joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50cd60
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.0050cad0
test eax, eax
jne 0x50cd78
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.AppID
push SysReAllocString
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x50ce10
mov esi, dword [ebp - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
push str.187621eb_d0b5_425f_9bb2_8db3e9c8cfa1
push esi
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x50cded
mov ebx, dword [ebp - 8]
push str.LocalService
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0
call fcn.0050cf90
mov edi, eax
test ebx, ebx
je 0x50cdfa
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
jmp 0x50ce00
push eax
call fcn.0050a060
add esp, 4
mov edi, eax
jmp 0x50ce00
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x50ce1b
push esi
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call fcn.0050a060
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50e260
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, ecx
cmp dword [edi + 0x260], 0
je 0x50e292
push 0
push 0
push 0
push 3
push 4
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x50e467
mov eax, dword [0x5311e0]
mov edx, dword [0x5311e4]
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, 1
cmp eax, edx
jae 0x50e31c
nop dword [eax + eax]
test esi, esi
js 0x50e463
mov ebx, dword [eax]
test ebx, ebx
je 0x50e312
mov ecx, dword [ebx + 8]
mov dword [ebp - 4], 0
test ecx, ecx
jne 0x50e2d0
xor esi, esi
jmp 0x50e312
lea eax, [ebp - 4]
push eax
push 0x527c20
push dword [ebx + 0xc]
call ecx
mov esi, eax
test esi, esi
js 0x50e2fc
mov eax, dword [ebx + 0x10]
add eax, 4
push eax
push 5
push 4
push dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
mov esi, eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x50e309
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov edx, dword [0x5311e4]
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
cmp eax, edx
jb 0x50e2b0
test esi, esi
js 0x50e463
jne 0x50e45f
cmp byte [edi + 0x3c], 0
je 0x50e3fe
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x50e3e7
lea eax, [ebp - 8]
push eax
push 0
push edi
push 0x50e1d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x50e379
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x30], ebx
test ebx, ebx
je 0x50e3e7
cmp dword [edi + 0x260], 0
je 0x50e3bc
mov edx, 4
lea ecx, [edi + 0x248]
mov eax, 2
lock cmpxchg dword [ecx], edx
cmp eax, 2
jne 0x50e3bc
push str.Service_started_resumed
push edi
call fcn.0050aa60
add esp, 8
lea eax, [edi + 0x244]
push eax
push dword [edi + 0x240]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x50e3de
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x50e449
mov ecx, edi
mov esi, 0x80004005
call fcn.0050e470
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x260], 0
je 0x50e441
mov edx, 4
lea ecx, [edi + 0x248]
mov eax, 2
lock cmpxchg dword [ecx], edx
cmp eax, 2
jne 0x50e441
push str.Service_started_resumed
push edi
call fcn.0050aa60
add esp, 8
lea eax, [edi + 0x244]
push eax
push dword [edi + 0x240]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x50e463
mov ecx, edi
call fcn.0050e470
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
mov byte [edi + 0x3c], 0
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x50e7e0
Capabilities:
Check if file exists
Modify service
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524a9d
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x53120c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0xf003f
push 0
push 0
mov dword [ebp - 0x44], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ecx, eax
mov dword [ebp - 0x58], ecx
test ecx, ecx
je 0x50eaf1
push 0xf01ff
lea eax, [esi + 0x40]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edx, eax
mov ecx, 0x14
mov dword [ebp - 0x40], edx
lea eax, [ebp - 0x78]
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x50e850
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x78]
push eax
push 2
push edx
mov dword [ebp - 0x24], 0xbb8
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0xbb8
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x78], 0x12c
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x6c], 3
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
call fcn.005048a0
mov ecx, eax
test ecx, ecx
je 0x50eb10
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0
call fcn.005048a0
mov ecx, eax
test ecx, ecx
je 0x50eb1a
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x30], edi
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 2
push eax
push 0x20019
push ebx
push str.SOFTWAREVAIO_CorporationVAIO_UWP_Update
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x50ea9a
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x38]
push ecx
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x54], eax
push ecx
push ebx
push str.InstalledDir
push eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x50ea8a
mov eax, dword [ebp - 0x48]
cmp eax, 1
je 0x50e94e
cmp eax, 2
jne 0x50ea8a
mov edx, dword [ebp - 0x38]
shr edx, 1
mov dword [ebp - 0x4c], edx
je 0x50ea8a
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
push 0x80004005
call fcn.005046e0
push 0x80004005
call fcn.005046e0
int3

Function at 0x50fb31
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x50fb70
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x50fb70
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x50fb70
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x50fb70
cmp dword [ecx + 0x74], 0xe
jbe 0x50fb70
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x519d1a
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x53120c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x519d65
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00519eb5
test al, al
jne 0x519d5f
sub edx, 2
cmp edx, edi
jne 0x519d45
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x519d87
lea eax, [edi + 2]
cmp edx, eax
je 0x519d87
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00519c66
add esp, 0x10
jmp 0x519e81
push esi
lea ecx, [ebp - 0x255]
call fcn.00519eb5
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x519dca
push dword [ebp - 0x25c]
jmp 0x519d77
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x519e07
cmp word [ebp - 0x226], 0
je 0x519e28
cmp word [ebp - 0x226], ax
jne 0x519e07
cmp word [ebp - 0x224], 0
je 0x519e28
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00519c66
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x519e74
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x519de1
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x519e5c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x519e81
push 0x519a96
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0051f3e0
add esp, 0x10
jmp 0x519e51
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050f225
leave
ret
Function at 0x51a9d6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x51aa73
push ebx
push esi
call fcn.0051a99f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0051a933
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x51aa20
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x51aa72
push edi
push eax
call fcn.00518433
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x51aa40
call fcn.005176db
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x51aa71
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0051a933
add esp, 0x20
test eax, eax
jne 0x51aa5f
push edi
call fcn.005176db
jmp 0x51aa67
push ebx
call fcn.005176db
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x51b0c2
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x52a320
push 0x52a318
push str.FlsAlloc
push 0x1f
call fcn.0051af81
mov esi, eax
add esp, 0x10
test esi, esi
je 0x51b0f6
push dword [ebp + 8]
mov ecx, esi
call dword [0x52527c]
call esi
jmp 0x51b0fc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x51b140
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x52a330
push 0x52a328
push str.FlsGetValue
push 0x21
call fcn.0051af81
mov esi, eax
add esp, 0x10
test esi, esi
je 0x51b177
push dword [ebp + 8]
mov ecx, esi
call dword [0x52527c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x51b17f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x52a338
push 0x52a330
push str.FlsSetValue
push 0x22
call fcn.0051af81
mov esi, eax
add esp, 0x10
test esi, esi
je 0x51b1b9
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x52527c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x523860
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x52388d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x52388d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40a2b0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [esp + 0x70]
test ebx, ebx
je 0x40a430
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000080
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov eax, dword [esp + 0x74]
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
je 0x40a420
mov dword [esp], ebx
call sym._GlobalLock_4
push ebp
mov esi, eax
test eax, eax
je 0x40a444
cmp dword [eax], 0x28
je 0x40a344
mov dword [esp], ebx
call sym._GlobalUnlock_4
push ebx
mov dword [esp], edi
call sym._CloseHandle_4
push esi
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov word [esp + 0x42], 0x4d42
mov dword [esp], eax
call sym.PaletteSize_char_
movzx ebp, ax
add ebp, 0x28
mov eax, dword [esi + 0x10]
dec eax
cmp eax, 1
jbe 0x40a454
mov edx, dword [esi + 8]
shl edx, 2
movzx eax, word [esi + 0xe]
imul eax, dword [esi + 4]
add eax, 0x1f
shr eax, 5
imul edx, eax
add ebp, edx
mov dword [esi + 0x14], edx
lea eax, [ebp + 0xe]
mov dword [esp + 0x44], eax
mov word [esp + 0x48], 0
mov word [esp + 0x4a], 0
mov edx, dword [esi]
mov dword [esp], esi
mov dword [esp + 0x2c], edx
call sym.PaletteSize_char_
movzx eax, ax
mov edx, dword [esp + 0x2c]
lea eax, [edx + eax + 0xe]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x10], 0
lea edx, [esp + 0x3c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0xe
lea eax, [esp + 0x42]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 0x2c], edx
call sym._WriteFile_20
sub esp, 0x14
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], edi
call sym._WriteFile_20
sub esp, 0x14
mov dword [esp], ebx
call sym._GlobalUnlock_4
push eax
mov dword [esp], edi
call sym._CloseHandle_4
push edx
mov ecx, dword [esp + 0x3c]
test ecx, ecx
jne 0x40a440
mov eax, 4
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x14
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x40a425
mov dword [esp], edi
call sym._CloseHandle_4
push edi
mov eax, 3
jmp 0x40a425
add ebp, dword [esi + 0x14]
jmp 0x40a382
Function at 0x4315b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x4f3890
call sym._EnterCriticalSection_4
mov ebx, dword [0x4f3888]
sub esp, 4
test ebx, ebx
je 0x4315fb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4315f4
test esi, esi
je 0x4315f4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4315d0
mov dword [esp], 0x4f3890
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4317e0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x431830
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x431904
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x43186e
cmp eax, 4
jne 0x431890
test esi, esi
je 0x431882
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x431874
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x4318cf
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x4318c1
cmp ecx, 0x40
je 0x431882
cmp ecx, 4
je 0x431882
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004317e0
lea esi, [esi]
Function at 0x431da0
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x38
call sym._GetLastError_0
test eax, eax
jne 0x431db8
add esp, 0x38
pop ebx
ret
lea edx, [esp + 0x2c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1100
call sym._FormatMessageA_28
sub esp, 0x1c
test eax, eax
jne 0x431e08
call sym._IsDebuggerPresent_0
test eax, eax
je 0x431daf
int3
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._OutputDebugStringA_4
sub esp, 4
mov dword [esp], ebx
call sym._OutputDebugStringA_4
sub esp, 4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._LocalFree_4
sub esp, 4
jmp 0x431df7

Function at 0x431e40
Capabilities:
Check mutex on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp + 8], 0x4f3904
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateMutexA_12
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
test eax, eax
jne 0x431f08
mov edx, dword [0x4f38c0]
mov eax, dword [edx + 4]
test eax, eax
je 0x431ed0
cmp edx, 0x4f38c0
jne 0x431eb5
mov dword [0x4f38c0], eax
cmp eax, 0x4f38c0
je 0x431ebc
lea esi, [esi]
test eax, eax
je 0x431ee4
mov edx, dword [edx]
mov dword [eax], edx
mov edx, eax
mov eax, dword [edx + 4]
cmp eax, 0x4f38c0
jne 0x431ea8
mov eax, dword [0x4f38c4]
mov dword [edx + 4], eax
test eax, eax
je 0x431ee4
mov edx, eax
jmp 0x431eb2
mov dword [esp], 0x4f3940
call sym._FindAtomA_4
sub esp, 4
test ax, ax
jne 0x431f24
mov dword [esp], ebx
call sym._ReleaseMutex_4
sub esp, 4
mov dword [esp], ebx
call sym._CloseHandle_4
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
mov eax, 0x4e3ea8
call dbg.__eh_shmem_get_error
mov dword [esp], ebx
call sym._CloseHandle_4
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
movzx eax, ax
mov dword [esp], eax
call sym._DeleteAtom_4
sub esp, 4
jmp 0x431ee4
Function at 0x431f40
Capabilities:
Check mutex on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call sym._GetCurrentProcessId_0
xor edx, edx
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + edx + 0x1c]
mov ecx, eax
and eax, 0xf
shr cl, 4
add eax, 0x61
add ecx, 0x41
mov byte [edx + edx + 0x4f3905], al
mov byte [edx + edx + 0x4f3904], cl
add edx, 1
cmp edx, 4
jne 0x431f52
xor eax, eax
mov edx, 0x5f
jmp 0x431f8f
movzx edx, byte [eax + str.__eh_shmem3_gcc_tdm_]
mov byte [eax + 0x4f390c], dl
add eax, 1
cmp eax, 0x15
jne 0x431f88
xor eax, eax
mov edx, 0x5f
jmp 0x431fb7
movzx edx, byte [eax + str.__eh_shmem3_gcc_tdm_]
mov byte [eax + 0x4f3940], dl
add eax, 1
cmp eax, 0x14
jne 0x431fb0
mov dword [esp + 8], 0x4f3904
mov dword [esp + 4], 0
mov dword [esp], 0
mov byte [0x4f3954], 0x2d
mov dword [0x4f3955], 0x61616161
mov dword [0x4f3959], 0x61616161
mov dword [0x4f395d], 0x61616161
mov dword [0x4f3961], 0x61616161
mov dword [0x4f3965], 0x61616161
mov dword [0x4f3969], 0x61616161
mov dword [0x4f396d], 0x61616161
mov dword [0x4f3971], 0x61616161
mov byte [0x4f3975], 0
call sym._CreateMutexA_12
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov esi, eax
test eax, eax
jne 0x43219a
mov dword [esp], 0x4f3940
call sym._FindAtomA_4
sub esp, 4
test ax, ax
jne 0x4320f0
mov edx, 0x4f38c0
mov eax, 0x20
nop
bt edx, eax
jae 0x432090
mov ecx, eax
neg ecx
mov byte [ecx + 0x4f3975], 0x41
sub eax, 1
jne 0x432080
mov dword [esp], 0x4f3940
call sym._AddAtomA_4
sub esp, 4
test ax, ax
je 0x432189
mov dword [esp], dbg.__eh_shmem3_gcc_tdm_cleanup_local_region
mov dword [0x4f38c0], 0x4f38c0
call sym.__onexit
mov dword [esp], ebx
call sym._ReleaseMutex_4
sub esp, 4
mov dword [esp], ebx
call sym._CloseHandle_4
mov eax, dword [0x4f38c0]
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, ax
mov ebp, 0x20
mov edi, 1
mov dword [esp + 8], 0x36
mov dword [esp + 4], 0x4f3940
mov dword [esp], eax
call sym._GetAtomNameA_12
mov edx, eax
sub esp, 0xc
xor eax, eax
test edx, edx
je 0x4321b9
lea esi, [esi]
cmp byte [eax + 0x4f3955], 0x41
jne 0x43213b
mov ecx, ebp
mov edx, edi
sub ecx, eax
shl edx, cl
or esi, edx
add eax, 1
cmp eax, 0x20
jne 0x432128
mov eax, esi
mov dword [0x4f38c0], eax
jmp 0x43215c
cmp edx, 0x4f38c0
je 0x4320c3
mov edx, eax
mov eax, dword [eax + 4]
test eax, eax
jne 0x432150
cmp edx, 0x4f38c0
je 0x4320c3
mov dword [edx + 4], 0x4f38c0
mov dword [esp], dbg.__eh_shmem3_gcc_tdm_cleanup_local_region
call sym.__onexit
jmp 0x4320c3
mov eax, 0x4e3f04
call dbg.__eh_shmem_get_error
xor eax, eax
jmp 0x4320de
mov eax, 0x4e3ee0
call dbg.__eh_shmem_get_error
mov dword [esp], ebx
call sym._CloseHandle_4
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x4e3f28
call dbg.__eh_shmem_get_error
xor eax, eax
jmp 0x432145
Function at 0x4363d0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 8
mov eax, dword [0x4f39e0]
test eax, eax
je 0x436450
mov edx, dword [eax + 0x18]
test edx, edx
jne 0x436470
mov dword [eax + 0x18], 0x4dd2d4
mov ebx, 0x4dd2d4
call sym._TlsAlloc_0
mov dword [ebx], eax
mov eax, dword [0x4f39e0]
test eax, eax
je 0x436428
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x436448
mov dword [eax + 0x18], 0x4dd2d4
mov eax, 0x4dd2d4
cmp dword [eax], 0xffffffff
je sym._pthread_tls_init.cold
add esp, 8
pop ebx
ret
call sym.___shmem3_winpthreads_tdm_init_local_region
mov edx, eax
mov eax, dword [0x4f39e0]
mov edx, dword [edx + 0x18]
test edx, edx
je 0x43640b
test eax, eax
jne 0x436448
call sym.___shmem3_winpthreads_tdm_init_local_region
lea esi, [esi]
mov eax, dword [eax + 0x18]
jmp 0x436417
call sym.___shmem3_winpthreads_tdm_init_local_region
mov ebx, dword [eax + 0x18]
mov eax, dword [0x4f39e0]
test ebx, ebx
je 0x4363e8
test eax, eax
jne 0x436470
call sym.___shmem3_winpthreads_tdm_init_local_region
lea esi, [esi]
mov ebx, dword [eax + 0x18]
jmp 0x4363f4

Function at 0x436480
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push edi
xor eax, eax
mov ecx, 0x10
sub esp, 0x88
lea edi, [esp + 0x40]
mov dword [esp + 0x15], 0x6f727245
mov dword [esp + 0x19], 0x6c632072
mov dword [esp + 0x1d], 0x696e6165
mov dword [esp + 0x21], 0x7520676e
mov dword [esp + 0x25], 0x70732070
mov dword [esp + 0x29], 0x6b5f6e69
mov dword [esp + 0x2d], 0x20737965
mov dword [esp + 0x31], 0x20726f66
mov dword [esp + 0x35], 0x65726874
mov dword [esp + 0x39], 0x206461
mov dword [esp + 0x3d], 0
mov dword [esp + 0x7c], 0
rep stosd dword es:[edi], eax
call sym._GetCurrentThreadId_0
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.__ultoa
cmp byte [esp + 0x3c], 0
je 0x43655a
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x43652d
cmp eax, 0x6a
je 0x43654a
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0x436528
cmp eax, 0x6a
je 0x43654a
add ecx, 2
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + ecx + 0x15], 0
mov dword [esp], edx
call sym._OutputDebugStringA_4
sub esp, 4
call sym._abort
mov ecx, 0x28
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x436540