joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401290
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x40], str.WindowsApp
mov dword [ebp - 0x60], sym.__Z15WindowProcedureP6HWND__jjl_16
mov dword [ebp - 0x64], 8
mov dword [ebp - 0x68], 0x30
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [ebp - 0x50], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [ebp - 0x3c], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadCursorA
sub esp, 8
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 1
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sub.USER32.dll_RegisterClassExA
sub esp, 4
test ax, ax
jne 0x401344
mov dword [ebp - 0x6c], 0
jmp 0x401425
mov dword [esp + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x177
mov dword [esp + 0x18], 0x220
mov eax, 0x80000000
mov dword [esp + 0x14], eax
mov eax, 0x80000000
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xcf0000
mov dword [esp + 8], 0x40c00b
mov dword [esp + 4], str.WindowsApp
mov dword [esp], 0
call sub.USER32.dll_CreateWindowExA
sub esp, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x40d350
call method.CPlayer.init_HWND___
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_GetMessageA
sub esp, 0x10
test eax, eax
je 0x40141f
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_TranslateMessage
sub esp, 4
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_DispatchMessageA
sub esp, 4
jmp 0x4013d7
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
leave
ret 0x10

Function at 0x408e30
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x408e66
mov dword [0x4113b0], eax
mov edx, sym.get_globals_dtor_void_
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [0x40b020], eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x40b020], eax
leave
ret
Function at 0x408f50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], sym.___gxx_personality_sj0
mov dword [ebp - 0x24], 0x40ac40
mov dword [ebp - 0x1c], 0x409010
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call sym.__Unwind_SjLj_Register
cmp dword [0x40b020], 0
mov dword [ebp - 0x44], 0x4113c0
je 0x408ff0
jl 0x409030
mov dword [ebp - 0x3c], 1
mov eax, dword [0x4113b0]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x4090d3
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4113f0]
mov eax, 0xffffffff
test edx, edx
je 0x40904a
mov eax, dword [0x40b024]
test eax, eax
je 0x40908a
xor eax, eax
test eax, eax
jne 0x409080
mov edi, dword [0x40b020]
test edi, edi
js 0x409080
mov dword [ebp - 0x44], 0x4113c0
mov ebx, dword [0x40b020]
test ebx, ebx
je 0x408ff0
jmp 0x408f9e
xor esi, esi
mov dword [0x40b020], esi
jmp 0x409058
mov dword [esp], 0x40b028
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.dll_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x409111
mov eax, dword [0x40b024]
test eax, eax
jne 0x409048
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x40b024]
test eax, eax
je 0x4090ad
jmp 0x409048
mov dword [esp], 8
call sym._malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x409105
mov dword [esp + 4], eax
mov eax, dword [0x4113b0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x40913a
test edx, edx
je 0x409125
mov dword [ebp - 0x3c], 1
call method.std.terminate__
call sym.get_globals_init__
mov eax, 1
mov dword [0x40b024], eax
jmp 0x409048
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x408fe6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
jmp 0x409101
Function at 0x4093a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.0040a740
call sym.___main
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x4093d8
jmp 0x409476
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x4093d7
cmp cl, 0x22
je 0x409430
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x409450
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x409450
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x409410
jmp 0x409450
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x409430
cmp cl, 0x22
je 0x4094b2
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x409470
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x409460
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x409494
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x409450

Function at 0x409960
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x411450]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4099a0
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x409d50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x411450]
mov edi, dword [ebp + 8]
test eax, eax
je 0x409e2c
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x409e41
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x409e00
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x409d98
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x409da8
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x409df3
test edx, edx
jne 0x409de6
test ecx, ecx
je 0x409d90
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x409e50
cmp eax, 8
je 0x409d90
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x409d82
call sym.___w32_sharedptr_initialize
mov eax, dword [0x411450]
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x409d74
call sym._fc_key_init_once
mov eax, dword [0x411450]
jmp 0x409d74
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x409deb
mov eax, dword [0x411450]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x409ea3
mov edi, dword [eax + 0x30]
test edi, edi
js 0x409ece
mov esi, dword [eax + 0x30]
test esi, esi
jne 0x409eaf
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call sym.___w32_sharedptr_initialize
mov eax, dword [0x411450]
jmp 0x409e81
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x409e92
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x409e92
call sym._fc_key_init_once
mov eax, dword [0x411450]
jmp 0x409e88
Function at 0x409fd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov eax, dword [0x411450]
test eax, eax
je 0x40a030
mov esi, dword [eax + 0x30]
test esi, esi
js 0x40a050
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x40a070
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x40a0c0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sym.___w32_sharedptr_initialize
mov eax, dword [0x411450]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x409ff2
jmp 0x40a050
call sym._fc_key_init_once
mov eax, dword [0x411450]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x409ff9
jmp 0x40a070
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
sub esp, 4
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x40a021
lea esi, [esi]
mov eax, dword [0x411450]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40a10d
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x40a119
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x40a0ee
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40a0dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a0dd
call sym.___w32_sharedptr_initialize
mov eax, dword [0x411450]
jmp 0x40a0cc
call sym._fc_key_init_once
mov eax, dword [0x411450]
jmp 0x40a0d3
Function at 0x40a130
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x411450]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40a1c4
mov esi, dword [eax + 0x30]
test esi, esi
js 0x40a1e0
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x40a200
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x40a1b8
lea edx, [ebp - 0x14]
mov eax, edi
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x40a27f
mov eax, dword [0x411450]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40a256
mov edx, dword [eax + 0x30]
test edx, edx
js 0x40a270
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x40a230
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
jmp 0x40a175
call sym.___w32_sharedptr_initialize
mov eax, dword [0x411450]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x40a150
lea esi, [esi]
call sym._fc_key_init_once
mov eax, dword [0x411450]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x40a15b
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40a15e
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40a1a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a1a7
call sym.___w32_sharedptr_initialize
mov eax, dword [0x411450]
mov edx, dword [eax + 0x30]
test edx, edx
jns 0x40a199
nop
lea esi, [esi]
call sym._fc_key_init_once
mov eax, dword [0x411450]
jmp 0x40a199
call sym._abort
lea esi, [esi]
lea edi, [edi]
Function at 0x40a290
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x40a322
mov eax, dword [0x411450]
test eax, eax
je 0x40a316
mov ebx, dword [eax + 0x30]
test ebx, ebx
js 0x40a391
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x40a337
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x40a3af
mov eax, dword [0x411450]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40a382
mov edx, dword [eax + 0x30]
test edx, edx
js 0x40a3a0
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x40a363
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call sym.___w32_sharedptr_initialize
mov eax, dword [0x411450]
jmp 0x40a2b2
mov dword [esp], edi
call sym.__Unwind_SjLj_RaiseException
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40a2c7
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40a305
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a305
call sym.___w32_sharedptr_initialize
mov eax, dword [0x411450]
jmp 0x40a2f0
call sym._fc_key_init_once
mov eax, dword [0x411450]
jmp 0x40a2bd
call sym._fc_key_init_once
mov eax, dword [0x411450]
jmp 0x40a2fb
call sym._abort
lea esi, [esi]
lea edi, [edi]

Function at 0x40a560
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov edx, eax
je 0x40a590
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [esp + 4], eax
call sym.___mingwthr_key_dtor
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret

Function at 0x40ab90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x40699a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x4069d1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4069ab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x4069a6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x4069e4
pop edi
not eax
pop esi
ret 0xc

Function at 0x428d10
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x428d1b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x428e1e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x41ac28]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x41ac28]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x41ac28]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x41ac28]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x41ac28]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x41ac28]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x41ac28]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x41ac28]
xor eax, edx
inc ecx
dec edi
jne 0x428d36
pop edi
test esi, esi
je 0x428e40
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x41ac28]
xor eax, edx
inc ecx
dec esi
jne 0x428e22
pop esi
pop ebx
not eax
ret
Function at 0x70443630
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
mov esi, dword fs:[0x18]
sub esp, 0x28
mov edi, dword [ecx]
mov dword [esp + 8], 0x544
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x704436e4
mov dword [eax], 0x7045c740
mov ebx, eax
mov dword [eax + 0x540], 0
mov dword [esp], eax
call fcn.70444900
test eax, eax
js 0x704436b0
mov eax, dword [ebx]
mov dword [edi], ebx
mov dword [esp], ebx
call dword [eax + 4]
xor edx, edx
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 8], ebx
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
mov edx, 0x8007000e
jmp 0x704436a0
Function at 0x70445050
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
cmp dword [ebx + 8], 8
je 0x70445107
mov eax, dword [ebx + 0x52c]
test eax, eax
jne 0x70445100
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x524]
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_send]
sub esp, 0x10
cmp eax, 0xffffffff
je 0x704450c0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [esp + 0x3c]
xor eax, eax
add esp, 0x28
pop ebx
ret
test byte [0x7045a06c], 2
je 0x7044509f
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esp + 0xc], str.send_failed_with_error__d_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.InternetTransport_Write
mov dword [esp + 4], 0x7045a06c
mov dword [esp], 1
call fcn.704444d0
jmp 0x7044509f
mov eax, 0x800ccc0b
jmp 0x704450b8
mov eax, 0x800ccc05
jmp 0x704450b8

Function at 0x704451a0
Capabilities:
Initialize winsock library

Disassembly:
push edi
sub esp, 0x1d8
lea eax, [esp + 0x40]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.ws2_32.dll_WSAStartup]
mov edx, eax
sub esp, 8
xor eax, eax
test edx, edx
jne 0x704451fe
lea edx, [esp + 0x18]
mov ecx, 9
mov dword [esp + 0x3c], str.ThorConnWndClass
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x1e0]
mov dword [esp + 0x1c], 0x70444520
mov dword [esp], edx
mov dword [esp + 0x28], eax
call dword [sym.imp.user32.dll_RegisterClassW]
sub esp, 4
movzx eax, ax
add esp, 0x1d8
pop edi
ret

Function at 0x70446730
Capabilities:
Get process heap flags

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x30
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [eax], str._VDp
sub esp, 0xc
mov dword [eax + 4], 0
mov dword [0x70471004], eax
add eax, 8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, dword [0x70471004]
sub esp, 4
mov edx, dword [eax + 8]
mov dword [edx + 0x18], str.dlls_inetcomm_mimeintl.c:_global_internat.cs
lea edx, [eax + 0x20]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x20]
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [edx], eax
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 4]
xor eax, eax
sub esp, 4
add esp, 0x1c
ret