joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
mov ecx, 1
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x44]
cmp edi, ecx
jae 0x48a37a
mov dword [esp + 0x44], ecx
jmp 0x48a38a
cmp edi, 0xff
jbe 0x48a38e
mov dword [esp + 0x44], 0xff
mov edi, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
xor ebp, ebp
mov esi, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
lea edx, [eax + eax*8]
lea eax, [eax + edx*2]
lea eax, [eax + eax*2]
lea eax, [esi + eax*4]
cmp esi, eax
jae 0x48a3bd
cmp dword [esi + 0x18], ebp
je 0x48a3b9
add esi, 0xe4
cmp esi, eax
jb 0x48a3aa
cmp esi, eax
jb 0x48a3c7
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
mov eax, dword [esp + 0x40]
mov dword [esi + 0x18], ecx
lea ebx, [edi + edi*2]
mov ecx, dword [eax]
mov dword [esi + 0xc], ecx
mov edx, dword [eax + 4]
shl ebx, 3
push ebx
mov dword [esi + 0x10], edx
call fcn.0048d830
add esp, 4
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edi
call fcn.0048d860
mov dword [esi + 8], eax
mov eax, dword [esp + 0x3c]
mov ecx, 0x8000
mov eax, dword [eax + 0x10]
cmp eax, ebp
jne 0x48a40e
mov dword [esi + 0x98], ecx
jmp 0x48a41a
shr eax, 0x10
shl eax, 0xc
mov dword [esi + 0x98], eax
mov eax, dword [esi + 0x98]
cmp eax, 0x1000
jae 0x48a433
mov dword [esi + 0x98], 0x1000
jmp 0x48a43d
cmp eax, ecx
jbe 0x48a43d
mov dword [esi + 0x98], ecx
mov edi, dword [esi + 0x1c]
lea ecx, [edi + ebx]
cmp edi, ecx
jae 0x48a47c
lea edx, [edi + 8]
mov word [edi], bp
push edx
mov word [edi + 2], bp
mov word [edi + 4], bp
mov word [edi + 6], bp
call fcn.0048d7e0
add esp, 4
lea eax, [edi + 0x10]
push eax
call fcn.0048d7e0
mov edx, dword [esi + 0x1c]
mov ecx, ebx
add edi, 0x18
add ecx, edx
add esp, 4
cmp edi, ecx
jb 0x48a447
mov edi, dword [sym.imp.WS2_32.dll_htons]
mov byte [esp + 0x10], 0x82
mov byte [esp + 0x11], 0xff
mov dx, word [esi + 6]
push edx
call edi
mov word [esp + 0x14], ax
mov ax, word [esi + 0x94]
push eax
call edi
mov edi, dword [sym.imp.WS2_32.dll_htonl]
mov word [esp + 0x16], ax
mov ecx, dword [esi + 0x98]
push ecx
call edi
mov edx, dword [esp + 0x44]
mov dword [esp + 0x18], eax
push edx
call edi
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0xc]
push eax
call edi
mov ecx, dword [ebx + 0x10]
mov dword [esp + 0x20], eax
push ecx
call edi
mov dword [esp + 0x24], eax
mov edx, dword [esi + 0x78]
push edx
call edi
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x70]
push eax
call edi
mov dword [esp + 0x2c], eax
mov ecx, dword [esi + 0x74]
push ecx
call edi
mov dword [esp + 0x30], eax
mov edx, dword [esi + 8]
push ebp
push ebp
lea eax, [esp + 0x18]
push ebp
push eax
push esi
mov dword [esp + 0x48], edx
call fcn.0048b3c0
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x48a8d0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x48a912
mov ax, word [esp]
cmp al, 1
jne 0x48a90c
xor ecx, ecx
mov cl, ah
cmp cl, al
jne 0x48a90c
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
xor eax, eax
add esp, 0x190
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
add esp, 0x190
ret

Function at 0x48a930
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x48a958
cmp word [eax + 8], 2
jne 0x48a958
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [esp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
xor eax, eax
pop esi
ret
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x48a968
or eax, eax
pop esi
ret
mov ecx, dword [esp + 8]
pop esi
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x48a980
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x24]
xor eax, eax
cmp ebx, 2
sete al
push esi
push edi
inc eax
push 0
push eax
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
mov eax, 0x40000
cmp esi, 0xffffffff
mov dword [esp + 0x2c], 1
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
je 0x48aa9c
cmp ebx, 2
jne 0x48aa1b
lea ecx, [esp + 0x2c]
push ecx
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea edx, [esp + 0xc]
push 4
push edx
push 0x1002
push 0xffff
push esi
call edi
lea eax, [esp + 0x10]
push 4
push eax
push 0x1001
push 0xffff
push esi
call edi
lea ecx, [esp + 0x14]
push 4
push ecx
push 0x20
push 0xffff
push esi
call edi
mov edi, dword [esp + 0x30]
xor edx, edx
mov dword [esp + 0x18], edx
xor eax, eax
mov dword [esp + 0x1c], edx
cmp edi, eax
mov dword [esp + 0x20], edx
mov word [esp + 0x18], 2
mov dword [esp + 0x24], edx
je 0x48aa56
mov ax, word [edi + 4]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [edi]
mov word [esp + 0x1a], ax
mov dword [esp + 0x1c], ecx
jmp 0x48aa5f
mov word [esp + 0x1a], ax
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x18]
push 0x10
push edx
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x48aa95
cmp ebx, 1
jne 0x48aa8c
test edi, edi
je 0x48aa8c
push closesocket
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x48aa95
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x1c
ret
Function at 0x48aab0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x48aad9
mov ax, word [esi + 4]
mov word [esp + 4], 2
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esi]
mov word [esp + 6], ax
mov dword [esp + 8], ecx
mov edx, esi
lea eax, [esp + 4]
neg edx
sbb edx, edx
push 0
and edx, 0x10
push 0
neg esi
sbb esi, esi
push edx
mov edx, dword [esp + 0x30]
and esi, eax
mov eax, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x2c]
push 0
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSASendTo]
cmp eax, 0xffffffff
jne 0x48ab27
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 0x1c]
pop esi
add esp, 0x10
ret

Function at 0x48ab30
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [esp + 0x24]
mov eax, esi
lea ecx, [esp + 8]
neg eax
sbb eax, eax
mov edx, esi
push 0
and eax, ecx
push 0
push eax
neg edx
sbb edx, edx
lea eax, [esp + 0x18]
and edx, eax
mov eax, dword [esp + 0x38]
push edx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
mov dword [esp + 0x2c], 0x10
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
jne 0x48abab
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
je 0x48aba4
sub eax, 0x13
je 0x48aba4
or eax, 0xffffffff
pop esi
add esp, 0x18
ret
xor eax, eax
pop esi
add esp, 0x18
ret
mov eax, dword [esp + 4]
test ah, 0x80
je 0x48abbc
or eax, 0xffffffff
pop esi
add esp, 0x18
ret
test esi, esi
je 0x48abd5
mov ecx, dword [esp + 0xe]
mov eax, dword [esp + 0x10]
push ecx
mov dword [esi], eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esi + 4], ax
mov eax, dword [esp + 0x24]
pop esi
add esp, 0x18
ret
Function at 0x48abe0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x210
mov ecx, dword [esp + 0x21c]
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov dword [esp], edx
mov eax, ecx
xor edx, edx
mov ecx, 0x3e8
div ecx
push ebp
mov ebp, dword [esp + 0x218]
push esi
mov esi, dword [esp + 0x220]
mov dword [esp + 0x114], 0
mov dword [esp + 0x10], 0
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, dword [esi]
shl edx, 3
test al, 1
mov dword [esp + 0xc], edx
je 0x48ac4b
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 1
test al, 2
je 0x48ac61
mov dword [esp + 0x118], ebp
mov dword [esp + 0x114], 1
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
push 0
lea edx, [esp + 0x11c]
push ecx
lea eax, [ebp + 1]
push edx
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jge 0x48ac8f
or eax, 0xffffffff
pop esi
pop ebp
add esp, 0x210
ret
test eax, eax
mov dword [esi], 0
je 0x48acc6
lea ecx, [esp + 0x10]
push ecx
push ebp
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x48acae
mov eax, dword [esi]
or al, 1
mov dword [esi], eax
lea edx, [esp + 0x114]
push edx
push ebp
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x48acc6
mov eax, dword [esi]
or al, 2
mov dword [esi], eax
pop esi
xor eax, eax
pop ebp
add esp, 0x210
ret
Function at 0x48b4e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
xor eax, eax
push ebp
mov al, byte [ebx + 1]
push esi
push edi
xor esi, esi
lea ecx, [eax + eax*2]
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 0x1c]
lea edi, [edx + ecx*8]
mov ecx, dword [eax + 0x18]
cmp ecx, 6
je case.default.0x48b57a
mov cl, byte [ebx]
mov ebp, 0xf000
mov al, cl
and al, 0xf
cmp al, 9
je 0x48b560
mov dx, word [edi + 4]
xor eax, eax
mov ax, word [ebx + 2]
cmp dx, bp
jb 0x48b532
cmp eax, 0x1000
jae 0x48b532
add eax, 0x10000
mov ebp, edx
and ebp, 0xffff
cmp eax, ebp
jb case.default.0x48b57a
cmp dx, 0x1000
jae 0x48b566
mov edx, eax
mov ebp, 0xf000
and edx, 0xffff
cmp edx, ebp
jae case.default.0x48b57a
jmp 0x48b56b
mov eax, dword [esp + 0x18]
jmp 0x48b56b
mov ebp, 0xf000
and ecx, 0xf
add ecx, 0xfffffffa
cmp ecx, 3
ja case.default.0x48b57a
jmp dword [ecx*4 + 0x48b71c]
xor ecx, ecx
mov cx, word [edi + 4]
cmp eax, ecx
je case.default.0x48b57a
mov ebx, dword [edi + 0xc]
add edi, 8
cmp ebx, edi
je 0x48b676
cmp eax, 0x10000
jb 0x48b5af
cmp word [ebx + 8], bp
jae 0x48b5af
sub eax, 0x10000
xor edx, edx
mov dx, word [ebx + 8]
cmp edx, eax
jbe 0x48b5c5
mov ebx, dword [ebx + 4]
cmp ebx, edi
jne 0x48b59d
jmp 0x48b676
xor ecx, ecx
mov cx, word [ebx + 8]
cmp ecx, eax
jae case.default.0x48b57a
jmp 0x48b676
mov dx, word [ebx + 4]
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
mov si, ax
mov ax, word [edi + 6]
and esi, 0xffff
cmp ax, bp
jb 0x48b603
cmp esi, 0x1000
jae 0x48b603
add esi, 0x10000
mov ecx, eax
and ecx, 0xffff
cmp esi, ecx
jbe case.default.0x48b57a
cmp ax, 0x1000
jae 0x48b629
mov edx, esi
and edx, 0xffff
cmp edx, ebp
jae case.default.0x48b57a
mov ebx, dword [edi + 0x14]
add edi, 0x10
cmp ebx, edi
je 0x48b676
mov al, byte [ebx + 0xc]
and al, 0xf
cmp al, 7
jne 0x48b65a
cmp esi, 0x10000
jb 0x48b650
cmp word [ebx + 0xa], bp
jae 0x48b650
sub esi, 0x10000
xor ecx, ecx
mov cx, word [ebx + 0xa]
cmp ecx, esi
jbe 0x48b663
mov ebx, dword [ebx + 4]
cmp ebx, edi
jne 0x48b633
jmp 0x48b676
xor edx, edx
mov dx, word [ebx + 0xa]
cmp edx, esi
jae case.default.0x48b57a
jmp 0x48b676
lea ebx, [edi + 0x10]
push 0x44
call fcn.0048d830
mov ebp, eax
mov eax, dword [esp + 0x1c]
add esp, 4
mov cx, word [eax + 2]
mov word [ebp + 0xa], si
mov word [ebp + 8], cx
lea edi, [ebp + 0xc]
mov ecx, 0xa
mov esi, eax
mov eax, dword [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x1c]
mov dword [ebp + 0x34], eax
test eax, eax
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x40], esi
mov dword [ebp + 0x3c], 0
jbe 0x48b6e5
lea edi, [eax + 0x1f]
shr edi, 5
shl edi, 2
push edi
call fcn.0048d830
mov edx, eax
mov ecx, edi
mov dword [ebp + 0x3c], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
test esi, esi
je 0x48b6eb
inc dword [esi]
mov eax, dword [ebx]
push ebp
push eax
call fcn.0048d7f0
add esp, 8
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x48b714
cmp dword [eax], 0
jne 0x48b714
push eax
call fcn.0048d6f0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x48d500
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
cmp dword [esi + 0x18], 1
jne 0x48d607
mov edi, dword [esp + 0x20]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov eax, dword [edi + 0xc]
push eax
call ebp
cmp eax, dword [esi + 0x20]
jne 0x48d600
mov ecx, dword [edi + 0x18]
push ecx
call ebp
cmp eax, dword [esi + 0x78]
jne 0x48d600
mov edx, dword [edi + 0x1c]
push edx
call ebp
cmp eax, dword [esi + 0x70]
jne 0x48d600
mov eax, dword [edi + 0x20]
push eax
call ebp
cmp eax, dword [esi + 0x74]
jne 0x48d600
push 0xff
push 1
push esi
call fcn.0048d450
mov cx, word [edi + 4]
mov ebx, dword [sym.imp.WS2_32.dll_ntohs]
add esp, 0xc
push ecx
call ebx
mov word [esi + 4], ax
mov dx, word [edi + 6]
push edx
call ebx
cmp ax, 0x240
jae 0x48d58d
mov eax, 0x240
jmp 0x48d598
cmp ax, 0x1000
jbe 0x48d598
mov eax, 0x1000
cmp ax, word [esi + 0x94]
jae 0x48d5a8
mov word [esi + 0x94], ax
mov eax, dword [edi + 8]
push eax
call ebp
cmp eax, 0x1000
jae 0x48d5ba
mov eax, 0x1000
cmp eax, 0x8000
jbe 0x48d5c6
mov eax, 0x8000
cmp eax, dword [esi + 0x98]
jae 0x48d5d4
mov dword [esi + 0x98], eax
mov ecx, dword [edi + 0x10]
push ecx
call ebp
mov dword [esi + 0x24], eax
mov edx, dword [edi + 0x14]
push edx
call ebp
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x18]
push eax
push esi
push ecx
call fcn.0048d410
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x18], 9
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret

Function at 0x48d720
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x5312f8]
push ebx
push ebp
push esi
or esi, 0xffffffff
push edi
test eax, eax
jne 0x48d735
call fcn.0048d790
mov eax, dword [esp + 0x18]
mov ecx, eax
dec eax
test ecx, ecx
jbe 0x48d776
mov edi, dword [esp + 0x14]
lea ebp, [eax + 1]
mov eax, dword [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
add ecx, ebx
cmp eax, ecx
jae 0x48d770
mov edx, esi
xor ebx, ebx
mov bl, byte [eax]
shr edx, 0x18
shl esi, 8
mov edx, dword [edx*4 + 0x530ef8]
or esi, ebx
xor esi, edx
inc eax
cmp eax, ecx
jb 0x48d754
add edi, 8
dec ebp
jne 0x48d747
not esi
push esi
call dword [sym.imp.WS2_32.dll_htonl]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x48d790
Capabilities:
Hash data using crc32b

Disassembly:
push esi
xor edx, edx
mov ecx, 0x530ef8
mov eax, edx
mov esi, 8
shl eax, 0x18
test eax, 0x80000000
je 0x48d7b2
add eax, eax
xor eax, 0x4c11db7
jmp 0x48d7b4
shl eax, 1
dec esi
jne 0x48d7a2
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x5312f8
jl 0x48d798
mov dword [0x5312f8], 1
pop esi
ret
Function at 0x493580
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
call fcn.00493640
mov eax, dword [0x5317c4]
mov ebp, dword [esp + 0x10]
cmp eax, 1
jne 0x4935a4
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x5317c0], 1
mov byte [0x5317bc], bl
jne 0x4935fe
mov ecx, dword [0x532e8c]
test ecx, ecx
je 0x4935ec
mov esi, dword [0x532e88]
sub esi, 4
cmp esi, ecx
jb 0x4935ec
mov eax, dword [esi]
test eax, eax
je 0x4935e5
call eax
mov ecx, dword [0x532e8c]
sub esi, 4
cmp esi, ecx
jae 0x4935d7
push 0x4aa368
push 0x4aa360
call fcn.00493660
add esp, 8
push 0x4aa374
push 0x4aa36c
call fcn.00493660
add esp, 8
test ebx, ebx
je 0x49361d
call fcn.00493650
pop esi
pop ebp
pop ebx
ret
push ebp
mov dword [0x5317c4], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x494bf0
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x494c09
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x494c0b
xor eax, eax
test eax, eax
je 0x494c1c
push eax
call fcn.00494680
add esp, 4
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x494c20
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x494c37
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x494c39
xor eax, eax
test eax, eax
je 0x494c4a
push eax
call fcn.00494680
add esp, 4
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x494c50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5fe8
push 0x498d68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x531794], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x531790], ecx
shl ecx, 8
add ecx, edx
mov dword [0x53178c], ecx
shr eax, 0x10
mov dword [0x531788], eax
call fcn.00495fc0
test eax, eax
jne 0x494cba
push 0x1c
call fcn.00494e30
add esp, 4
call fcn.00497e60
test eax, eax
jne 0x494ccd
push 0x10
call fcn.00494e30
add esp, 4
mov dword [ebp - 4], 0
call fcn.00498600
call fcn.0049b560
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x532e84], eax
call fcn.0049af00
mov dword [0x5317c8], eax
test eax, eax
je 0x494d00
mov eax, dword [0x532e84]
test eax, eax
jne 0x494d0a
push 0xffffffffffffffff
call fcn.00493540
add esp, 4
call fcn.0049ac50
call fcn.0049ab60
call fcn.00493510
mov esi, dword [0x532e84]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x494de9
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x494d51
test al, al
je 0x494d51
and eax, 0xff
push eax
call fcn.0049ab00
add esp, 4
test eax, eax
je 0x494d2b
inc esi
mov dword [ebp - 0x64], esi
jmp 0x494d2b
cmp byte [esi], 0x22
jne 0x494d5a
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x494d6a
cmp al, 0x20
ja 0x494d6a
inc esi
mov dword [ebp - 0x64], esi
jmp 0x494d5a
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x494d8b
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x494d90
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.00493540
jmp 0x494dce
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x494d5a
inc esi
mov dword [ebp - 0x64], esi
jmp 0x494de9

Function at 0x494e30
Capabilities:
Terminate process

Disassembly:
cmp dword [0x5317d0], 1
jne 0x494e3e
call fcn.0049b570
mov eax, dword [esp + 4]
push eax
call fcn.0049b5b0
add esp, 4
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x497e60
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.00495800
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x4b6080], eax
je 0x497eb8
push 0x74
push 1
call fcn.0049c100
mov esi, eax
add esp, 8
test esi, esi
je 0x497eb8
mov eax, dword [0x4b6080]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x497eb8
push esi
call fcn.00497ec0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x497ee0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x4b6080]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x497f4e
push 0x74
push 1
call fcn.0049c100
mov esi, eax
add esp, 8
test esi, esi
je 0x497f44
mov ecx, dword [0x4b6080]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x497f44
push esi
call fcn.00497ec0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
push 0x10
call fcn.00494e00
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
Function at 0x498ec0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x41c
push ebx
mov ebx, dword [esp + 0x42c]
push ebp
xor ebp, ebp
push esi
cmp ebx, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], ebp
jne 0x498eec
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x430]
mov eax, ecx
sar eax, 5
lea edi, [eax*4 + 0x531d60]
mov eax, ecx
and eax, 0x1f
mov dword [esp + 0x24], edi
mov edx, dword [edi]
lea esi, [eax + eax*8]
shl esi, 2
mov dword [esp + 0x14], esi
test byte [esi + edx + 4], 0x20
je 0x498f27
push 2
push ebp
push ecx
call fcn.00498890
add esp, 0xc
mov eax, dword [edi]
add eax, esi
test byte [eax + 4], 0x80
je 0x499089
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x18], 0
test ebx, ebx
mov edi, ebp
jbe 0x498fd1
lea eax, [esp + 0x28]
mov ecx, edi
sub ecx, ebp
cmp ecx, ebx
jae 0x498f82
mov cl, byte [edi]
inc edi
cmp cl, 0xa
jne 0x498f6f
mov esi, dword [esp + 0x20]
mov byte [eax], 0xd
inc esi
inc eax
mov dword [esp + 0x20], esi
mov byte [eax], cl
inc eax
mov edx, eax
lea ecx, [esp + 0x28]
sub edx, ecx
cmp edx, 0x400
jl 0x498f52
mov esi, eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c]
sub esi, edx
mov edx, dword [esp + 0x24]
push 0
push eax
lea ecx, [esp + 0x30]
mov eax, dword [edx]
push esi
push ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + eax]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49907a
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add edx, eax
cmp eax, esi
mov dword [esp + 0x10], edx
jl 0x498fcd
mov eax, edi
sub eax, ebp
cmp eax, ebx
jb 0x498f4e
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x499069
mov eax, dword [esp + 0x18]
test eax, eax
je 0x499025
cmp eax, 5
jne 0x49900e
call fcn.00494700
mov dword [eax], 9
call fcn.00494710
mov dword [eax], 5
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
push eax
call fcn.00494680
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
test byte [esi + edx + 4], 0x40
je 0x499045
cmp byte [ebp], 0x1a
jne 0x499045
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
call fcn.00494700
mov dword [eax], 0x1c
call fcn.00494710
mov dword [eax], 0
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
add esp, 0x41c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x498fcd
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x438]
push ecx
push ebx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4990ba
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
jmp 0x498fd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x498fd1