joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4252f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
mov eax, dword [esp + 0xa4]
lea esi, [esp + 0x48]
mov edi, dword [esp + 0xa0]
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 4], esi
mov dword [esp + 0x58], 0
mov dword [esp], eax
mov dword [esp + 0x5c], 0
call sym._jq_parse
test eax, eax
mov ebx, eax
je 0x425350
add esp, 0x8c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x60]
mov dword [esp + 4], edi
mov dword [esp], eax
call dbg.jq_get_prog_origin
lea eax, [esp + 0x70]
mov dword [esp + 4], edi
mov dword [esp], eax
call dbg.jq_get_jq_origin
lea eax, [esp + 0x50]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x70]
mov dword [esp], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xc], eax
mov eax, edi
call dbg.process_dependencies
mov ebx, eax
call sym._gen_noop
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x5c]
or eax, dword [esp + 0x58]
mov dword [esp + 0x3c], edx
je 0x425447
xor ebp, ebp
xor esi, esi
xor edi, edi
mov eax, dword [esp + 0x50]
mov eax, dword [eax + ebp]
mov dword [esp], eax
call sym._free
test ebx, ebx
lea ecx, [ebp + ebp]
jne 0x42541f
mov eax, dword [esp + 0x54]
mov dword [esp + 0x34], ecx
mov edx, dword [eax + ebp*2 + 4]
mov eax, dword [eax + ebp*2]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._block_is_const
test eax, eax
mov ecx, dword [esp + 0x34]
je 0x4254c0
mov eax, dword [esp + 0x54]
mov edx, dword [eax + ecx + 4]
mov eax, dword [eax + ecx]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._block_free
add esi, 1
adc edi, 0
add ebp, 4
cmp dword [esp + 0x5c], edi
ja 0x4253e1
jae 0x4254b0
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call sym._free
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call sym._free
test ebx, ebx
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
jne 0x4254f4
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._block_join
mov dword [esp], eax
mov dword [esp + 4], edx
call dbg.block_drop_unreferenced
mov ecx, dword [esp + 0xa8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
add esp, 0x8c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [esp + 0x58], esi
ja 0x4253e1
jmp 0x425447
mov eax, dword [esp + 0x54]
mov edx, dword [eax + ecx + 4]
mov eax, dword [eax + ecx]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._block_join
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
jmp 0x425436
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._block_free
add esp, 0x8c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x425f70
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x44
mov dword [esp], 0x477895
mov ebx, dword [esp + 0x50]
call sym._getenv
test eax, eax
je 0x425fa0
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._jv_string
add esp, 0x44
mov eax, ebx
pop ebx
pop esi
ret
mov dword [esp], str.USERPROFILE
call sym._getenv
test eax, eax
jne 0x425f89
mov dword [esp], str.HOMEDRIVE
call sym._getenv
mov dword [esp], str.HOMEPATH
test eax, eax
mov esi, eax
mov eax, 0x477894
cmove esi, eax
call sym._getenv
test eax, eax
je 0x426020
lea edx, [esp + 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], str._s_s
mov dword [esp], edx
call dbg.jv_string_fmt
mov eax, dword [esp + 0x20]
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0xc], eax
add esp, 0x44
mov eax, ebx
pop ebx
pop esi
ret
lea eax, [esp + 0x30]
mov dword [esp + 4], str.Could_not_find_home_directory.
mov dword [esp], eax
call sym._jv_string
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x38]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x10], edx
call sym._jv_invalid_with_msg
jmp 0x425ff4
Function at 0x462350
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4cf560]
test esi, esi
jle 0x462460
mov edi, dword [0x4cf564]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x462384
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x462405
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x462370
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x462487
mov eax, dword [0x4cf564]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov edx, dword [0x4cf564]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x462467
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4623fe
sub eax, 4
and eax, 0xfffffffb
jne 0x462410
add dword [0x4cf560], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x4cf564]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4623fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
xor esi, esi
jmp 0x46238e
mov eax, dword [0x4cf564]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
mov esi, esi
lea edi, [edi]

Function at 0x4628c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4cf578
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4cf570]
sub esp, 4
test ebx, ebx
je 0x462915
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x46290e
test esi, esi
je 0x46290e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4628f0
mov dword [esp], 0x4cf578
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4672e0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x473398], eax
je 0x4672f7
add esp, 0xc
ret
call sym._abort
lea esi, [esi]
Function at 0x4677f0
Capabilities:
Print debug messages

Disassembly:
test eax, eax
je 0x467820
push edi
push esi
push ebx
mov ebx, eax
add esp, 0xffffff80
mov dword [esp], eax
call sym._pthread_spin_destroy
cmp eax, 1
je 0x467822
mov dword [ebx], 0xffffffff
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
ret
repz ret
lea ebx, [esp + 0x15]
mov esi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
xor eax, eax
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x3d]
mov ecx, 0x43
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
mov eax, 0x27
jne 0x467875
jmp 0x467892
cmp eax, 0x6a
je 0x467883
add eax, 1
cmp byte [ebx + eax], 0
jne 0x467870
cmp eax, 0x6a
jne 0x467892
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sym._abort
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + eax + 0x16], 0
jmp 0x467883

Function at 0x467930
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [0x4cf5e4], 1
je 0x467945
call sym.__pthread_once_raw.part.5.constprop.11
mov eax, dword [0x473398]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x467970
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._pop_pthread_mem
mov esi, eax
mov eax, dword [entry3]
test eax, eax
je 0x46795c
test esi, esi
je 0x46795c
mov dword [esi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x18], eax
lea eax, [esi + 0x38]
sub esp, 0x10
mov dword [esi + 0x1c], 0xffffffff
call sym._replace_spin_keys.constprop.10
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esi + 0x64], 0
mov dword [esi + 0x14], 0
call ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call ebx
lea edx, [esi + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebp
mov dword [esp + 0xc], edx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x467a72
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x6c], eax
movzx eax, byte [esi + 0x20]
sub esp, 4
mov dword [esi + 0x68], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [esi + 0x20], al
mov eax, dword [0x473398]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x467a72
add esp, 0x2c
mov ebx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._abort
mov esi, esi
lea edi, [edi]
Function at 0x467bb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x467be0
mov edi, dword [esp + 0x28]
test edi, edi
je 0x467c81
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x467cb0
cmp eax, 3
jne 0x467bca
mov eax, dword [0x473398]
cmp eax, 0xffffffff
je 0x467bca
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x467bca
test byte [eax + 0x20], 0x30
je 0x467cd2
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x467dd4
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x467c54
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x467c46
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
lea eax, [ebx + 0x38]
call sym._replace_spin_keys.constprop.10
mov esi, dword [ebx + 0xb0]
test esi, esi
jne 0x467d59
mov eax, ebx
call sym._push_pthread_mem.part.2
jmp 0x467d59
mov eax, dword [0x4cf5c0]
test eax, eax
je 0x467bca
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x4cf5c0], 0
sub esp, 4
jmp 0x467bca
mov dword [esp + 4], sym._SetThreadName_VEH_4
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x4cf5c0], eax
jmp 0x467bca
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x467d80
test eax, eax
je 0x467cf0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
jne 0x467db0
test byte [ebx + 0x24], 4
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
je 0x467dc0
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x467d35
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call sym._pthread_mutex_destroy
mov eax, esi
call sym._replace_spin_keys.constprop.10
mov ecx, dword [ebx + 0xb0]
test ecx, ecx
je 0x467c75
mov eax, dword [0x473398]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x467bca
test eax, eax
je 0x467d90
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call sym._pthread_mutex_destroy
lea eax, [ebx + 0x38]
call sym._replace_spin_keys.constprop.10
jmp 0x467bca
call sym.__pthread_cleanup_dest.part.8
jmp 0x467d0c
mov dword [esp], edi
call sym._pthread_mutex_destroy
mov eax, esi
call sym._replace_spin_keys.constprop.10
jmp 0x467bca
call sym.__pthread_cleanup_dest.part.8
jmp 0x467c22
Function at 0x467dea
Capabilities:
Set thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov eax, dword [ecx]
mov dword [esp], 0x473390
mov esi, eax
mov dword [ebp - 0x1c], eax
lea ebx, [esi + 0x1c]
call sym._pthread_mutex_lock
mov dword [esp], ebx
call sym._pthread_mutex_lock
cmp dword [0x4cf5e4], 1
je 0x467e20
call sym.__pthread_once_raw.part.5.constprop.11
mov esi, dword [ebp - 0x1c]
mov eax, dword [0x473398]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp], ebx
call sym._pthread_mutex_unlock
lea eax, [esi + 0x70]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym.__setjmp3
test eax, eax
je 0x467ef3
mov dword [esp], 0x473390
call sym._pthread_mutex_lock
mov esi, dword [ebp - 0x1c]
lea ebx, [esi + 0x1c]
mov dword [esp], ebx
call sym._pthread_mutex_lock
mov eax, esi
mov esi, dword [esi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x467e93
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
je 0x467f3d
mov dword [esp], ebx
call sym._pthread_mutex_unlock
mov dword [esp], ebx
call sym._pthread_mutex_destroy
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x1c], 0xffffffff
mov dword [eax + 0x68], 1
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x467eda
mov dword [esp], 0
call ebx
push eax
mov dword [esp], 0x473390
call sym._pthread_mutex_unlock
test eax, eax
je 0x467ed0
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov dword [esp], 0x473390
call sym._pthread_mutex_unlock
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
test eax, eax
je 0x467f88
mov edx, dword [edx + 4]
mov dword [esp], edx
call eax
mov ebx, eax
mov dword [esp], 0x473390
call sym._pthread_mutex_lock
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], ebx
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x467e6f
call sym.__pthread_cleanup_dest.part.8
jmp 0x467e6f
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0xdeadbeef
mov dword [esp], ebx
call sym._pthread_mutex_unlock
mov dword [esp], ebx
call sym._pthread_mutex_destroy
test edi, edi
je 0x467f6b
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xb0], 0
jne 0x467f6b
call sym._push_pthread_mem.part.2
mov eax, dword [0x473398]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x467ec8
mov ebx, pe_nt_image_headers32
jmp 0x467f13
Function at 0x468750
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x4687d2
test byte [ebx + 0x20], 0x30
jne 0x468786
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
mov eax, dword [0x473398]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
push edx
mov ebx, eax
je 0x4687c9
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x468816
test eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x68], 1
je 0x4687bc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x4687d9
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call sym.__pthread_cleanup_dest.part.8
jmp 0x46876d
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x14], 0
je 0x46883d
mov eax, dword [0x473398]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x4687c9
test eax, eax
mov dword [ebx], 0xdeadbeef
je 0x46882a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jne 0x4687fc
mov eax, ebx
call sym._push_pthread_mem.part.2
jmp 0x4687fc

Function at 0x46ba84
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [0x4cf03c]
mov ebx, dword [dbg.__acrt_iob_func]
mov dword [esp], 2
call ebx
mov dword [esp + 8], esi
mov dword [esp + 4], str.Use__s___help_for_help_with_command_line_options__n
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 2
call ebx
mov dword [esp + 8], 0x48
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.or_see_the_jq_manpage__or_online_docs__at_https:__stedolan.github.io_jq_n
call sym._fwrite
mov dword [esp], 2
call sym._exit
Function at 0x46bae7
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
mov ebx, eax
sub esp, 0x2c
mov ebp, dword [dbg.__acrt_iob_func]
mov dword [esp], 2
call ebp
test ebx, ebx
mov esi, eax
jne 0x46bb12
mov dword [esp], 1
call ebp
mov esi, eax
mov eax, dword [0x4cf03c]
mov dword [esp + 8], 0x4740c1
mov dword [esp + 4], str.jq___commandline_JSON_processor__version__s__n_nUsage:_t_s__options___jq_filter___file...__n_t_s__options____args__jq_filter___strings...__n_t_s__options____jsonargs__jq_filter___JSON_TEXTS...__n_njq_is_a_tool_for_processing_JSON_inputs__applying_the_given_filter_to_nits_JSON_text_inputs_and_producing_the_filters_results_as_JSON_on_nstandard_output._n_nThe_simplest_filter_is_.__which_copies_jqs_input_to_its_output_nunmodified__except_for_formatting__but_note_that_IEEE754_is_used_nfor_number_representation_internally__with_all_that_that_implies_._n_nFor_more_advanced_filters_see_the_jq_1__manpage___man_jq___nand_or_https:__stedolan.github.io_jq_n_nExample:_n_n_t__echo__foo_:_0__jq_._n_t_n_t_t_foo_:_0_n_t_n_n
mov dword [esp], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
call sym._fprintf
test edi, edi
mov ebp, eax
je 0x46bb5c
mov eax, dword [0x4cf03c]
mov dword [esp + 4], str.For_a_listing_of_options__use__s___help._n
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._fprintf
jmp 0x46bb7c
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x4a4
mov dword [esp + 4], 1
mov dword [esp], str.Some_of_the_options_include:_n___c_______________compact_instead_of_pretty_printed_output__n___n_______________use__null__as_the_single_input_value__n___e_______________set_the_exit_status_code_based_on_the_output__n___s_______________read__slurp__all_inputs_into_an_array__apply_filter_to_it__n___r_______________output_raw_strings__not_JSON_texts__n___R_______________read_raw_strings__not_JSON_texts__n___C_______________colorize_JSON__n___M_______________monochrome__dont_colorize_JSON___n___S_______________sort_keys_of_objects_on_output__n____tab____________use_tabs_for_indentation__n____arg_a_v________set_variable__a_to_value__v___n____argjson_a_v____set_variable__a_to_JSON_value__v___n____slurpfile_a_f__set_variable__a_to_an_array_of_JSON_texts_read_from__f___n____rawfile_a_f____set_variable__a_to_a_string_consisting_of_the_contents_of__f___n____args___________remaining_arguments_are_string_arguments__not_files__n____jsonargs_______remaining_arguments_are_JSON_arguments__not_files__n___________________terminates_argument_processing__n_nNamed_arguments_are_also_available_as__ARGS.named____while_npositional_arguments_are_available_as__ARGS.positional__._n_nSee_the_manpage_for_more_options._n
call sym._fwrite
test ebp, ebp
jns 0x46bb8a
test ebx, ebx
mov eax, 2
cmove ebx, eax
mov dword [esp], ebx
call sym._exit
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x46e0e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov dword [esp], 0x46f008
call sym.___emutls_get_address
mov edx, dword [eax]
test edx, edx
je 0x46e0fd
mov eax, dword [eax + 4]
mov dword [esp], eax
call edx
mov dword [esp], 2
call dword [0x473380]
mov dword [esp + 8], 0x1e
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.error:_cannot_allocate_memory_n
call sym._fwrite
call sym._abort
nop

Function at 0x46e160
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
nop
nop
nop
nop
nop
Function at 0x6d60d7d5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d616878]
jne 0x6d60d7df
repz ret
jmp fcn.6d60de74
Function at 0x1000f7ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1008c0d0]
jne 0x1000f7b6
repz ret
jmp fcn.1000fa5d