joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a4d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x41a4f8
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x41a5f0
add esp, 0x14
pop ebx
pop esi
ret 0xc
cmp eax, 1
je 0x41a5c0
cmp eax, 3
jne 0x41a4e9
mov eax, dword [0x422064]
cmp eax, 0xffffffff
je 0x41a4e9
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41a4e9
test byte [eax + 0x20], 0x30
je 0x41a620
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41a53b
call sym.__pthread_cleanup_dest.part.0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x41a56d
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x41a55f
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
lea eax, [ebx + 0x38]
mov dword [esp], eax
call sym._pthread_spin_destroy
cmp eax, 1
je 0x41a6ee
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x41a6e2
mov eax, dword [0x422064]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x41a4e9
mov eax, dword [0x42eacc]
test eax, eax
je 0x41a60c
mov dword [esp + 4], sym._SetThreadName_VEH_4
mov dword [esp], 1
call eax
mov dword [0x42ead0], eax
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [0x42ead0]
test eax, eax
je 0x41a4e9
mov edx, dword [0x42eac8]
test edx, edx
je 0x41a60c
mov dword [esp], eax
call edx
mov dword [0x42ead0], 0
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x41a694
test eax, eax
je 0x41a63a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x41a657
call sym.__pthread_cleanup_dest.part.0
test byte [ebx + 0x24], 4
je 0x41a6d2
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41a56d
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], eax
call sym._pthread_mutex_destroy
lea eax, [ebx + 0x38]
jmp 0x41a57b
test eax, eax
je 0x41a6d2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call sym._pthread_mutex_destroy
lea eax, [ebx + 0x38]
mov dword [esp], eax
call sym._pthread_spin_destroy
cmp eax, 1
je 0x41a6ee
mov dword [ebx + 0x38], 0xffffffff
jmp 0x41a4e9
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
lea eax, [ebx + 0x38]
jmp 0x41a6b9
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x41a5a1
call sym._replace_spin_keys.part.0
lea esi, cs:[esi]
lea esi, cs:[esi]
Function at 0x41a9c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [0x42e0e8]
mov dword [esp + 0x2c], esi
mov esi, dword [esp + 0x54]
mov ebx, dword [esp + 0x50]
mov eax, dword [ebx]
test esi, esi
je 0x41ab00
cmp eax, 1
je 0x41aa1e
mov eax, ebx
call sym._enterOnceObject
lea edi, [eax + 4]
mov dword [esp + 0x1c], eax
mov dword [esp], edi
call sym._pthread_mutex_lock
mov ebp, dword [ebx]
test ebp, ebp
je 0x41aa40
cmp ebp, 1
jne 0x41aad0
mov dword [esp], edi
call sym._pthread_mutex_unlock
mov eax, dword [esp + 0x1c]
call sym._leaveOnceObject.part.0
xor eax, eax
mov edx, dword [esp + 0x2c]
sub edx, dword [0x42e0e8]
jne 0x41ab4a
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], sym.__pthread_once_cleanup
mov dword [esp + 0x24], eax
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x422064]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41ab38
mov eax, dword [eax + 0xc]
mov dword [esp + 0x28], eax
lock or dword [esp], 0
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x422064]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41ab20
lea ecx, [esp + 0x20]
mov dword [eax + 0xc], ecx
lock or dword [esp], 0
call esi
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x422064]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41ab10
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x41aa0d
mov dword [esp], 2
call dword [0x42204c]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call sym._fprintf
jmp 0x41aa0d
mov eax, 0x16
jmp 0x41aa20
call sym.___pthread_self_lite.part.0
test eax, eax
jne 0x41aaba
jmp 0x42156f
call sym.___pthread_self_lite.part.0
test eax, eax
jne 0x41aa96
jmp 0x421564
call sym.___pthread_self_lite.part.0
test eax, eax
jne 0x41aa70
jmp sym._pthread_once.cold
call dbg.__stack_chk_fail
nop
lea eax, [esp + 0x20]
mov dword [0], eax
ud2
mov eax, dword [esp + 0x28]
mov dword [0], eax
ud2

Function at 0x41ad90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x422064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41ae08
lea ebp, [ebx + 0x38]
xor edi, edi
mov dword [esp], ebp
call sym._pthread_spin_lock
mov eax, dword [ebx + 0x28]
cmp dword [esp + 0x30], eax
jae 0x41ade4
mov eax, dword [ebx + 0x30]
mov edx, dword [esp + 0x30]
cmp byte [eax + edx], 0
je 0x41ade4
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + edx*4]
mov dword [esp], ebp
call sym._pthread_spin_unlock
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call sym.___pthread_self_lite.part.0
mov ebx, eax
jmp 0x41adbb
Function at 0x41ae20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x422064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41af38
lea edi, [ebx + 0x38]
mov dword [esp], edi
call sym._pthread_spin_lock
mov edx, dword [ebx + 0x2c]
cmp esi, dword [ebx + 0x28]
jb 0x41af04
lea ebp, [esi + 1]
mov dword [esp], edx
lea eax, [ebp*4]
mov dword [esp + 4], eax
call sym._realloc
test eax, eax
je 0x41af44
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sym._realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x41af44
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebx + 0x28]
mov edx, dword [esp + 0x18]
mov ecx, ebp
mov dword [esp + 4], 0
sub ecx, eax
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sym._memset
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call sym._pthread_spin_unlock
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call sym.___pthread_self_lite.part.0
mov ebx, eax
jmp 0x41ae55
mov dword [esp], edi
call sym._pthread_spin_unlock
mov eax, 0xc
jmp 0x41af2c

Function at 0x41afe0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x422064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41b008
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call sym.___pthread_self_lite.part.0
test eax, eax
jne 0x41affd
add esp, 0x1c
ret

Function at 0x41b070
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x422064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41b098
add eax, 0xc
add esp, 0x1c
ret
call sym.___pthread_self_lite.part.0
test eax, eax
jne 0x41b08d
jmp 0x41b090
Function at 0x41b0d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41b0f2
call sym.__pthread_cleanup_dest.part.0
test byte [ebx + 0x20], 0x30
jne 0x41b10c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x422064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x41b14d
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x41b18d
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x41b142
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x41b156
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call sym._push_pthread_mem
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x422064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x41b14d
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41b1a1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x41b16e

Function at 0x41b1b0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x42eafc]
test eax, eax
jne 0x41b1c0
xor eax, eax
ret
sub esp, 0x1c
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x422064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41b200
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x41b1f0
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x41b1e4
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x41b1e6
call sym.___pthread_self_lite.part.0
test eax, eax
je 0x41b1e4
jmp 0x41b1dd

Function at 0x41b210
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x422064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41b250
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x41b240
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call sym.___pthread_self_lite.part.0
test eax, eax
jne 0x41b22d
add esp, 0x1c
ret
Function at 0x41b350
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x422064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41b3c0
test byte [ebx + 0x20], 0xc
jne 0x41b380
mov eax, dword [0x42eafc]
test eax, eax
jne 0x41b390
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call sym._pthread_mutex_lock
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x41b3b2
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x41b3b2
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x41b3d1
mov dword [esp], esi
call sym._pthread_mutex_unlock
add esp, 0x14
pop ebx
pop esi
ret
call sym.___pthread_self_lite.part.0
mov ebx, eax
test eax, eax
jne 0x41b371
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x41b3f1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call sym._pthread_mutex_unlock
call sym.__pthread_invoke_cancel
nop

Function at 0x41fb90
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [0x42e0e8]
mov dword [esp + 0x1c], eax
xor eax, eax
cmp byte [0x4220a8], 0
jne 0x41fcc1
mov byte [0x4220a8], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x41fc8f
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym.___cxa_demangle
mov dword [esp], 2
mov esi, dword [dbg.__acrt_iob_func]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sym._fwrite
mov edx, dword [esp + 0x18]
mov dword [esp], 2
test edx, edx
je 0x41fc7f
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x423399
call sym._fwrite
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4213bc
jmp 0x4213b4
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._fputs
jmp 0x41fc45
mov dword [esp], 2
call dword [0x42204c]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sym._fwrite
jmp 0x4213a3
mov dword [esp], 2
call dword [0x42204c]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sym._fwrite
mov eax, dword [esp + 0x1c]
sub eax, dword [0x42e0e8]
jne 0x41fcff
call sym._abort
call dbg.__stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x420720
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call sym.___cxa_get_globals
mov edx, dword [eax]
add dword [eax + 4], 1
test edx, edx
je sym.___cxa_rethrow.cold
mov ecx, dword [edx + 0x30]
mov ebx, dword [edx + 0x34]
mov esi, 1
add ecx, 0xbcd4d500
mov edi, ecx
adc ebx, 0xb8b1aabc
xor ecx, ecx
cmp esi, edi
sbb ecx, ebx
jae 0x420777
xor ecx, ecx
mov dword [eax], ecx
lea ebx, [edx + 0x30]
mov dword [esp], ebx
call sym.__Unwind_Resume_or_Rethrow
mov dword [esp], ebx
call sym.___cxa_begin_catch
jmp sym.___cxa_rethrow.cold
neg dword [edx + 0x14]
jmp 0x42075f

Function at 0x420fb0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x42e0e8]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 4], 0
mov dword [esp], 0x422098
call sym._pthread_mutex_init
mov dword [esp], str.GLIBCXX_TUNABLES
mov dword [0x42209c], 0
mov dword [0x4220a0], 0
mov dword [0x4220a4], 0
call sym._getenv
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], str.obj_size
mov ebx, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 9
mov dword [esp + 0x24], str.obj_count
mov dword [esp + 0x28], 0x40
test eax, eax
jne 0x421056
jmp 0x421127
mov dword [esp], ebx
mov dword [esp + 4], 0x3a
call sym._strchr
mov ebx, eax
test eax, eax
je 0x4210d0
xor eax, eax
cmp byte [ebx], 0x3a
sete al
add ebx, eax
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
xor eax, 0x62696c67
xor edx, 0x2e787863
or eax, edx
jne 0x421040
mov eax, dword [ebx + 7]
mov edx, dword [ebx + 0xb]
xor eax, 0x5f68652e
xor edx, 0x6c6f6f70
or eax, edx
jne 0x421040
cmp byte [ebx + 0xf], 0x2e
jne 0x421040
add ebx, 0x10
lea esi, [esp + 0x14]
lea ebp, [esp + 0x2c]
mov edi, dword [esi]
test edi, edi
je 0x4210b7
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov eax, dword [esi + 4]
mov dword [esp], eax
call sym._memcmp
test eax, eax
jne 0x4210c1
cmp byte [ebx + edi], 0x3d
je 0x421155
add esi, 0xc
cmp ebp, esi
jne 0x42109a
jmp 0x421040
mov eax, dword [esp + 0x28]
mov edx, 0x100
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [esp + 0x1c]
test eax, eax
cmove eax, ecx
add eax, 0x2c
imul eax, edx
lea ebx, [eax*4]
mov dword [0x4220a4], ebx
test ebx, ebx
jne 0x421136
mov dword [esp], sym.___tcf_0
call dbg.atexit
mov eax, dword [esp + 0x2c]
sub eax, dword [0x42e0e8]
jne 0x4211a0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0x4220a4], 0x3200
mov ebx, 0x3200
mov dword [esp], ebx
call sym._malloc
mov dword [0x4220a0], eax
test eax, eax
je 0x421193
xor edx, edx
mov dword [0x42209c], eax
mov dword [eax], ebx
mov dword [eax + 4], edx
jmp 0x421103
lea eax, [esp + 0x10]
xor ebp, ebp
mov dword [esp + 4], eax
lea eax, [ebx + edi + 1]
mov dword [esp + 8], ebp
mov dword [esp], eax
call sym._strtoul
mov ebx, dword [esp + 0x10]
movzx edx, byte [ebx]
cmp dl, 0x3a
je 0x421183
test dl, dl
jne 0x421040
test eax, eax
js 0x421040
mov dword [esi + 8], eax
jmp 0x421040
xor ecx, ecx
mov dword [0x4220a4], ecx
jmp 0x421103
call dbg.__stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x40bc60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x43c080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x43d55c]
mov eax, dword [0x43d558]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x1a], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x19], al
mov dword [ebp - 0x20], 0xf1eb513d
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
sub eax, 0xa511a83f
je 0x40bdd9
jmp 0x40bccd
mov eax, dword [ebp - 0x2c]
sub eax, 0xc6ea305f
je 0x40bdb9
jmp 0x40bce0
mov eax, dword [ebp - 0x2c]
sub eax, 0xd3cbe46f
je 0x40be1a
jmp 0x40bcf3
mov eax, dword [ebp - 0x2c]
sub eax, 0xf1eb513d
je 0x40bd31
jmp 0x40bd06
mov eax, dword [ebp - 0x2c]
sub eax, 0x691bb22
je 0x40bd57
jmp 0x40bd19
mov eax, dword [ebp - 0x2c]
sub eax, 0x2e23e2e0
je 0x40bdc5
jmp 0x40bd2c
jmp 0x40be29
mov al, byte [ebp - 0x1a]
mov cl, byte [ebp - 0x19]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd3cbe46f
mov ecx, 0x691bb22
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x20], eax
jmp 0x40be29
mov ecx, dword [ebp - 0x28]
push eax
mov eax, esp
mov dword [ebp - 0x18], eax
push eax
mov eax, esp
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [0x43d55c]
mov ecx, dword [0x43d558]
mov edx, eax
sub edx, 0x2c58fc98
sub edx, 1
add edx, 0x2c58fc98
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd3cbe46f
mov ecx, 0xc6ea305f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x20], eax
jmp 0x40be29
mov dword [ebp - 0x20], 0x2e23e2e0
jmp 0x40be29
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov dword [eax], ecx
mov dword [ebp - 0x20], 0xa511a83f
jmp 0x40be29
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
push ebx
pop ebx
nop
mov ebx, eax
xor ebx, 0x39
mov ecx, dword [edx]
mov edi, dword [esi]
not byte [edi]
push ebx
pop ebx
nop
mov ebx, eax
xor ebx, 0x39
add byte [edi], 0x47
sub byte [edi], 0x25
push ebx
pop ebx
nop
mov ebx, eax
xor ebx, 0x39
imul byte [edi]
inc edi
loop 0x40bdeb
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004256c0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x28]
push eax
mov eax, esp
mov dword [eax], ecx
mov dword [ebp - 0x20], 0x691bb22
jmp 0x40bcb7
Function at 0x41bc40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xcd287917
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
sub eax, 0xa80e2930
je 0x41bcbd
jmp 0x41bc6f
mov eax, dword [ebp - 0x18]
sub eax, 0xcd287917
je 0x41bc87
jmp 0x41bc82
jmp 0x41bce7
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
push eax
mov ecx, esp
mov dword [ebp - 8], edx
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0041ba30
add esp, 8
and al, 1
mov byte [ebp - 1], al
mov dword [ebp - 0xc], 0xa80e2930
jmp 0x41bce7
mov ah, byte [ebp - 1]
mov al, ah
xor al, 0xff
and al, 1
mov dl, 1
xor dl, 1
and ah, dl
mov cl, 1
xor cl, 1
and cl, 0xff
and dl, 1
or al, ah
or cl, dl
xor al, cl
and al, 1
movzx eax, al
mov esp, ebp
pop ebp
ret
jmp 0x41bc59

Function at 0x425fb8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x425ff7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x425ff7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x425ff7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x425ff7
cmp dword [ecx + 0x74], 0xe
jbe 0x425ff7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42d75b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42d7f8
push ebx
push esi
call fcn.0042d724
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042d6b8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42d7a5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42d7f7
push edi
push eax
call fcn.0042c1f0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42d7c5
call fcn.0042c23e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42d7f6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042d6b8
add esp, 0x20
test eax, eax
jne 0x42d7e4
push edi
call fcn.0042c23e
jmp 0x42d7ec
push ebx
call fcn.0042c23e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42ea07
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x437950
push 0x437948
push str.FlsAlloc
push 0x1f
call fcn.0042e8c6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42ea3b
push dword [ebp + 8]
mov ecx, esi
call dword [0x435144]
call esi
jmp 0x42ea41
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42ea85
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x437960
push 0x437958
push str.FlsGetValue
push 0x21
call fcn.0042e8c6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42eabc
push dword [ebp + 8]
mov ecx, esi
call dword [0x435144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42eac4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x437968
push 0x437960
push str.FlsSetValue
push 0x22
call fcn.0042e8c6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42eafe
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x435144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x433dd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x433dfd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x433dfd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret