joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x40b750
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x71ed8be
or eax, ebp
cmp al, 0xfc
mov esi, 0xb071ed8
lds edi, [esp + edi*8]
cwde
xor dword [ecx + 0x76f84100], edi
jno 0x40b70f
hlt
push edi
scasb al, byte es:[edi]
mov ebx, 0xa0a12e0
sub ecx, edi
invalid
wait
insb byte es:[edi], dx
jo 0x40b7bc
mov byte [ebx], cl
invalid
lahf
sbb eax, 0x4846ddde
jp 0x40b70e
shr byte [ebx], 0x6b
adc dword [eax + 0x66], 0x25
mov al, byte [eax - 0x4c]
in eax, dx
inc ebx
push esp
les edi, [ebp + ecx*8 - 0x2b0600d3]
push ebx
pop es
lock or esp, dword [ebx - 0x42]
dec ebx
rcl dword [0x25706df2], 0x8d
push 0x2b
jbe 0x40b7e6
mov byte [ecx + 0xcb9c24d], bl
stosb byte es:[edi], al
xchg ebx, eax
aad 0x15
in al, dx
js 0x40b746
jmp 0x5b6acf1a
pop ss
sub bl, byte [ebx + 0x57]
jl 0x40b725
mov al, 0x41
fadd dword [ecx]
jmp 0x40b7b3
pop edx
push cs
add eax, 0x8da0d7ca
or bh, byte [ebx + ebx]
xchg ebx, eax
mov byte [0x3c072cea], al
inc eax
sbb edx, dword [ebx + 0x72ceaa2]
cmp al, 0x40
xor edx, dword [ebp + 0x3a]
in al, dx
dec edx
cmp byte [esi - 0x63699d4d], bl
xor al, byte [eax + 0x2d8de76c]
sti
xchg ecx, eax
call 0x5c7de08a
arpl word [eax + eax*2 + 0x56], dx
lea ebp, [0xaee891fb]
sub byte [0x4054635c], bh
push esi
or byte [edx + esi*2 + 4], 0x5d
jb 0x40b7e8
pop ebp
mov edi, ds
push ebp
fist word [ebp - 0x4b]
add dword [ecx], 0xf3eba93c
loope 0x40b78d
mov ch, 0x81
add dword [ecx + ebp*4], edi
jmp 0x40b7e2
sub dword [eax], esp
dec edx
js 0x40b7d3
dec ebx
push edi
inc ebx
movsd dword es:[edi], dword [esi]
scasd eax, dword es:[edi]
aas
aam 0x25
xchg ebx, eax
dec esp
retf 0x91b7
Function at 0x401390
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x40], str.WindowsApp
mov dword [ebp - 0x60], sym.__Z15WindowProcedureP6HWND__jjl_16
mov dword [ebp - 0x64], 8
mov dword [ebp - 0x68], 0x30
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [ebp - 0x50], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [ebp - 0x3c], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadCursorA
sub esp, 8
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 1
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sub.USER32.dll_RegisterClassExA
sub esp, 4
test ax, ax
jne 0x401444
mov dword [ebp - 0x6c], 0
jmp 0x401525
mov dword [esp + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x177
mov dword [esp + 0x18], 0x220
mov eax, 0x80000000
mov dword [esp + 0x14], eax
mov eax, 0x80000000
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xcf0000
mov dword [esp + 8], 0x44c00b
mov dword [esp + 4], str.WindowsApp
mov dword [esp], 0
call sub.USER32.dll_CreateWindowExA
sub esp, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x44f450
call method.CPlayer.init_HWND___
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_GetMessageA
sub esp, 0x10
test eax, eax
je 0x40151f
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_TranslateMessage
sub esp, 4
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_DispatchMessageA
sub esp, 4
jmp 0x4014d7
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
leave
ret 0x10

Function at 0x4134f0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x413526
mov dword [0x453b90], eax
mov edx, sym.get_globals_dtor_void_
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [0x44b050], eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x44b050], eax
leave
ret
Function at 0x413610
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], sym.___gxx_personality_sj0
mov dword [ebp - 0x24], 0x449c0c
mov dword [ebp - 0x1c], 0x4136d0
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call sym.__Unwind_SjLj_Register
cmp dword [0x44b050], 0
mov dword [ebp - 0x44], 0x453ba0
je 0x4136b0
jl 0x4136f0
mov dword [ebp - 0x3c], 1
mov eax, dword [0x453b90]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x413793
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x454170]
mov eax, 0xffffffff
test edx, edx
je 0x41370a
mov eax, dword [0x44b054]
test eax, eax
je 0x41374a
xor eax, eax
test eax, eax
jne 0x413740
mov edi, dword [0x44b050]
test edi, edi
js 0x413740
mov dword [ebp - 0x44], 0x453ba0
mov ebx, dword [0x44b050]
test ebx, ebx
je 0x4136b0
jmp 0x41365e
xor esi, esi
mov dword [0x44b050], esi
jmp 0x413718
mov dword [esp], 0x44b058
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.dll_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x4137d1
mov eax, dword [0x44b054]
test eax, eax
jne 0x413708
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x44b054]
test eax, eax
je 0x41376d
jmp 0x413708
mov dword [esp], 8
call sym._malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x4137c5
mov dword [esp + 4], eax
mov eax, dword [0x453b90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x4137fa
test edx, edx
je 0x4137e5
mov dword [ebp - 0x3c], 1
call method.std.terminate__
call sym.get_globals_init__
mov eax, 1
mov dword [0x44b054], eax
jmp 0x413708
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x4136a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
jmp 0x4137c1
Function at 0x414090
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call method.std::__basic_file_char_.fd__
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sym._read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x4140dc
call sym.__errno
cmp dword [eax], 4
je 0x4140b0
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x416f40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00418060
call sym.___main
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x416f78
jmp 0x417016
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x416f77
cmp cl, 0x22
je 0x416fd0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x416ff0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x416ff0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x416fb0
jmp 0x416ff0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x416fd0
cmp cl, 0x22
je 0x417052
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x417010
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x417000
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x417034
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x416ff0

Function at 0x417500
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x4541d0]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x417540
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x4178f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x4541d0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x4179cc
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x4179e1
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x4179a0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x417938
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x417948
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x417993
test edx, edx
jne 0x417986
test ecx, ecx
je 0x417930
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x4179f0
cmp eax, 8
je 0x417930
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x417922
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4541d0]
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x417914
call sym._fc_key_init_once
mov eax, dword [0x4541d0]
jmp 0x417914
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x41798b
mov eax, dword [0x4541d0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x417a43
mov edi, dword [eax + 0x30]
test edi, edi
js 0x417a6e
mov esi, dword [eax + 0x30]
test esi, esi
jne 0x417a4f
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4541d0]
jmp 0x417a21
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x417a32
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x417a32
call sym._fc_key_init_once
mov eax, dword [0x4541d0]
jmp 0x417a28
Function at 0x417b70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov eax, dword [0x4541d0]
test eax, eax
je 0x417bd0
mov esi, dword [eax + 0x30]
test esi, esi
js 0x417bf0
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x417c10
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x417c60
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4541d0]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x417b92
jmp 0x417bf0
call sym._fc_key_init_once
mov eax, dword [0x4541d0]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x417b99
jmp 0x417c10
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
sub esp, 4
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x417bc1
lea esi, [esi]
mov eax, dword [0x4541d0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x417cad
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x417cb9
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x417c8e
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x417c7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x417c7d
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4541d0]
jmp 0x417c6c
call sym._fc_key_init_once
mov eax, dword [0x4541d0]
jmp 0x417c73
Function at 0x417cd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x4541d0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x417d64
mov esi, dword [eax + 0x30]
test esi, esi
js 0x417d80
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x417da0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x417d58
lea edx, [ebp - 0x14]
mov eax, edi
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x417e1f
mov eax, dword [0x4541d0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x417df6
mov edx, dword [eax + 0x30]
test edx, edx
js 0x417e10
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x417dd0
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
jmp 0x417d15
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4541d0]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x417cf0
lea esi, [esi]
call sym._fc_key_init_once
mov eax, dword [0x4541d0]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x417cfb
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x417cfe
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x417d47
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x417d47
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4541d0]
mov edx, dword [eax + 0x30]
test edx, edx
jns 0x417d39
nop
lea esi, [esi]
call sym._fc_key_init_once
mov eax, dword [0x4541d0]
jmp 0x417d39
call sym._abort
lea esi, [esi]
lea edi, [edi]
Function at 0x417e30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x417ec2
mov eax, dword [0x4541d0]
test eax, eax
je 0x417eb6
mov ebx, dword [eax + 0x30]
test ebx, ebx
js 0x417f31
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x417ed7
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x417f4f
mov eax, dword [0x4541d0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x417f22
mov edx, dword [eax + 0x30]
test edx, edx
js 0x417f40
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x417f03
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4541d0]
jmp 0x417e52
mov dword [esp], edi
call sym.__Unwind_SjLj_RaiseException
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x417e67
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x417ea5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x417ea5
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4541d0]
jmp 0x417e90
call sym._fc_key_init_once
mov eax, dword [0x4541d0]
jmp 0x417e5d
call sym._fc_key_init_once
mov eax, dword [0x4541d0]
jmp 0x417e9b
call sym._abort
lea esi, [esi]
lea edi, [edi]

Function at 0x418130
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov edx, eax
je 0x418160
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [esp + 4], eax
call sym.___mingwthr_key_dtor
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret
Function at 0x41b060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init

Function at 0x41bd20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], esi
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sym._fread
test eax, eax
mov edx, eax
jle 0x41bd70
movzx eax, byte [esi + eax - 1]
mov dword [ebx + 0x24], eax
mov ebx, dword [ebp - 8]
mov eax, edx
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [ebx + 0x24], 0xffffffff
mov eax, edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x413820
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x413828
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x413a35
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [0x416350]
mov edx, dword [0x416348]
mov eax, 0x80000000
call fcn.00411ba8
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0040f77c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.0040352c
mov eax, dword [ebp - 0x18]
call fcn.00406e3c
cmp al, 1
jne 0x4138cf
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004130f0
push 0
mov ecx, dword [0x416354]
mov edx, dword [0x416348]
mov eax, 0x80000000
call fcn.00411ad8
push 0
mov ecx, dword [0x416350]
mov edx, dword [0x416348]
mov eax, 0x80000000
call fcn.00411ad8
push 0
mov ecx, dword [0x41634c]
mov edx, dword [0x416348]
mov eax, 0x80000000
call fcn.00411ad8
mov dl, 1
mov eax, dword [0x40b6fc]
call fcn.00402af4
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
call fcn.00411aa0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 8]
call fcn.00406edc
lea eax, [ebp - 0x24]
call fcn.00411aa0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xc]
call fcn.00406f38
mov eax, dword [ebp - 8]
call fcn.004036f0
mov edx, dword [ebp - 8]
cmp byte [edx + eax - 1], 0x5c
je 0x413928
lea eax, [ebp - 0x10]
mov ecx, 0x413a4c
mov edx, dword [ebp - 8]
call fcn.0040373c
jmp 0x413933
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040352c
mov edx, 0x413a58
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, 0x413a6c
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x413a7c
push dword [ebp - 0xc]
push 0x413a8c
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.004037b0
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x413a9c
push dword [ebp - 0xc]
push 0x413ab0
push 0x413abc
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.004037b0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, 0x413ad0
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor eax, eax
push ebp
push 0x413a01
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov ecx, 0x413af0
mov edx, dword [ebp - 0x10]
call fcn.0040373c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
push 0x413afc
mov eax, dword [ebp - 0x14]
call fcn.004038b4
push eax
push 0x413b00
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x413a0b
mov eax, dword [ebp - 4]
call fcn.00402b24
xor eax, eax
call fcn.004033f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413a3c
lea eax, [ebp - 0x2c]
mov edx, 0xa
call fcn.004034b8
ret