp + 8]
cmp eax, 2
je 0x46edf6
test eax, eax
je 0x46ed85
cmp dword [esi + 0x9c], 0
je 0x46ed5a
mov ecx, edi
mov edx, esi
call fcn.0046e591
cmp byte [esp + 8], 4
jne 0x46ed3e
mov eax, dword [esp + 0xc]
jmp 0x46ed4f
mov ebx, dword [esp + 8]
mov eax, dword [esp + 0xc]
cmp bl, 4
jne 0x46ee06
test eax, eax
je 0x46ed85
and dword [esi + 0x9c], 0
mov ecx, edi
mov edx, esi
call fcn.0046e761
cmp byte [esp + 8], 4
jne 0x46ed70
mov bh, byte [esp + 9]
jmp 0x46ed7d
mov ebx, dword [esp + 8]
cmp bl, 4
jne 0x46ee00
test bh, bh
je 0x46ecf6
mov ecx, esi
call fcn.0046ef21
cmp ebp, edx
mov edi, edx
mov dword [esp + 0x20], eax
cmovae ebp, edx
mov edx, dword [esp]
mov ecx, ebp
push 0x53c014
push dword [esp + 0x28]
call fcn.004558a3
pop ecx
pop ecx
mov ebx, edx
mov edx, dword [esp + 0x20]
mov ecx, ebp
mov dword [esp], eax
push 0x53c024
push edi
call fcn.004558a3
pop ecx
pop ecx
mov ecx, dword [esp]
mov edi, edx
mov edx, ebx
push 0x53c034
push edi
push eax
call fcn.004bda8a
add esp, 0xc
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
add eax, ebp
adc ecx, 0
xor edx, edx
cmp dword [esi + 0x20], eax
sbb edx, ecx
jb 0x46ee6c
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
jmp 0x46ee15
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
jmp 0x46ee08
mov ebp, dword [esp + 0xc]
jmp 0x46ee08
mov ebp, eax
cmp bl, 4
je 0x46ee15
movzx eax, bl
cmp eax, 4
jne 0x46ee39
mov ecx, dword [esp + 0x40]
mov edx, ebp
push 0x53c4fc
call fcn.0046eed1
pop eax
mov eax, dword [esp + 4]
mov byte [eax], 4
and dword [esi + 0x78], 0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
lea edi, [esp + 8]
mov ecx, edi
mov dword [edi], ebx
mov dword [edi + 4], ebp
call fcn.0046cad4
cmp al, 0xd
jne 0x46ee61
mov eax, dword [esp + 4]
and dword [esi + 0x78], 0
mov byte [eax], 5
push edi
call fcn.00441d62
pop eax
jmp 0x46ee31
mov eax, dword [esp + 4]
mov dword [eax], ebx
mov dword [eax + 4], ebp
jmp 0x46ee2d
push 0x3b
pop edx
mov ecx, str.assertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
push 0x53c140
call fcn.0050af40
pop eax
ud2
Function at 0x489ad6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov ebp, edx
mov edx, dword [esp + 0x38]
lea edi, [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, edi
push 0xb
call fcn.00489bc6
pop eax
mov eax, esp
mov ecx, 0x800
mov dword [eax], 0x800
lea eax, [esp + 8]
and dword [eax], 0
call fcn.0043afb9
lea esi, [esp + 0xc]
mov edi, dword [edi + 4]
mov ebx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
and dword [esi + 8], 0
mov eax, esp
push eax
push ebx
lea eax, [esp + 0x10]
push eax
push 0
push edi
push ebp
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x489b49
mov edx, dword [esp]
mov ecx, esi
call fcn.004912ee
mov ebx, dword [esp + 0x10]
jmp 0x489b20
test eax, eax
jne 0x489b68
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
cmp eax, 0xb
jbe 0x489b84
mov eax, 0xde
jmp 0x489b6c
mov edx, dword [esp + 4]
xor ecx, ecx
mov dword [edx], ecx
mov ecx, dword [esp + 0xc]
mov dword [edx + 4], eax
mov byte [edx + 0xc], 0xc
mov edx, ebx
call fcn.0043d0cd
jmp 0x489b98
mov ecx, dword [esp + 0x14]
movsd xmm0, qword [esp + 0xc]
mov dword [edx + 8], ecx
movsd qword [edx], xmm0
mov byte [edx + 0xc], al
mov ecx, dword [esp + 0x18]
mov edx, edi
call fcn.004bd0bc
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x492cad
Capabilities:
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1e0
cmp dword [ebp + 8], 0x20
mov esi, ecx
jne 0x492e95
mov eax, edx
push 0x20
pop ebx
lea edi, [esp + 0xf0]
mov edx, 0x53eb28
mov ecx, edi
push ebx
push eax
call fcn.00492b1b
pop eax
pop ecx
mov eax, dword [edi + 0x40]
push 0x40
pop edx
mov ecx, edi
push 0x540e9c
push dword [eax + 0x40]
call fcn.00402c4c
pop ecx
pop ecx
lea ebx, [esp + 0x30]
mov edi, edx
mov edx, eax
mov ecx, ebx
push 0x53ebf0
push 0x20
pop eax
push eax
push edi
call fcn.0046751b
add esp, 0xc
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 8], eax
push 0x20
pop eax
cmp dword [ebx + 4], eax
mov al, 1
jne 0x492d60
mov eax, dword [esp + 0x30]
movsd xmm0, qword [eax + 0x18]
movsd qword [esp + 0x49], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0x41], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
xor eax, eax
movsd qword [esp + 0x39], xmm1
movsd qword [esp + 0x31], xmm0
lea ecx, [esi + 1]
lea edx, [esp + 0x30]
lea edi, [esp + 0x13c]
mov dword [esp + 0xc], ecx
mov byte [edx], al
mov ecx, edi
push 0x53ec00
call fcn.00492aa5
pop eax
push edi
call fcn.004ef560
pop eax
movsd xmm1, qword [edi + 0x10]
lea ebx, [esp + 0xd0]
movsd xmm0, qword [edi + 0x18]
movsd xmm2, qword [edi]
movsd qword [ebx + 0x10], xmm1
movsd xmm1, qword [edi + 8]
movsd qword [ebx + 0x18], xmm0
movsd qword [ebx], xmm2
movsd qword [ebx + 8], xmm1
push 0xa0
push 0
push edi
call fcn.004fd260
add esp, 0xc
push ebx
push edi
call fcn.004ef080
pop eax
pop ecx
movsd xmm1, qword [ebx + 0x10]
movsd xmm0, qword [ebx + 0x18]
movsd xmm2, qword [ebx]
cmp dword [esp + 8], 0x20
mov al, 1
movsd qword [esp + 0x20], xmm1
movsd xmm1, qword [ebx + 8]
movsd qword [esp + 0x28], xmm0
movsd qword [esp + 0x10], xmm2
movsd qword [esp + 0x18], xmm1
jne 0x492e33
mov eax, dword [esp + 4]
movsd xmm0, qword [eax + 0x18]
movsd qword [esp + 0x49], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0x41], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
xor eax, eax
movsd qword [esp + 0x39], xmm1
movsd qword [esp + 0x31], xmm0
lea ebx, [esp + 0x30]
lea ecx, [esi + 0x21]
mov byte [ebx], al
mov edx, ebx
push 0x53ec10
call fcn.00492aa5
pop eax
push 0xa0
push edi
push ebx
call fcn.004fea40
add esp, 0xc
lea ecx, [esi + 0x41]
mov edx, ebx
call fcn.00492bb2
mov eax, dword [esp + 0xc]
movsd xmm1, qword [esp + 0x20]
movsd xmm0, qword [esp + 0x28]
movsd xmm2, qword [esp + 0x10]
movsd qword [eax + 0x10], xmm1
movsd xmm1, qword [esp + 0x18]
movsd qword [eax + 0x18], xmm0
movsd qword [eax], xmm2
movsd qword [eax + 8], xmm1
xor eax, eax
jmp 0x492ea5
mov al, 1
mov dword [esi + 4], 0x53fa46
mov dword [esi + 8], 0xf
mov byte [esi], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x493105
Capabilities:
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1d0
mov ebx, edx
mov dword [esp + 0xc], ecx
call fcn.004911ec
xorps xmm0, xmm0
lea eax, [esp + 0x90]
movaps xmmword [eax - 0x10], xmm0
movaps xmmword [eax - 0x20], xmm0
movaps xmmword [eax - 0x30], xmm0
movaps xmmword [eax - 0x40], xmm0
movaps xmmword [eax - 0x50], xmm0
movaps xmmword [eax - 0x60], xmm0
movaps xmmword [eax - 0x70], xmm0
movaps xmmword [eax - 0x80], xmm0
push 0x10
pop ecx
mov edi, eax
mov esi, 0x53eb28
rep movsd dword es:[edi], dword [esi]
and dword [eax + 0x44], 0
and dword [eax + 0x40], 0
mov dword [eax + 0x48], 0x53eb28
and dword [eax + 0x50], 0
push 0x20
pop edi
lea esi, [esp + 0x10]
mov edx, ebx
mov ecx, esi
push edi
call fcn.00490d5e
pop eax
mov edx, dword [ebp + 8]
mov ecx, esi
push edi
call fcn.00490d5e
pop eax
mov edx, dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 0x10]
call fcn.00490d5e
pop eax
lea edi, [esp + 0xf0]
push 0xd8
push esi
push edi
call fcn.004fea40
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov edx, edi
call fcn.00490f08
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4939e6
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov ebp, ebx
cmp ebx, esi
jae 0x493a17
mov ecx, edi
mov edx, esi
push 0x53fe04
push ebp
call fcn.0041757d
pop ecx
pop ecx
mov ebx, edx
push edx
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
add ebx, ebp
test al, al
jne 0x4939f0
cmp ebp, esi
setb al
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b7469
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [esp + 0x78]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x7c]
lea edi, [esp + 0xa]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 2
mov esi, eax
rol si, 8
mov word [edi], si
xor edi, edi
lea esi, [esp + 2]
inc edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 0x542133
mov dword [esp + 0x20], 6
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x28], ecx
add cl, 6
mov byte [esi], cl
mov ecx, dword [esp + 0x88]
lea esi, [esp + 3]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], edi
mov byte [esi], cl
mov esi, dword [esp + 0x84]
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], ecx
mov ecx, dword [edx + 0x48]
imul esi, dword [ecx + 0x40], 0xff
xor ecx, ecx
cmp esi, eax
jb 0x4b7514
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], 6
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], edx
lea edx, [esp + 0x3c]
lea esi, [esp + 0x50]
mov dword [edx], ecx
mov ecx, esi
call fcn.004b72ed
mov edi, dword [esi + 8]
xor edx, edx
inc edx
mov ecx, edi
call fcn.004915a5
mov ebx, eax
mov ebp, edx
mov ecx, esi
push edi
call fcn.004adea4
pop ecx
movzx ecx, al
mov edx, 0x54214c
call fcn.004ab3f7
mov eax, dword [esp + 4]
mov dword [eax], ebx
mov dword [eax + 4], ebp
mov dword [eax + 8], edi
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4bd333
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [edx + 4]
and dword [esp + 8], 0
and dword [esp + 0xc], 0
and dword [esp + 0x20], 0
and dword [esp + 0x1c], 0
and dword [esp + 0x28], 0
and dword [esp + 0x24], 0
and dword [esp + 0x30], 0
and dword [esp + 0x2c], 0
and dword [esp + 0x38], 0
and dword [esp + 0x34], 0
and dword [esp + 0x3c], 0
and dword [esp + 0x44], 0
mov dword [esp + 0x10], 4
mov dword [esp + 4], ecx
mov dword [esp + 0x40], 0x400010
test eax, eax
je 0x4bd39c
mov ecx, dword [edx + 8]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov eax, dword [edx + 0x10]
test eax, eax
je 0x4bd3be
mov esi, dword [edx + 0x14]
xor ecx, ecx
test esi, esi
je 0x4bd3ba
movzx edi, byte [eax]
inc eax
dec esi
or ecx, dword [edi*4 + 0x57f5a8]
jmp 0x4bd3a8
mov dword [esp + 0x30], ecx
mov ebp, dword [edx + 0x20]
mov esi, dword [edx + 0x1c]
lea edi, [ebp*4]
test ebp, ebp
je 0x4bd401
xor edx, edx
cmp ebp, 0x20000000
setb al
jae 0x4bd495
mov dl, al
mov ecx, edi
shl edx, 2
mov dword [esp], edx
call fcn.004912aa
mov ebx, eax
test eax, eax
jne 0x4bd404
mov edx, dword [esp]
mov ecx, edi
call fcn.0050aba0
ud2
push 4
pop ebx
xor eax, eax
mov ecx, edi
test ecx, ecx
je 0x4bd418
mov edx, dword [esi + eax*4]
add ecx, 0xfffffffc
mov dword [ebx + eax*4], edx
inc eax
jmp 0x4bd408
lea ecx, [esp + 0x10]
mov dword [ecx + 4], eax
lea eax, [esp + 8]
mov dword [ecx + 8], ebx
push 0
push eax
push 0
push 0
push ecx
push 0
push 2
push str.Microsoft_Unified_Security_Protocol_Provider
push 0
call dword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x4bd44f
mov ecx, dword [esp + 4]
and dword [ecx], 0
mov dword [ecx + 4], eax
jmp 0x4bd47d
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov dword [esp], eax
push 0x10
pop ecx
call fcn.00417919
xor ecx, ecx
mov edx, dword [esp + 4]
inc ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
mov esi, dword [esp]
mov dword [eax + 0xc], esi
mov dword [edx + 4], eax
mov byte [edx], 4
test ebp, ebp
je 0x4bd48d
mov ecx, ebx
mov edx, edi
push 4
call fcn.00403400
pop eax
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004152f0
ud2

Function at 0x4bd8f7
Capabilities:
Get remote cert context via schannel

Disassembly:
push esi
push eax
mov eax, esp
mov esi, ecx
and dword [eax], 0
push eax
push 0x53
push edx
call dword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x4bd916
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x4bd91f
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 4
pop esi
ret