joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467530
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x4675a0
lea ebx, [esi + 0xc]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push 0
push ebx
call sub.kernel32.dll_InitOnceBeginInitialize
cmp eax, 1
mov dword [ebp - 0x10], eax
jne 0x4675d6
cmp dword [ebp - 0x14], 0
je 0x4675bd
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x4675ea
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x4e4114]
nop dword [eax + eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x4e4114], esi
jne 0x467580
mov byte [0x4e4110], 1
push 0
push 0
push ebx
call sub.kernel32.dll_InitOnceComplete
jmp 0x4675cc
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x467626
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x4675c1
mov edi, dword [ebp - 0x10]
jmp 0x4675cc
mov edi, dword [esi]
jmp 0x4675cb
mov edi, eax
push dword [ebp - 0x10]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
call fcn.00467930
ud2
push 0
push 4
push ebx
call sub.kernel32.dll_InitOnceComplete
lea ecx, [ebp - 0x2c]
mov edx, 0x4ca324
mov dword [ebp - 0x2c], 0x4ca2ec
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0x4cc61c
mov dword [ebp - 0x20], 0
call fcn.004468e0
ud2
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x4ca2ec
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 0x4cc61c
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.00467970
ud2

Function at 0x467830
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x4ba030]
test eax, eax
je 0x4678e9
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x46785e
cmp dword [eax + 4], 0
mov edi, eax
je 0x46785e
add edi, 8
jmp 0x4678e3
mov eax, dword [0x4ba030]
test eax, eax
je 0x4678f8
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x4678e1
mov esi, eax
test eax, eax
jne 0x4678b7
movzx eax, byte [0x4e4158]
mov ecx, 0xc
mov edx, 4
call fcn.00413060
test eax, eax
je 0x467913
mov dword [eax], 0x4ba030
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4ba030]
test eax, eax
je 0x467907
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x4678e3
test ecx, ecx
je 0x4678e3
lock dec dword [ecx]
jne 0x4678e3
call fcn.004674f0
jmp 0x4678e3
xor edi, edi
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov ecx, 0x4ba030
call fcn.00467530
jmp 0x467843
mov ecx, 0x4ba030
call fcn.00467530
jmp 0x46786c
mov ecx, 0x4ba030
call fcn.00467530
jmp 0x4678b0
mov ecx, 4
mov edx, 0xc
call fcn.00413450
ud2
Function at 0x467e50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x4ba040]
test eax, eax
je 0x467ed5
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x467e71
cmp byte [eax + 4], 0
mov esi, eax
jne 0x467ec9
mov eax, dword [0x4ba040]
test eax, eax
je 0x467ee4
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x467ece
mov esi, eax
test eax, eax
jne 0x467ec3
movzx eax, byte [0x4e4158]
mov ecx, 8
mov edx, 4
call fcn.00413060
test eax, eax
je 0x467efc
mov dword [eax], 0x4ba040
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x4ba040]
test eax, eax
je 0x467ef0
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
mov word [esi + 4], 1
add esi, 5
jmp 0x467ed0
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret
mov ecx, 0x4ba040
call fcn.00467530
jmp 0x467e5e
mov ecx, 0x4ba040
call fcn.00467530
jmp 0x467e7b
mov ecx, 0x4ba040
call fcn.00467530
jmp 0x467ebc
mov ecx, 4
mov edx, 8
call fcn.00413450
ud2

Function at 0x468510
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov edi, edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x103
lea edx, [ebp - 0x14]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x46855f
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x14]
cmp eax, 0x103
je 0x468581
test eax, eax
js 0x46856d
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov al, 4
jmp 0x468578
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0xc]
mov dword [ebp - 0x3c], 0x4c9c8c
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x30], 0
push eax
push ecx
push edx
call fcn.00466b90
add esp, 0xc
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
call fcn.00466c80
mov ecx, 7
int 0x29
ud2
Function at 0x468c80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x4ba020]
test eax, eax
je 0x468d19
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x468ca8
cmp dword [eax + 4], 0
je 0x468ca8
add eax, 8
jmp 0x468d16
mov eax, dword [0x4ba020]
test eax, eax
je 0x468d28
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x468d14
mov esi, eax
test eax, eax
jne 0x468cfd
movzx eax, byte [0x4e4158]
mov ecx, 0x10
mov edx, 4
call fcn.00413060
test eax, eax
je 0x468d43
mov dword [eax], 0x4ba020
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4ba020]
test eax, eax
je 0x468d37
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
lea eax, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
mov byte [esi + 0xc], 0
jmp 0x468d16
xor eax, eax
pop esi
pop ebp
ret
mov ecx, 0x4ba020
call fcn.00467530
jmp 0x468c92
mov ecx, 0x4ba020
call fcn.00467530
jmp 0x468cb2
mov ecx, 0x4ba020
call fcn.00467530
jmp 0x468cf6
mov ecx, 4
mov edx, 0x10
call fcn.00413450
ud2
Function at 0x46ab80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x430
mov edi, 0x200
xor esi, esi
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x20], 0
cmp edi, 0x201
jae 0x46ac00
jmp 0x46abe1
mov esi, dword [ebp - 0x10]
jbe 0x46ac89
cmp edi, 0x201
jae 0x46ac00
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], 0x200
lea ebx, [ebp - 0x43c]
mov esi, edi
jmp 0x46ac31
mov eax, dword [ebp - 0x20]
sub edi, esi
sub eax, esi
cmp eax, edi
jae 0x46ac22
mov edx, esi
lea ecx, [ebp - 0x2c]
push edi
call fcn.00469960
add esp, 4
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], esi
push 0
call sub.kernel32.dll_SetLastError
push ebx
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
mov edi, eax
test eax, eax
jne 0x46ac52
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x46acd3
cmp edi, esi
jne 0x46abd0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x46acee
lea edi, [esi + esi]
test esi, esi
mov esi, dword [ebp - 0x10]
mov eax, 0xffffffff
cmovs edi, eax
cmp edi, 0x201
jb 0x46abe1
jmp 0x46ac00
mov edx, dword [ebp - 0x1c]
cmp edi, edx
ja 0x46ad07
mov edx, ebx
lea ecx, [ebp - 0x3c]
push edi
call fcn.0046b4e0
add esp, 4
movsd xmm0, qword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
movsd xmm1, qword [ebp - 0x34]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
test esi, esi
je 0x46acc8
push dword [ebp - 0x14]
push 0
push dword [0x4e4100]
call sub.kernel32.dll_HeapFree
add esp, 0x430
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [ecx], 0
mov dword [ecx + 4], eax
mov byte [ecx + 0xc], 2
test esi, esi
jne 0x46acb8
jmp 0x46acc8
mov edx, 0x28
mov ecx, str.internal_error:_entered_unreachable_code
push 0x4ca414
call fcn.004478a0
add esp, 4
jmp 0x46ad16
mov ecx, edi
push 0x4ca404
call fcn.004475b0
add esp, 4
ud2
Function at 0x46e4d0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 7
mov dword [esp + 0x32], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x36], 0
mov byte [esp + 0x34], 1
lea esi, [esp + 0x18]
lea ecx, [esp + 0xc]
push esi
push eax
call fcn.00488e00
add esp, 8
cmp byte [esp + 0xc], 4
jne 0x46e545
mov esi, dword [esp + 0x10]
jmp 0x46e560
movzx eax, byte [esp + 0xc]
mov esi, dword [esp + 0x10]
cmp eax, 3
je 0x46e5fc
cmp eax, 4
jne 0x46e6ae
lea ebx, [esp + 0x18]
mov edx, esi
mov ecx, ebx
call fcn.00489010
mov eax, dword [esp + 0x18]
xor eax, 2
or eax, dword [esp + 0x1c]
jne 0x46e5bb
cmp byte [esp + 0x20], 3
jne 0x46e6dc
mov eax, dword [esp + 0x24]
mov ebx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp + 8], ecx
push ecx
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x46e6cb
cmp dword [ebx + 8], 9
jae 0x46e6b6
mov eax, dword [esp + 8]
jmp 0x46e6bd
cmp dword [esp + 0x54], 0
jne 0x46e6dc
mov eax, dword [esp + 0x50]
test esi, esi
mov dword [esp + 4], eax
je 0x46e623
mov dword [esp + 0x18], 0
call sub.kernel32.dll_GetCurrentProcess
push 2
push 0
push 0
push ebx
push eax
push esi
push eax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x46e6e4
mov eax, dword [esp + 0x18]
jmp 0x46e625
mov ebx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [ebx]
mov dword [esp + 4], ecx
push ecx
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x46e6a0
cmp dword [ebx + 8], 9
jae 0x46e68b
mov eax, dword [esp + 4]
jmp 0x46e692
xor eax, eax
push 0
push 0
push 0
push 2
push 0
mov dword [esp + 0x1c], eax
push eax
call sub.kernel32.dll_CreateFileMappingA
test eax, eax
je 0x46e67a
mov ebx, eax
push dword [esp + 4]
push 0
push 0
push 4
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [esp + 0x14], eax
push ebx
call sub.kernel32.dll_CloseHandle
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x46e67a
mov eax, dword [esp + 8]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov ecx, dword [esp + 4]
mov dword [edi + 0xc], ecx
mov dword [edi], 1
jmp 0x46e6ef
mov dword [edi], 0
push dword [esp + 8]
call sub.kernel32.dll_CloseHandle
jmp 0x46e6ef
mov eax, dword [esp + 4]
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x4e4100]
call sub.kernel32.dll_HeapFree
push esi
push 0
push dword [0x4e4100]
call sub.kernel32.dll_HeapFree
mov dword [edi], 0
jmp 0x46e6f5
mov eax, dword [esp + 8]
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x4e4100]
call sub.kernel32.dll_HeapFree
push dword [esp + 4]
push 0
push dword [0x4e4100]
call sub.kernel32.dll_HeapFree
mov dword [edi], 0
jmp 0x46e6ef
call sub.kernel32.dll_GetLastError
mov dword [edi], 0
push esi
call sub.kernel32.dll_CloseHandle
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x482310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov dword [esp], ecx
mov eax, dword [edx + 4]
mov ecx, dword [edx + 8]
mov ebx, dword [edx]
mov esi, edx
mov dword [esp + 0x3c], eax
call fcn.00456370
mov ecx, dword [esp + 0x3c]
mov edi, eax
mov eax, ebx
test edx, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], esi
je 0x48241a
mov ebx, edx
nop dword [eax + eax]
add edi, 0x10
dec ebx
cmp ebx, 0xffffffff
je 0x48242e
lea eax, [edi - 0x10]
lea ecx, [esp + 0x20]
lea esi, [esp + 0x40]
lea edx, [esp + 0xc]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov eax, dword [esp + 0x1c]
movsd qword [esp + 0x48], xmm1
movsd qword [esp + 0x40], xmm0
mov eax, dword [eax + 0xc]
push esi
push dword [eax + 0x20]
call fcn.0047bea0
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, eax
xor edx, 0x2e
or edx, ecx
je 0x48245a
lea esi, [esp + 0x32]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebx
mov esi, dword [esi]
mov dword [esp + 4], esi
lea esi, [esp + 0x32]
movzx esi, word [esi + 4]
mov word [esp + 8], si
movzx esi, word [esp + 0x30]
cmp si, word [ebp + 8]
mov esi, dword [esp + 0x2c]
jne 0x482360
movzx edi, word [esp + 8]
mov ebx, dword [esp]
mov word [ebx + 0x16], di
mov edi, dword [esp + 4]
mov dword [ebx + 0x12], edi
mov dword [ebx + 4], ecx
movzx ecx, word [ebp + 8]
mov dword [ebx], eax
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], esi
mov word [ebx + 0x10], cx
jmp 0x48249b
cmp dword [esi + 0x14], 0
jne 0x482448
sub eax, dword [esi]
mov dword [esi + 0x14], 1
mov dword [esi + 0x18], eax
jmp 0x482448
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x14], 0
jne 0x482448
mov ecx, dword [esp + 0xc]
sub ecx, dword [eax]
mov dword [eax + 0x14], 1
mov dword [eax + 0x18], ecx
mov eax, dword [esp]
mov dword [eax + 4], 0
mov dword [eax], 0x2e
jmp 0x48249b
lea edx, [esp + 0x32]
mov ecx, dword [esp]
mov edi, dword [esp + 0x2c]
mov esi, dword [edx]
movzx eax, word [edx + 4]
movzx edx, word [esp + 0x30]
mov dword [esp + 4], esi
mov dword [ecx + 0x12], esi
mov esi, dword [esp + 0x28]
mov word [ecx + 0x16], ax
mov word [esp + 8], ax
mov dword [ecx + 0xc], edi
mov dword [ecx + 8], esi
mov word [ecx + 0x10], dx
mov dword [ecx + 4], 0
mov dword [ecx], 0x2f
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x48b050
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov edi, edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x103
lea edx, [ebp - 0x14]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x48b098
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x14]
cmp eax, 0xc0000011
jne 0x48b0a8
mov dword [esi + 4], 0
jmp 0x48b0b9
cmp eax, 0x103
je 0x48b0d1
test eax, eax
js 0x48b0c3
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
pop ebp
ret
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x48b0bc
lea eax, [ebp - 0xc]
mov dword [ebp - 0x3c], 0x4c9c8c
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x30], 0
push eax
push ecx
push edx
call fcn.00466b90
add esp, 0xc
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
call fcn.00466c80
mov ecx, 7
int 0x29
ud2

Function at 0x48e1c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x4ba050]
test eax, eax
je 0x48e279
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x48e1ee
cmp dword [eax + 4], 0
mov edi, eax
je 0x48e1ee
add edi, 8
jmp 0x48e273
mov eax, dword [0x4ba050]
test eax, eax
je 0x48e288
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x48e271
mov esi, eax
test eax, eax
jne 0x48e247
movzx eax, byte [0x4e4158]
mov ecx, 0xc
mov edx, 4
call fcn.00413060
test eax, eax
je 0x48e2a3
mov dword [eax], 0x4ba050
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4ba050]
test eax, eax
je 0x48e297
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x48e273
test ecx, ecx
je 0x48e273
lock dec dword [ecx]
jne 0x48e273
call fcn.0048e2c0
jmp 0x48e273
xor edi, edi
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov ecx, 0x4ba050
call fcn.00467530
jmp 0x48e1d3
mov ecx, 0x4ba050
call fcn.00467530
jmp 0x48e1fc
mov ecx, 0x4ba050
call fcn.00467530
jmp 0x48e240
mov ecx, 4
mov edx, 0xc
call fcn.00413450
ud2

Function at 0x48f7b0
Capabilities:
Create process on windows
Encode data using base64
Get common file path
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x560
call fcn.0048f7c4
Function at 0x494e80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, ecx
lea ecx, [ebp - 0x28]
push dword [ebp + 8]
call fcn.00469460
add esp, 4
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
test edx, edx
je 0x494ee2
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x34]
mov dword [ebp - 0x30], eax
call fcn.00494db0
mov edi, dword [ebp - 0x18]
test edi, edi
je 0x494eef
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x494f05
mov eax, dword [ebp - 0x1c]
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], eax
jmp 0x494efd
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
call fcn.004695e0
mov dword [esi], 0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
mov dword [esi], 0
je 0x494efd
push edi
push 0
push dword [0x4e4100]
call sub.kernel32.dll_HeapFree
jmp 0x494efd
Function at 0x496d30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1024
call fcn.004b42f0
mov esi, edx
mov edi, ecx
lea ebx, [ebp - 0x1030]
push 0x1000
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x30]
push 0x48f2b0
push eax
push 0x1000
push ebx
push edi
call sub.kernel32.dll_ReadFileEx
test eax, eax
je 0x496e56
mov dword [ebp - 0x10], edi
push 1
push 0xffffffffffffffff
call sub.kernel32.dll_SleepEx
cmp dword [ebp - 0x1c], 0
je 0x496d8e
cmp dword [ebp - 0x18], 0
jne 0x496e65
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x496e65
cmp ebx, 0x1000
ja 0x496e8f
xor edi, edi
mov eax, ebx
sub eax, edi
jb 0x496e7c
xorps xmm0, xmm0
lea edx, [ebp - 0x1c]
lea ecx, [ebp + edi - 0x1030]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], edx
push 0x48f2b0
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
push esi
call sub.kernel32.dll_WriteFileEx
test eax, eax
je 0x496e5d
nop word [eax + eax]
push 1
push 0xffffffffffffffff
call sub.kernel32.dll_SleepEx
cmp dword [ebp - 0x1c], 0
je 0x496e00
cmp dword [ebp - 0x18], 0
jne 0x496e62
add edi, dword [ebp - 0x14]
cmp edi, ebx
jne 0x496dc0
xorps xmm0, xmm0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], eax
push 0x48f2b0
lea eax, [ebp - 0x30]
push eax
push 0x1000
lea eax, [ebp - 0x1030]
push eax
mov edi, dword [ebp - 0x10]
push edi
call sub.kernel32.dll_ReadFileEx
test eax, eax
jne 0x496d8e
call sub.kernel32.dll_GetLastError
jmp 0x496e65
call sub.kernel32.dll_GetLastError
mov edi, dword [ebp - 0x10]
push edi
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_CloseHandle
add esp, 0x1024
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, ebx
mov ecx, edi
push 0x4c9ed8
call fcn.00448980
add esp, 4
jmp 0x496ea3
mov edx, 0x1000
mov ecx, ebx
push 0x4c9ed8
call fcn.004475b0
add esp, 4
ud2

Function at 0x496fd0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, ecx
xorps xmm0, xmm0
movaps xmmword [esp], xmm0
mov eax, esp
push 0x10
push eax
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x497015
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov edi, dword [esp + 0xc]
mov dword [esi + 0xc], edi
mov dword [esi + 8], edx
mov dword [esi + 4], ecx
mov dword [esi], eax
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov byte [esp + 0x20], 0
mov dword [esp + 0x24], eax
lea edi, [esp + 0x20]
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 0x4ca004
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], fcn.0048a0b0
mov dword [esp + 0x34], 1
lea ecx, [esp + 0x28]
mov edx, 0x4ca030
call fcn.004468e0
ud2
Function at 0x498d20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx], 0
mov edi, edx
jne 0x498deb
mov ebx, dword [edi + 0xc]
mov esi, ecx
mov edx, dword [ebx + 4]
test edx, edx
jne 0x498d51
mov eax, dword [ebx + 8]
xor edx, edx
lea ecx, [eax + 0xf]
cmp ecx, 0xf
jbe 0x498dd5
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x498dc1
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx]
mov dword [ebp - 0x24], 0
lea ebx, [ebp - 0x24]
push ecx
push ebx
push edx
push eax
push dword [edi + 0x10]
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x498d87
mov eax, dword [ebp - 0x24]
mov ecx, 2
test eax, eax
jne 0x498da4
jmp 0x498d98
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x498d9f
cmp eax, 0x6d
jne 0x498db6
mov word [esi], 4
jmp 0x498dae
mov ecx, 1
mov dword [edi], ecx
mov dword [edi + 4], eax
mov word [esi], 0x104
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi], 0
mov dword [esi + 4], eax
jmp 0x498dae
mov ecx, ebx
push 1
call fcn.0046c820
add esp, 4
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 8]
jmp 0x498d58
mov edx, eax
mov ecx, ebx
push 0x10
call fcn.0046c820
add esp, 4
mov edx, dword [ebx + 4]
jmp 0x498d51
lea edx, [ebp - 0x24]
mov ecx, edi
mov dword [ebp - 0x24], 0
call fcn.00498e00
ud2

Function at 0x49c310
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x4ba060]
test eax, eax
je 0x49c3f1
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x49c340
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x49c3e6
mov eax, dword [0x4ba060]
test eax, eax
je 0x49c400
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x49c3c3
mov esi, eax
test eax, eax
jne 0x49c3a4
movzx eax, byte [0x4e4158]
mov ecx, 0x20
mov edx, 8
call fcn.00413060
test eax, eax
je 0x49c41b
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x4ba060
mov esi, eax
mov eax, dword [0x4ba060]
test eax, eax
je 0x49c40f
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x49c3c7
movaps xmm0, xmmword [esp]
jmp 0x49c3d5
xor esi, esi
jmp 0x49c3e9
lea ecx, [esp + 0x10]
call fcn.00496fd0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x4ba060
call fcn.00467530
jmp 0x49c328
mov ecx, 0x4ba060
call fcn.00467530
jmp 0x49c34e
mov ecx, 0x4ba060
call fcn.00467530
jmp 0x49c39d
mov ecx, 8
mov edx, 0x20
call fcn.00413450
ud2