joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438faa
Capabilities:
Check http status code
Read http header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x477008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], 4
push ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 8]
mov edi, ecx
push eax
push ebx
push 0x20000013
push dword [ebp + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x439018
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004247f6
mov edx, dword [edi + 0x5c]
mov ebx, eax
push 0x2f2
push 0x40fea0
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x47a4c4]
lea ecx, [edi + 0x5c]
jmp 0x4391d9
mov eax, dword [ebp - 8]
cmp eax, 0x64
je 0x43920a
cmp eax, 0xc7
jbe 0x43904c
cmp eax, 0xce
jbe 0x43920a
cmp eax, 0x130
je 0x43920a
cmp eax, 0x133
je 0x43920a
add edi, 0x5c
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47a4c4]
mov ecx, edi
call esi
test eax, eax
je 0x439088
push dword [ebp - 8]
mov eax, dword [edi]
push 0x40fef8
push 4
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47a4c4]
mov ecx, edi
call esi
push eax
call fcn.0044ba12
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, 0x19a
cmp eax, ecx
ja 0x439154
je 0x439148
add ecx, 0xfffffff6
cmp eax, ecx
ja 0x4390fe
je 0x43919e
cmp eax, 0x65
je 0x4390ef
cmp eax, 0xcc
je 0x439148
mov ecx, 0x12c
cmp eax, ecx
je 0x4391f2
jbe 0x4391bb
cmp eax, 0x12f
jbe 0x439148
cmp eax, 0x131
jne 0x4391bb
mov ebx, 0x800704d0
push 0x35b
jmp 0x4391c5
mov ebx, 0x8007045d
push 0x316
jmp 0x4391c5
cmp eax, 0x193
jbe 0x43913c
cmp eax, 0x194
je 0x439148
cmp eax, 0x195
jbe 0x4391bb
cmp eax, 0x197
jbe 0x43913c
cmp eax, 0x198
je 0x4391e6
cmp eax, 0x199
jne 0x4391bb
push 0x21
pop ebx
jmp 0x439247
mov ebx, 0x80070005
push 0x33b
jmp 0x4391c5
mov ebx, 0x80070002
push 0x367
jmp 0x4391c5
mov ecx, 0x1f4
cmp eax, ecx
ja 0x4391aa
je 0x4391f2
cmp eax, 0x19c
jbe 0x43919e
add ecx, 0xffffffa9
cmp eax, ecx
je 0x439194
jbe 0x4391bb
cmp eax, 0x19f
jbe 0x43919e
cmp eax, 0x1a0
je 0x4391fe
cmp eax, 0x1c1
jne 0x4391bb
mov ebx, 0x800704d5
push 0x342
jmp 0x4391c5
mov ebx, 0xdf
jmp 0x439247
mov ebx, 0x8007000d
push 0x330
jmp 0x4391c5
sub eax, 0x1f5
je 0x4391fe
dec eax
dec eax
je 0x4391f2
dec eax
je 0x4391e6
dec eax
je 0x4391fe
mov ebx, 0x80004005
push 0x372
mov eax, dword [edi]
push 0x40fea0
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47a4c4]
mov ecx, edi
call esi
mov edx, ebx
mov ecx, eax
call fcn.0044b9c9
jmp 0x439247
mov ebx, 0x800705b4
push 0x31e
jmp 0x4391c5
mov ebx, 0x8007001f
push 0x34b
jmp 0x4391c5
mov ebx, 0x80070032
push 0x354
jmp 0x4391c5
mov eax, dword [edi + 0x5c]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47a4c4]
lea ecx, [edi + 0x5c]
call esi
test eax, eax
je 0x439247
push dword [ebp - 8]
mov eax, dword [edi + 0x5c]
push 0x40fef8
push 2
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47a4c4]
lea ecx, [edi + 0x5c]
call esi
push eax
call fcn.0044ba12
add esp, 0x10
mov ecx, ebx
call fcn.00427547
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00456cf0
mov esp, ebp
pop ebp
ret 4
Function at 0x444884
Capabilities:
Create thread

Disassembly:
push 0x14
mov eax, 0x473a06
call fcn.00471e35
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebp - 0x18], eax
push eax
push eax
push ebx
push 0x43e0b0
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 0x18]
call fcn.0041d80b
mov esi, dword [ebp - 0x18]
test esi, esi
jne 0x4448f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004247f6
mov edx, dword [ebx + 0x60]
push 0xbae
push 0x411d90
mov dword [ebp - 0x14], eax
mov edi, dword [edx + 4]
mov ecx, edi
call dword [0x47a4c4]
lea ecx, [ebx + 0x60]
call edi
mov ebx, dword [ebp - 0x14]
jmp 0x444a08
add ebx, 0x60
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x47a4c4]
mov ecx, ebx
call edi
test eax, eax
je 0x44492b
mov eax, dword [ebx]
push 0x411dc8
push 2
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x47a4c4]
mov ecx, ebx
call edi
push eax
call fcn.0044ba12
add esp, 0xc
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x444976
cmp eax, 0xffffffff
je 0x444952
mov eax, dword [ebp - 0x14]
mov ebx, 0x8000ffff
push 0xbc6
mov eax, dword [eax + 0x60]
jmp 0x4449f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x444969
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0x444a11
push 0xbc1
jmp 0x4449ea
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x47a4c4]
mov ecx, ebx
call edi
test eax, eax
je 0x4449ac
mov eax, dword [ebx]
push 0x411e10
push 2
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x47a4c4]
mov ecx, ebx
call edi
push eax
call fcn.0044ba12
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x4449d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004247f6
mov ebx, eax
push 0xbbc
jmp 0x4449ea
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jle 0x4449e3
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0x444a11
push 0xbbd
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x60]
mov edi, dword [eax + 4]
mov ecx, edi
push 0x411d90
call dword [0x47a4c4]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx + 0x60]
call edi
mov edx, ebx
mov ecx, eax
call fcn.0044b9c9
mov ecx, ebx
call fcn.00427547
test esi, esi
je 0x444a23
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
call fcn.00471de9
ret
Function at 0x445c30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x2c
mov eax, 0x473b18
call fcn.00471e35
mov ebx, ecx
lea eax, [ebx + 0xe0]
push eax
lea ecx, [ebp - 0x30]
call fcn.0044b4dd
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
mov eax, dword [ebx]
push ecx
lea ecx, [ebp - 0x38]
push ecx
mov esi, dword [eax + 0x64]
mov ecx, esi
call dword [0x47a4c4]
mov ecx, ebx
call esi
mov dword [ebp - 0x14], eax
test eax, eax
jns 0x445c9f
mov edx, dword [ebx + 0x60]
push 0xdf2
mov esi, dword [edx + 4]
push 0x4124e8
mov ecx, esi
call dword [0x47a4c4]
lea ecx, [ebx + 0x60]
call esi
mov esi, dword [ebp - 0x14]
mov edx, esi
mov ecx, eax
call fcn.0044b9c9
jmp 0x445de3
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebx + 0x310]
jne 0x445dad
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebx + 0x314]
jne 0x445dad
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 0x304]
cmp eax, dword [ebx + 0x2f8]
jb 0x445de0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebx + 0x88]
call fcn.004305bb
mov dword [ebp - 0x14], eax
test eax, eax
jns 0x445cf8
mov eax, dword [ebx + 0x60]
push 0xe04
mov esi, dword [eax + 4]
jmp 0x445c7c
cmp dword [ebp - 0x18], 3
je 0x445d32
cmp dword [ebp - 0x18], 5
je 0x445d32
mov eax, dword [ebx + 0x60]
push 0xe06
push 0x4124e8
mov dword [ebp - 0x14], 0x8000ffff
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47a4c4]
lea ecx, [ebx + 0x60]
call esi
mov esi, 0x8000ffff
jmp 0x445c91
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x18], 3
mov dword [ebx + 0x304], eax
mov eax, dword [ebx + 8]
push 0
mov esi, dword [eax + 0xc]
mov ecx, esi
jne 0x445d8d
push 3
call dword [0x47a4c4]
lea ecx, [ebx + 8]
call esi
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jns 0x445de3
push 0xe0f
mov eax, dword [ebx + 0x60]
push 0x4124e8
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47a4c4]
lea ecx, [ebx + 0x60]
call esi
mov edx, dword [ebp - 0x14]
mov ecx, eax
call fcn.0044b9c9
jmp 0x445de0
push 0x10002
call dword [0x47a4c4]
lea ecx, [ebx + 8]
call esi
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jns 0x445de3
push 0xe15
jmp 0x445d69
mov ecx, ebx
call fcn.004462f4
mov dword [ebp - 0x14], eax
test eax, eax
jns 0x445dc2
push 0xdfa
jmp 0x445d69
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x310], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x314], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x304], eax
mov esi, dword [ebp - 0x14]
mov ecx, esi
call fcn.00427547
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0x4067d8
call fcn.0044b57c
mov eax, dword [ebp - 0x14]
call fcn.00471de9
ret
Function at 0x44bc54
Capabilities:
Shutdown system

Disassembly:
push 8
mov eax, 0x474045
call fcn.00471dfd
mov ebx, edx
mov edi, ecx
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x13
test edi, edi
je 0x44bc90
cmp edi, 1
je 0x44bc90
cmp edi, 2
je 0x44bc90
cmp edi, 3
je 0x44bc90
mov esi, 0x80070057
jmp 0x44bd1d
push 1
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.00419ea6
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x44bd1d
test edi, edi
je 0x44bcdd
cmp edi, 1
je 0x44bcdd
cmp edi, 2
je 0x44bcba
cmp edi, 3
jne 0x44bd24
xor eax, eax
cmp edi, 2
setne al
inc eax
push eax
call dword [sym.imp.ntdll.dll_NtShutdownSystem]
lea edx, [ebp - 0x10]
mov ecx, eax
call fcn.0041e6a6
mov esi, dword [ebp - 0x10]
test eax, eax
je 0x44bd1d
jmp 0x44bd24
test ebx, ebx
jne 0x44bce6
mov ebx, 0x80030002
mov ecx, 0x4135f0
test edi, edi
je 0x44bcf4
mov ecx, 0x41361c
xor eax, eax
test edi, edi
push ebx
sete al
push eax
push 1
push 0
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
test eax, eax
jne 0x44bd24
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004247f6
mov esi, eax
mov ecx, esi
call fcn.0042752a
mov ecx, esi
call fcn.00427547
lea ecx, [ebp - 0x14]
call fcn.0041b802
lea ecx, [ebp - 0x14]
call fcn.0041b802
mov eax, esi
call fcn.00471dd0
ret

Function at 0x44c7cc
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], edx
mov esi, edi
mov dword [ebp - 8], edi
mov ebx, ecx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x44c7fe
xor ecx, ecx
mov ebx, edi
call fcn.0042752a
jmp 0x44c89d
dec ebx
je 0x44c826
dec ebx
je 0x44c81f
dec ebx
je 0x44c818
dec ebx
je 0x44c811
mov esi, 0x413680
jmp 0x44c82b
mov esi, 0x413674
jmp 0x44c82b
mov esi, 0x413664
jmp 0x44c82b
mov esi, 0x413658
jmp 0x44c82b
mov esi, 0x41364c
lea ecx, [ebp - 8]
call fcn.0044d3cb
mov edi, dword [ebp - 8]
push dword [ebp - 0xc]
push esi
test eax, eax
js 0x44c869
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push edi
lea eax, [ebp - 4]
push 0x413690
push eax
call fcn.004255e4
mov ebx, eax
add esp, 0x18
test ebx, ebx
jns 0x44c893
mov ecx, ebx
call fcn.0042752a
mov esi, dword [ebp - 4]
jmp 0x44c89d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [ebp - 4]
push 0x4136d0
push eax
call fcn.004255e4
mov ebx, eax
add esp, 0x14
test ebx, ebx
jns 0x44c893
mov ecx, ebx
call fcn.0042752a
mov edi, dword [ebp - 8]
jmp 0x44c864
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
call fcn.00427547
test esi, esi
je 0x44c8af
mov ecx, esi
call fcn.004274da
test edi, edi
je 0x44c8ba
mov ecx, edi
call fcn.004274da
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44de4b
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x477008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, 0x206
push ebx
push eax
mov word [ebp - 0x20c], ax
mov edi, edx
lea eax, [ebp - 0x20a]
mov esi, ecx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push ebx
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
lea eax, [ebp - 0x20c]
mov ebx, 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x44deca
cmp eax, ebx
ja 0x44deca
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44dee0
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x44dee0
xor eax, eax
jmp 0x44df18
lea eax, [ebp - 0x414]
push eax
push 0
push 0x413af4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x44dedc
lea eax, [ebp - 0x414]
mov edx, esi
push eax
mov ecx, edi
call fcn.00422d13
xor ecx, ecx
test eax, eax
setns cl
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00456cf0
mov esp, ebp
pop ebp
ret
Function at 0x44df2e
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 0x34
push 0x476228
call fcn.00457514
mov eax, edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
xor edi, edi
mov dword [ebp - 0x30], edi
or dword [ebp - 0x2c], 0xffffffff
or dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], edi
push edi
push 0x100
push 2
push edi
push edi
push 0xc0000000
push eax
mov esi, dword [0x479ee0]
mov ecx, esi
call dword [0x47a4c4]
call esi
mov ebx, eax
mov dword [ebp - 0x2c], ebx
cmp ebx, 0xffffffff
je 0x44e00f
mov esi, dword [ebp - 0x40]
test esi, esi
je 0x44dfa5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], edi
push edi
push edi
neg esi
sbb esi, esi
lea eax, [ebp - 0x3c]
and esi, eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov esi, dword [0x479ee8]
mov ecx, esi
call dword [0x47a4c4]
call esi
test eax, eax
je 0x44e00f
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x28], eax
cmp eax, 0xffffffff
je 0x44e00f
push edi
push eax
push dword [ebp - 0x24]
push 2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x44e00f
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.0044e056
test edi, edi
je 0x44e046
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x44e031
mov eax, dword [ebp - 0x28]
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x44e03d
mov eax, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x44e046
mov dword [eax], ebx
mov eax, edi
call fcn.0045755c
ret 0xc
Function at 0x44ec36
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
push 0x4762f8
call fcn.0045768c
xor edi, edi
mov ebx, edi
mov dword [ebp - 0x20], ebx
push dword [0x47706c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x44ed8c
push 0x479e74
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], edi
cmp dword [0x479ec0], esi
jne 0x44eca9
push 4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x479ec0], eax
test eax, eax
je 0x44ed31
mov ecx, edi
mov dword [0x479ec4], ecx
mov dword [0x479eb4], 1
jmp 0x44ece9
mov ecx, dword [0x479ec4]
mov eax, dword [0x479eb4]
cmp ecx, eax
jne 0x44ece9
lea eax, [eax*4 + 4]
push eax
push dword [0x479ec0]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x44ed31
mov dword [0x479ec0], eax
inc dword [0x479eb4]
mov ecx, dword [0x479ec4]
mov eax, dword [0x479ec0]
mov dword [eax + ecx*4], edi
push 0x8010
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x44ed31
lea eax, [esi + 0x10]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x8000
push esi
push dword [0x47706c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x44ed31
xor ebx, ebx
inc ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.0044ed60
test ebx, ebx
je 0x44ed61
mov ecx, dword [0x479ec4]
mov eax, dword [0x479ec0]
mov dword [eax + ecx*4], esi
inc ecx
mov dword [0x479ec4], ecx
jmp 0x44ed7f
push edi
push dword [0x47706c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, edi
push 0x479e74
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
call fcn.004576d1
ret

Function at 0x44eed8
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x477070]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x44ef11
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x44ef11
mov eax, dword [eax]
mov eax, dword [eax + ecx*4 - 4]
test eax, eax
je 0x44ef11
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x44ef11
mov eax, dword [eax + 8]
mov eax, dword [eax + ecx*4 - 4]
test eax, eax
je 0x44ef11
mov eax, dword [eax]
test eax, eax
jne 0x44ef16
mov eax, 0x4137cc
ret
Function at 0x44efcc
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x477008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
mov esi, ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x44f03e
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x44f02b
mov ebx, dword [ebp - 0x14]
jmp 0x44f033
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
jmp 0x44f046
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00456cf0
mov esp, ebp
pop ebp
ret
Function at 0x44fbee
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x477008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x479f1c], 0
jne 0x44fdea
push ebx
xor ebx, ebx
mov dword [0x479f1c], 1
mov dword [0x479f18], ebx
cmp dword [0x479618], ebx
je 0x44fc47
mov dword [0x479618], ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
sbb eax, eax
neg eax
mov dword [0x479f00], eax
jmp 0x44fc4c
mov eax, dword [0x479f00]
mov dword [0x479ef8], 0x44f530
test eax, eax
je 0x44fcd0
push 0x413d54
mov dword [0x479ef4], 0x44f9f0
mov dword [0x479f20], 0x44fa60
mov dword [0x479f14], 0x44fae0
mov dword [0x479efc], 0x44f7b0
mov dword [0x479ef0], 0x44fb50
mov dword [0x479ee0], 0x44fb70
mov dword [0x479f04], 0x44fb90
mov dword [0x479eec], 0x44fbb0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44fd20
push 0x413d68
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44fd20
mov dword [0x479ef8], eax
jmp 0x44fd20
mov dword [0x479ef4], 0x44f540
mov dword [0x479f20], 0x44f600
mov dword [0x479f14], 0x44f6e0
mov dword [0x479efc], 0x44f7b0
mov dword [0x479ef0], 0x44f7d0
mov dword [0x479ee0], 0x44f850
mov dword [0x479f04], 0x44f8e0
mov dword [0x479eec], 0x44f970
push 0x103
lea eax, [ebp - 0x107]
mov dword [0x479edc], 0x44f3d0
push ebx
push eax
mov dword [0x479f10], 0x44f400
mov dword [0x479ee4], 0x44f420
mov dword [0x479f24], 0x44f450
mov dword [0x479f28], 0x44f480
mov dword [0x479f2c], 0x44f4a0
mov dword [0x479f08], 0x44f4f0
mov dword [0x479f0c], 0x44fbd0
mov byte [ebp - 0x108], bl
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0x413d84
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x44fddf
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test eax, eax
jne 0x44fdcc
push ebx
mov dword [0x479ee8], 0x44f520
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x44fde9
push 0x413da4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x479ee8], eax
jmp 0x44fde9
mov dword [0x479ee8], 0x44f520
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.00456cf0
mov esp, ebp
pop ebp
ret
Function at 0x456ce0
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x476778
call fcn.00457514
and dword [ebp - 0x24], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov edi, dword [eax + 4]
xor esi, esi
mov edx, 0x479f60
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x456ae5
cmp eax, edi
jne 0x456af7
mov esi, ebx
cmp dword [0x479f64], ebx
jne 0x456b04
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x456b33
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x456ace
cmp dword [0x479f64], 0
jne 0x456b2d
mov dword [0x479f64], ebx
push 0x401054
push 0x401048
call fcn.00456c84
pop ecx
pop ecx
test eax, eax
je 0x456b33
jmp 0x456c6d
mov dword [0x4799c4], ebx
cmp dword [0x479f64], ebx
jne 0x456b56
push 0x401044
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x479f64], 2
test esi, esi
jne 0x456b63
xor eax, eax
mov ecx, 0x479f60
xchg dword [ecx], eax
cmp dword [0x479f70], 0
je 0x456b91
push 0x479f70
call fcn.00457340
pop ecx
test eax, eax
je 0x456b91
push 0
push 2
push 0
mov esi, dword [0x479f70]
mov ecx, esi
call dword [0x47a4c4]
call esi
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov ecx, dword [eax]
test ecx, ecx
je 0x456c6d
mov dword [ebp - 0x20], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x24]
movzx eax, word [ecx]
cmp ax, si
ja 0x456c01
test ax, ax
je 0x456bba
test edx, edx
jne 0x456c01
movzx eax, word [ecx]
test ax, ax
je 0x456bcf
cmp ax, si
ja 0x456bcf
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x456bba
test byte [ebp - 0x40], 1
je 0x456bdb
movzx eax, word [ebp - 0x3c]
jmp 0x456bde
push 0xa
pop eax
push eax
push ecx
push 0
push 0x400000
call main
mov dword [0x4799c0], eax
cmp dword [0x4799d8], 0
jne 0x456c49
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp eax, 0x22
jne 0x456c12
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x24], edx
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x456ba9
cmp dword [0x4799c4], 0
jne 0x456c5d
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x4799c0]
mov dword [ebp - 4], 0xfffffffe
jmp 0x456c79
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0045755c
ret
call fcn.00457448
jmp 0x456a98

Function at 0x45722f
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x476820
call fcn.0045768c
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x45728f
cmp eax, 0xffffffff
je 0x45728f
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x457288
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x457288
cmp edx, 0x10000000
jae 0x457288
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x457285
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.004576d1
ret 4
Function at 0x4572f0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x45732e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x457326
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x457330
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x457316
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x457410
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x457426
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x457441
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret