joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5089d4
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x508a0c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00506a61
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00506a39
jmp 0x508a18
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x50a0c6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x50a108
call fcn.0050fe44
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x50a108
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x50a0ff
xor eax, eax
jmp 0x50a110
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0050a116
pop edi
pop esi
pop ebx
ret 4

Function at 0x510374
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5103a2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5103c0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005102da
jmp 0x5103c0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5103c0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005102da
test edi, edi
mov eax, edi
jne 0x5103aa
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4082e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x44d1fc], 0
mov ebp, esp
push edi
mov ecx, dword [ebp + 0xc]
push esi
push ebx
mov ebx, dword [ebp + 0x10]
jne 0x408329
xor edx, edx
mov eax, edx
mov esi, 8
mov edi, eax
and eax, 1
neg eax
shr edi, 1
and eax, 0xedb88320
xor eax, edi
dec esi
jne 0x408306
mov dword [edx*4 + 0x44d1f8], eax
inc edx
cmp edx, 0x100
jne 0x4082ff
mov eax, dword [ebp + 8]
not eax
jmp 0x408343
mov dl, byte [ecx]
dec ebx
inc ecx
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x44d1f8]
test ebx, ebx
jne 0x408330
pop ebx
not eax
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x4011a7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, 0xbb40e64e
cmp dword [0x4010fc], eax
je 0x4011c9
cmp dword [0x4010fc], ebx
jne 0x401262
push esi
push eax
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4010fc
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x4010fc], esi
test esi, esi
jne 0x401238
mov dword [0x4010fc], ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
mov esi, 0x4010fc
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
push esi
call sub.KERNEL32.dll_WerRegisterMemoryBlock
mov eax, dword [0x4010fc]
not eax
mov dword [0x40300c], eax
pop esi
pop ebx
leave
ret
Function at 0x401550
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x401c18
call fcn.004018fb
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp dword [0x403390], ebx
jne 0x4012eb
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], ebx
mov edi, 0x403384
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x401325
cmp eax, esi
jne 0x401318
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x401328
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4012ff
xor esi, esi
inc esi
mov eax, dword [0x403380]
cmp eax, esi
jne 0x40133b
push 0x1f
call fcn.00572000
pop ecx
jmp 0x401376
mov eax, dword [0x403380]
test eax, eax
jne 0x401370
mov dword [0x403380], esi
push 0x4010e8
push 0x4010dc
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x401376
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x401490
mov dword [0x403038], esi
mov eax, dword [0x403380]
cmp eax, esi
jne 0x40139a
push 0x4010d8
push 0x4010d0
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x403380], 2
cmp dword [ebp - 0x24], ebx
jne 0x4013a7
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x403394], ebx
je 0x4013c8
push 0x403394
call fcn.00401833
pop ecx
test eax, eax
je 0x4013c8
push ebx
push 2
push ebx
call dword [0x403394]
mov eax, dword [sym.imp.MSVCR100.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x401421
cmp al, bl
je 0x4013e1
cmp dword [ebp - 0x1c], ebx
jne 0x401421
mov al, byte [esi]
cmp al, bl
je 0x4013f1
cmp al, 0x20
ja 0x4013f1
inc esi
mov dword [ebp - 0x20], esi
jmp 0x4013e1
test byte [ebp - 0x40], 1
je 0x4013fd
movzx eax, word [ebp - 0x3c]
jmp 0x401400
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x403034], eax
cmp dword [0x403028], ebx
jne 0x401476
push eax
call dword [sym.imp.MSVCR100.dll_exit]
cmp al, 0x22
jne 0x401430
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR100.dll__ismbblead]
pop ecx
test eax, eax
je 0x401443
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x4013cf
cmp dword [0x403038], ebx
jne 0x401484
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x403034]
call fcn.00401940
ret
call fcn.004011a7
jmp 0x4012bd
Function at 0x41ae50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x18]
mov dword [ebp + 0x18], 1
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], ebx
mov edx, dword [ebp + 0xc]
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], edi
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
mov esp, ebp
pop ebp
jmp fcn.0041a780
Function at 0x41d3d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [0x45b584]
test eax, eax
jne 0x41d3e6
add esp, 0x24
pop ebx
pop ebp
ret
xor eax, eax
mov ebx, 0x14
mov dword [esp + 4], eax
mov eax, dword [0x45b598]
mov dword [esp], eax
call sub.cygX11_6.dll_XBell
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov ecx, 1
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov dword [esp], str.dumping_stack_ring:_n
call sub.cygwin1.dll_fwrite
mov ebx, dword [0x45cbb4]
jmp 0x41d467
call sub.cygwin1.dll___getreent
mov edx, dword [ebx]
mov dword [esp + 0x14], edx
mov edx, dword [ebx + 0x20]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
mov edx, dword [ebx + 0x29c]
mov dword [esp + 8], edx
mov edx, str.____l_d_fw0x_08x_f0x_08x__s_n
mov dword [esp + 4], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call fcn.00451ea8
mov ebx, dword [ebx + 0x10]
cmp ebx, 0x45cba4
jne 0x41d430
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x41db40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
sub esp, 0x1c
cmp edx, 0x45cba4
mov ebx, eax
je 0x41dc83
cmp ebx, 0x45cba4
mov edi, ebx
je 0x41dc3d
cmp ebx, esi
je 0x41dc7b
cmp edi, esi
mov ecx, edi
mov ebx, 1
je 0x41db92
cmp edi, 0x45cba4
jmp 0x41db90
mov ecx, dword [ecx + 0x10]
inc ebx
cmp ecx, esi
je 0x41db92
cmp edi, 0x45cba4
jne 0x41db82
lea eax, [ebx + ebx*2 + 4]
mov dword [ebp - 0x10], eax
shl eax, 2
mov dword [esp], eax
call fcn.0044f760
mov dword [eax], 0xffffffff
mov esi, eax
mov ecx, edi
mov dword [eax + 4], 0x10000000
mov eax, dword [ebp - 0x10]
lea edx, [esi + 0x10]
test ebx, ebx
mov dword [esi + 8], eax
mov eax, dword [0x45b21c]
mov dword [esi + 0xc], eax
jmp 0x41dbe9
mov eax, dword [ecx + 0x18]
mov dword [edx], eax
mov eax, dword [ecx + 0x20]
add edx, 4
mov dword [edx], eax
add edx, 4
mov dword [edx], ecx
mov ecx, dword [ecx + 0x10]
add edx, 4
dec ebx
jne 0x41dbd0
xor ebx, ebx
cmp ebx, dword [0x45c5a0]
jl 0x41dc09
mov dword [esp], esi
call fcn.00451dd8
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0041d480
mov edi, dword [ebp - 0x10]
shl edi, 2
nop
mov dword [esp], ebx
inc ebx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
call fcn.0041b720
cmp ebx, dword [0x45c5a0]
jl 0x41dc10
mov dword [esp], esi
call fcn.00451dd8
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0041d480
mov edi, dword [0x45cbb4]
cmp edi, 0x45cba4
je 0x41dc7b
mov dword [esp + 0x10], edi
mov eax, dword [edi + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0x18]
mov dword [esp], 8
mov dword [esp + 8], eax
mov eax, 3
mov dword [esp + 4], eax
call fcn.0041bd70
cmp dword [edi + 0x10], esi
jne 0x41db67
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [0x45cbb8]
cmp esi, 0x45cba4
jne 0x41db59
jmp 0x41dc7b

Function at 0x41dca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov edx, dword [0x45cbb8]
mov ebp, esp
pop ebp
mov eax, dword [0x45cbb4]
jmp fcn.0041db40

Function at 0x41e560
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [esp + 0x10], ebx
mov eax, dword [ebx + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x18]
mov dword [esp], 0x10
mov dword [esp + 8], eax
mov eax, 3
mov dword [esp + 4], eax
call fcn.0041bd70
mov dword [esp], 1
xor eax, eax
mov edx, 1
mov dword [esp + 4], eax
mov eax, ebx
call fcn.0041de20
call fcn.00414cf0
add esp, 0x14
pop ebx
pop ebp
jmp fcn.0041d480

Function at 0x41e5c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [esp + 0x10], ebx
mov eax, dword [ebx + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x18]
mov dword [esp], 8
mov dword [esp + 8], eax
mov eax, 3
mov dword [esp + 4], eax
call fcn.0041bd70
mov dword [esp], 1
xor eax, eax
xor edx, edx
mov dword [esp + 4], eax
mov eax, ebx
call fcn.0041de20
call fcn.00414cf0
add esp, 0x14
pop ebx
pop ebp
jmp fcn.0041d480
Function at 0x41e850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
pop ebp
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
jmp fcn.0041db40
Function at 0x43a7d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov ecx, dword [0x45dec0]
cmp ecx, ebx
je 0x43a850
mov dword [0x45b3b8], ecx
mov eax, dword [0x45de90]
mov edx, 1
mov dword [0x45b3e8], ecx
mov dword [0x45b3d8], eax
mov eax, dword [0x45de94]
mov dword [0x45b3c8], eax
mov eax, ecx
call fcn.0043a510
mov dword [0x45dec0], ebx
mov eax, ebx
mov edx, 1
call fcn.0043a600
mov dword [esp], 2
mov eax, dword [0x45dec0]
mov edx, 1
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.0041bd70
add esp, 0x14
pop ebx
pop ebp
jmp fcn.0041dca0
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x43a9e0
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
test ebx, ebx
je 0x43aa40
movzx eax, byte [ebx + 0x5d]
shr al, 5
and eax, 1
jne 0x43aa30
test byte [ebx + 0x50], 1
jne 0x43aa40
mov edx, dword [0x45dec0]
cmp dword [ebx + 0x1e0], edx
je 0x43aa59
cmp edx, ecx
je 0x43aa46
mov dword [ebx + 0x1e0], ecx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], 0x40000000
add esp, 0x14
pop ebx
pop ebp
jmp fcn.0041bde0
test byte [ebx + 0x58], 8
je 0x43a9fd
lea esi, [esi]
lea edi, [edi]
add esp, 0x14
pop ebx
pop ebp
ret
mov dword [ebx + 0x1e0], ecx
test eax, eax
jne 0x43aa71
mov eax, ebx
call fcn.004389b0
jmp 0x43aa1b
mov dword [ebx + 0x1e0], ecx
call fcn.00413a60
cmp eax, ebx
je 0x43aa7b
mov eax, ebx
call fcn.00438880
jmp 0x43aa1b
mov dword [esp], ebx
call fcn.00424990
jmp 0x43aa50
mov dword [esp], 0
call fcn.00414ad0
jmp 0x43aa68
Function at 0x444a10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call sub.cygwin1.dll___getreent
mov edx, str.2.4.7
mov ecx, str._nFVWM_version__s_Usage:_n_n
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call fcn.00451ea8
call sub.cygwin1.dll___getreent
mov edx, dword [0x45ca80]
mov edx, dword [edx]
mov dword [esp + 8], edx
mov edx, str.___s___d_dpy____debug____f_config_file____cmd_config_cmd____s____version____h____replace____clientId_id____restore_file____visualId_id____visual_class__n_n
mov dword [esp + 4], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call fcn.00451ea8
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea esi, [esi]
Function at 0x44c970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], esi
xor esi, esi
test ebx, ebx
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
je 0x44c999
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.cygX11_6.dll_XLoadQueryFont
mov esi, eax
test esi, esi
sete al
xor edx, edx
test ebx, ebx
setne dl
test edx, eax
jne 0x44c9c0
test esi, esi
je 0x44c9df
mov eax, esi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sub.cygwin1.dll___getreent
mov dword [esp + 8], ebx
mov ebx, str._GetFontOrFixed_:_WARNING____cant_get_font__s__trying_fixed_n
mov dword [esp + 4], ebx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call fcn.00451ea8
jmp 0x44c9a9
mov dword [esp], edi
mov ecx, str.fixed
mov dword [esp + 4], ecx
call sub.cygX11_6.dll_XLoadQueryFont
test eax, eax
mov esi, eax
jne 0x44c9ad
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov edx, 0x32
mov dword [esp + 8], edx
mov dword [esp], str._GetFontOrFixed_:_ERROR____cant_get_font_fixed_n
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.cygwin1.dll_fwrite
jmp 0x44c9ad
Function at 0x44dd80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
xor ebx, ebx
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], esi
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0044dab0
mov dword [ebp - 0x10], eax
cmp ebx, esi
jg 0x44ddcc
lea esi, [esi]
lea edi, [edi]
mov eax, dword [edi + ebx*4]
test eax, eax
jne 0x44ddf0
inc ebx
cmp ebx, esi
jle 0x44ddc0
mov dword [esp], edi
call fcn.00451dd8
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00451dd8
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x44ddfb
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
inc ebx
call fcn.00451dd8
jmp 0x44ddc8
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp], 0x45a22c
mov dword [esp + 0xc], eax
mov eax, 0x19
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.cygwin1.dll_fwrite
xor eax, eax
jmp 0x44dde6

Function at 0x44f720
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], esi
mov esi, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 0xc], ebx
mov edx, str._s_of__d_bytes_failed._Exiting_n
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call fcn.00451ea8
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea esi, [esi]

Function at 0x44fbe0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0xffffffff
call sub.cygwin1.dll___errno
mov dword [eax], 4
mov ecx, 1
mov edx, 0x45bf44
mov dword [0x45bf40], ecx
xor eax, eax
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.cygwin1.dll_pthread_sigmask
mov dword [esp], 0x45be70
call sub.cygwin1.dll_setjmp
test eax, eax
jne 0x44fc48
mov eax, 1
mov dword [0x45be60], eax
mov eax, dword [0x45be58]
test eax, eax
je 0x44fc50
xor eax, eax
mov dword [0x45be60], eax
mov eax, dword [ebp - 4]
leave
ret
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_select
mov dword [ebp - 4], eax
xor eax, eax
mov dword [0x45be60], eax
jmp 0x44fc48
Function at 0x451520
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov edi, edx
mov dword [ebp - 0xc], ebx
mov dword [esp], eax
call fcn.0044f840
test eax, eax
mov esi, eax
je 0x4515d0
movzx eax, byte [eax]
cmp al, 0x24
sete al
movzx eax, al
lea ebx, [esi + eax]
cmp byte [ebx], 0x7b
je 0x4515b0
test edi, edi
jle 0x451566
mov dword [esp], esi
call sub.cygwin1.dll_strlen
cmp edi, eax
jb 0x451590
mov dword [esp], ebx
call sub.cygwin1.dll_getenv
test eax, eax
mov ebx, eax
je 0x4515a2
mov dword [esp], esi
call fcn.00451dd8
mov eax, ebx
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov byte [esi + edi], 0
mov dword [esp], ebx
call sub.cygwin1.dll_getenv
test eax, eax
mov ebx, eax
jne 0x451574
mov ebx, dword [0x453720]
jmp 0x451574
inc ebx
mov ecx, 0x7d
mov dword [esp + 4], ecx
mov dword [esp], ebx
call sub.cygwin1.dll_strchr
test eax, eax
je 0x451556
mov byte [eax], 0
jmp 0x451556
mov eax, dword [0x453720]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4527a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], esi
mov esi, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], edx
jne 0x4527c7
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2c]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x45288c
mov eax, dword [ebp - 0x18]
cmp eax, 0x40
je 0x452860
cmp eax, 4
je 0x452860
mov eax, dword [ebp - 0x20]
lea edi, [ebp - 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 0x30]
sub esp, 0x10
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00451d60
mov eax, dword [ebp - 0x18]
cmp eax, 0x40
je 0x4527ba
cmp eax, 4
je 0x4527ba
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x4527ba
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00451d60
mov eax, dword [ebp - 0x18]
cmp eax, 0x40
je 0x4527ba
cmp eax, 4
lea edi, [ebp - 0x10]
jne 0x45283a
jmp 0x4527ba
mov dword [esp + 8], esi
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00452410
lea esi, [esi]
lea edi, [edi]
Function at 0x401029
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call fcn.00410898
xor ebp, ebp
pop ecx
test eax, eax
je 0x401076
push str.Windows_original_main_args:_n
call fcn.00401108
pop ecx
mov esi, ebp
call fcn.00410604
cmp dword [eax], ebp
jle 0x401076
call fcn.0041060a
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00401108
add esp, 0xc
inc esi
call fcn.00410604
cmp esi, dword [eax]
jl 0x401054
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.00401213
call fcn.0040127b
mov ebx, eax
lea ecx, [ebx*4 + 4]
push ecx
call fcn.0040112b
pop ecx
pop ecx
mov esi, eax
call fcn.00401281
mov edx, ebp
test ebx, ebx
jle 0x4010b4
mov edi, esi
mov ecx, dword [eax + edx*8]
inc edx
mov dword [edi], ecx
lea edi, [edi + 4]
cmp edx, ebx
jl 0x4010a7
mov edi, dword [0x436004]
mov dword [esi + edx*4], ebp
test edi, edi
jne 0x4010c3
mov edi, dword [esi]
mov edx, dword [section..data]
test edx, edx
jne 0x4010cf
mov edx, dword [esi]
mov ecx, dword [0x436ae8]
test ecx, ecx
push ebp
push ebp
push 1
setne al
movzx eax, al
push eax
push edi
push edx
push 0x42927c
push 0x429280
push dword [0x436aec]
push 1
push ecx
push 1
push esi
push ebx
call fcn.00401d61
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x404c63
Capabilities:
Create thread

Disassembly:
push ecx
push ecx
push ebx
push esi
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push 0x10000
push dword [esp + 0x28]
mov dword [esp + 0x14], ebx
push dword [esp + 0x20]
push dword [esp + 0x28]
push ebx
call fcn.00416940
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x404caf
lea eax, [esp + 0xc]
push eax
push ebx
push dword [esp + 0x28]
push dword [esp + 0x20]
push dword [esp + 0x28]
push ebx
call fcn.00416940
add esp, 0x18
mov esi, eax
cmp dword [0x436020], ebx
je 0x404d56
push ebp
push edi
push str.J2D_D3D
call fcn.00410898
mov ebp, str.false
pop ecx
test eax, eax
je 0x404ce4
push ebp
push eax
call fcn.0041884c
neg eax
pop ecx
sbb eax, eax
and dword [0x436020], eax
pop ecx
push str.J2D_D3D_PRELOAD
call fcn.00410898
mov edi, eax
pop ecx
test edi, edi
je 0x404d10
push ebp
push edi
call fcn.0041884c
pop ecx
neg eax
pop ecx
sbb ecx, ecx
and ecx, dword [0x436020]
mov dword [0x436020], ecx
jmp 0x404d16
mov ecx, dword [0x436020]
test ecx, ecx
jns 0x404d47
mov dword [0x436020], ebx
test edi, edi
je 0x404d54
push str.true
push edi
call fcn.0041884c
xor edx, edx
pop ecx
inc edx
test eax, eax
pop ecx
mov ecx, dword [0x436020]
cmove ecx, edx
mov dword [0x436020], ecx
test ecx, ecx
je 0x404d54
push str.preloadD3D
call fcn.00404b14
pop ecx
pop edi
pop ebp
test esi, esi
je 0x404d78
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404d84
push dword [esp + 0x20]
call dword [esp + 0x18]
mov dword [esp + 8], eax
cmp dword [0x436b68], 0
pop esi
pop ebx
je 0x404d9a
mov eax, dword [0x436b84]
test eax, eax
je 0x404d9a
call eax
mov eax, dword [esp]
pop ecx
pop ecx
ret