joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62383c00
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6245f7c4
call sym._EnterCriticalSection_4
mov ebx, dword [0x6245f7bc]
sub esp, 4
test ebx, ebx
je 0x62383c4b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x62383c44
test esi, esi
je 0x62383c44
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x62383c20
mov dword [esp], 0x6245f7c4
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x62383e30
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], 0x6245300c
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x62383e80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x62383f54
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x62383ebe
cmp eax, 4
jne 0x62383ee0
test esi, esi
je 0x62383ed2
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x62383ec4
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x62383f1f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x62383f11
cmp ecx, 0x40
je 0x62383ed2
cmp ecx, 4
je 0x62383ed2
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.62383e30
lea esi, [esi]
Function at 0x623843f0
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x38
call sym._GetLastError_0
test eax, eax
jne 0x62384408
add esp, 0x38
pop ebx
ret
lea edx, [esp + 0x2c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1100
call sym._FormatMessageA_28
sub esp, 0x1c
test eax, eax
jne 0x62384458
call sym._IsDebuggerPresent_0
test eax, eax
je 0x623843ff
int3
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._OutputDebugStringA_4
sub esp, 4
mov dword [esp], ebx
call sym._OutputDebugStringA_4
sub esp, 4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._LocalFree_4
sub esp, 4
jmp 0x62384447

Function at 0x62384490
Capabilities:
Check mutex on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp + 8], 0x6245f844
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateMutexA_12
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
test eax, eax
jne 0x62384558
mov edx, dword [0x6245f800]
mov eax, dword [edx + 4]
test eax, eax
je 0x62384520
cmp edx, 0x6245f800
jne 0x62384505
mov dword [0x6245f800], eax
cmp eax, 0x6245f800
je 0x6238450c
lea esi, [esi]
test eax, eax
je 0x62384534
mov edx, dword [edx]
mov dword [eax], edx
mov edx, eax
mov eax, dword [edx + 4]
cmp eax, 0x6245f800
jne 0x623844f8
mov eax, dword [0x6245f804]
mov dword [edx + 4], eax
test eax, eax
je 0x62384534
mov edx, eax
jmp 0x62384502
mov dword [esp], 0x6245f880
call sym._FindAtomA_4
sub esp, 4
test ax, ax
jne 0x62384574
mov dword [esp], ebx
call sym._ReleaseMutex_4
sub esp, 4
mov dword [esp], ebx
call sym._CloseHandle_4
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
mov eax, 0x624530b8
call dbg.__eh_shmem_get_error
mov dword [esp], ebx
call sym._CloseHandle_4
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
movzx eax, ax
mov dword [esp], eax
call sym._DeleteAtom_4
sub esp, 4
jmp 0x62384534
Function at 0x62384590
Capabilities:
Check mutex on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call sym._GetCurrentProcessId_0
xor edx, edx
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + edx + 0x1c]
mov ecx, eax
and eax, 0xf
shr cl, 4
add eax, 0x61
add ecx, 0x41
mov byte [edx + edx + 0x6245f845], al
mov byte [edx + edx + 0x6245f844], cl
add edx, 1
cmp edx, 4
jne 0x623845a2
xor eax, eax
mov edx, 0x5f
jmp 0x623845df
movzx edx, byte [eax + str.__eh_shmem3_gcc_tdm_]
mov byte [eax + 0x6245f84c], dl
add eax, 1
cmp eax, 0x15
jne 0x623845d8
xor eax, eax
mov edx, 0x5f
jmp 0x62384607
movzx edx, byte [eax + str.__eh_shmem3_gcc_tdm_]
mov byte [eax + 0x6245f880], dl
add eax, 1
cmp eax, 0x14
jne 0x62384600
mov dword [esp + 8], 0x6245f844
mov dword [esp + 4], 0
mov dword [esp], 0
mov byte [0x6245f894], 0x2d
mov dword [0x6245f895], 0x61616161
mov dword [0x6245f899], 0x61616161
mov dword [0x6245f89d], 0x61616161
mov dword [0x6245f8a1], 0x61616161
mov dword [0x6245f8a5], 0x61616161
mov dword [0x6245f8a9], 0x61616161
mov dword [0x6245f8ad], 0x61616161
mov dword [0x6245f8b1], 0x61616161
mov byte [0x6245f8b5], 0
call sym._CreateMutexA_12
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov esi, eax
test eax, eax
jne 0x623847ea
mov dword [esp], 0x6245f880
call sym._FindAtomA_4
sub esp, 4
test ax, ax
jne 0x62384740
mov edx, 0x6245f800
mov eax, 0x20
nop
bt edx, eax
jae 0x623846e0
mov ecx, eax
neg ecx
mov byte [ecx + 0x6245f8b5], 0x41
sub eax, 1
jne 0x623846d0
mov dword [esp], 0x6245f880
call sym._AddAtomA_4
sub esp, 4
test ax, ax
je 0x623847d9
mov dword [esp], dbg.__eh_shmem3_gcc_tdm_cleanup_local_region
mov dword [0x6245f800], 0x6245f800
call sym.__onexit
mov dword [esp], ebx
call sym._ReleaseMutex_4
sub esp, 4
mov dword [esp], ebx
call sym._CloseHandle_4
mov eax, dword [0x6245f800]
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, ax
mov ebp, 0x20
mov edi, 1
mov dword [esp + 8], 0x36
mov dword [esp + 4], 0x6245f880
mov dword [esp], eax
call sym._GetAtomNameA_12
mov edx, eax
sub esp, 0xc
xor eax, eax
test edx, edx
je 0x62384809
lea esi, [esi]
cmp byte [eax + 0x6245f895], 0x41
jne 0x6238478b
mov ecx, ebp
mov edx, edi
sub ecx, eax
shl edx, cl
or esi, edx
add eax, 1
cmp eax, 0x20
jne 0x62384778
mov eax, esi
mov dword [0x6245f800], eax
jmp 0x623847ac
cmp edx, 0x6245f800
je 0x62384713
mov edx, eax
mov eax, dword [eax + 4]
test eax, eax
jne 0x623847a0
cmp edx, 0x6245f800
je 0x62384713
mov dword [edx + 4], 0x6245f800
mov dword [esp], dbg.__eh_shmem3_gcc_tdm_cleanup_local_region
call sym.__onexit
jmp 0x62384713
mov eax, 0x62453114
call dbg.__eh_shmem_get_error
xor eax, eax
jmp 0x6238472e
mov eax, 0x624530f0
call dbg.__eh_shmem_get_error
mov dword [esp], ebx
call sym._CloseHandle_4
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x62453138
call dbg.__eh_shmem_get_error
xor eax, eax
jmp 0x62384795
Function at 0x62388a20
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 8
mov eax, dword [0x6245f920]
test eax, eax
je 0x62388aa0
mov edx, dword [eax + 0x18]
test edx, edx
jne 0x62388ac0
mov dword [eax + 0x18], 0x6244b0e4
mov ebx, 0x6244b0e4
call sym._TlsAlloc_0
mov dword [ebx], eax
mov eax, dword [0x6245f920]
test eax, eax
je 0x62388a78
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x62388a98
mov dword [eax + 0x18], 0x6244b0e4
mov eax, 0x6244b0e4
cmp dword [eax], 0xffffffff
je sym._pthread_tls_init.cold
add esp, 8
pop ebx
ret
call sym.___shmem3_winpthreads_tdm_init_local_region
mov edx, eax
mov eax, dword [0x6245f920]
mov edx, dword [edx + 0x18]
test edx, edx
je 0x62388a5b
test eax, eax
jne 0x62388a98
call sym.___shmem3_winpthreads_tdm_init_local_region
lea esi, [esi]
mov eax, dword [eax + 0x18]
jmp 0x62388a67
call sym.___shmem3_winpthreads_tdm_init_local_region
mov ebx, dword [eax + 0x18]
mov eax, dword [0x6245f920]
test ebx, ebx
je 0x62388a38
test eax, eax
jne 0x62388ac0
call sym.___shmem3_winpthreads_tdm_init_local_region
lea esi, [esi]
mov ebx, dword [eax + 0x18]
jmp 0x62388a44

Function at 0x62388ad0
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push edi
xor eax, eax
mov ecx, 0x10
sub esp, 0x88
lea edi, [esp + 0x40]
mov dword [esp + 0x15], 0x6f727245
mov dword [esp + 0x19], 0x6c632072
mov dword [esp + 0x1d], 0x696e6165
mov dword [esp + 0x21], 0x7520676e
mov dword [esp + 0x25], 0x70732070
mov dword [esp + 0x29], 0x6b5f6e69
mov dword [esp + 0x2d], 0x20737965
mov dword [esp + 0x31], 0x20726f66
mov dword [esp + 0x35], 0x65726874
mov dword [esp + 0x39], 0x206461
mov dword [esp + 0x3d], 0
mov dword [esp + 0x7c], 0
rep stosd dword es:[edi], eax
call sym._GetCurrentThreadId_0
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.__ultoa
cmp byte [esp + 0x3c], 0
je 0x62388baa
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x62388b7d
cmp eax, 0x6a
je 0x62388b9a
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0x62388b78
cmp eax, 0x6a
je 0x62388b9a
add ecx, 2
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + ecx + 0x15], 0
mov dword [esp], edx
call sym._OutputDebugStringA_4
sub esp, 4
call sym._abort
mov ecx, 0x28
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x62388b90
Function at 0x6238bdb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x6238bdd2
call sym.__pthread_cleanup_dest.part.0
test byte [ebx + 0x20], 0x30
je 0x6238bf77
mov eax, dword [0x6245f920]
test eax, eax
je 0x6238be58
mov ebx, dword [eax + 0x18]
test ebx, ebx
jne 0x6238be78
mov dword [eax + 0x18], 0x6244b0e4
mov eax, 0x6244b0e4
mov eax, dword [eax]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6238be43
mov edx, dword [ebx + 0x14]
mov eax, dword [eax + 0x18]
test edx, edx
je 0x6238be80
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x6238be32
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [ebx + 0x18], 0
test byte [ebx + 0x24], 4
jne 0x6238bf28
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp sym.__endthreadex
call sym.___shmem3_winpthreads_tdm_init_local_region
mov ecx, dword [eax + 0x18]
mov eax, dword [0x6245f920]
test ecx, ecx
je 0x6238bdf0
test eax, eax
jne 0x6238be78
call sym.___shmem3_winpthreads_tdm_init_local_region
lea esi, [esi]
mov eax, dword [eax + 0x18]
jmp 0x6238bdfc
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x6238be95
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebx + 0xb0]
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], 0
test eax, eax
je 0x6238bf18
mov eax, dword [0x6245f920]
test eax, eax
je 0x6238bef0
mov edx, dword [eax + 0x18]
test edx, edx
jne 0x6238bf10
mov dword [eax + 0x18], 0x6244b0e4
mov eax, 0x6244b0e4
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp sym.__endthreadex
call sym.___shmem3_winpthreads_tdm_init_local_region
mov edx, eax
mov eax, dword [0x6245f920]
mov ebx, dword [edx + 0x18]
test ebx, ebx
je 0x6238beb9
test eax, eax
jne 0x6238bf10
call sym.___shmem3_winpthreads_tdm_init_local_region
lea esi, [esi]
mov eax, dword [eax + 0x18]
jmp 0x6238bec5
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x6238bea9
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call sym._CloseHandle_4
mov ecx, dword [ebx + 0xb0]
mov dword [ebx + 0x14], 0
sub esp, 4
test ecx, ecx
jne 0x6238bf54
mov eax, ebx
call sym._push_pthread_mem.part.0
mov eax, dword [0x6245f920]
test eax, eax
jne 0x6238beb2
call sym.___shmem3_winpthreads_tdm_init_local_region
mov eax, dword [eax + 0x18]
test eax, eax
mov eax, dword [0x6245f920]
jne 0x6238bf03
jmp 0x6238beb9
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
lea esi, [esi]
Function at 0x6238dbd0
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x38
call sym._GetLastError_0
test eax, eax
jne 0x6238dbe8
add esp, 0x38
pop ebx
ret
lea edx, [esp + 0x2c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1100
call sym._FormatMessageA_28
sub esp, 0x1c
test eax, eax
jne 0x6238dc38
call sym._IsDebuggerPresent_0
test eax, eax
je 0x6238dbdf
int3
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._OutputDebugStringA_4
sub esp, 4
mov dword [esp], ebx
call sym._OutputDebugStringA_4
sub esp, 4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._LocalFree_4
sub esp, 4
jmp 0x6238dc27

Function at 0x6238dc70
Capabilities:
Check mutex on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp + 8], 0x6245f980
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateMutexA_12
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
test eax, eax
jne 0x6238dd38
mov edx, dword [0x6245f920]
mov eax, dword [edx + 4]
test eax, eax
je 0x6238dd00
cmp edx, 0x6245f920
jne 0x6238dce5
mov dword [0x6245f920], eax
cmp eax, 0x6245f920
je 0x6238dcec
lea esi, [esi]
test eax, eax
je 0x6238dd14
mov edx, dword [edx]
mov dword [eax], edx
mov edx, eax
mov eax, dword [edx + 4]
cmp eax, 0x6245f920
jne 0x6238dcd8
mov eax, dword [0x6245f924]
mov dword [edx + 4], eax
test eax, eax
je 0x6238dd14
mov edx, eax
jmp 0x6238dce2
mov dword [esp], 0x6245f9c0
call sym._FindAtomA_4
sub esp, 4
test ax, ax
jne 0x6238dd54
mov dword [esp], ebx
call sym._ReleaseMutex_4
sub esp, 4
mov dword [esp], ebx
call sym._CloseHandle_4
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
mov eax, str.failed_to_to_lock_cleanup_mutex_n
call sym.___shmem_get_error
mov dword [esp], ebx
call sym._CloseHandle_4
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
movzx eax, ax
mov dword [esp], eax
call sym._DeleteAtom_4
sub esp, 4
jmp 0x6238dd14
Function at 0x6238dd70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call sym._GetCurrentProcessId_0
xor edx, edx
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + edx + 0x1c]
mov ecx, eax
and eax, 0xf
shr cl, 4
add eax, 0x61
add ecx, 0x41
mov byte [edx + edx + 0x6245f981], al
mov byte [edx + edx + 0x6245f980], cl
add edx, 1
cmp edx, 4
jne 0x6238dd82
xor eax, eax
mov edx, 0x5f
jmp 0x6238ddbf
movzx edx, byte [eax + str.__shmem3_winpthreads_tdm_]
mov byte [eax + 0x6245f988], dl
add eax, 1
cmp eax, 0x1a
jne 0x6238ddb8
xor eax, eax
mov edx, 0x5f
jmp 0x6238dde7
movzx edx, byte [eax + str.__shmem3_winpthreads_tdm_]
mov byte [eax + 0x6245f9c0], dl
add eax, 1
cmp eax, 0x19
jne 0x6238dde0
mov dword [esp + 8], 0x6245f980
mov dword [esp + 4], 0
mov dword [esp], 0
mov byte [0x6245f9d9], 0x2d
mov dword [0x6245f9da], 0x61616161
mov dword [0x6245f9de], 0x61616161
mov dword [0x6245f9e2], 0x61616161
mov dword [0x6245f9e6], 0x61616161
mov dword [0x6245f9ea], 0x61616161
mov dword [0x6245f9ee], 0x61616161
mov dword [0x6245f9f2], 0x61616161
mov dword [0x6245f9f6], 0x61616161
mov byte [0x6245f9fa], 0
call sym._CreateMutexA_12
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov esi, eax
test eax, eax
jne 0x6238dfca
mov dword [esp], 0x6245f9c0
call sym._FindAtomA_4
sub esp, 4
test ax, ax
jne 0x6238df20
mov edx, 0x6245f920
mov eax, 0x20
nop
bt edx, eax
jae 0x6238dec0
mov ecx, eax
neg ecx
mov byte [ecx + 0x6245f9fa], 0x41
sub eax, 1
jne 0x6238deb0
mov dword [esp], 0x6245f9c0
call sym._AddAtomA_4
sub esp, 4
test ax, ax
je 0x6238dfb9
mov dword [esp], sym.___shmem3_winpthreads_tdm_cleanup_local_region
mov dword [0x6245f920], 0x6245f920
call sym.__onexit
mov dword [esp], ebx
call sym._ReleaseMutex_4
sub esp, 4
mov dword [esp], ebx
call sym._CloseHandle_4
mov eax, dword [0x6245f920]
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, ax
mov ebp, 0x20
mov edi, 1
mov dword [esp + 8], 0x3b
mov dword [esp + 4], 0x6245f9c0
mov dword [esp], eax
call sym._GetAtomNameA_12
mov edx, eax
sub esp, 0xc
xor eax, eax
test edx, edx
je 0x6238dfe9
lea esi, [esi]
cmp byte [eax + 0x6245f9da], 0x41
jne 0x6238df6b
mov ecx, ebp
mov edx, edi
sub ecx, eax
shl edx, cl
or esi, edx
add eax, 1
cmp eax, 0x20
jne 0x6238df58
mov eax, esi
mov dword [0x6245f920], eax
jmp 0x6238df8c
cmp edx, 0x6245f920
je 0x6238def3
mov edx, eax
mov eax, dword [eax + 4]
test eax, eax
jne 0x6238df80
cmp edx, 0x6245f920
je 0x6238def3
mov dword [edx + 4], 0x6245f920
mov dword [esp], sym.___shmem3_winpthreads_tdm_cleanup_local_region
call sym.__onexit
jmp 0x6238def3
mov eax, str.failed_to_add_string_to_atom_table_n
call sym.___shmem_get_error
xor eax, eax
jmp 0x6238df0e
mov eax, str.failed_to_to_lock_creation_mutex_n
call sym.___shmem_get_error
mov dword [esp], ebx
call sym._CloseHandle_4
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, str.failed_to_get_string_from_atom_n
call sym.___shmem_get_error
xor eax, eax
jmp 0x6238df75
Function at 0x62397090
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x3c
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._setlocale
test eax, eax
je 0x62397164
mov dword [esp], eax
mov esi, eax
mov ebx, esp
call sym._strlen
lea edx, [eax + 1]
add eax, 0x10
shr eax, 4
shl eax, 4
call fcn.62384160
sub esp, eax
lea eax, [esp + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._memcpy
mov dword [esp + 4], 0x624539c4
mov dword [esp], 2
mov esi, eax
call sym._setlocale
mov dword [esp], esi
mov dword [esp + 4], eax
call sym._strcmp
test eax, eax
je 0x62397170
mov dword [esp + 4], esi
mov dword [esp], 2
call sym._setlocale
mov eax, esi
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call sym._strchr
test eax, eax
je 0x62397160
add eax, 1
mov dword [esp], eax
call sym._atoi
mov edi, eax
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], edi
call sym._GetCPInfo_8
sub esp, 8
test eax, eax
je 0x62397160
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x623971b0
xor edi, edi
mov esp, ebx
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.LC_ALL
call sym._getenv
test eax, eax
jne 0x62397122
mov dword [esp], str.LC_CTYPE
call sym._getenv
test eax, eax
jne 0x62397122
mov dword [esp], str.LANG
call sym._getenv
test eax, eax
jne 0x62397122
mov eax, esi
jmp 0x62397122
mov esp, ebx
jmp 0x62397164

Function at 0x6239bf50
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
mov ebx, ecx
sub esp, 0x14
mov eax, dword [ecx + 0x20]
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._fread
mov edx, 0xffffffff
test eax, eax
jle 0x6239bf88
movzx edx, byte [esi + eax - 1]
mov dword [ebx + 0x24], edx
add esp, 0x14
pop ebx
pop esi
ret 8

Function at 0x6239bfa0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [ecx + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._fwrite
add esp, 0x1c
ret 8
Function at 0x623a6e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
lea eax, [esp + 0x4c]
mov ebx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov dword [esp + 0x1c], 4
mov edi, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x80]
mov dword [esp], ebx
mov dword [esp + 0x18], 0x270f
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebp
mov dword [esp + 4], edx
mov dword [esp + 0x4c], 0
call sym.__ZNKSt7__cxx118time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE14_M_extract_numES4_S4_RiiijRSt8ios_baseRSt12_Ios_Iosta
sub esp, 0x28
mov ebx, eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x623a6f40
mov ecx, dword [esp + 0x48]
lea esi, [ecx + 0x64]
lea eax, [ecx - 0x76c]
test ecx, ecx
mov ecx, dword [esp + 0x88]
cmovs eax, esi
mov dword [ecx + 0x14], eax
cmp edx, 0xffffffff
sete al
test ebx, ebx
mov esi, eax
setne al
mov ecx, esi
and cl, al
mov byte [esp + 0x38], cl
jne 0x623a6f78
cmp ebp, 0xffffffff
sete al
test edi, edi
je 0x623a6f18
test al, al
jne 0x623a6f50
mov ebx, esi
cmp bl, al
jne 0x623a6f28
mov eax, dword [esp + 0x84]
or dword [eax], 2
mov eax, dword [esp + 0x34]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0x84]
or dword [eax], 4
jmp 0x623a6ef3
mov ebx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ebx
jb 0x623a6f18
mov eax, dword [edi]
mov dword [esp + 0x38], edx
mov ecx, edi
call dword [eax + 0x24]
mov edx, dword [esp + 0x38]
cmp eax, 0xffffffff
sete al
jmp 0x623a6f18
mov eax, dword [ebx + 0xc]
xor esi, esi
cmp dword [ebx + 8], eax
jb 0x623a6f0a
mov eax, dword [ebx]
mov dword [esp + 0x3c], edx
mov ecx, ebx
call dword [eax + 0x24]
mov edx, dword [esp + 0x3c]
cmp eax, 0xffffffff
movzx eax, byte [esp + 0x38]
cmove esi, eax
mov eax, 0
cmovne eax, ebx
mov dword [esp + 0x34], eax
jmp 0x623a6f0a