joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47edc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x1c
test eax, eax
je 0x47eee6
mov edx, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x2c]
push esi
push edi
mov edi, dword [esp + 0x30]
cmp eax, 4
jb 0x47ee03
mov esi, eax
shr esi, 2
mov ecx, dword [edi]
sub eax, 4
xor ecx, dword [ebx]
add edi, 4
mov dword [edx], ecx
add ebx, 4
add edx, 4
sub esi, 1
jne 0x47ede8
mov dword [esp + 0x38], eax
push ebp
xor ebp, ebp
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edi
test eax, eax
je 0x47eee2
cmp eax, 0x20
jb 0x47eebd
lea ecx, [ebx - 1]
lea esi, [edx - 1]
add ecx, eax
add esi, eax
cmp edx, ecx
ja 0x47ee35
cmp esi, ebx
jae 0x47eebd
lea ecx, [edi - 1]
add ecx, eax
cmp edx, ecx
ja 0x47ee42
cmp esi, edi
jae 0x47eebd
mov ecx, eax
lea esi, [edx + 0x10]
mov eax, edx
mov dword [esp + 0x18], esi
sub eax, ebx
mov esi, edi
mov dword [esp + 0x20], eax
and ecx, 0xffffffe0
sub esi, ebx
mov dword [esp + 0x28], ecx
mov eax, edi
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x20]
mov ecx, ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x24]
nop dword [eax]
movups xmm0, xmmword [ecx]
add ebp, 0x20
lea ecx, [ecx + 0x20]
lea esi, [esi + 0x20]
movups xmm1, xmmword [eax + ecx - 0x20]
pxor xmm1, xmm0
movups xmmword [edx + ecx - 0x20], xmm1
movups xmm1, xmmword [edi + esi - 0x20]
movups xmm0, xmmword [ecx - 0x10]
pxor xmm1, xmm0
movups xmmword [esi - 0x20], xmm1
cmp ebp, dword [esp + 0x28]
jb 0x47ee80
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
cmp ebp, eax
jae 0x47eee2
sub edi, ebx
lea esi, [ebx + ebp]
sub edx, ebx
sub eax, ebp
nop word [eax + eax]
mov cl, byte [esi + edi]
lea esi, [esi + 1]
xor cl, byte [esi - 1]
mov byte [esi + edx - 1], cl
sub eax, 1
jne 0x47eed0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x47eef0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
test eax, eax
je 0x47ef98
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
cmp eax, 4
jb 0x47ef22
mov edx, eax
shr edx, 2
mov ecx, dword [esi]
sub eax, 4
xor dword [edi], ecx
add esi, 4
add edi, 4
sub edx, 1
jne 0x47ef10
push ebx
xor ebx, ebx
test eax, eax
je 0x47ef95
cmp eax, 0x20
jb 0x47ef7c
lea ecx, [esi - 1]
lea edx, [edi - 1]
add ecx, eax
add edx, eax
cmp edi, ecx
ja 0x47ef40
cmp edx, esi
jae 0x47ef7c
push ebp
mov edx, eax
mov ebp, esi
and edx, 0xffffffe0
mov ecx, edi
sub ebp, edi
nop dword [eax]
movups xmm0, xmmword [ecx]
lea ecx, [ecx + 0x20]
movups xmm1, xmmword [ecx + ebp - 0x20]
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
movups xmm1, xmmword [esi + ebx + 0x10]
add ebx, 0x20
movups xmm0, xmmword [ecx - 0x10]
pxor xmm1, xmm0
movups xmmword [ecx - 0x10], xmm1
cmp ebx, edx
jb 0x47ef50
pop ebp
cmp ebx, eax
jae 0x47ef95
sub esi, edi
lea edx, [ebx + edi]
sub eax, ebx
mov cl, byte [edx + esi]
lea edx, [edx + 1]
xor byte [edx - 1], cl
sub eax, 1
jne 0x47ef87
pop ebx
pop edi
pop esi
ret

Function at 0x485530
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00485540
Function at 0x4fb4c1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
mov ebx, eax
sub esp, 0x1c
mov byte [eax + 0x38], 1
movzx edi, byte [eax + 0x3b]
mov dword [ebp - 0x1c], 0
dec edi
cmp esi, edi
jge 0x4fb5a2
movzx eax, byte [ebx + 0x3a]
lea eax, [esi + eax + 1]
cdq
idiv edi
imul eax, edx, 0x48
lea ecx, [ebx + eax + 0x40]
cmp dword [ebx + eax + 0x44], 0
mov dword [ebp - 0x1c], ecx
jne 0x4fb50f
imul edx, edx, 0x48
cmp dword [ebx + edx + 0x40], 0
je 0x4fb526
inc esi
jmp 0x4fb4de
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
call fcn.004ef8d1
mov edx, dword [ebp - 0x20]
test eax, eax
je 0x4fb502
jmp 0x4fb5ba
mov edx, dword [ebp - 0x1c]
lea ecx, [ebx + 0x40]
mov eax, dword [ebp - 0x1c]
lea esi, [ebx + 0x24]
sub edx, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x1c]
sar edx, 3
imul edx, edx, 0x38e38e39
lea edi, [ecx + 0x10]
mov ecx, 3
mov byte [ebx + 0x3a], dl
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x2c], 0
test eax, eax
je 0x4fb56f
mov dword [ebx + 0x28], eax
call fcn.00495c27
mov dword [ebx + 0x34], eax
jmp 0x4fb585
cmp dword [ebx + 0x28], 0
je 0x4fb585
mov eax, dword [ebx + 0x34]
cdq
call fcn.004ecb7d
mov dword [ebx + 0x28], eax
test eax, eax
je 0x4fb59b
mov ecx, dword [ebp - 0x1c]
add esp, 0x1c
mov edx, 0x4fb4a4
pop ebx
pop esi
mov eax, ecx
pop edi
pop ebp
jmp fcn.004ef734
mov eax, 7
jmp 0x4fb5ba
jne 0x4fb526
imul esi, esi, 0x48
add esp, 0x1c
lea edx, [ebx + 0x24]
lea eax, [ebx + esi + 0x40]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004fb31d
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x55a2b8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov byte [eax + 0x10], 1
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 4], str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov dword [esp], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
call fcn.00558929
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x55a31d
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov dword [esp], ebx
call fcn.00558929
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5665d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00580460
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00580460
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x566630
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x67d3d0]
test esi, esi
jle 0x566750
mov eax, dword [0x67d3d4]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x566664
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x5666e7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x566650
mov dword [esp], ebx
call fcn.00566f90
mov edi, eax
test eax, eax
je 0x566777
mov eax, dword [0x67d3d4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.005670d0
mov edx, dword [0x67d3d4]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x566757
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x5666e0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x5666f0
add dword [0x67d3d0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x67d3d4]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x5666e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.005665d0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x56666e
mov eax, dword [0x67d3d4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.005665d0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.005665d0
lea esi, [esi]
nop
Function at 0x566c10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x67d3ec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x67d3e4]
sub esp, 4
test ebx, ebx
je 0x566c65
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x566c5e
test esi, esi
je 0x566c5e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x566c40
mov dword [esp], 0x67d3ec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x566f90
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x566fb5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x566fc0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x566fb5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x567008
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x566ffe
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x56700a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x566ff0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x567bd0
Capabilities:
Print debug messages

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x34
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x567bf0
add esp, 0x34
pop ebx
pop esi
ret
lea edx, [esp + 0x2c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
sub esp, 0x1c
test eax, eax
jne 0x567c40
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x567be1
int3
mov eax, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esp], eax
call esi
sub esp, 4
mov dword [esp], ebx
call esi
sub esp, 4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
jmp 0x567c30
Function at 0x567d70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + edx + 0x1c]
mov ecx, eax
and eax, 0xf
shr cl, 4
add eax, 0x61
add ecx, 0x41
mov byte [edx + edx + 0x67d465], al
mov byte [edx + edx + 0x67d464], cl
add edx, 1
cmp edx, 4
jne 0x567d83
xor eax, eax
mov edx, 0x5f
jmp 0x567dbf
movzx edx, byte [eax + str.__eh_shmem3_gcc_tdm_]
mov byte [eax + 0x67d46c], dl
add eax, 1
cmp eax, 0x15
jne 0x567db8
xor eax, eax
mov edx, 0x5f
jmp 0x567de7
movzx edx, byte [eax + str.__eh_shmem3_gcc_tdm_]
mov byte [eax + 0x67d4a0], dl
add eax, 1
cmp eax, 0x14
jne 0x567de0
mov byte [0x67d4b4], 0x2d
mov dword [0x67d4b5], 0x61616161
mov dword [0x67d4b9], 0x61616161
mov dword [0x67d4bd], 0x61616161
mov dword [0x67d4c1], 0x61616161
mov dword [0x67d4c5], 0x61616161
mov dword [0x67d4c9], 0x61616161
mov dword [0x67d4cd], 0x61616161
mov dword [0x67d4d1], 0x61616161
mov byte [0x67d4d5], 0
mov dword [esp + 8], 0x67d464
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov esi, eax
test eax, eax
jne 0x567fda
mov dword [esp], 0x67d4a0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x567f30
mov edx, 0x67d420
mov eax, 0x20
lea esi, [esi]
lea esi, [esi]
bt edx, eax
jae 0x567ed0
mov ecx, eax
neg ecx
mov byte [ecx + 0x67d4d5], 0x41
sub eax, 1
jne 0x567ec0
mov dword [esp], 0x67d4a0
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x567fc9
mov dword [esp], 0x567c70
mov dword [0x67d420], 0x67d420
call sub.msvcrt.dll__onexit
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x67d420]
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, ax
mov ebp, 0x20
mov edi, 1
mov dword [esp + 8], 0x36
mov dword [esp + 4], 0x67d4a0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
mov edx, eax
sub esp, 0xc
xor eax, eax
test edx, edx
je 0x567ffa
lea esi, [esi]
cmp byte [eax + 0x67d4b5], 0x41
jne 0x567f7b
mov ecx, ebp
mov edx, edi
sub ecx, eax
shl edx, cl
or esi, edx
add eax, 1
cmp eax, 0x20
jne 0x567f68
mov eax, esi
mov dword [0x67d420], eax
jmp 0x567f9c
cmp edx, 0x67d420
je 0x567f04
mov edx, eax
mov eax, dword [eax + 4]
test eax, eax
jne 0x567f90
cmp edx, 0x67d420
je 0x567f04
mov dword [edx + 4], 0x67d420
mov dword [esp], 0x567c70
call sub.msvcrt.dll__onexit
jmp 0x567f04
mov eax, 0x67507c
call fcn.00567bd0
xor eax, eax
jmp 0x567f21
mov eax, 0x675058
call fcn.00567bd0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x6750a0
call fcn.00567bd0
xor eax, eax
jmp 0x567f85
Function at 0x56c230
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 8
mov eax, dword [0x67d540]
test eax, eax
je 0x56c2b8
mov edx, dword [eax + 0x18]
test edx, edx
jne 0x56c2e0
mov dword [eax + 0x18], 0x660d0c
mov ebx, 0x660d0c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx], eax
mov eax, dword [0x67d540]
test eax, eax
je 0x56c290
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x56c2b0
mov dword [eax + 0x18], 0x660d0c
mov eax, 0x660d0c
cmp dword [eax], 0xffffffff
je 0x65b7e0
add esp, 8
pop ebx
ret
call fcn.00571500
mov edx, eax
mov eax, dword [0x67d540]
mov edx, dword [edx + 0x18]
test edx, edx
je 0x56c26c
test eax, eax
jne 0x56c2b0
call fcn.00571500
lea esi, [esi]
mov eax, dword [eax + 0x18]
jmp 0x56c278
call fcn.00571500
mov ebx, dword [eax + 0x18]
mov eax, dword [0x67d540]
test ebx, ebx
je 0x56c248
test eax, eax
jne 0x56c2e0
call fcn.00571500
lea esi, [esi]
lea esi, [esi]
mov ebx, dword [eax + 0x18]
jmp 0x56c254
call sub.msvcrt.dll_abort

Function at 0x56c2f0
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push edi
xor eax, eax
mov ecx, 0x10
sub esp, 0x88
lea edi, [esp + 0x40]
mov dword [esp + 0x15], 0x6f727245
mov dword [esp + 0x19], 0x6c632072
mov dword [esp + 0x1d], 0x696e6165
mov dword [esp + 0x21], 0x7520676e
mov dword [esp + 0x25], 0x70732070
mov dword [esp + 0x29], 0x6b5f6e69
mov dword [esp + 0x2d], 0x20737965
mov dword [esp + 0x31], 0x20726f66
mov dword [esp + 0x35], 0x65726874
mov dword [esp + 0x39], 0x206461
mov dword [esp + 0x3d], 0
mov dword [esp + 0x7c], 0
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
je 0x56c3cb
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x56c39d
cmp eax, 0x6a
je 0x56c3ba
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0x56c398
cmp eax, 0x6a
je 0x56c3ba
add ecx, 2
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + ecx + 0x15], 0
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sub.msvcrt.dll_abort
mov ecx, 0x28
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x56c3b0
Function at 0x56f5a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.0056cdc0
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x56f5c2
call fcn.0056d2d0
test byte [ebx + 0x20], 0x30
je 0x56f639
mov eax, dword [0x67d540]
mov edx, eax
test eax, eax
je 0x56f6df
cmp dword [eax + 0x18], 0
jne 0x56f634
mov dword [eax + 0x18], 0x660d0c
mov eax, 0x660d0c
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x56f62b
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x56f64d
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x56f61e
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [ebx + 0x18], 0
test byte [ebx + 0x24], 4
jne 0x56f69f
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [edx + 0x18]
jmp 0x56f5e9
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x56f661
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov dword [ebx + 0x18], 0
mov eax, ebx
mov esi, dword [ebx + 4]
call fcn.0056cda0
mov eax, dword [0x67d540]
test eax, eax
je 0x56f721
cmp dword [eax + 0x18], 0
je 0x56f6d1
mov eax, dword [eax + 0x18]
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x56f62b
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
push edx
mov dword [ebx + 0x14], 0
call fcn.0056cda0
mov eax, dword [0x67d540]
mov edx, eax
test eax, eax
je 0x56f745
cmp dword [eax + 0x18], 0
jne 0x56f719
mov dword [eax + 0x18], 0x660d0c
mov eax, 0x660d0c
jmp 0x56f688
call fcn.00571500
cmp dword [eax + 0x18], 0
jne 0x56f6f4
mov eax, dword [0x67d540]
jmp 0x56f5dd
mov edx, dword [0x67d540]
test edx, edx
jne 0x56f634
call fcn.00571500
mov eax, dword [eax + 0x18]
jmp 0x56f5e9
mov edx, dword [0x67d540]
test edx, edx
je 0x56f73b
mov eax, dword [edx + 0x18]
jmp 0x56f688
call fcn.00571500
mov edx, eax
mov eax, dword [0x67d540]
cmp dword [edx + 0x18], 0
je 0x56f6d1
test eax, eax
jne 0x56f685
call fcn.00571500
jmp 0x56f685
call fcn.00571500
cmp dword [eax + 0x18], 0
jne 0x56f70f
mov eax, dword [0x67d540]
jmp 0x56f6d1
Function at 0x571360
Capabilities:
Print debug messages

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x34
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x571380
add esp, 0x34
pop ebx
pop esi
ret
lea edx, [esp + 0x2c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
sub esp, 0x1c
test eax, eax
jne 0x5713d0
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x571371
int3
mov eax, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esp], eax
call esi
sub esp, 4
mov dword [esp], ebx
call esi
sub esp, 4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
jmp 0x5713c0
Function at 0x571500
Capabilities:
Check mutex on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + edx + 0x1c]
mov ecx, eax
and eax, 0xf
shr cl, 4
add eax, 0x61
add ecx, 0x41
mov byte [edx + edx + 0x67d5a1], al
mov byte [edx + edx + 0x67d5a0], cl
add edx, 1
cmp edx, 4
jne 0x571513
xor eax, eax
mov edx, 0x5f
jmp 0x57154f
movzx edx, byte [eax + str.__shmem3_winpthreads_tdm_]
mov byte [eax + 0x67d5a8], dl
add eax, 1
cmp eax, 0x1a
jne 0x571548
xor eax, eax
mov edx, 0x5f
jmp 0x571577
movzx edx, byte [eax + str.__shmem3_winpthreads_tdm_]
mov byte [eax + 0x67d5e0], dl
add eax, 1
cmp eax, 0x19
jne 0x571570
mov byte [0x67d5f9], 0x2d
mov dword [0x67d5fa], 0x61616161
mov dword [0x67d5fe], 0x61616161
mov dword [0x67d602], 0x61616161
mov dword [0x67d606], 0x61616161
mov dword [0x67d60a], 0x61616161
mov dword [0x67d60e], 0x61616161
mov dword [0x67d612], 0x61616161
mov dword [0x67d616], 0x61616161
mov byte [0x67d61a], 0
mov dword [esp + 8], 0x67d5a0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov esi, eax
test eax, eax
jne 0x57176a
mov dword [esp], 0x67d5e0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x5716c0
mov edx, 0x67d540
mov eax, 0x20
lea esi, [esi]
lea esi, [esi]
bt edx, eax
jae 0x571660
mov ecx, eax
neg ecx
mov byte [ecx + 0x67d61a], 0x41
sub eax, 1
jne 0x571650
mov dword [esp], 0x67d5e0
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x571759
mov dword [esp], 0x571400
mov dword [0x67d540], 0x67d540
call sub.msvcrt.dll__onexit
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x67d540]
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, ax
mov ebp, 0x20
mov edi, 1
mov dword [esp + 8], 0x3b
mov dword [esp + 4], 0x67d5e0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
mov edx, eax
sub esp, 0xc
xor eax, eax
test edx, edx
je 0x57178a
lea esi, [esi]
cmp byte [eax + 0x67d5fa], 0x41
jne 0x57170b
mov ecx, ebp
mov edx, edi
sub ecx, eax
shl edx, cl
or esi, edx
add eax, 1
cmp eax, 0x20
jne 0x5716f8
mov eax, esi
mov dword [0x67d540], eax
jmp 0x57172c
cmp edx, 0x67d540
je 0x571694
mov edx, eax
mov eax, dword [eax + 4]
test eax, eax
jne 0x571720
cmp edx, 0x67d540
je 0x571694
mov dword [edx + 4], 0x67d540
mov dword [esp], 0x571400
call sub.msvcrt.dll__onexit
jmp 0x571694
mov eax, str.failed_to_add_string_to_atom_table_n
call fcn.00571360
xor eax, eax
jmp 0x5716b1
mov eax, str.failed_to_to_lock_creation_mutex_n
call fcn.00571360
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, str.failed_to_get_string_from_atom_n
call fcn.00571360
xor eax, eax
jmp 0x571715