joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e3b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x45f4f0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x48fd5c]
test al, al
je 0x44e581
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x44e3fc
cmp eax, 3
jne 0x44e57a
mov ebx, dword [0x48fd60]
test ebx, ebx
je 0x44e57a
mov dword [ebp - 0x20], 0
jmp 0x44e427
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x44e458
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x44e5cb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x44e420
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x44e420
test byte [ebp - 0x20], 1
je 0x44e57a
mov ebx, dword [0x48fd60]
test ebx, ebx
je 0x44e57a
mov dword [ebp - 0x20], 0
jmp 0x44e487
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x44e4b8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x44e5cb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x44e480
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x44e480
test byte [ebp - 0x20], 1
je 0x44e57a
mov ebx, dword [0x48fd60]
test ebx, ebx
je 0x44e57a
mov dword [ebp - 0x20], 0
jmp 0x44e4e7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x44e518
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x44e5cb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x44e4e0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x44e4e0
test byte [ebp - 0x20], 1
je 0x44e57a
mov ebx, dword [0x48fd60]
test ebx, ebx
je 0x44e57a
mov dword [ebp - 0x20], 0
jmp 0x44e547
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x44e574
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x44e5cb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x44e540
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x44e540
test byte [ebp - 0x20], 1
jne 0x44e594
movzx eax, byte [0x489508]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x48fd60]
jmp 0x44e59f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x44e57a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x44e5cb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x44e59c
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x44e59c
mov ecx, 0x47efe4
mov dword [ebp - 0x10], 0
call fcn.0046ed60
ud2
Function at 0x44f200
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x48f448]
test eax, eax
je 0x44f2b5
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x44f22c
cmp dword [eax + 4], 0
mov edi, eax
je 0x44f22c
add edi, 8
jmp 0x44f2b0
mov eax, dword [0x48f448]
test eax, eax
je 0x44f2c4
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x44f2ae
mov esi, eax
test eax, eax
jne 0x44f284
movzx eax, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0xc
call fcn.0045a4d0
test eax, eax
je 0x44f2df
mov dword [eax], 0x48f448
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x48f448]
test eax, eax
je 0x44f2d3
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x44f2b0
test ecx, ecx
je 0x44f2b0
lock dec dword [ecx]
jne 0x44f2b0
call fcn.0044ef00
jmp 0x44f2b0
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x48f448
call fcn.00471a40
jmp 0x44f210
mov ecx, 0x48f448
call fcn.00471a40
jmp 0x44f23a
mov ecx, 0x48f448
call fcn.00471a40
jmp 0x44f27c
mov ecx, 4
mov edx, 0xc
call fcn.0046d190
int3

Function at 0x44f7d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x48f458]
test eax, eax
je 0x44f851
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x44f7ef
cmp byte [eax + 4], 0
mov esi, eax
jne 0x44f846
mov eax, dword [0x48f458]
test eax, eax
je 0x44f860
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x44f84b
mov esi, eax
test eax, eax
jne 0x44f840
movzx eax, byte [0x48fdb4]
xor ecx, ecx
mov edx, 8
call fcn.0045a4d0
test eax, eax
je 0x44f878
mov dword [eax], 0x48f458
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x48f458]
test eax, eax
je 0x44f86c
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x44f84d
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x48f458
call fcn.00471a40
jmp 0x44f7db
mov ecx, 0x48f458
call fcn.00471a40
jmp 0x44f7f9
mov ecx, 0x48f458
call fcn.00471a40
jmp 0x44f838
mov ecx, 4
mov edx, 8
call fcn.0046d190
int3
Function at 0x44ffa0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x44fff4
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x450017
test eax, eax
js 0x450003
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x45000f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x47ea3c
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0044e9d0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0044eb30
mov ecx, 7
int 0x29
ud2
Function at 0x450660
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x48f438]
test eax, eax
je 0x4506f5
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x450686
cmp dword [eax + 4], 0
je 0x450686
add eax, 8
pop esi
ret
mov eax, dword [0x48f438]
test eax, eax
je 0x450704
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4506f1
mov esi, eax
test eax, eax
jne 0x4506da
movzx eax, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0x10
call fcn.0045a4d0
test eax, eax
je 0x45071c
mov dword [eax], 0x48f438
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x48f438]
test eax, eax
je 0x450710
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x48f438
call fcn.00471a40
jmp 0x45066f
mov ecx, 0x48f438
call fcn.00471a40
jmp 0x450690
mov ecx, 0x48f438
call fcn.00471a40
jmp 0x4506d2
mov ecx, 4
mov edx, 0x10
call fcn.0046d190
int3
Function at 0x451560
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], esp
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0x45f670
lea eax, [esi + 0x38]
mov ecx, dword fs:[0]
mov dword [esi + 0x38], ecx
mov dword fs:[0], eax
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4516cb
mov ebx, dword [esi + 8]
mov ecx, dword [esi + 0xc]
movq xmm0, qword [0x48fd68]
movd edx, xmm0
pshufd xmm0, xmm0, 0x55
mov dword [esi + 4], ecx
movd edi, xmm0
mov eax, edx
or eax, edi
jne 0x451619
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x451704
movq xmm0, qword [esi + 8]
mov edx, dword [esi + 8]
mov edi, dword [esi + 0xc]
movq qword [0x48fd68], xmm0
mov eax, edx
mov ecx, dword [esi + 4]
or eax, edi
je 0x4516b7
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], ebx
push edi
push edx
push ecx
push ebx
mov edi, edx
mov dword [esi + 0x28], edx
call fcn.0045f900
mov dword [esi + 0x1c], eax
mov ebx, edx
mov ecx, edi
mov dword [esi + 0x2c], edx
mul edi
mov edi, dword [esi + 0x20]
imul ecx, ebx
mov ebx, dword [esi + 0x1c]
add ecx, edx
mov edx, edi
imul edx, ebx
add ecx, edx
mov edx, dword [esi + 0x24]
sub edx, eax
mov eax, dword [esi + 4]
sbb eax, ecx
imul ecx, eax, 0x3b9aca00
mov eax, edx
mov edx, 0x3b9aca00
mul edx
add edx, ecx
push edi
push dword [esi + 0x28]
push edx
push eax
call fcn.0045f900
mov ecx, eax
mov dword [esi + 4], edx
mov eax, ebx
mov edx, 0x3b9aca00
mul edx
mov edi, eax
imul eax, dword [esi + 0x2c], 0x3b9aca00
add eax, edx
add edi, ecx
adc eax, dword [esi + 4]
push 0
push 0x3b9aca00
push eax
push edi
call fcn.0045f900
imul ecx, eax, 0xc4653600
add ecx, edi
mov edi, dword [esi + 0x38]
mov dword fs:[0], edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.attempt_to_divide_by_zero_____f__VjZ_KkV__P8Hv_PeL_jsAJ____A___RA1bU_fB__DeZ_5dNrqz___a_3___8J___U__B_K
mov edx, 0x19
push 0x47e3bc
call fcn.0046ea20
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x40], 0
lea eax, [esi + 0x14]
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
push 0x47f0e8
push 0x47d3b0
push eax
call fcn.0046ece0
add esp, 0xc
jmp 0x45173b
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x40], 1
lea eax, [esi + 0x14]
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
push 0x47f0d8
push 0x47d3b0
push eax
call fcn.0046ece0
add esp, 0xc
ud2
Function at 0x458df0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x48f468]
test eax, eax
je 0x458ea5
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x458e1c
cmp dword [eax + 4], 0
mov edi, eax
je 0x458e1c
add edi, 8
jmp 0x458ea0
mov eax, dword [0x48f468]
test eax, eax
je 0x458eb4
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x458e9e
mov esi, eax
test eax, eax
jne 0x458e74
movzx eax, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0xc
call fcn.0045a4d0
test eax, eax
je 0x458ecf
mov dword [eax], 0x48f468
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x48f468]
test eax, eax
je 0x458ec3
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x458ea0
test ecx, ecx
je 0x458ea0
lock dec dword [ecx]
jne 0x458ea0
call fcn.00415c90
jmp 0x458ea0
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x48f468
call fcn.00471a40
jmp 0x458e00
mov ecx, 0x48f468
call fcn.00471a40
jmp 0x458e2a
mov ecx, 0x48f468
call fcn.00471a40
jmp 0x458e6c
mov ecx, 4
mov edx, 0xc
call fcn.0046d190
int3

Function at 0x459ce0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x45f7d0
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x459d5e
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
lea edx, [esi + 8]
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], 0x47ec38
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x30]
mov edx, 0x47ec68
mov dword [esi + 0x2c], fcn.00455dc0
mov dword [esi + 0x3c], 1
call fcn.0046e8d0
ud2
Function at 0x45d7a0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x48f478]
test eax, eax
je 0x45d882
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x45d7d1
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x45d877
mov eax, dword [0x48f478]
test eax, eax
je 0x45d891
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x45d854
mov esi, eax
test eax, eax
jne 0x45d834
movzx eax, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0x20
call fcn.0045a4d0
test eax, eax
je 0x45d8ac
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x48f478
mov esi, eax
mov eax, dword [0x48f478]
test eax, eax
je 0x45d8a0
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x45d858
movaps xmm0, xmmword [esp]
jmp 0x45d866
xor esi, esi
jmp 0x45d87a
lea ecx, [esp + 0x10]
call fcn.00459ce0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x48f478
call fcn.00471a40
jmp 0x45d7b8
mov ecx, 0x48f478
call fcn.00471a40
jmp 0x45d7df
mov ecx, 0x48f478
call fcn.00471a40
jmp 0x45d82c
mov ecx, 8
mov edx, 0x20
call fcn.0046d190
int3

Function at 0x45d9cf
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x48f498]
test eax, eax
je 0x45daa2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x45d9fb
cmp dword [eax + 4], 0
mov esi, eax
je 0x45d9fb
add esi, 4
jmp 0x45da9d
mov eax, dword [0x48f498]
test eax, eax
je 0x45dab1
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x45da9b
mov esi, eax
test eax, eax
jne 0x45da59
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 8
call fcn.0045a4d0
test eax, eax
je 0x45dadb
mov dword [eax], 0x48f498
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x48f498]
test eax, eax
je 0x45dac0
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0x18
xor edi, edi
call fcn.0045a4d0
test eax, eax
je 0x45dacc
add esi, 4
xor ecx, ecx
inc ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0xc], edi
mov dword [eax + 8], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], edi
mov ecx, dword [esi]
mov dword [esi], eax
test ecx, ecx
je 0x45da9d
lock dec dword [ecx]
jne 0x45da9d
call fcn.00450dd0
jmp 0x45da9d
xor esi, esi
mov eax, esi
pop esi
pop edi
ret
mov ecx, 0x48f498
call fcn.00471a40
jmp 0x45d9df
mov ecx, 0x48f498
call fcn.00471a40
jmp 0x45da09
mov ecx, 0x48f498
call fcn.00471a40
jmp 0x45da51
mov ecx, 4
mov edx, 0x18
call fcn.0046d190
mov ecx, 4
mov edx, 8
call fcn.0046d190
Function at 0x45daea
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x48f488]
test eax, eax
je 0x45db69
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x45db09
cmp byte [eax + 4], 0
mov esi, eax
jne 0x45db5e
mov eax, dword [0x48f488]
test eax, eax
je 0x45db75
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x45db63
mov esi, eax
test eax, eax
jne 0x45db58
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 8
call fcn.0045a4d0
test eax, eax
je 0x45db8d
mov dword [eax], 0x48f488
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x48f488]
test eax, eax
je 0x45db81
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x45db65
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x48f488
call fcn.00471a40
jmp 0x45daf5
mov ecx, 0x48f488
call fcn.00471a40
jmp 0x45db13
mov ecx, 0x48f488
call fcn.00471a40
jmp 0x45db50
mov ecx, 4
mov edx, 8
call fcn.0046d190
push edi
push esi
mov edi, dword [esp + 0xc]
mov esi, dword [edi]
mov eax, dword [esi]
test eax, eax
je 0x45dbea
dec eax
push 1
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [edi + 4]
test eax, eax
je 0x45dbc8
lock dec dword [eax]
jne 0x45dbc8
mov ecx, dword [edi + 4]
call fcn.00450dd0
push edi
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi]
test eax, eax
je 0x45dbf3
dec eax
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
pop edi
ret
mov ecx, esi
call fcn.00471a40
jmp 0x45dbab
mov ecx, esi
call fcn.00471a40
jmp 0x45dbde
Function at 0x45db9c
Capabilities:
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x48f488]
test eax, eax
je 0x45db69
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x45db09
cmp byte [eax + 4], 0
mov esi, eax
jne 0x45db5e
mov eax, dword [0x48f488]
test eax, eax
je 0x45db75
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x45db63
mov esi, eax
test eax, eax
jne 0x45db58
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 8
call fcn.0045a4d0
test eax, eax
je 0x45db8d
mov dword [eax], 0x48f488
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x48f488]
test eax, eax
je 0x45db81
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x45db65
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x48f488
call fcn.00471a40
jmp 0x45daf5
mov ecx, 0x48f488
call fcn.00471a40
jmp 0x45db13
mov ecx, 0x48f488
call fcn.00471a40
jmp 0x45db50
mov ecx, 4
mov edx, 8
call fcn.0046d190
push edi
push esi
mov edi, dword [esp + 0xc]
mov esi, dword [edi]
mov eax, dword [esi]
test eax, eax
je 0x45dbea
dec eax
push 1
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [edi + 4]
test eax, eax
je 0x45dbc8
lock dec dword [eax]
jne 0x45dbc8
mov ecx, dword [edi + 4]
call fcn.00450dd0
push edi
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi]
test eax, eax
je 0x45dbf3
dec eax
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
pop edi
ret
mov ecx, esi
call fcn.00471a40
jmp 0x45dbab
mov ecx, esi
call fcn.00471a40
jmp 0x45dbde
Function at 0x45f1ab
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, edx
mov edx, dword [ecx + 8]
mov esi, ecx
cmp edx, dword [ecx]
jne 0x45f1c5
mov ecx, esi
call fcn.0045e938
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
mov byte [eax + edx], 0
inc edx
mov dword [esp], eax
mov dword [esi + 8], edx
mov ebp, dword [edi]
mov edx, dword [edi + 8]
cmp edx, ebp
jne 0x45f1e8
mov ecx, edi
call fcn.0045e938
mov ebp, dword [edi]
mov edx, dword [edi + 8]
mov ebx, dword [edi + 4]
xor eax, eax
mov byte [ebx + edx], 0
inc edx
mov dword [edi + 8], edx
push 6
push eax
push ebx
mov edi, dword [esp + 0xc]
push edi
push eax
push eax
call sub.shell32.dll_ShellExecuteA
test ebp, ebp
je 0x45f218
push ebx
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esi], 0
je 0x45f22c
push edi
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x45f2ea
Capabilities:
Impersonate user

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, edx
mov esi, ecx
xor ecx, ecx
mov edx, esp
mov edi, dword [esp + 0x44]
lea ebx, [esp + 0xc]
mov dword [edx], ecx
mov edx, dword [eax + 4]
mov ecx, ebx
mov dword [esp + 4], eax
push dword [eax + 8]
call fcn.0045f280
add esp, 4
mov edx, dword [esi + 4]
lea ebp, [esp + 0x18]
mov dword [esp + 8], esi
mov ecx, ebp
push dword [esi + 8]
call fcn.0045f280
add esp, 4
mov edx, dword [edi + 4]
lea esi, [esp + 0x24]
mov ecx, esi
push dword [edi + 8]
call fcn.0045f280
add esp, 4
mov ebx, dword [ebx + 4]
mov ebp, dword [ebp + 4]
mov esi, dword [esi + 4]
mov eax, esp
push eax
xor eax, eax
push eax
push 3
push esi
push ebp
push ebx
call sub.advapi32.dll_LogonUserW
test eax, eax
je 0x45f371
push dword [esp]
call sub.advapi32.dll_ImpersonateLoggedOnUser
push dword [esp]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [esp + 0x24], 0
je 0x45f387
push esi
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0x18], 0
je 0x45f39d
push ebp
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0xc], 0
je 0x45f3b3
push ebx
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 0x44]
cmp dword [eax], 0
je 0x45f3cd
push dword [eax + 4]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 4]
cmp dword [eax], 0
je 0x45f3e7
push dword [eax + 4]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 8]
cmp dword [eax], 0
je 0x45f401
push dword [eax + 4]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45fff1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x460030
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x460030
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x460030
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x460030
cmp dword [ecx + 0x74], 0xe
jbe 0x460030
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x464d80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x464dad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x464dad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x468056
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00468061