joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe2fa19
Capabilities:
Parse pe header

Disassembly:
test esi, esi
jmp 0xde70c7
je 0xde70e1
mov esi, dword [ebp + 0xc]
jmp 0xdb31d0
push ebp
btr bp, 0x10
mov ebp, esp
cwd
shrd dx, bx, 0xbc
rcl dl, cl
mov edx, dword [ebp + 8]
test bp, 0xbdb5
lea esp, [esp - 0x114]
cmp ecx, ecx
push esi
cmc
test ecx, esi
test edx, edx
jmp 0xdfc25b

Function at 0xe3b372
Capabilities:
Access peb ldr_data

Disassembly:
inc ecx
not edx
dec esp
mov dword [esp + ebp - 0x5492], edi
dec eax
mov dword [esp + ebp*2 - 0xa924], esi
inc esp
xor dword [esp + ebp - 0x5492], edx
dec eax
sub eax, eax
pop esi
dec esp
lea ebp, [ebx*8 - 0x5ef6bd48]
dec ebp
arpl dx, dx
movsx edi, bx
inc esp
movzx esp, cx
dec ebp
adc eax, edx
inc ecx
mov edx, edi
or cl, 0xbd
dec ecx
dec ebp
inc bp
adc edi, dword [ebx + ebp - 0x5492]
ror edx, cl
or ax, bp
inc ecx
mov cl, byte [ebx + ebp - 0x5490]
dec ebp
lea ebx, [ebx + ebp*2 - 0xa922]
dec edx
lea edx, [ebp + 0xe34cb8e]
call fcn.00a222c4
dec ecx
add esi, 1
dec ecx
dec esp
inc ecx
movsx eax, ah
inc esp
xor dl, dh
inc ecx
neg dl
dec esi
lea ecx, [0x57387338]
inc ebp
movsx ebp, cl
call fcn.00e208da
dec dl
xor eax, ebx
xadd dword [esp + edx - 0x2195a923], edx
sar edx, 0x7b
xor eax, 0x7d25632e
dec eax
not cx
xor eax, 0x93954807
sub dword [esp + edx - 4], ecx
mov dword [esp + edx - 4], ecx
sal dword [esp + edx - 4], 0x4a
dec eax
shr word [esp + edx - 3], 0xca
cmovne cx, dx
neg eax
ror dword [esp + edx*2 - 8], 0x11
push edx
lea eax, [edx + eax - 0x1b1fa1a7]
shr cl, 0xc2
xor eax, 0x603fbe2a
shl ecx, 0x76
setbe byte [esp + edx*2 - 2]
lea eax, [eax + edx*4 + 0xd909176]
call fcn.00dce250

Function at 0xe43cf1
Capabilities:
Authenticate hmac

Disassembly:
inc esp
movzx edi, word [esp + edx - 0xec00]
rol ebx, 2
inc ecx
not ch
dec ebx
movzx ebp, dx
dec edx
mov dword [esp + edx + 0x684bcbbe], 0xad03dea0
dec eax
mov dword [esp + edx*8 - 0x76040], esi
sar word [esp + edx - 0xec04], 0xa4
not byte [esp + edx - 0xec04]
xor dword [esp + edx - 0xec01], ebx
dec eax
mov esi, dword [esp + edx*2 - 0x1d80a]
jmp 0xdbd70b
dec eax
mov dword [esp + edx - 0xec01], 0x350d201e
dec byte [esp + edx - 0xec01]
dec eax
arpl bx, bx
dec eax
add ecx, dword [esp + edx*2 - 0x1d80b]
dec esp
adc eax, ebx
dec esp
mov dword [esp + edx*4 - 0x3b024], eax
ret 8
neg ebx
inc esp
movzx ebp, word [esp + edx*8 - 0x7603c]
dec eax
mov dword [esp + edx - 0xec01], 0x66895d1c
inc ebx
dec eax
xadd dword [esp + edx*2 - 0x1d80a], ecx
jg 0xa0aca9

Function at 0xe47583
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
inc ecx
bswap edx
movzx edi, word [esp]
inc ebp
movsx esp, cx
inc dx
sar dword [esp - 0xf6d7], 0xe2
inc ecx
rol edx, 3
inc eax
movsx eax, bh
inc ecx
inc edx
inc ecx
bswap edx
inc ecx
inc edx
dec esp
lea ebp, [edx + 0x2303b2a5]
movsx ecx, word [esp + edi*4 - 0x15ee8]
call fcn.009fc5b2
inc ebp
mov edx, dword [esi]
dec eax
mov dword [esp], 0x35a357ba
inc esp
sub cl, byte [esp + 4]
dec ecx
adc esi, 4
inc esp
xor edx, esi
ror word [esp + 2], 0x65
dec ebx
lea edx, [ecx + ecx*8 - 0xfe96bd8]
jae 0x9349b7
Function at 0xe49072
Capabilities:
Encode data using xor

Disassembly:
adc edi, ecx
mov dword [esp + eax*2 - 0x1c800], eax
lea edx, [edx*2 + 0x88c653a]
mov ecx, dword [eax + esi - 0xe408]
dec al
lea esi, [esi + eax*4 - 0x39404]
call fcn.0092f474

Function at 0xe57703
Capabilities:
Encode data using xor

Disassembly:
dec ebp
lea esi, [esi + ecx*2 - 0x1fcd23be]
xor ebp, esi
inc ecx
pop ecx
movzx edi, cx
neg ebp
dec ecx
and ebx, ebp
xor ebp, 0x2b0c8f23
call fcn.009df44b
call fcn.00e154b6
mov al, 0xf8
inc esp
pushal
adc eax, dword [eax]
stc
xor dword [ebp - 0x57], ebx
mov al, byte [edi]
shl cl, 0xd1
sub eax, 0xc0078af9
in eax, dx
std
loope 0xe57714
mov al, byte [edi]
rcr cl, 0x1a
in eax, 0x9c
pop es
inc eax
aam 0xa5
dec ecx
test dl, bl
jno 0xe57772
cmpsb byte [esi], byte es:[edi]
idiv edi
ficomp dword [ecx + 0x4a]
fld qword [ebp - 0x21452302]
push ds
dec eax
std
mov dh, 0x9a
shr dword [edx + 0x1b], 0xfe
in al, 0xd6
popfd
push 0x1b
invalid
test dword [edx + 0x1b], ebp
invalid

Function at 0xe5d0c1
Capabilities:
Encode data using xor

Disassembly:
xor edx, ebx
sub edx, 0xb499c6ba
mov ecx, 0xe3afcf30
mov dword [esp + 4], ecx
not byte [esp + 6]
ror edx, 1
call fcn.00dee352

Function at 0xe6b1d9
Capabilities:
Encode data using xor

Disassembly:
xor edi, esi
inc ebp
movzx esp, dl
inc ecx
dec ah
inc ecx
ror ch, 4
lea edi, [edi + eax*8 - 0x511f8ebc]
inc esp
xchg dword [esp + eax - 0x2695010a], esp
bswap edi
lea edi, [edi + eax + 0x26797b1f]
inc ebx
ja 0xe45d51
xor edi, 0xf021113
and byte [esp + eax - 0x2695010a], dh
inc esp
adc edx, ebp
dec edi
jmp 0xa18cca
dec esi
mov dword [esp + ebp - 0x94], edx
jae 0x973151

Function at 0xe76bf2
Capabilities:
Encode data using xor

Disassembly:
not al
dec al
call fcn.00e4ee0d
mov eax, 0xe7a0ff18
dec ecx
mov ebx, dword [ebx]
inc esp
movsx ebp, al
jmp 0xe2afdc
and byte [esp + edi + 1], dh
inc ecx
bswap edi
dec edx
mov dword [esp + ebp - 0x10], esi
inc esi
xor dword [esp + ebp - 0x10], edi
call fcn.00e0b05b
dec edi
mov esp, dword [ebx + ebp - 0x10]
inc ecx
mov edi, ebp
inc ebp
movzx edi, ch
dec ecx
and ebx, esp
dec eax
not ebx
sal edi, 0x3d
dec ebx
mov dword [ebp + ebx - 0x10], ebx
inc ecx
push edi
mov edx, eax
inc edi
mov edi, dword [ebp + esi - 0x18]
movsx ecx, dl
dec edi
lea esi, [esi + ebp - 0x14]
inc esp
xor edi, esi
inc ecx
push ebp
inc esp
movsx edx, cx
inc ecx
ror edi, 1
inc ecx
xor edi, 0xa0ae50e
inc ecx
inc edi
jmp 0xdba440
mov eax, dword [edx]
call fcn.009d9d6e
and dl, 0x24
xor al, bl
xor al, 0x98
ror dx, 0x86
dec al
shr dx, 0x8f
jbe 0x9ec261
mov edx, 0x44a97a01
call fcn.009dde38
mov ecx, 0x3636048c
movsx edx, cx
lea edi, [ecx + edi - 0x36360490]
lea eax, [edx + edx*2 - 0x36055cc]
jmp 0xe30359

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0xf3877e5
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x1a740f87
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x531c7b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x531d00
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.0050cdc0
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x531cc3
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x531ce5
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x531d5b
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.005319cb
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x531d47
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x531d5b
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x531c84
pop esi
pop ebx
leave
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4156f0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0
jne 0x41571c
mov word [esp + 0x10], 0
jmp 0x415724
push eax
call esi
mov word [esp + 0x10], ax
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x415733
mov word [esp + 0x12], ax
jmp 0x41573b
push eax
call esi
mov word [esp + 0x12], ax
mov eax, dword [0x5debe0]
push edi
call dword [eax + 0x36c]
lea ecx, [esp + 0xc]
push ecx
call fcn.004157b0
add esp, 8
lea edx, [esp + 8]
push edx
push 0x4159e0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41577e
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp word [esp + 0x10], 0
mov esi, dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
je 0x415793
mov edx, dword [esp + 0x10]
push edx
call esi
cmp word [esp + 0x12], 0
je 0x4157a2
mov eax, dword [esp + 0x12]
push eax
call esi
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x10
ret
Function at 0x43dcf0
Capabilities:
Create thread

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
push 0x64
call fcn.004783d0
add esp, 4
mov esi, eax
call fcn.0043d110
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov edi, dword [esp + 0x40]
xor ebx, ebx
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x50]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x14], edi
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call sub.KERNEL32.dll_GetCurrentThreadId
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
cmp edi, ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x28], eax
je 0x43dda1
push ebx
push 1
push 1
push ebx
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x38], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x44], eax
call edi
lea ecx, [esp + 0x10]
push ecx
push ebx
push esi
push 0x43ea40
push 0x100
push ebx
mov dword [esi + 0x48], eax
call ebp
push 2
push eax
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
or dword [esi + 8], 2
jmp 0x43dda4
mov dword [esi + 0x30], ebx
cmp dword [esp + 0x44], ebx
je 0x43ddef
push ebx
push 1
push 1
push ebx
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x34], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x3c], eax
call edi
lea edx, [esp + 0x10]
push edx
push ebx
push esi
push 0x43eb50
push 0x100
push ebx
mov dword [esi + 0x40], eax
call ebp
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x30]
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
or dword [esi + 8], 4
push esi
lea ecx, [esp + 0x18]
push str.file_lx
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [esi + 8]
push edx
push esi
lea eax, [esp + 0x28]
push eax
push 0x5adae0
call fcn.00441f10
push str.auto
push str._translation
push eax
push ebx
mov dword [esi + 4], eax
call fcn.00445e60
mov ecx, dword [esi + 4]
push 0x5adc84
push str._eofchar
push ecx
push ebx
call fcn.00445e60
mov eax, dword [esi + 4]
add esp, 0x3c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x463200
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x3c4
push esi
push 1
push 0x5b1360
mov dword [esp + 0xc], 0x100
call fcn.00465960
mov esi, dword [esp + 0x3d4]
add esp, 4
push eax
push 0
push str.tclDefaultLibrary
push esi
call fcn.00407c40
add esp, 0x14
lea eax, [esp + 0x130]
push eax
mov dword [esp + 0x134], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 1
push str.windows
push str.platform
push str.tcl_platform
push esi
call fcn.00407bd0
mov eax, dword [esp + 0x154]
add esp, 0x14
cmp eax, 4
jae 0x46329d
mov edx, dword [eax*4 + 0x5b1320]
push 1
push edx
push 0x5aaadc
push str.tcl_platform
push esi
call fcn.00407bd0
add esp, 0x14
mov eax, dword [esp + 0x138]
mov ecx, dword [esp + 0x134]
push eax
push ecx
lea edx, [esp + 0x108]
push str._d._d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
push 1
lea eax, [esp + 0x114]
push eax
push str.osVersion
push str.tcl_platform
push esi
call fcn.00407bd0
mov eax, dword [esp + 0x2c]
add esp, 0x24
cmp ax, 0xb
jae 0x463309
push 1
and eax, 0xffff
mov ecx, dword [eax*4 + 0x5b1330]
push ecx
push str.machine
push str.tcl_platform
push esi
call fcn.00407bd0
add esp, 0x14
lea edx, [esp + 0x2c]
push edx
call fcn.00464ab0
push 1
push str.HOME
push 0x5aaae0
push esi
call fcn.00407930
add esp, 0x14
test eax, eax
jne 0x4633a7
push 1
push str.HOMEDRIVE
push 0x5aaae0
push esi
call fcn.00407930
add esp, 0x10
test eax, eax
je 0x463355
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00464ad0
add esp, 0xc
push 1
push str.HOMEPATH
push 0x5aaae0
push esi
call fcn.00407930
add esp, 0x10
test eax, eax
je 0x46337e
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.00464ad0
add esp, 0xc
mov eax, dword [esp + 0x30]
test eax, eax
push 1
jle 0x46338f
mov edx, dword [esp + 0x30]
push edx
jmp 0x463394
push 0x5b147c
push str.HOME
push 0x5aaae0
push esi
call fcn.00407bd0
add esp, 0x14
lea eax, [esp + 0x2c]
push eax
call fcn.00464ab0
lea ecx, [esp + 0x30]
push ecx
push str.USERNAME
call fcn.00466490
add esp, 0xc
test eax, eax
jne 0x46340e
mov ecx, dword [0x5e0920]
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x1c8]
push eax
call dword [ecx + 0x9c]
test eax, eax
je 0x46340e
mov edx, dword [esp + 4]
mov ecx, dword [0x5e0920]
lea eax, [edx - 1]
cmp dword [ecx], 0
je 0x4633f8
add eax, eax
lea edx, [esp + 0x2c]
push edx
push eax
lea eax, [esp + 0x1cc]
push eax
call fcn.004a9720
add esp, 0xc
mov ecx, dword [esp + 0x2c]
push 1
push ecx
push str.user
push str.tcl_platform
push esi
call fcn.00407bd0
lea edx, [esp + 0x40]
push edx
call fcn.00464cc0
add esp, 0x18
pop esi
add esp, 0x3c4
ret
Function at 0x46c2a0
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x5ded78
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push edi
push 0
push eax
push ecx
push edx
push 0
mov dword [edi], 0
call fcn.00584441
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x46c2ec
push 0x5ded78
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, 1
pop esi
ret
test byte [esp + 0x1c], 1
je 0x46c2fe
mov eax, dword [edi]
push eax
call fcn.004b06e0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5ded78
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
ret

Function at 0x46c7d0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
mov eax, dword [0x5ded70]
test eax, eax
jne 0x46c800
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x5ded50], eax
mov dword [0x5ded70], 1
jne 0x46c800
push str.could_not_allocate_thread_local_storage
call fcn.00406da0
add esp, 4
mov eax, dword [0x5ded50]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x46c82a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x46c82a
push str.TlsGetValue_failed_from_TclpGetAllocCache
call fcn.00406da0
add esp, 4
mov eax, esi
pop esi
ret
Function at 0x499a60
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx + 0x3c]
push esi
push edi
add eax, ebx
push 1
push eax
call fcn.00499bd0
add esp, 8
test eax, eax
jne 0x499a85
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov eax, dword [eax]
push eax
push ebx
lea esi, [eax + ebx]
call fcn.00499bf0
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0xc], edi
jne 0x499aa5
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov ecx, dword [edi + 8]
lea eax, [esp + 0x14]
push eax
mov eax, dword [edi + 0xc]
push 0x40
mov edx, ebx
push ecx
add edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x499ac9
pop edi
pop esi
pop ebx
add esp, 0xc
ret
cmp dword [esi], 0
je 0x499bab
mov eax, dword [esi + 0xc]
add eax, ebx
push str.KERNEL32.dll
push eax
call fcn.0058f240
add esp, 8
test eax, eax
je 0x499af8
mov eax, dword [esi + 0x14]
add esi, 0x14
test eax, eax
jne 0x499ad2
jmp 0x499bab
mov ecx, dword [esi]
mov esi, dword [esi + 0x10]
mov eax, dword [ecx + ebx]
add ecx, ebx
add esi, ebx
test eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], esi
je 0x499bab
push ebp
test eax, 0x80000000
jne 0x499b8d
lea ebp, [eax + ebx + 2]
mov al, byte [ebp]
cmp al, 0x44
mov edi, 0x5b6be0
je 0x499b38
cmp al, 0x46
je 0x499b38
cmp al, 0x47
je 0x499b38
cmp al, 0x4c
jne 0x499b89
mov eax, dword [str.DisableThreadLibraryCalls]
test eax, eax
je 0x499b89
mov eax, dword [edi]
mov esi, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x499b69
test cl, cl
je 0x499b65
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x499b69
add eax, 2
add esi, 2
test cl, cl
jne 0x499b45
xor eax, eax
jmp 0x499b6e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x499b7b
mov eax, dword [edi + 8]
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
mov eax, dword [edi + 0xc]
add edi, 0xc
test eax, eax
jne 0x499b41
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x20]
mov eax, dword [ecx + 4]
add ecx, 4
add esi, 4
test eax, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], esi
jne 0x499b15
pop ebp
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 8]
lea edx, [esp + 0x14]
push edx
push eax
push ecx
add ebx, dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x499bf0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
mov ax, word [ecx + 0x14]
xor edx, edx
mov dx, word [ecx + 6]
push ebx
push esi
xor esi, esi
push edi
lea eax, [eax + ecx + 0x18]
test edx, edx
jle 0x499c2e
mov edi, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
cmp ecx, edi
ja 0x499c26
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x499c30
inc esi
add eax, 0x28
cmp esi, edx
jl 0x499c16
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x4a1750
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
push edi
je 0x4a1777
sub eax, dword [esi + 0x14]
push eax
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4a17f0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov edi, eax
test edi, edi
jle 0x4a17f0
mov ecx, dword [esi + 0x20]
mov edx, dword [ecx + 0x10]
push edx
call fcn.005856f9
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0x10]
push 0
push edi
push 0
push 2
push 0
push ecx
call fcn.005856f9
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
je 0x4a17f0
push edi
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x4a17e9
mov ecx, dword [esi + 0x14]
lea edx, [ecx + eax]
sub edi, ecx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
ret

Function at 0x4a8f40
Capabilities:
Set socket configuration

Disassembly:
call fcn.004a7a70
test eax, eax
jne 0x4a8f4d
or eax, 0xffffffff
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
ret
Function at 0x4a92b0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x5dfe30]
push ebp
push esi
push edi
push eax
call fcn.0049b0b0
mov eax, dword [esp + 0x14]
xor ebp, ebp
add esp, 4
cmp eax, ebp
je 0x4a9403
push str.unicode
push ebp
mov dword [0x5e0920], 0x5b8270
call fcn.0049b030
mov ecx, dword [0x5e0920]
mov dword [0x5dfe30], eax
mov eax, dword [ecx + 0x68]
add esp, 8
cmp eax, ebp
jne 0x4a947d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.kernel32
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
je 0x4a9375
push str.GetFileAttributesExW
push edi
call esi
mov edx, dword [0x5e0920]
push str.CreateHardLinkW
push edi
mov dword [edx + 0x68], eax
call esi
mov ecx, dword [0x5e0920]
push str.FindFirstFileExW
push edi
mov dword [ecx + 0x6c], eax
call esi
mov edx, dword [0x5e0920]
push str.GetVolumeNameForVolumeMountPointW
push edi
mov dword [edx + 0x70], eax
call esi
mov ecx, dword [0x5e0920]
push str.GetLongPathNameW
push edi
mov dword [ecx + 0x74], eax
call esi
mov edx, dword [0x5e0920]
push edi
mov dword [edx + 0x78], eax
call ebp
push str.advapi32
call ebx
mov edi, eax
test edi, edi
pop ebx
je 0x4a947d
push str.GetFileSecurityW
push edi
call esi
mov ecx, dword [0x5e0920]
push str.ImpersonateSelf
push edi
mov dword [ecx + 0x7c], eax
call esi
mov edx, dword [0x5e0920]
push str.OpenThreadToken
push edi
mov dword [edx + 0x80], eax
call esi
mov ecx, dword [0x5e0920]
push str.RevertToSelf
push edi
mov dword [ecx + 0x84], eax
call esi
mov edx, dword [0x5e0920]
push str.MapGenericMask
push edi
mov dword [edx + 0x88], eax
call esi
mov ecx, dword [0x5e0920]
push str.AccessCheck
push edi
mov dword [ecx + 0x8c], eax
call esi
mov edx, dword [0x5e0920]
push edi
mov dword [edx + 0x90], eax
call ebp
pop edi
pop esi
pop ebp
ret
cmp dword [0x5b8238], ebp
mov dword [0x5e0920], 0x5b81d0
mov dword [0x5dfe30], ebp
jne 0x4a947d
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebp
je 0x4a947d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetFileAttributesExA
push esi
call edi
mov ecx, dword [0x5e0920]
push str.CreateHardLinkA
push esi
mov dword [ecx + 0x68], eax
call edi
mov edx, dword [0x5e0920]
mov dword [edx + 0x6c], eax
mov eax, dword [0x5e0920]
mov dword [eax + 0x70], ebp
mov ecx, dword [0x5e0920]
push str.GetVolumeNameForVolumeMountPointA
push esi
mov dword [ecx + 0x78], ebp
call edi
mov edx, dword [0x5e0920]
push esi
mov dword [edx + 0x74], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
ret