joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440f86
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x565fa8]
mov esi, ecx
mov ecx, dword [ebp + 8]
mov edi, edx
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
js 0x440fb4
mov word [ecx], 0
mov byte [ecx + 0xb], 0
jmp 0x440fc2
mov eax, dword [ecx]
mov word [eax], 0
mov dword [ecx + 4], 0
test esi, esi
je 0x4410b6
lea eax, [ebp - 0x20]
xor ecx, ecx
lea edx, [ebp - 0x228]
mov dword [edx], ecx
mov dword [eax], ecx
push eax
push edx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4410b6
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x234], esi
movzx ebx, word [eax]
movzx esi, word [eax + 2]
mov word [ebp - 0x20], bx
mov word [ebp - 0x1e], si
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], si
mov si, 0x4e4
mov word [ebp - 0x18], bx
mov word [ebp - 0x16], si
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], si
mov esi, 2
movzx eax, word [ebp + esi*2 - 0x22]
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x441045
mov ecx, dword [edi]
movzx edx, bx
push ecx
push eax
push edx
push str.StringFileInfo_04hx_04hx_ls
mov eax, 0x104
push eax
push eax
lea eax, [ebp - 0x228]
mov ebx, eax
push eax
call fcn.0044115e
add esp, 0x1c
xor eax, eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x22c]
push eax
push ebx
push dword [ebp - 0x234]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x44109e
mov eax, dword [ebp - 0x22c]
test eax, eax
jne 0x4410ad
cmp esi, 7
ja 0x4410b6
movzx ebx, word [ebp + esi*2 - 0x20]
add esi, 2
jmp 0x441036
mov ecx, dword [ebp + 8]
push eax
call fcn.0041dc5e
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444c6a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x444d4d
mov eax, dword [ecx + 4]
mov ebx, ecx
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx + 0x74], 0
je 0x444d4d
cmp word [eax + edx + 0x14], 0x68
jb 0x444d4d
mov esi, dword [ebx]
mov ecx, ebx
push dword [eax + edx + 0x78]
call dword [esi + 4]
test eax, eax
je 0x444d4d
mov esi, eax
mov eax, dword [ebp + 8]
cmp eax, 0xffff
ja 0x444cc4
mov word [edi], ax
jmp 0x444d7a
mov eax, dword [ebx]
mov ecx, ebx
push dword [esi + 0x20]
call dword [eax + 4]
mov edi, eax
mov eax, dword [esi + 0x18]
lea ecx, [eax*4]
test ecx, ecx
je 0x444d4d
mov dword [ebp - 0x10], ebx
lea ebx, [edi + eax*4]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], edi
inc eax
mov dword [ebp - 0x1c], eax
mov eax, ebx
sub eax, edi
mov ecx, eax
shr eax, 0x1f
sar ecx, 2
add eax, ecx
mov ecx, dword [ebp - 0x10]
and eax, 0xfffffffe
lea esi, [edi + eax*2]
mov eax, dword [ecx]
push dword [esi]
call dword [eax + 4]
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x444d27
mov edx, dword [ebp - 0x1c]
cmp cl, byte [eax]
jne 0x444d29
mov cl, byte [edx]
inc eax
inc edx
test cl, cl
jne 0x444d1b
xor ecx, ecx
movzx eax, byte [eax]
movzx ecx, cl
mov edx, ecx
sub edx, eax
test edx, edx
lea edx, [esi + 4]
cmovg edi, edx
sub ecx, eax
cmovs ebx, esi
cmove edi, esi
je 0x444d49
cmp edi, ebx
jne 0x444cf1
test ecx, ecx
je 0x444d59
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
mov eax, dword [ecx]
push dword [esi + 0x24]
call dword [eax + 4]
sub edi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
sar edi, 1
movzx eax, word [eax + edi]
add ax, word [esi + 0x10]
mov word [ecx], ax
mov al, 1
jmp 0x444d4f

Function at 0x4481e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x448216
mov edx, dword [ebp + 0xc]
nop word cs:[eax + eax]
nop dword [eax]
movzx edi, byte [edx]
movzx esi, al
shr eax, 8
inc edx
xor edi, esi
xor eax, dword [edi*4 + 0x51b22c]
dec ecx
jne 0x448200
pop esi
pop edi
pop ebp
ret
Function at 0x448620
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.004e6ca0
mov eax, dword [0x565fa8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x565fb8]
cmp eax, 0xffffffff
je 0x44876f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x44876f
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.004ea200
add esp, 0xc
mov ecx, dword [0x565fb8]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.00461960
add esp, 8
test ebx, ebx
je 0x44869b
push ebx
call fcn.004e688c
add esp, 4
mov ecx, dword [0x569ccc]
mov edx, dword fs:[0x2c]
mov eax, dword [0x56a910]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x448784
mov esi, dword [0x56a90c]
mov ecx, esi
call fcn.00430040
lea eax, [ebp - 0x1410]
push 0xc00
push 0x569d0c
push eax
call fcn.004ea200
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov esi, 0x100
mov al, 1
test al, 1
jne 0x44870c
jmp 0x44875f
cmp esi, 2
lea esi, [esi - 1]
jb 0x44875f
test al, 1
je 0x44875f
mov ebx, 0xfffff400
xor eax, eax
lea edi, [ebp - 0x810]
jmp 0x448728
add edi, 8
add ebx, 0xc
je 0x448700
mov ecx, dword [edi]
test ecx, ecx
je 0x448720
cmp dword [ebp + ebx - 0x810], 0
je 0x448720
mov edx, dword [edi + 4]
cmp edx, dword [ebp + ebx - 0x808]
jne 0x448720
mov edx, dword [ebp + ebx - 0x80c]
test edx, edx
je 0x448720
mov dword [edi], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x448720
push 2
push dword [ebp - 0x1414]
call fcn.00461960
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x56a910
call fcn.004e68d7
add esp, 4
cmp dword [0x56a910], 0xffffffff
jne 0x4486bc
push 4
call fcn.004e6826
add esp, 4
mov ecx, eax
mov esi, eax
call fcn.00430030
mov dword [0x56a90c], esi
push 0x56a910
call fcn.004e694d
add esp, 4
jmp 0x4486bc

Function at 0x4487d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x565fb8]
cmp eax, 0xffffffff
je 0x4487f0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x448800
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov eax, dword [0x565fa8]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x565fb8]
cmp eax, 0xffffffff
je 0x44882d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x448832
call fcn.004489c0
mov ecx, dword [0x569ccc]
mov edx, dword fs:[0x2c]
mov eax, dword [0x56a910]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x448974
mov edi, dword [0x56a90c]
mov ecx, edi
call fcn.00430040
mov eax, dword [0x569d08]
mov ecx, 0x100
inc eax
nop dword [eax + eax]
movzx edx, al
lea ebx, [edx + edx*2]
cmp dword [ebx*4 + 0x569d0c], 0
je 0x448886
inc eax
dec ecx
jne 0x448870
jmp 0x4488b6
mov ecx, dword [ebp + 8]
lea eax, [ebx*4 + 0x569d0c]
mov dword [0x569d08], edx
mov dword [eax], 1
lea eax, [edx*4]
mov dword [eax + eax*2 + 0x569d10], ecx
mov dword [esi], edx
mov eax, dword [eax + eax*2 + 0x569d14]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
mov dword [ebp - 0xb8], 0xffffffff
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
jne 0x44890c
lea eax, [ebp - 0xb8]
lea ecx, [ebp - 0x14]
push 0x51b62c
push eax
push ecx
call fcn.00426b90
add esp, 0xc
test eax, eax
je 0x44890c
lea edi, [ebp - 0xb8]
mov ecx, edi
push eax
push 0x196
push str..._.._base_threading_thread_local_storage.cc
call fcn.00427d80
mov ecx, edi
call fcn.00426f60
mov eax, dword [esi]
mov dword [ebp - 0xb8], 0x100
cmp eax, 0xff
mov dword [ebp - 0x14], eax
jle 0x44895d
lea eax, [ebp - 0xb8]
lea ecx, [ebp - 0x14]
push str.slot____kThreadLocalStorageSize
push eax
push ecx
call fcn.00426b90
add esp, 0xc
test eax, eax
je 0x44895d
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 0x197
push str..._.._base_threading_thread_local_storage.cc
call fcn.00427d80
mov ecx, esi
call fcn.00426f60
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x56a910
call fcn.004e68d7
add esp, 4
cmp dword [0x56a910], 0xffffffff
jne 0x448853
push 4
call fcn.004e6826
add esp, 4
mov ecx, eax
mov edi, eax
call fcn.00430030
mov dword [0x56a90c], edi
push 0x56a910
call fcn.004e694d
add esp, 4
jmp 0x448853
Function at 0x44e450
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0xa8
mov ecx, dword [0x565fa8]
mov eax, dword [ebp + 0xc]
xor ecx, ebp
test eax, eax
mov dword [ebp - 8], ecx
je 0x44e499
push eax
push dword [ebp + 8]
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x44e499
lea esi, [ebp - 0xac]
mov ecx, esi
push str.success
push 0x20
push str..._.._base_rand_util_win.cc
call fcn.00426e70
mov ecx, esi
call fcn.00426f60
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004e6891
add esp, 0xa8
pop esi
pop ebp
ret

Function at 0x450070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x565fa8]
xor eax, ebp
mov dword [esp + 0x18], eax
mov edi, dword [ecx + 0x38]
test edi, edi
jne 0x450113
mov esi, ecx
mov dword [esp + 0x10], 0
mov byte [esp + 0x13], 9
mov dword [esp + 0xc], 0x65647261
mov dword [esp + 8], 0x63736964
mov word [esp + 0x10], 0x64
push 0x40
call fcn.004e6826
add esp, 4
mov ebx, eax
lea eax, [esp + 8]
mov edi, esp
mov ecx, esi
push eax
push edi
call fcn.0044ff80
mov ecx, ebx
push edi
push dword [esi + 0x28]
lea eax, [esp + 0x10]
push eax
call fcn.004504e0
mov edi, dword [esi + 0x38]
mov dword [esi + 0x38], ebx
test edi, edi
je 0x4500fd
mov ecx, edi
call fcn.00450530
push edi
call fcn.004e6856
add esp, 4
cmp byte [esp + 0x13], 0
jns 0x450110
push dword [esp + 8]
call fcn.004e6856
add esp, 4
mov edi, dword [esi + 0x38]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.004e6891
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x462a40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x565fa8]
mov ebx, ecx
lea esi, [ebp - 0x1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], edx
push edx
push ecx
push esi
call fcn.0042f7c0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x462a6f
mov esi, dword [ebp - 0x1c]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
mov edi, eax
js 0x462afd
test edi, edi
je 0x462b10
cmp dword [ebp + 8], 0
mov dword [ebp - 0x20], ebx
mov bl, 1
je 0x462b74
mov eax, edi
mov ecx, 0xffffffff
add eax, edi
cmovae ecx, eax
push ecx
call fcn.004e6883
add esp, 4
mov esi, eax
lea ebx, [ebp - 0x1c]
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push ebx
call fcn.0042f7c0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x462acb
mov ebx, dword [ebp - 0x1c]
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x462ae5
push dword [ebp - 0x1c]
call fcn.004e6856
add esp, 4
cmp word [esi], 0
mov bl, 1
je 0x462b14
xor eax, eax
nop
cmp word [esi + eax*2 + 2], 0
lea eax, [eax + 1]
jne 0x462af0
jmp 0x462b16
push dword [ebp - 0x1c]
call fcn.004e6856
add esp, 4
test edi, edi
jne 0x462a8a
xor ebx, ebx
jmp 0x462b74
xor eax, eax
lea ecx, [ebp - 0x1c]
push eax
push esi
push ecx
call fcn.0042fbe0
add esp, 0xc
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
js 0x462b36
mov byte [ecx], 0
mov byte [ecx + 0xb], 0
jmp 0x462b5c
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
cmp byte [ecx + 0xb], 0
jns 0x462b5c
push dword [ecx]
call fcn.004e6856
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [ecx + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [ecx + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ecx], xmm0
push esi
call fcn.004e688c
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4658a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
js 0x4658af
pop ebp
jmp fcn.00497440
xor eax, eax
pop ebp
ret

Function at 0x4742bd
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov eax, dword [0x565fa8]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, ecx
cmp byte [ecx + 0xb], 0
jns 0x4742df
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x4743c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x47431a
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004743da
push 2
call fcn.004278b0
add esp, 4
test al, al
je 0x4743c1
call fcn.00427e80
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x244
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.00428040
lea eax, [ebp - 0xb0]
push 0x10
push str.CreateDirectory
push eax
call fcn.00401965
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x47436e
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.0042fbe0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x474393
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.00401965
add esp, 0xc
xor eax, eax
cmp byte [ebp - 0xb9], al
jns 0x4743b6
push dword [ebp - 0xc4]
call fcn.004e6856
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00428100
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4743da
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov eax, dword [0x565fa8]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, ecx
cmp byte [ecx + 0xb], 0
jns 0x4743fc
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4744cc
mov bl, 1
test al, 0x10
jne 0x474575
push 2
call fcn.004278b0
add esp, 4
test al, al
je 0x474573
lea ecx, [ebp - 0xb8]
push 2
push 0x232
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.00427940
lea eax, [ebp - 0xb4]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00401965
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x474464
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.0042fbe0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x474489
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.00401965
add esp, 0xc
push 0x11
push str.:_not_a_directory
push eax
call fcn.00401965
add esp, 0xc
xor eax, eax
cmp byte [ebp - 0xb9], al
jns 0x4744bc
push dword [ebp - 0xc4]
call fcn.004e6856
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00426f60
jmp 0x474573
push 2
call fcn.004278b0
add esp, 4
test al, al
je 0x474573
call fcn.00427e80
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x22e
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.00428040
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00401965
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x474520
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.0042fbe0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x474545
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.00401965
add esp, 0xc
xor eax, eax
cmp byte [ebp - 0xb9], al
jns 0x474568
push dword [ebp - 0xc4]
call fcn.004e6856
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00428100
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47657e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x50]
cmp eax, edx
jne 0x476593
cmp byte [ecx + 0x1b], 0
jns 0x4765a1
mov ecx, dword [ecx + 0x10]
jmp 0x4765a4
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [ecx + ecx*2 + 1]
jmp 0x4765be
add ecx, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
mov ecx, eax
shr edx, 3
and edx, 2
xor eax, eax
inc eax
cmp ecx, 0xffffffff
cmovne eax, edx
pop ebp
ret

Function at 0x4827d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov ecx, dword [0x565fa8]
mov eax, dword [ebp + 0xc]
xor ecx, ebp
cmp eax, 3
mov dword [ebp - 0xc], ecx
jne 0x482864
push 0x482880
push 0x56b250
call fcn.0048277c
add esp, 8
cmp dword [0x56b254], 0
jne 0x482864
push dword [0x56b258]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x482864
mov esi, eax
mov edi, 0x56b25c
push edi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [0x56b268]
movsd xmm0, qword [0x56b260]
mov dword [ebp - 0x10], eax
movsd qword [ebp - 0x18], xmm0
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov edi, 0xfffffff4
mov eax, dword [ebp + edi - 0xc]
test eax, eax
je 0x482856
push dword [esi + edi + 0xc]
call eax
add esp, 4
add edi, 4
jne 0x482845
push esi
call fcn.004817ec
add esp, 4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004e6891
add esp, 0x10
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x48f4fc
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [0x565fa8]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0x2c], 0
je 0x48f60f
mov esi, ecx
lea edx, [ecx + 0x24]
lea eax, [ebp - 0x58]
lea edi, [ebp - 0x5c]
mov ecx, edi
push eax
push 2
call fcn.0048f636
add esp, 8
mov edx, dword [edi]
test edx, edx
je 0x48f616
cmp dword [edx], 0
mov dword [ebp - 0x64], esi
je 0x48f5fb
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], edx
add eax, 0x18
mov dword [ebp - 0x6c], eax
xor eax, eax
test dword [edx + eax*8 + 8], 0xc0000020
mov dword [ebp - 0x60], eax
jne 0x48f5ef
cmp dword [ebp + 8], 0
je 0x48f5b2
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [eax + 4], ecx
je 0x48f5b2
xor ebx, ebx
xor edi, edi
mov eax, dword [ebp - 0x60]
add ecx, ebx
mov esi, dword [edx + eax*8 + 4]
call fcn.0048fec4
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov edx, dword [ebp - 0x68]
test eax, eax
jne 0x48f5ef
mov eax, dword [ebp + 8]
inc edi
add ebx, 0x44
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 2
imul eax, eax, 0xf0f0f0f1
cmp edi, eax
jb 0x48f57a
mov eax, dword [ebp - 0x60]
lea edi, [ebp - 0x54]
mov ecx, edi
push dword [edx + eax*8 + 4]
call fcn.0048fc08
mov esi, dword [ebp - 0x64]
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
jae 0x48f5e3
mov ebx, 0x44
push ebx
push edi
push eax
call fcn.004ea200
add esp, 0xc
add dword [esi + 0x1c], ebx
jmp 0x48f5ec
mov ecx, dword [ebp - 0x6c]
push edi
call fcn.0045eaa0
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x60]
inc eax
cmp eax, dword [edx]
jb 0x48f555
mov dword [ebp - 0x5c], 0
push edx
call fcn.004e688c
add esp, 4
xor esi, esi
jmp 0x48f620
mov esi, 0x3f0
jmp 0x48f620
mov esi, dword [ebp - 0x58]
mov dword [ebp - 0x5c], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
mov eax, esi
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x493c74
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
call fcn.00465c90
test al, al
je 0x493c98
push 0x32
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea edi, [esi + 0x20]
mov ecx, edi
push 0
call fcn.00493cf8
mov eax, dword [esi + 0x30]
test eax, eax
je 0x493cb7
mov dword [esi + 0x34], eax
push eax
call fcn.004e6856
add esp, 4
mov eax, dword [esi + 0x2c]
xor ecx, ecx
mov dword [esi + 0x2c], ecx
test eax, eax
je 0x493ccc
push eax
call fcn.004385d0
add esp, 4
mov ecx, edi
push 0
call fcn.00493cf8
lea ecx, [esi + 0x18]
call fcn.00401c80
lea ecx, [esi + 0x14]
call fcn.00401c80
lea ecx, [esi + 0x10]
call fcn.00401c80
mov ecx, esi
pop esi
pop edi
pop ebp
jmp fcn.00465ba0
Function at 0x4940d2
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x565fa8]
mov esi, ecx
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
lea edi, [esi + 0x18]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [edx + ecx]
push ebx
push eax
push ebx
push 0x8000004
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, edi
push eax
call fcn.00401c30
mov ecx, esi
mov esi, dword [esi + 0x18]
lea eax, [esi + 1]
cmp eax, 1
ja 0x494141
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov ebx, 0x19
mov dword [ecx], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
mov eax, dword [ecx]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ebx
push ebx
push 7
push ecx
push dword [ebp - 0x18]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x494269
xor eax, eax
push eax
push eax
push eax
push 6
push dword [edi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, dword [ebp + 0x18]
test eax, eax
je 0x49427c
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
test ebx, ebx
je 0x4941c7
test ecx, ecx
je 0x4941c7
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x18]
lea edi, [edx + eax]
push ecx
push ebx
push edi
call fcn.004ea200
add esp, 0xc
mov eax, 0xffffff00
mov ecx, dword [edi + eax + 0x100]
test ecx, ecx
je 0x4941c2
sub ecx, ebx
mov dword [edi + eax + 0x100], ecx
add eax, 4
jne 0x4941ae
mov eax, dword [ebp - 0x14]
mov dword [0x56aa30], eax
sub esp, 0xc
mov edi, dword [ebp - 0x20]
mov dword [esp + 8], 4
mov dword [esp + 4], 0x56aa30
mov ecx, edi
call fcn.0049406e
test eax, eax
mov dword [0x56aa30], 0
jne 0x49425a
mov eax, dword [ebp + 0x10]
mov dword [0x56b2f8], eax
sub esp, 0xc
mov ecx, edi
mov dword [esp + 8], 4
mov dword [esp + 4], 0x56b2f8
call fcn.0049406e
test eax, eax
mov dword [0x56b2f8], 0
jne 0x49425a
mov eax, dword [ebp + 0x14]
mov dword [0x56b2fc], eax
sub esp, 0xc
mov ecx, edi
mov dword [esp + 8], 4
mov dword [esp + 4], 0x56b2fc
call fcn.0049406e
test eax, eax
mov dword [0x56b2fc], 0
je 0x49428e
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x49412b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov ebx, 0x1a
jmp 0x494129
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov ebx, 0x1b
jmp 0x49412b
mov esi, dword [ebp + 8]
mov eax, 0x20
lea ecx, [edi + eax]
mov dword [ebp - 0x1c], ecx
push eax
call fcn.004e6826
add esp, 4
mov ebx, eax
mov ecx, eax
push esi
push dword [edi + 0x24]
push dword [edi + 8]
push dword [edi]
call fcn.004ac0dc
mov ecx, dword [ebp - 0x1c]
push ebx
call fcn.00493cf8
mov ecx, dword [edi + 0x20]
push 0x400
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call fcn.004ac16e
mov ebx, 4
test al, al
je 0x49412b
mov ecx, edi
call fcn.00465e30
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x49412b