joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bf0c7
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebp, dword [esp + 0x34]
mov esi, ecx
cmp dl, 4
jne 0x4bf133
mov eax, dword [0x5b7acc]
cmp eax, 3
jne 0x4bf225
cmp word [ebp], 0
push 2
pop eax
push 0x17
pop ebx
cmove ebx, eax
push 0x81
push 0
push 0
push 0
push 2
push ebx
call sub.ws2_32.dll_WSASocketW
mov edi, eax
cmp eax, 0xffffffff
je 0x4bf14e
cmp word [ebp], 0
je 0x4bf1a2
mov ecx, dword [ebp + 0x18]
movups xmm0, xmmword [ebp + 4]
lea eax, [ebp + 0x14]
add ebp, 0x1c
mov dword [esp], ecx
push 0x1c
pop ecx
mov bx, 0x17
jmp 0x4bf1b2
mov eax, edx
shr eax, 8
mov word [esi + 1], ax
mov eax, edx
shr eax, 0x18
mov byte [esi + 3], al
mov byte [esi], dl
mov dword [esi + 4], ebp
jmp 0x4bf21d
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x4bf166
cmp eax, 0x2726
jne 0x4bf20e
push 1
push 0
push 0
push 0
push 2
push ebx
call sub.ws2_32.dll_WSASocketW
cmp eax, 0xffffffff
je 0x4bf208
mov edi, eax
push 0
push 1
push eax
call sub.kernel32.dll_SetHandleInformation
test eax, eax
jne 0x4bf10f
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
mov eax, ebx
jmp 0x4bf20e
lea eax, [ebp + 2]
add ebp, 6
xorps xmm0, xmm0
push 0x10
pop ecx
mov bx, 2
movzx ebp, word [ebp]
mov eax, dword [eax]
lea edx, [esp + 4]
mov word [edx], bx
rol bp, 8
mov word [edx + 2], bp
mov dword [edx + 4], eax
mov eax, dword [esp]
movups xmmword [edx + 8], xmm0
mov dword [edx + 0x18], eax
push ecx
push edx
push edi
call dword [sym.imp.ws2_32.dll_bind]
cmp eax, 0xffffffff
je 0x4bf1ea
mov dword [esi + 4], edi
mov byte [esi], 4
jmp 0x4bf21d
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi], cl
and word [esi + 1], 0
mov byte [esi + 3], cl
mov dword [esi + 4], eax
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
jmp 0x4bf21d
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
and word [esi + 1], 0
xor ecx, ecx
mov byte [esi + 3], cl
mov byte [esi], cl
mov dword [esi + 4], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0050d960
jmp 0x4bf0e7

Function at 0x4bf24e
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
cmp word [edx], 0
mov esi, ecx
je 0x4bf292
movsd xmm0, qword [edx + 4]
movsd xmm1, qword [edx + 0xc]
mov ebx, dword [edx + 0x14]
mov ebp, dword [edx + 0x18]
movzx edx, word [edx + 0x1c]
lea edi, [esi + 0x1c]
rol dx, 8
movsd qword [esi + 0x10], xmm1
movsd qword [esi + 8], xmm0
push 0x19
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esi + 0x18], ebp
push 0x1c
pop eax
mov cx, 0x17
jmp 0x4bf2b6
mov ebx, dword [edx + 2]
movzx edx, word [edx + 6]
lea edi, [esi + 0x10]
rol dx, 8
push 0x1c
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
and dword [esi + 0xc], 0
and dword [esi + 8], 0
push 0x10
pop eax
mov cx, 2
mov word [esi], cx
mov word [esi + 2], dx
mov dword [esi + 4], ebx
mov dword [esi + 0x80], eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4bf71e
Capabilities:
Set socket configuration

Disassembly:
push edi
push esi
sub esp, 8
mov esi, ecx
lea eax, [esp + 0x18]
push 4
push eax
push dword [esp + 0x1c]
push 0xffff
push edx
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x4bf74f
mov edi, esp
mov ecx, edi
call fcn.004bd1c2
mov eax, dword [edi]
cmp al, 4
jne 0x4bf754
mov byte [esi], 4
jmp 0x4bf75d
mov ecx, dword [esp + 4]
mov dword [esi], eax
mov dword [esi + 4], ecx
add esp, 8
pop esi
pop edi
ret
Function at 0x4bf7c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4e8bf0
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
cmp eax, 3
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
je 0x4bf7fe
test eax, eax
jne 0x4bf97a
mov ebx, dword [0x5b7ad4]
test ebx, ebx
je 0x4bf97a
mov dword [ebp - 0x20], 0
jmp 0x4bf827
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4bf858
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4bf9cb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4bf820
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4bf820
test byte [ebp - 0x20], 1
je 0x4bf97a
mov ebx, dword [0x5b7ad4]
test ebx, ebx
je 0x4bf97a
mov dword [ebp - 0x20], 0
jmp 0x4bf887
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4bf8b8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4bf9cb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4bf880
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4bf880
test byte [ebp - 0x20], 1
je 0x4bf97a
mov ebx, dword [0x5b7ad4]
test ebx, ebx
je 0x4bf97a
mov dword [ebp - 0x20], 0
jmp 0x4bf8e7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4bf918
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4bf9cb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4bf8e0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4bf8e0
test byte [ebp - 0x20], 1
je 0x4bf97a
mov ebx, dword [0x5b7ad4]
test ebx, ebx
je 0x4bf97a
mov dword [ebp - 0x20], 0
jmp 0x4bf947
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4bf974
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4bf9cb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4bf940
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4bf940
test byte [ebp - 0x20], 1
jne 0x4bf994
movzx eax, byte [0x5b2d00]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x5b7ad4]
jmp 0x4bf99f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4bf97a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4bf9cb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4bf99c
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x4bf99c
mov dword [ebp - 0x10], 0
mov ecx, str.called__Option::unwrap____on_a__None__value
mov edx, 0x2b
push 0x546830
call fcn.0050af40
add esp, 4
ud2
Function at 0x4c0220
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4e8c70
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x5b70dc]
test eax, eax
je 0x4c0312
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4c0276
cmp dword [eax], 0
mov edi, eax
je 0x4c0276
add edi, 4
jmp 0x4c02ff
mov eax, dword [0x5b70dc]
test eax, eax
je 0x4c0321
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4c02fd
mov esi, eax
test eax, eax
jne 0x4c02ce
mov ecx, 0x10
mov edx, 4
call fcn.00414760
test eax, eax
je 0x4c033c
mov dword [eax], 0
mov dword [eax + 0xc], 0x5b70dc
mov esi, eax
mov eax, dword [0x5b70dc]
test eax, eax
je 0x4c0330
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
je 0x4c02ff
test ecx, ecx
je 0x4c02ff
lock dec dword [ecx]
jne 0x4c02ff
call fcn.004c0390
jmp 0x4c02ff
xor edi, edi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x5b70dc
call fcn.0050d3d0
jmp 0x4c025b
mov ecx, 0x5b70dc
call fcn.0050d3d0
jmp 0x4c0284
mov ecx, 0x5b70dc
call fcn.0050d3d0
jmp 0x4c02c6
mov ecx, 0x10
mov edx, 4
mov dword [ebp - 0x10], 0
call fcn.0050aba0
ud2

Function at 0x4c0dd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x5b70b4]
test eax, eax
je 0x4c0e4d
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4c0def
cmp byte [eax + 4], 0
mov esi, eax
jne 0x4c0e42
mov eax, dword [0x5b70b4]
test eax, eax
je 0x4c0e59
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4c0e47
mov esi, eax
test eax, eax
jne 0x4c0e3c
mov ecx, 8
mov edx, 4
call fcn.00414760
test eax, eax
je 0x4c0e71
mov dword [eax], 0x5b70b4
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x5b70b4]
test eax, eax
je 0x4c0e65
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x4c0e49
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x5b70b4
call fcn.0050d3d0
jmp 0x4c0ddb
mov ecx, 0x5b70b4
call fcn.0050d3d0
jmp 0x4c0df9
mov ecx, 0x5b70b4
call fcn.0050d3d0
jmp 0x4c0e34
mov ecx, 8
mov edx, 4
call fcn.0050aba0
ud2
Function at 0x4c1af0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x50
mov eax, dword [esp + 0x5c]
mov esi, ecx
mov ecx, dword [esp + 0x60]
mov edi, edx
mov dword [esp], 0x103
mov dword [esp + 4], 0
mov edx, esp
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x4c1b40
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp]
cmp eax, 0x103
je 0x4c1b66
test eax, eax
js 0x4c1b50
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x4c1b60
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
mov dword [esi], 0
add esp, 0x50
pop esi
pop edi
ret
lea eax, [esp + 0x38]
mov dword [esp + 0x28], 0x544e70
mov dword [esp + 0x2c], 2
mov dword [esp + 0x20], 0
lea esi, [esp + 0x18]
mov dword [esp + 8], 0
mov dword [esp + 0x40], 0x546260
mov dword [esp + 0x44], 1
mov dword [esp + 0x38], 0
mov dword [esp + 0x48], str._rustc_90c541806f23a127002de5b4038be731ba1458calibrarycore_src_strpattern.rs
mov byte [esp + 0xc], 0
mov dword [esp + 0x4c], 0
lea ecx, [esp + 8]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x418fc0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x34], 1
push eax
push ecx
push esi
call fcn.004bfde0
add esp, 0xc
cmp byte [esp + 0x18], 4
je 0x4c1bfa
push esi
call fcn.004bff30
add esp, 4
mov ecx, 7
int 0x29
ud2
Function at 0x4c2200
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x5b70ec]
test eax, eax
je 0x4c2287
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4c2221
cmp dword [eax], 0
je 0x4c2221
add eax, 4
pop esi
ret
mov eax, dword [0x5b70ec]
test eax, eax
je 0x4c2296
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4c2283
mov esi, eax
test eax, eax
jne 0x4c2271
mov ecx, 0xc
mov edx, 4
call fcn.00414760
test eax, eax
je 0x4c22ae
mov dword [eax], 0
mov dword [eax + 8], 0x5b70ec
mov esi, eax
mov eax, dword [0x5b70ec]
test eax, eax
je 0x4c22a2
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi], 1
lea eax, [esi + 4]
mov dword [esi + 4], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x5b70ec
call fcn.0050d3d0
jmp 0x4c220b
mov ecx, 0x5b70ec
call fcn.0050d3d0
jmp 0x4c222b
mov ecx, 0x5b70ec
call fcn.0050d3d0
jmp 0x4c2269
mov ecx, 0xc
mov edx, 4
call fcn.0050aba0
ud2
Function at 0x4c85f0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x50
mov eax, dword [esp + 0x5c]
mov esi, ecx
mov ecx, dword [esp + 0x60]
mov edi, edx
mov dword [esp], 0x103
mov dword [esp + 4], 0
mov edx, esp
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x4c8639
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp]
cmp eax, 0xc0000011
jne 0x4c8649
mov dword [esi + 4], 0
jmp 0x4c865b
cmp eax, 0x103
je 0x4c8676
test eax, eax
js 0x4c8664
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x50
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x4c865e
lea eax, [esp + 0x38]
mov dword [esp + 0x28], 0x544e70
mov dword [esp + 0x2c], 2
mov dword [esp + 0x20], 0
lea esi, [esp + 0x18]
mov dword [esp + 8], 0
mov dword [esp + 0x40], 0x546260
mov dword [esp + 0x44], 1
mov dword [esp + 0x38], 0
mov dword [esp + 0x48], str._rustc_90c541806f23a127002de5b4038be731ba1458calibrarycore_src_strpattern.rs
mov byte [esp + 0xc], 0
mov dword [esp + 0x4c], 0
lea ecx, [esp + 8]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x418fc0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x34], 1
push eax
push ecx
push esi
call fcn.004bfde0
add esp, 0xc
cmp byte [esp + 0x18], 4
je 0x4c870a
push esi
call fcn.004bff30
add esp, 4
mov ecx, 7
int 0x29
ud2

Function at 0x4c98d0
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov esi, ecx
mov ecx, esp
push dword [esp + 0x30]
call fcn.004c2a70
add esp, 4
cmp dword [esp], 0
je 0x4c98f6
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
jmp 0x4c9927
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], edx
lea ecx, [esp + 0x10]
mov edx, esp
call fcn.004c8720
cmp dword [esp + 0x10], 0
je 0x4c9933
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], ecx
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x4c9951
mov byte [esi], 4
test ebx, ebx
jne 0x4c996b
jmp 0x4c992c
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x4c992c
mov ecx, edi
mov edx, 2
call fcn.004147c0
jmp 0x4c992c
Function at 0x4cb490
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4e8f40
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x5b70a4]
test eax, eax
je 0x4cb57b
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4cb4e6
cmp dword [eax], 0
mov edi, eax
je 0x4cb4e6
add edi, 4
jmp 0x4cb568
mov eax, dword [0x5b70a4]
test eax, eax
je 0x4cb58a
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4cb566
mov esi, eax
test eax, eax
jne 0x4cb53e
mov ecx, 0xc
mov edx, 4
call fcn.00414760
test eax, eax
je 0x4cb5a5
mov dword [eax], 0
mov dword [eax + 8], 0x5b70a4
mov esi, eax
mov eax, dword [0x5b70a4]
test eax, eax
je 0x4cb599
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 4]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
je 0x4cb568
test ecx, ecx
je 0x4cb568
lock dec dword [ecx]
jne 0x4cb568
call fcn.004cb5e0
jmp 0x4cb568
xor edi, edi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x5b70a4
call fcn.0050d3d0
jmp 0x4cb4cb
mov ecx, 0x5b70a4
call fcn.0050d3d0
jmp 0x4cb4f4
mov ecx, 0x5b70a4
call fcn.0050d3d0
jmp 0x4cb536
mov ecx, 0xc
mov edx, 4
mov dword [ebp - 0x10], 0
call fcn.0050aba0
ud2
Function at 0x4cbb60
Capabilities:
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1a8
mov edi, dword [edx]
mov ebp, dword [edx + 4]
movzx ebx, word [edx + 8]
mov eax, dword [0x5b7acc]
mov esi, ecx
cmp eax, 3
jne 0x4cbc7b
cmp ebp, 0x17f
ja 0x4cbc8c
mov dword [esp + 4], ebx
lea ebx, [esp + 0x28]
push ebp
push edi
push ebx
call fcn.004fea40
add esp, 0xc
lea edi, [ebp + 1]
cmp ebp, 6
mov byte [esp + ebp + 0x28], 0
ja 0x4cbbd6
lea eax, [ebp + 1]
xor edx, edx
nop word cs:[eax + eax]
nop
cmp byte [esp + edx + 0x28], 0
je 0x4cbbeb
inc edx
cmp eax, edx
jne 0x4cbbc0
xor eax, eax
mov edx, edi
test eax, eax
jne 0x4cbbf4
jmp 0x4cbc42
lea edx, [esp + 0x28]
xor ecx, ecx
push edi
call fcn.004195e0
add esp, 4
test eax, eax
jne 0x4cbbf4
jmp 0x4cbc42
mov eax, 1
test eax, eax
je 0x4cbc42
cmp edx, ebp
jne 0x4cbc42
xorps xmm0, xmm0
mov eax, esp
mov dword [esp], 0
lea ecx, [esp + 8]
movups xmmword [esp + 8], xmm0
movups xmmword [esp + 0x18], xmm0
mov dword [esp + 0x10], 1
push eax
push ecx
push 0
push ebx
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x4cbc5b
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, 1
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], ecx
jmp 0x4cbc70
mov eax, dword [0x545980]
mov ecx, dword [0x545984]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 1
jmp 0x4cbc70
mov eax, dword [esp]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov eax, dword [esp + 4]
mov word [esi + 0xc], ax
xor eax, eax
mov dword [esi], eax
add esp, 0x1a8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0050d960
cmp ebp, 0x17f
jbe 0x4cbb8f
mov ecx, esi
mov edx, edi
push ebx
push ebp
call fcn.0050d9b0
add esp, 0x1b0
jmp 0x4cbc76

Function at 0x4cc720
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4e8fa0
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, edx
mov dword [ebp - 0x24], ecx
mov ecx, 8
mov edx, 4
mov eax, dword fs:[0]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], edi
call fcn.00414760
test eax, eax
je 0x4cc7ff
mov dword [eax], ebx
mov dword [eax + 4], edi
push 0
push 0x10000
mov dword [ebp - 0x20], eax
push eax
push 0x4cc890
push esi
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x4cc7a1
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 4], eax
mov byte [ecx], 4
jmp 0x4cc7ee
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x10], 1
push eax
call dword [ecx]
add esp, 4
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 4]
cmp dword [eax + 4], 0
je 0x4cc7d2
mov ecx, dword [ebp - 0x20]
mov edx, dword [eax + 8]
mov ecx, dword [ecx]
call fcn.004147c0
mov ecx, dword [ebp - 0x20]
mov edx, 4
call fcn.004147c0
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 4], eax
mov dword [ecx], 0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 8
mov edx, 4
mov dword [ebp - 0x10], 0
call fcn.0050aba0
ud2
Function at 0x4cc9b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x4e8fc0
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x4cca2e
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
lea edx, [esi + 8]
lea ecx, [esi + 0x28]
mov dword [esi + 0x38], 0x546480
mov dword [esi + 0x3c], 1
mov dword [esi + 0x30], 0
mov dword [esi + 0xc], eax
mov dword [esi + 8], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x40], ecx
lea ecx, [esi + 0x30]
mov edx, 0x5464ac
mov dword [esi + 0x2c], fcn.004c6660
mov dword [esi + 0x44], 1
call fcn.0050ae80
ud2

Function at 0x4d0860
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x5b7094]
test eax, eax
je 0x4d0965
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4d0891
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x4d095a
mov eax, dword [0x5b7094]
test eax, eax
je 0x4d0974
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4d0937
mov esi, eax
test eax, eax
jne 0x4d08f8
mov ecx, 0x20
mov edx, 8
call fcn.00414760
test eax, eax
je 0x4d0992
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x5b7094
mov esi, eax
mov eax, dword [0x5b7094]
test eax, eax
je 0x4d0983
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [ebp + 8]
test eax, eax
je 0x4d0917
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
cmp ecx, 1
je 0x4d0949
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x4d093b
movaps xmm0, xmmword [esp]
jmp 0x4d0949
xor esi, esi
jmp 0x4d095d
lea ecx, [esp + 0x10]
call fcn.004cc9b0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x5b7094
call fcn.0050d3d0
jmp 0x4d0878
mov ecx, 0x5b7094
call fcn.0050d3d0
jmp 0x4d089f
mov ecx, 0x5b7094
call fcn.0050d3d0
jmp 0x4d08f0
mov ecx, 0x20
mov edx, 8
call fcn.0050aba0
ud2
Function at 0x4d5e04
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov esi, ecx
lea edi, [esp + 0x40]
xorps xmm0, xmm0
movaps xmmword [edi], xmm0
movaps xmmword [edi + 0x30], xmm0
movaps xmmword [edi + 0x20], xmm0
movaps xmmword [edi + 0x10], xmm0
mov dword [edi], 0x40
push edi
call sub.kernel32.dll_GlobalMemoryStatusEx
movsd xmm0, qword [edi + 8]
mov eax, esp
and dword [eax + 0x34], 0
and dword [eax + 0x30], 0
movsd qword [esi + 0x90], xmm0
movsd xmm0, qword [edi + 0x10]
movsd qword [esi + 0x98], xmm0
xorps xmm0, xmm0
movaps xmmword [eax + 0x20], xmm0
movaps xmmword [eax + 0x10], xmm0
movaps xmmword [eax], xmm0
push 0x38
push eax
call sub.psapi.dll_GetPerformanceInfo
cmp eax, 1
jne 0x4d5ecd
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
xor edi, edi
sub edx, eax
cmovb edx, edi
sub ebx, eax
mov eax, ecx
cmovb ebx, edi
mul edx
mov edx, 0
cmovo edx, edx
mov dword [esi + 0xa4], edx
mov edx, 0xffffffff
cmovo eax, edx
mov dword [esi + 0xa0], eax
mov eax, ecx
mov ecx, 0xffffffff
mul ebx
cmovo eax, ecx
cmovo edi, edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xa8], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4d6b60
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, ecx
lea edi, [ecx + 0x38]
imul ebx, edx, 0x50
test ebx, ebx
je 0x4d6bb0
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
je 0x4d6ba5
and dword [esp], 0
and dword [esp + 4], 0
mov eax, esp
push eax
push 0
push 0
push dword [edi]
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x4d6ba5
movsd xmm0, qword [esp]
movsd qword [edi - 0x20], xmm0
add esi, 0x50
add edi, 0x50
add ebx, 0xffffffb0
jmp 0x4d6b74
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret