joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [edx + 4]
test eax, eax
je 0x4a9ad3
mov ebp, ecx
mov ecx, dword [edx]
mov edi, edx
xor edx, edx
cmp eax, 8
mov esi, 0
jb 0x4a9aa7
mov edx, eax
lea esi, [ecx + 0x10]
pxor xmm0, xmm0
pxor xmm1, xmm1
and edx, 0xfffffff8
mov ebx, edx
nop word cs:[eax + eax]
movdqu xmm2, xmmword [esi - 0x10]
movdqu xmm3, xmmword [esi]
add esi, 0x20
add ebx, 0xfffffff8
por xmm0, xmm2
por xmm1, xmm3
jne 0x4a9a70
por xmm1, xmm0
cmp eax, edx
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd esi, xmm1
je 0x4a9ab8
mov ebx, eax
sub ebx, edx
lea edx, [ecx + edx*4]
nop
or esi, dword [edx]
add edx, 4
dec ebx
jne 0x4a9ab0
test esi, esi
je 0x4a9ad3
test eax, eax
jle 0x4a9ac5
test byte [ecx], 1
jne 0x4a9af5
push 0xa9
push str.external_boringssl_src_crypto_fipsmodule_bn_montgomery.c
push 0x68
jmp 0x4a9adf
push 0xa5
push str.external_boringssl_src_crypto_fipsmodule_bn_montgomery.c
push 0x69
push 0
push 3
call sym.fastboot.exe_ERR_put_error
add esp, 0x14
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [edi + 0xc], 0
je 0x4a9b09
push 0xad
push str.external_boringssl_src_crypto_fipsmodule_bn_montgomery.c
push 0x6d
jmp 0x4a9adf
lea ebx, [ebp + 0x14]
cmp ebx, edi
je 0x4a9b47
push eax
push ebx
call fcn.0049d890
add esp, 8
test eax, eax
je 0x4a9b86
mov eax, dword [edi + 4]
lea ecx, [eax*4]
test ecx, ecx
je 0x4a9b3c
push ecx
push dword [edi]
push dword [ebx]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [edi + 4]
mov dword [ebp + 0x18], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp + 0x20], ecx
jmp 0x4a9b4a
mov eax, dword [ebp + 0x18]
mov dword [esp + 4], ebp
nop
test eax, eax
jle 0x4a9b72
mov ecx, dword [ebx]
lea edx, [eax - 1]
cmp dword [ecx + eax*4 - 4], 0
mov eax, edx
je 0x4a9b50
inc edx
mov dword [ebp + 0x18], edx
cmp edx, 2
mov eax, dword [ecx]
jl 0x4a9b97
mov ecx, dword [ecx + 4]
jmp 0x4a9b99
mov dword [ebp + 0x18], eax
jne 0x4a9b7e
mov dword [ebp + 0x20], 0
mov eax, dword [ebx]
xor ecx, ecx
mov eax, dword [eax]
jmp 0x4a9b99
push 0xb3
push str.external_boringssl_src_crypto_fipsmodule_bn_montgomery.c
push 0x44
jmp 0x4a9adf
xor ecx, ecx
mov esi, 1
xor edi, edi
xor ebx, ebx
mov dword [esp + 8], 0x40
mov dword [esp], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov ebp, esi
nop dword [eax + eax]
mov edx, dword [esp + 0xc]
and ebp, 1
mov ecx, 0
neg ebp
sbb ecx, ecx
and ebp, eax
and edx, ecx
mov eax, edx
and edx, edi
xor eax, edi
mov edi, ebp
and ebp, esi
xor edi, esi
shrd edi, eax, 1
shr eax, 1
add ebp, edi
adc edx, eax
shrd dword [esp], ebx, 1
and ecx, 0x80000000
shr ebx, 1
mov eax, dword [esp + 0x10]
mov esi, ebp
or ebx, ecx
dec dword [esp + 8]
mov edi, edx
jne 0x4a9bc0
mov eax, dword [esp + 4]
mov ecx, dword [esp]
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ebx
mov eax, 1
jmp 0x4a9aed
Function at 0x4b6e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x20]
cmp dword [edi + 0xc], 0
je 0x4b6ea9
push 0x13c
push str.external_boringssl_src_crypto_fipsmodule_bn_bn.c
push 0x6d
push 0
push 3
call sym.fastboot.exe_ERR_put_error
add esp, 0x14
push 0x1c
push str.external_boringssl_src_crypto_fipsmodule_ec_scalar.c
push 0x85
push 0
push 0xf
call sym.fastboot.exe_ERR_put_error
add esp, 0x14
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + 0x18]
mov ebx, dword [edi + 4]
mov eax, dword [esi + 0xc]
mov ebp, ebx
sub ebp, eax
jbe 0x4b6f63
mov edx, dword [edi]
xor ecx, ecx
cmp ebp, 8
mov edi, eax
jb 0x4b6f2e
mov ecx, edx
mov edx, ebp
pxor xmm0, xmm0
pxor xmm1, xmm1
and edx, 0xfffffff8
mov dword [esp], ecx
lea ecx, [ecx + eax*4 + 0x10]
lea edi, [eax + edx]
mov esi, edx
nop word cs:[eax + eax]
nop dword [eax]
movdqu xmm2, xmmword [ecx - 0x10]
movdqu xmm3, xmmword [ecx]
add ecx, 0x20
add esi, 0xfffffff8
por xmm0, xmm2
por xmm1, xmm3
jne 0x4b6ef0
por xmm1, xmm0
cmp ebp, edx
mov esi, dword [esp + 0x18]
mov edx, dword [esp]
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd ecx, xmm1
je 0x4b6f48
sub ebx, edi
lea edx, [edx + edi*4]
nop word cs:[eax + eax]
nop dword [eax]
or ecx, dword [edx]
add edx, 4
dec ebx
jne 0x4b6f40
mov edi, dword [esp + 0x20]
test ecx, ecx
mov ebx, eax
je 0x4b6f63
push 0x143
push str.external_boringssl_src_crypto_fipsmodule_bn_bn.c
push 0x66
jmp 0x4b6e7b
mov ecx, dword [esp + 0x1c]
shl eax, 2
test eax, eax
je 0x4b6f7e
push eax
push 0
push ecx
mov ebp, ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov ecx, ebp
add esp, 0xc
shl ebx, 2
test ebx, ebx
je 0x4b6f95
push ebx
push dword [edi]
push ecx
mov edi, ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, edi
add esp, 0xc
mov edx, dword [esi + 0xc]
test edx, edx
je 0x4b6e87
mov eax, dword [esi + 8]
xor esi, esi
mov dword [esp], eax
mov eax, ecx
xor ecx, ecx
nop dword [eax]
mov edi, dword [esp]
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
mov edi, ebp
sub edi, ebx
xor ebx, ebp
xor edi, ebp
or edi, ebx
xor edi, ebp
mov ebp, ebx
dec ebx
sar edi, 0x1f
xor ebp, 0x80000000
or edi, 1
test ebx, ebp
cmovns ecx, edi
inc esi
cmp edx, esi
jne 0x4b6fb0
test ecx, ecx
jns 0x4b6e87
mov eax, 1
jmp 0x4b6ea1
Function at 0x4c3b00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov ecx, dword [esp + 0x4c]
xor eax, eax
cmp ecx, 0x30
ja 0x4c3c47
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
test ecx, ecx
movsd xmm0, qword [eax + 0x28]
movsd qword [esp + 0x28], xmm0
movsd xmm0, qword [eax + 0x20]
movsd qword [esp + 0x20], xmm0
movsd xmm0, qword [eax + 0x18]
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0x10], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
movsd qword [esp + 8], xmm1
movsd qword [esp], xmm0
je 0x4c3bbc
mov eax, dword [esp + 0x48]
xor edx, edx
cmp ecx, 0x1f
jbe 0x4c3bb0
mov edx, ecx
xor edi, edi
and edx, 0xffffffe0
nop word cs:[eax + eax]
nop dword [eax]
movups xmm0, xmmword [eax + edi]
movups xmm2, xmmword [esp + edi]
movups xmm1, xmmword [eax + edi + 0x10]
movups xmm3, xmmword [esp + edi + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm1
movups xmmword [esp + edi], xmm2
movups xmmword [esp + edi + 0x10], xmm3
add edi, 0x20
cmp edx, edi
jne 0x4c3b80
cmp edx, ecx
je 0x4c3bbc
nop dword [eax]
movzx ebx, byte [eax + edx]
xor byte [esp + edx], bl
inc edx
cmp ecx, edx
jne 0x4c3bb0
movups xmm0, xmmword [esp]
movups xmm1, xmmword [esp + 0x10]
mov eax, esp
xorps xmm0, xmmword [0x51d660]
xorps xmm1, xmmword [str._M_kn_aN]
movups xmmword [esp], xmm0
movups xmmword [esp + 0x10], xmm1
movups xmm0, xmmword [esp + 0x20]
xorps xmm0, xmmword [0x51d680]
movups xmmword [esp + 0x20], xmm0
push esi
push 0x100
push eax
call fcn.0049a480
add esp, 0xc
mov dword [esi + 0xf4], fcn.0049aa10
mov dword [esi + 0xf8], 0
mov eax, 1
movsd xmm0, qword [esp + 0x20]
movsd xmm1, qword [esp + 0x28]
movsd qword [esi + 0xfc], xmm0
movsd qword [esi + 0x104], xmm1
mov dword [esi + 0x114], 0
mov dword [esi + 0x110], 1
add esp, 0x30
pop esi
pop edi
pop ebx
ret
Function at 0x4c3c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ecx, dword [esp + 0x80]
mov esi, dword [esp + 0x78]
test ecx, ecx
je 0x4c3d1c
xor eax, eax
cmp ecx, 0x30
ja 0x4c3e13
movsd xmm0, qword [esi + 0x28]
mov eax, dword [esp + 0x7c]
xor edx, edx
cmp ecx, 0x20
movsd qword [esp + 0x28], xmm0
movsd xmm0, qword [esi + 0x20]
movsd qword [esp + 0x20], xmm0
movsd xmm0, qword [esi + 0x18]
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [esi + 0x10]
movsd qword [esp + 0x10], xmm0
movsd xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
movsd qword [esp + 8], xmm1
movsd qword [esp], xmm0
jb 0x4c3d00
mov edx, ecx
xor esi, esi
and edx, 0xffffffe0
nop word [eax + eax]
movups xmm0, xmmword [eax + esi]
movups xmm2, xmmword [esp + esi]
movups xmm1, xmmword [eax + esi + 0x10]
movups xmm3, xmmword [esp + esi + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm1
movups xmmword [esp + esi], xmm2
movups xmmword [esp + esi + 0x10], xmm3
add esi, 0x20
cmp edx, esi
jne 0x4c3cd0
cmp edx, ecx
jne 0x4c3d00
mov esi, esp
jmp 0x4c3d1c
mov esi, esp
nop word cs:[eax + eax]
nop dword [eax]
movzx ebx, byte [eax + edx]
xor byte [esp + edx], bl
inc edx
cmp ecx, edx
jne 0x4c3d10
mov edi, dword [esp + 0x74]
lea ebx, [esp + 0x30]
mov eax, dword [edi + 0x108]
lea ebp, [edi + 0xfc]
bswap eax
inc eax
bswap eax
mov dword [edi + 0x108], eax
push edi
push ebx
push ebp
call dword [edi + 0xf4]
add esp, 0xc
mov eax, dword [edi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [edi + 0x108], eax
lea eax, [esp + 0x40]
push edi
push eax
push ebp
call dword [edi + 0xf4]
add esp, 0xc
mov eax, dword [edi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [edi + 0x108], eax
lea eax, [esp + 0x50]
push edi
push eax
push ebp
call dword [edi + 0xf4]
add esp, 0xc
movups xmm0, xmmword [esi]
movups xmm1, xmmword [esp + 0x30]
xorps xmm1, xmm0
movups xmm0, xmmword [esp + 0x40]
movups xmmword [esp + 0x30], xmm1
movups xmm1, xmmword [esi + 0x10]
xorps xmm1, xmm0
movups xmmword [esp + 0x40], xmm1
movups xmm0, xmmword [esi + 0x20]
movups xmm1, xmmword [esp + 0x50]
xorps xmm1, xmm0
movups xmmword [esp + 0x50], xmm1
push edi
push 0x100
push ebx
call fcn.0049a480
add esp, 0xc
mov dword [edi + 0xf4], fcn.0049aa10
mov dword [edi + 0xf8], 0
mov eax, 1
movsd xmm0, qword [esp + 0x50]
movsd xmm1, qword [esp + 0x58]
movsd qword [edi + 0xfc], xmm0
movsd qword [edi + 0x104], xmm1
mov dword [edi + 0x114], 0
mov dword [edi + 0x110], 1
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c3e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebp, dword [esp + 0x44]
xor eax, eax
cmp ebp, 0x30
ja 0x4c3f3e
mov eax, dword [ecx + 0x108]
mov edi, edx
mov esi, ecx
lea ebx, [ecx + 0xfc]
bswap eax
inc eax
bswap eax
mov dword [ecx + 0x108], eax
mov eax, esp
push ecx
push eax
push ebx
call dword [ecx + 0xf4]
add esp, 0xc
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esp + 0x10]
push esi
push eax
push ebx
call dword [esi + 0xf4]
add esp, 0xc
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esp + 0x20]
push esi
push eax
push ebx
call dword [esi + 0xf4]
add esp, 0xc
test ebp, ebp
je 0x4c3efc
xor eax, eax
cmp ebp, 0x1f
jbe 0x4c3ef0
mov eax, ebp
xor ecx, ecx
and eax, 0xffffffe0
nop word cs:[eax + eax]
nop dword [eax]
movups xmm0, xmmword [edi + ecx]
movups xmm2, xmmword [esp + ecx]
movups xmm1, xmmword [edi + ecx + 0x10]
movups xmm3, xmmword [esp + ecx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm1
movups xmmword [esp + ecx], xmm2
movups xmmword [esp + ecx + 0x10], xmm3
add ecx, 0x20
cmp eax, ecx
jne 0x4c3ec0
cmp eax, ebp
je 0x4c3efc
nop dword [eax]
movzx ecx, byte [edi + eax]
xor byte [esp + eax], cl
inc eax
cmp ebp, eax
jne 0x4c3ef0
push esi
push 0x100
lea eax, [esp + 8]
push eax
call fcn.0049a480
add esp, 0xc
mov dword [esi + 0xf4], fcn.0049aa10
mov dword [esi + 0xf8], 0
lea eax, [esp + 0x20]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov eax, 1
movsd qword [ebx], xmm0
movsd qword [ebx + 8], xmm1
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4dbc73
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
jne 0x4dbc86
jmp 0x4dbdba
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004fc178
cmp eax, 1
jne 0x4dbdb2
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea edx, [ebp - 0x4f]
mov ebx, 0x43
mov eax, 0
mov ecx, edx
and ecx, 1
test ecx, ecx
je 0x4dbcfe
mov byte [edx], al
add edx, 1
sub ebx, 1
mov ecx, edx
and ecx, 2
test ecx, ecx
je 0x4dbd10
mov word [edx], ax
add edx, 2
sub ebx, 2
mov ecx, ebx
shr ecx, 2
mov edi, edx
rep stosd dword es:[edi], eax
mov edx, edi
mov ecx, ebx
and ecx, 2
test ecx, ecx
je 0x4dbd2a
mov word [edx], ax
add edx, 2
and ebx, 1
mov ecx, ebx
test ecx, ecx
je 0x4dbd38
mov byte [edx], al
add edx, 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x4dbd68
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x4dbd7f
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x4dbd64
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x4dbd9d
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x4dcd46
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x4dcbbb
mov dword [esp], 0x5383a4
call fcn.004dc30d
mov eax, dword [0x5363e4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4dcd8d
mov eax, dword [ebp - 0x20]
jmp 0x4dced8
call fcn.004dbb7c
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x4dcda4
cmp dword [ebp - 0x20], 0
jne 0x4dcdae
mov eax, 0
jmp 0x4dced8
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004dbc73
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x4dce80
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x5363e4]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x4dced5
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4dcf9c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.004dcd46
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.004dcbde
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x4dcff5
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_longjmp
mov eax, dword [0x5363e4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4dd11f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x4dd087
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4dd044
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004dba90
mov dword [ebp - 0x10], 0
mov eax, dword [0x5363e4]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x4dd11f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4dd0b7
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x4dd11f
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004dba90
mov dword [ebp - 0x10], 0
mov eax, dword [0x5363e4]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax
Function at 0x4e2aa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [ebp + 8]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x4e2c4e
cmp byte [ebx], 0
je 0x4e2c18
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x4e2c30
test al, 0x10
je 0x4e2c18
lea edi, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, edi
mov dword [esp + 8], 0x104
mov dword [esp], edi
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__fullpath
mov edx, dword [ebx]
add ebx, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4e2b04
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [ebx + 2]
cmove ebx, edx
add al, al
sbb ebx, 3
sub ebx, edi
lea eax, [ebx + 0x233]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test eax, eax
mov esi, eax
je 0x4e2c3f
lea edx, [eax + 0x22c]
lea eax, [ebx + 1]
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [ebp - 0x12c], edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebp - 0x12c]
cmp byte [esi + 0x22c], 0
je 0x4e2b93
movzx eax, byte [esi + ebx + 0x22b]
cmp al, 0x2f
je 0x4e2b93
cmp al, 0x5c
je 0x4e2b93
mov edi, 0x5c
mov word [edx + ebx], di
mov eax, edx
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x4e2b95
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea ecx, [eax + 2]
cmove eax, ecx
add dl, dl
sbb eax, 3
mov edx, 0x2a
mov word [eax], dx
xor ecx, ecx
xor eax, eax
lea edx, [esi + 0x120]
xor ebx, ebx
mov word [esi + 0x11c], cx
mov edi, edx
mov ecx, 0x41
mov dword [esi + 0x224], 0xffffffff
mov dword [esi + 0x228], 0
mov dword [esi + 0x118], 0
mov word [esi + 0x11e], bx
rep stosd dword es:[edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0x14
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x4e2c10
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x4e2c10
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x4e2c10
Function at 0x4e76f0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
cmp byte [0x5383dc], 0
mov al, 1
je 0x4e7708
add esp, 0x190
ret
mov eax, esp
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
sete al
sete byte [0x5383dc]
add esp, 0x190
ret

Function at 0x4e77f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x88
mov eax, dword [ebp + 8]
lea ecx, [esp + 4]
mov dword [esp + 4], pe_nt_image_headers32
lea edx, [esp + 8]
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x4e7832
movzx eax, word [esp + 0xa]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov esp, ebp
pop ebp
ret

Function at 0x4e7870
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, 0xffffffff
call fcn.004e76f0
test al, al
je 0x4e793f
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [esp + 0xc], 0
lea edi, [esp + 0x30]
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x18], eax
push ecx
push 0x52496c
push 0x10
push edi
call fcn.00420780
add esp, 0x10
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push edi
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x4e7914
test eax, eax
je 0x4e7914
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp eax, 0xffffffff
mov eax, dword [esp + 0xc]
je 0x4e7926
push dword [eax + 0x10]
push dword [eax + 0x18]
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x4e7929
push dword [esp + 0xc]
jmp 0x4e791e
mov esi, 0xffffffff
test eax, eax
je 0x4e793f
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x4e793f
push eax
jmp 0x4e7934
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov esi, 0xffffffff
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret