joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484b80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e8c6e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x417270]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], eax
mov byte [esi + 0x1c], bl
xor eax, eax
mov dword [esi], 0x41ff28
mov byte [esi + 0x20], 0x35
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
push 0x18
mov dword [esp + 0x28], ebx
mov dword [esi + 0x3c], eax
call fcn.004cb3d4
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
mov byte [esp + 0x24], 1
lea ebp, [ebx + 1]
cmp edi, ebx
je 0x484c39
push ebp
mov dword [edi], 0x418d24
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 8], ebx
mov byte [edi + 0x10], 1
mov dword [edi + 0x14], ebx
call fcn.004caa28
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 0xc], ebp
mov dword [edi + 8], ebp
cmp dword [edi + 0x14], ebp
jne 0x484c3b
mov byte [eax], bl
jmp 0x484c3b
xor edi, edi
push 0x18
mov byte [esp + 0x28], bl
mov dword [esi + 0x40], edi
call fcn.004cb3d4
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
mov byte [esp + 0x24], 2
cmp edi, ebx
je 0x484c8f
push ebp
mov dword [edi], 0x418d24
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 8], ebx
mov byte [edi + 0x10], 1
mov dword [edi + 0x14], ebx
call fcn.004caa28
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 0xc], ebp
mov dword [edi + 8], ebp
cmp dword [edi + 0x14], ebp
jne 0x484c8a
mov byte [eax], bl
mov dword [esi + 0x44], edi
jmp 0x484c92
mov dword [esi + 0x44], ebx
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x484ea0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e8ca6
mov eax, dword fs:[0]
push eax
sub esp, 0x3a8
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0x3a0], eax
push ebx
push esi
push edi
mov eax, dword [0x417270]
xor eax, esp
push eax
lea eax, [esp + 0x3b8]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
or eax, 0xffffffff
xor edi, edi
push 0x2c4
mov dword [esp + 0x44], eax
mov dword [esp + 0x54], eax
lea eax, [esp + 0x64]
push edi
push eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x50], edi
mov byte [esp + 0x54], 0
mov dword [esp + 0x60], edi
mov dword [esp + 0x58], edi
mov byte [esp + 0x64], 0
mov dword [esp + 0x48], 0x41fc58
mov byte [esp + 0x68], 0x64
call fcn.004caf20
add esp, 0xc
mov dword [esp + 0x324], edi
mov dword [esp + 0x3c0], edi
call fcn.0048cb10
mov ecx, eax
call fcn.0048d050
mov ecx, 0x53e208
mov dword [ebx + 0x1d0], eax
call fcn.00467900
cmp al, 1
jne 0x484f5e
mov dword [ebx + 0x1d0], edi
xor eax, eax
lea esi, [ebx + 0x270]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
lea ecx, [esp + 0x14]
mov dword [esi + 0x14], eax
push ecx
lea edx, [esp + 0x330]
mov dword [esi + 0x18], eax
push edx
mov dword [esi + 0x1c], eax
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x484ffc
mov eax, dword [esp + 0x14]
dec eax
push eax
lea ecx, [esp + 0x330]
push ecx
lea ecx, [esp + 0x24]
call fcn.004370a0
push 0x20
push esi
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c8], 1
call fcn.00466620
cmp dword [esp + 0x38], 0x10
mov byte [esp + 0x3c0], 0
mov dword [esp + 0x1c], 0x41c480
jb 0x484feb
mov edx, dword [esp + 0x24]
push edx
call fcn.004cada5
add esp, 4
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], edi
mov byte [esp + 0x24], 0
mov eax, dword [ebp + 8]
and eax, 3
or eax, 0x10000000
mov byte [ebx + 0x28f], 0
mov dword [esp + 0x60], eax
mov ecx, 0xb0
mov esi, ebx
lea edi, [esp + 0x64]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x18]
call fcn.0047e080
movzx cx, al
lea eax, [ebx + 0x134]
movzx esi, cx
mov byte [ebx + 0x1b3], 0
lea edi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x485040
sub eax, edi
mov edx, 0x80
sub edx, eax
push edx
lea eax, [ebx + eax + 0x134]
push 0
push eax
call fcn.004caf20
add esp, 0xc
push 1
movzx ecx, si
push 8
mov dword [esp + 0x240], ecx
mov ecx, dword [esp + 0x20]
push 0x2c8
lea edx, [esp + 0x48]
push edx
add ecx, 0x28
call fcn.0049f610
mov dword [esp + 0x3c0], 0xffffffff
mov dword [esp + 0x3c], 0x41fc58
lea ecx, [esp + 0x3c]
test al, al
jne 0x4850ab
call fcn.0049e580
xor eax, eax
jmp 0x4850b9
mov esi, dword [esp + 0x324]
call fcn.0049e580
mov eax, esi
mov ecx, dword [esp + 0x3b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3a0]
xor ecx, esp
call fcn.004cb3aa
mov esp, ebp
pop ebp
ret 8
Function at 0x4850e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 8
push ebx
mov bl, byte [esp + 0x18]
push ebp
xor ebp, ebp
movzx eax, bl
neg eax
sbb eax, eax
push esi
mov esi, dword [esp + 0x1c]
and eax, 0x210
add eax, 0xb0
push edi
mov edi, ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
je 0x48512e
push eax
push esi
call fcn.0049ef30
test al, al
jne 0x48512e
push 0x71
mov ecx, edi
call fcn.0047e020
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
cmp esi, ebp
jne 0x485147
push 0x69
mov ecx, edi
call fcn.0047e020
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
test bl, bl
jne 0x485151
mov dword [esp + 0x10], esi
jmp 0x485155
mov dword [esp + 0x14], esi
cmp dword [esi + 4], ebp
jne 0x485169
cmp dword [esi + 8], 0x186a0
jne 0x485169
or dword [esi], 0x10000
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x20], ebp
cmp byte [esp + 0x24], 0
mov ecx, edi
jne 0x485187
mov ebp, dword [esp + 0x10]
push ebp
push ebx
call fcn.00480f80
jmp 0x485192
mov ebp, dword [esp + 0x14]
push ebp
push ebx
call fcn.00484ea0
mov ebp, dword [ebp + 0x10]
mov esi, eax
push esi
mov ecx, edi
call fcn.004810e0
test al, al
jne 0x4851b3
mov ecx, dword [esp + 0x20]
inc ecx
cmp ecx, 5
mov dword [esp + 0x20], ecx
jl 0x485171
jmp 0x4851b9
and esi, 0xffff
test al, al
jne 0x4851ff
mov eax, dword [0x53e204]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x4851ed
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x4851ed
mov ecx, dword [0x53e204]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
mov dword [esi], 0x7f
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
test esi, esi
je 0x485234
test ebp, ebp
je 0x485234
push esi
mov ecx, edi
call fcn.00482990
test eax, eax
je 0x485217
cmp eax, ebp
jae 0x485234
push esi
mov ecx, edi
call fcn.004811f0
push 0x7d
mov ecx, edi
call fcn.0047e020
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x485ef0
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4e8da1
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0x450], eax
push ebx
push ebp
push esi
mov eax, dword [0x417270]
xor eax, esp
push eax
lea eax, [esp + 0x464]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x47c]
mov eax, dword [esp + 0x478]
mov dword [esp + 0x14], eax
test ebp, ebp
je 0x485f5d
push ebp
push eax
call fcn.0049ef30
test al, al
jne 0x485f5d
push 0x71
mov ecx, esi
call fcn.0047e020
xor eax, eax
jmp 0x486129
xor eax, eax
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], 0
mov word [esp + 0x48], ax
mov dword [esp + 0x40], 0x41c478
mov ecx, dword [0x53e204]
push ecx
mov dword [esp + 0x470], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x485f96
mov eax, dword [eax]
add eax, 0x2710
push eax
call fcn.0047d720
add esp, 4
push eax
lea ecx, [esp + 0x44]
call fcn.00467740
mov ebx, dword [esp + 0x474]
cmp bl, 0x10
jne 0x486047
lea ecx, [esp + 0x10]
call fcn.004a3f30
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x470], 1
call fcn.004676e0
push ecx
mov eax, esp
mov dword [eax], 1
mov dword [esp + 0x40], esp
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x478], 2
call fcn.004a3fb0
cmp dword [esp + 0x38], 0x10
mov dword [esp + 0x1c], 0x41c480
jb 0x486021
mov edx, dword [esp + 0x24]
push edx
call fcn.004cada5
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
mov byte [esp + 0x46c], 0
call fcn.004a3fd0
and ebx, 0xf00
mov byte [esp + 0x45f], 0
cmp ebx, 0x100
je 0x4860c5
push 1
cmp ebx, 0x200
je 0x48608a
push 0x3ff
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x4c]
call fcn.00466c30
lea eax, [esp + 0x60]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x486081
jmp 0x4860e7
push 0x200
lea ecx, [esp + 0x68]
push ecx
lea ecx, [esp + 0x4c]
call fcn.00466780
xor edx, edx
lea eax, [esp + 0x60]
mov word [esp + 0x45e], dx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4860b0
sub eax, edx
sar eax, 1
lea esi, [eax + eax + 2]
jmp 0x4860ec
push 0x3ff
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x48]
call fcn.00466640
lea eax, [esp + 0x60]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4860e0
sub eax, edx
lea esi, [eax + 1]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x48610b
mov eax, ebp
cmp ebp, esi
jb 0x4860fc
mov eax, esi
push eax
lea edx, [esp + 0x64]
push edx
push ecx
call fcn.004cb570
add esp, 0xc
cmp dword [esp + 0x5c], 8
mov dword [esp + 0x40], 0x41c478
jb 0x486127
mov eax, dword [esp + 0x48]
push eax
call fcn.004cada5
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x464]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x450]
xor ecx, esp
call fcn.004cb3aa
add esp, 0x460
ret 0xc
Function at 0x486290
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x94
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
mov ebx, dword [esp + 0xa0]
push ebp
push esi
push edi
mov edi, dword [esp + 0xa8]
push 0x90
xor ebp, ebp
lea eax, [esp + 0x14]
push ebp
push eax
mov esi, ecx
call fcn.004caf20
add esp, 0xc
push 0x90
lea ecx, [esp + 0x14]
push ecx
push 1
push edi
mov ecx, esi
call fcn.00485a20
cmp eax, 0x90
je 0x486318
mov edx, dword [0x53e204]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x486318
cmp dword [eax], 0x73
jne 0x486318
mov eax, dword [esp + 0xb0]
push ebp
push ebp
push eax
push ebx
push 0x101
push edi
mov ecx, esi
call fcn.004821c0
jmp 0x48631a
mov eax, ebp
mov ecx, dword [esp + 0xa0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004cb3aa
add esp, 0x94
ret 0xc

Function at 0x486340
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0xa4
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push ebp
mov ebp, dword [esp + 0xb4]
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0xb8]
push 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push 0x20
push edi
mov esi, ecx
xor ebx, ebx
call fcn.00485a20
cmp eax, 0x10
jne 0x4863f8
cmp word [esp + 0x10], bx
je 0x4863f8
push 0x90
lea ecx, [esp + 0x24]
push ebx
push ecx
call fcn.004caf20
add esp, 0xc
push 0x90
lea edx, [esp + 0x24]
push edx
push 1
push edi
mov ecx, esi
call fcn.00485a20
cmp eax, 0x90
je 0x4863f4
mov eax, dword [0x53e204]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4863f4
cmp dword [eax], 0x73
jne 0x4863f4
mov ecx, dword [esp + 0xc0]
push ebx
push ebx
push ecx
push ebp
push 0x102
push edi
mov ecx, esi
call fcn.004821c0
mov ebx, eax
mov eax, ebx
jmp 0x486430
mov edx, dword [0x53e204]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x486428
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x486428
mov eax, dword [0x53e204]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0x10e
xor eax, eax
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004cb3aa
add esp, 0xa4
ret 0xc
Function at 0x48a0d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, 0x52fc
call fcn.004cc0c0
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0x52f8], eax
push ebx
mov ebx, dword [esp + 0x530c]
push esi
mov esi, dword [esp + 0x5308]
push edi
push 0x2c0
lea eax, [esp + 0x18]
push 0
push eax
call fcn.004caf20
lea ecx, [esp + 0x20]
push ecx
push 0
mov dword [esp + 0x28], 0x80000
call fcn.0046b740
mov edi, eax
add esp, 0x14
test edi, edi
je 0x48a1e0
push 0x5030
lea edx, [esp + 0x2d8]
push 0
push edx
call fcn.004caf20
mov ecx, dword [esp + 0x531c]
push 0x5030
lea eax, [esp + 0x2e4]
push eax
push ecx
push esi
push 0x1e
push edi
call fcn.0046b2d0
add esp, 0x24
cmp eax, 0x5030
jne 0x48a1d7
mov eax, dword [esp + 0x2d4]
dec eax
cmp eax, 5
ja case.0x48a174.3
jmp dword [eax*4 + 0x48a204]
mov dx, word [esp + 0x31c]
mov eax, dword [esp + 0x320]
lea ecx, [esp + 0xc]
push ecx
mov ecx, ebx
mov word [esp + 0x14], dx
mov dword [esp + 0x10], eax
call fcn.00489a80
jmp 0x48a1d7
mov edx, dword [0x53e204]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x48a1d1
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x48a1d1
mov eax, dword [0x53e204]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0xdc
push edi
call fcn.0046b860
add esp, 4
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
mov ecx, dword [esp + 0x5304]
pop edi
pop esi
pop ebx
xor ecx, esp
sar eax, 3
call fcn.004cb3aa
add esp, 0x52fc
ret 0xc
Function at 0x48b2d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x94
push 0xffffffffffffffff
push 0x4e94d0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x417270]
xor eax, ebp
mov dword [ebp + 0x90], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x9c]
mov ebx, dword [ebp + 0xa0]
xor eax, eax
push 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push 0x20
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
call fcn.00485a20
cmp eax, 0x10
jne 0x48b3d2
cmp word [ebp - 0x28], 0
je 0x48b3d2
push 0x90
lea ecx, [ebp]
push 0
push ecx
mov dword [ebp - 4], 0
call fcn.004caf20
add esp, 0xc
push 0x90
lea edx, [ebp]
push edx
push 1
push edi
mov ecx, esi
call fcn.00485a20
cmp eax, 0x90
je 0x48b3ba
mov eax, dword [0x53e204]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48b3ba
cmp dword [eax], 0x73
jne 0x48b3ba
mov ecx, dword [ebp + 0xa4]
push 0
push 0
push ecx
push ebx
push 0x15
push edi
mov ecx, esi
call fcn.0048a6c0
test eax, eax
je 0x48b3ba
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
jmp 0x48b40a
mov edx, dword [0x53e204]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x48b402
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x48b402
mov eax, dword [0x53e204]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0x10e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x90]
xor ecx, ebp
call fcn.004cb3aa
add ebp, 0x94
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48bdf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ecx
mov eax, dword [0x53e204]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push ebp
push esi
push edi
push eax
mov edi, ecx
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x48be2b
push 4
push 0x40
call ebp
mov esi, eax
test esi, esi
je 0x48be2b
mov ecx, dword [0x53e204]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 4
lea edx, [esp + 0x1c]
push edx
mov dword [esi], 0
call fcn.0049ef30
test al, al
jne 0x48be79
mov eax, dword [0x53e204]
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x48be69
push 4
push 0x40
call ebp
mov esi, eax
test esi, esi
je 0x48be69
mov ecx, dword [0x53e204]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0x72
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x20
cmp dword [esp + 0x18], 0xffff
jbe 0x48bea7
mov edx, dword [0x53e204]
push edx
call ebx
mov esi, eax
test esi, esi
jne 0x48be69
push 4
push 0x40
call ebp
mov esi, eax
test esi, esi
je 0x48be69
mov eax, dword [0x53e204]
push esi
push eax
jmp 0x48be63
mov eax, dword [esp + 0x24]
add eax, eax
add eax, eax
je 0x48bef8
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.0049ef30
test al, al
jne 0x48bef8
mov edx, dword [0x53e204]
push edx
call ebx
mov esi, eax
test esi, esi
jne 0x48bee8
push 4
push 0x40
call ebp
mov esi, eax
test esi, esi
je 0x48bee8
mov eax, dword [0x53e204]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
mov dword [esi], 0x71
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x20
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x30]
test ebp, ebp
jne 0x48bf64
test ebx, ebx
je 0x48bf68
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x34]
push 4
lea ecx, [esp + 0x14]
push ecx
push 0x10
push edx
mov ecx, edi
mov dword [esi], 0
mov dword [esp + 0x20], 0
call fcn.00485a20
cmp eax, 4
jne 0x48be6f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push esi
push ebx
and eax, 8
push ecx
push ebp
cmp al, 8
jne 0x48bf7b
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push edx
push eax
mov ecx, edi
call fcn.0048b010
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x20
test ebx, ebx
je 0x48bf08
push 0x69
mov ecx, edi
call fcn.0047e020
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x20
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
mov ecx, edi
call fcn.0048b510
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x20
Function at 0x48c8c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e9678
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x417270]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0048d810
xor eax, eax
mov ecx, esi
mov dword [esp + 0x14], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
call fcn.0048c7f0
test al, al
jne 0x48c92c
mov ecx, esi
call fcn.0048c7a0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x48cbe0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e9748
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x417270]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov edi, dword [esp + 0x84]
mov ebx, dword [esp + 0x88]
mov esi, ecx
cmp dword [esi + 0x18], 0
mov dword [esi + 0x20], 0xffffffff
je 0x48cd00
lea eax, [esp + 0x50]
push eax
call fcn.0046e4a0
cmp dword [edi + 0x18], 0
mov dword [esp + 0x7c], 0
mov ebp, 0x10
jne 0x48cc54
xor edi, edi
jmp 0x48cc61
cmp dword [edi + 0x1c], ebp
jb 0x48cc5e
mov edi, dword [edi + 8]
jmp 0x48cc61
add edi, 8
push 0x3c
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.004caf20
add esp, 0xc
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0x440
cmp dword [esi + 0x1c], ebp
jb 0x48cc98
mov edx, dword [esi + 8]
mov dword [esp + 0x24], edx
jmp 0x48cc9f
lea eax, [esi + 8]
mov dword [esp + 0x24], eax
cmp dword [ebx + 0x18], 0
mov dword [esp + 0x28], edi
jne 0x48ccc3
cmp dword [esp + 0x6c], ebp
jb 0x48ccb9
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x2c], ecx
jmp 0x48ccd8
lea edx, [esp + 0x58]
mov dword [esp + 0x2c], edx
jmp 0x48ccd8
cmp dword [ebx + 0x1c], ebp
jb 0x48ccd1
mov eax, dword [ebx + 8]
mov dword [esp + 0x2c], eax
jmp 0x48ccd8
add ebx, 8
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x34], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x48cd04
lea ecx, [esp + 0x50]
mov dword [esp + 0x7c], 0xffffffff
call fcn.004a5ea0
xor al, al
jmp 0x48cd36
mov edx, dword [esi + 0x24]
mov eax, dword [edx + 0x2c]
test eax, eax
je 0x48cd18
mov ecx, dword [esp + 0x4c]
push ecx
call eax
mov dword [esi + 0x20], eax
mov edx, dword [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x50]
mov dword [esp + 0x7c], 0xffffffff
call fcn.004a5ea0
mov al, 1
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004cb3aa
add esp, 0x6c
ret 8
Function at 0x48ce00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4e97cc
mov eax, dword fs:[0]
push eax
sub esp, 0x1b4
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x417270]
xor eax, esp
push eax
lea eax, [esp + 0x1c8]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x18], 0
mov byte [esp + 0x17], 0
jne 0x48ce4f
xor al, al
jmp 0x48cffe
mov eax, dword [edi + 0x24]
cmp dword [eax + 4], 0
je 0x48ce48
mov eax, dword [eax + 0x18]
push 0
push 2
call eax
mov ebp, eax
cmp ebp, 0xffffffff
je 0x48ce48
mov dword [esp + 0x9c], 0x128
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [edi + 0x24]
lea edx, [esp + 0x9c]
push edx
mov dword [esp + 0x1c], eax
mov eax, dword [ecx + 0x1c]
push ebp
call eax
test eax, eax
je 0x48cff3
push 1
lea ecx, [esp + 0x80]
push ecx
mov ecx, edi
call fcn.0046f3f0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x1d0], 0
call fcn.00436970
jmp 0x48cec0
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0xa4]
je 0x48cfac
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0x60]
call fcn.0046e330
mov ecx, dword [esp + 0x74]
mov byte [esp + 0x1d0], 1
test ecx, ecx
je 0x48cf09
cmp dword [esp + 0x78], 0x10
mov eax, dword [esp + 0x64]
jae 0x48cf01
lea eax, [esp + 0x64]
push ecx
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffA]
push 1
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x84]
call fcn.0046f3f0
mov byte [esp + 0x1d0], 2
test eax, eax
je 0x48cf2d
lea esi, [eax + 4]
jmp 0x48cf2f
xor esi, esi
push 1
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x64]
call fcn.0046f3f0
mov byte [esp + 0x1d0], 3
test eax, eax
je 0x48cf50
lea ecx, [eax + 4]
jmp 0x48cf52
xor ecx, ecx
cmp dword [esi + 0x18], 0x10
mov edx, dword [esi + 0x14]
jb 0x48cf60
mov eax, dword [esi + 4]
jmp 0x48cf63
lea eax, [esi + 4]
push edx
push eax
mov eax, dword [ecx + 0x14]
push eax
push 0
call fcn.004295b0
test eax, eax
lea ecx, [esp + 0x3c]
sete bl
mov byte [esp + 0x1d0], 2
call fcn.004a5ea0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1d0], 1
call fcn.004a5ea0
mov byte [esp + 0x1d0], 0
test bl, bl
jne 0x48cfc7
lea ecx, [esp + 0x5c]
call fcn.004a5ea0
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx + 0x20]
lea edx, [esp + 0x9c]
push edx
push ebp
call eax
test eax, eax
jne 0x48cec0
jmp 0x48cfdf
mov ecx, dword [esp + 0xa4]
mov dword [edi + 0x20], ecx
lea ecx, [esp + 0x5c]
mov byte [esp + 0x17], 1
call fcn.004a5ea0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x1d0], 0xffffffff
call fcn.004a5ea0
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x1c8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.004cb3aa
add esp, 0x1c0
ret