joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4250b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push esi
mov esi, dword [ebp + 8]
push eax
push 0
push 0
push 0x1c
push 0
mov byte [esi], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x4250e0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 4
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0044db20
add esp, 0x10
test eax, eax
setne al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x438390
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0x1fffc
mov dword [ebp - 0xc], 0x4eb3fc
call fcn.00451186
mov esi, eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
add esp, 4
mov dword [ebp - 8], esi
test eax, eax
je 0x4383d8
push 0
push eax
push 0x1fffc
push esi
call fcn.0044c410
push esi
call fcn.0044c320
add esp, 0x14
jmp 0x4383db
mov byte [esi], 0
lea ecx, [ebp - 0xc]
call fcn.004385a0
mov esi, dword [ebp - 4]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x438404
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x438404
xor bl, bl
jmp 0x438406
mov bl, 1
test esi, esi
je 0x438413
push esi
call fcn.00452754
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x438423
push eax
call fcn.00452754
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438450
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x1fffc
mov dword [ebp - 0x14], 0x4eb3fc
call fcn.00451186
mov esi, eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
add esp, 4
mov dword [ebp - 0x10], esi
test eax, eax
je 0x438499
push 0
push eax
push 0x1fffc
push esi
call fcn.0044c410
push esi
call fcn.0044c320
add esp, 0x14
jmp 0x43849c
mov byte [esi], 0
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x14]
mov ecx, ebx
push eax
push eax
call fcn.00438210
lea ecx, [ebp - 0x14]
call fcn.004385a0
mov esi, dword [ebp - 0xc]
push 0
push 0x80
push 3
push 0
push 3
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x438574
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp + 0x10], eax
lea ecx, [ebp + 0x10]
lea edx, [ebp + 8]
mov dword [ebp + 8], eax
cmovae ecx, edx
mov eax, dword [ecx]
mov dword [ebp - 4], eax
cmp eax, 0x7fffffff
ja 0x43856d
inc eax
mov ecx, ebx
push eax
call fcn.00437e30
cmp byte [ebx + 0x1e], 0
jne 0x43856d
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x438529
push 0
push 0
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [ebp - 8], eax
test eax, eax
je 0x43855d
mov esi, dword [ebx + 4]
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp - 4]
mov dword [ebp + 8], 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 8], eax
push 0
call fcn.00438190
mov eax, dword [ebp - 4]
mov byte [esi + eax], 0
mov esi, dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
setne bl
jmp 0x438576
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
test esi, esi
je 0x438583
push esi
call fcn.00452754
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x438593
push eax
call fcn.00452754
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a5f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43a601
sub ecx, edx
mov edx, 2
lea ebx, [ecx + 1]
xor ecx, ecx
mov eax, ebx
mov dword [ebp - 8], ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00451186
mov esi, eax
add esp, 4
xor eax, eax
test esi, esi
je 0x43a6c4
push dword [ebp - 8]
dec ebx
mov word [esi], ax
push esi
push ebx
push edi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x43a674
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
cmp edi, ebx
lea eax, [ebp - 4]
push esi
cmovge eax, ecx
xor ecx, ecx
mov eax, dword [eax]
mov word [esi + eax*2], cx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43a6ac
push dword [ebp - 8]
xor eax, eax
push esi
push ebx
push dword [ebp + 8]
mov word [esi], ax
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x43a6b0
cmp edi, ebx
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0xc]
lea eax, [ebp - 4]
cmovge eax, ecx
xor ecx, ecx
mov eax, dword [eax]
mov word [esi + eax*2], cx
test edi, edi
jg 0x43a6c2
push esi
call fcn.00452754
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43a6d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push dword [ebp + 8]
mov edi, 5
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43a707
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x43a781
cmp esi, dword [ebp + 0xc]
ja 0x43a781
push esi
call fcn.004515ee
mov ecx, eax
add esp, 4
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x43a781
xor edi, edi
test esi, esi
je 0x43a772
jmp 0x43a740
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
mov eax, 0x100000
cmp esi, eax
cmovb eax, esi
push eax
lea eax, [edi + ecx]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43a791
add edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
sub esi, dword [ebp - 8]
jne 0x43a740
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x14]
mov dword [ecx], edi
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call fcn.004515b6
mov eax, dword [ebp + 0x10]
add esp, 4
mov dword [eax], 0
mov eax, dword [ebp + 0x14]
pop esi
pop edi
pop ebx
mov dword [eax], 0
mov eax, 5
mov esp, ebp
pop ebp
ret
Function at 0x43ae90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
test esi, esi
je 0x43aefd
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + esi - 1], 0
je 0x43aeaf
cmp byte [edi + esi], 0
je 0x43aeca
push 0
push 0xa29
push str.logger.cpp
push 0
push str.Assertion_Failed:_pch_cub___1____0__pch_cub___0
call fcn.0043eb80
add esp, 0x14
push dword [ebx + 0x11c]
push 1
push esi
push edi
call fcn.00453540
add esp, 0x10
pop edi
cmp eax, 1
je 0x43aefd
push 0
push 0xa49
push str.logger.cpp
push 0
push str.Assertion_Failed:_1__ret
call fcn.0043eb80
add esp, 0x14
pop esi
pop ebx
pop ebp
ret 8
Function at 0x43c4e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x94
push ebx
cmp ecx, 0x200
jb 0x43c6ad
mov ebx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x43c6ad
mov edx, dword [ebx + 0x3c]
cmp edx, 0x40
jb 0x43c6ad
lea eax, [ecx - 0xf8]
cmp edx, eax
jae 0x43c6ad
cmp dword [edx + ebx], 0x4550
jne 0x43c6ad
cmp dword [ebx + 0x40], 0x564c56
je 0x43c544
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x44], 1
je 0x43c554
mov eax, 4
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, dword [ebx + 0x48]
jae 0x43c563
mov eax, 3
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebx + 0x18]
add eax, edx
mov edx, 0x10b
movzx ecx, word [eax]
cmp cx, dx
jne 0x43c582
mov dword [ebp + 0xc], eax
jmp 0x43c58f
mov edx, 0x20b
cmp cx, dx
jne 0x43c559
mov dword [ebp - 0x10], eax
push esi
push edi
lea eax, [ebx + 0x50]
mov ecx, 0x20
push 0x80
mov esi, eax
mov dword [ebp - 0x14], eax
lea edi, [ebp - 0x94]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00451ad0
mov eax, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
je 0x43c5ec
mov ecx, dword [eax + 0x40]
mov dword [eax + 0x40], 0
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x80]
mov dword [ebp - 4], ecx
mov ecx, dword [eax + 0x84]
mov dword [ebp - 8], ecx
xor ecx, ecx
mov dword [eax + 0x80], ecx
mov dword [eax + 0x84], ecx
jmp 0x43c61c
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x40]
mov dword [eax + 0x40], 0
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x90]
mov dword [ebp - 4], ecx
mov ecx, dword [eax + 0x94]
mov dword [ebp - 8], ecx
xor ecx, ecx
mov dword [eax + 0x90], ecx
mov dword [eax + 0x94], ecx
mov edi, dword [ebp + 0x14]
xor dl, dl
xor esi, esi
cmp esi, edi
jae 0x43c64c
mov eax, dword [ebp + 0x10]
push dword [eax + esi*4]
lea eax, [ebp - 0x94]
push 0x80
push eax
push dword [ebx + 0x48]
push ebx
call fcn.0043c460
mov dl, al
add esp, 0x14
inc esi
test dl, dl
je 0x43c623
mov edi, dword [ebp - 0x14]
lea esi, [ebp - 0x94]
mov eax, dword [ebp + 0xc]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
test eax, eax
je 0x43c689
mov dword [eax + 0x40], ecx
mov ecx, dword [ebp - 4]
mov dword [eax + 0x80], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 0x84], ecx
xor eax, eax
test dl, dl
pop ebx
sete al
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
pop ebx
mov dword [eax + 0x40], ecx
mov ecx, dword [ebp - 4]
mov dword [eax + 0x90], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 0x94], ecx
xor eax, eax
test dl, dl
sete al
mov esp, ebp
pop ebp
ret
mov eax, 6
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c6e0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
push esi
push edi
movzx edi, al
mov eax, dword [ebp + 8]
dec edi
shr ecx, 2
or edi, 0xdfdfdfdf
lea esi, [eax + ecx*4]
neg ecx
je 0x43c735
jmp 0x43c710
mov eax, dword [esi + ecx*4]
and eax, edi
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
rol edx, 0xd
add edx, 0xfaddaf14
lea edx, [edx + edx*4]
inc ecx
jne 0x43c710
mov eax, ebx
xor ecx, ecx
and eax, 3
dec eax
je 0x43c755
dec eax
je 0x43c74c
dec eax
jne 0x43c76d
movzx ecx, byte [esi + 2]
shl ecx, 0x10
movzx eax, byte [esi + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [esi]
xor eax, ecx
and eax, edi
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
xor edx, ebx
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop ebp
ret

Function at 0x43f1a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x501d64
call fcn.0043f260
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x43f1df
push 1
push eax
mov eax, dword [ebp + 0x10]
mov ecx, str.Fatal_assert
push dword [ebp + 0xc]
test eax, eax
push dword [ebp + 8]
cmovne ecx, eax
push ecx
call fcn.00447d40
add esp, 0x14
push str._ExitOnFatalAssert_n
push 1
push str.console
call fcn.0043f170
add esp, 0xc
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop ebp
ret
Function at 0x43f280
Capabilities:
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e4910
push eax
mov eax, 0x13a0
mov dword fs:[0], esp
call fcn.00453200
mov eax, dword [0x580280]
test al, 1
jne 0x43f2f0
or eax, 1
mov dword [0x580280], eax
mov dword [ebp - 4], 0
mov ecx, 0x580260
mov dword [0x580258], 0
mov dword [0x58025c], 0
call fcn.00442f90
mov byte [ebp - 4], 0
push 0x4e5930
call fcn.004515a1
add esp, 4
mov dword [ebp - 4], 0xffffffff
push ebx
push edi
mov dword [ebp - 0x10], 0x580258
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov ebx, 0x580258
cmp edx, dword [0x580258]
je 0x43f326
mov ecx, edx
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
je 0x43f326
pause
push edx
mov ecx, ebx
call fcn.00443090
jmp 0x43f32c
inc dword [0x58025c]
push esi
mov dword [ebp - 4], 2
mov esi, dword [ebp + 8]
cmp esi, 2
je 0x43f341
cmp esi, 3
jne 0x43f346
call fcn.00447e30
xor edi, edi
cmp esi, 2
jne 0x43f379
push dword [0x580250]
lea eax, [ebp - 0x13ac]
push dword [0x58024c]
push str._s___d__:
push 0x139b
push eax
call fcn.00453979
mov edi, eax
add esp, 0x14
cmp edi, 0xffffffff
je 0x43f39d
push dword [ebp + 0x10]
mov ecx, 0x139b
lea eax, [ebp - 0x13ac]
push dword [ebp + 0xc]
sub ecx, edi
add eax, edi
push ecx
push eax
call fcn.004512c0
add esp, 0x10
cmp eax, 0xffffffff
jne 0x43f3a4
mov edi, 2
jmp 0x43f416
add edi, eax
cmp esi, 2
jne 0x43f3ce
lea eax, [ebp - 0x13ac]
add eax, edi
push 0x4eb590
push eax
call fcn.00453e47
add esp, 8
lea eax, [ebp - 0x13ac]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x13ac]
push eax
push esi
call dword [0x5580a4]
add esp, 8
mov edi, eax
sub eax, 0
je 0x43f410
sub eax, 2
jne 0x43f416
push str.Exiting_on_SPEW_ABORT_n
push 1
push str.console
call fcn.0043f170
add esp, 0xc
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x43f416
cmp esi, 2
je 0x43f416
int3
mov dword [ebp - 4], 0xffffffff
dec dword [0x58025c]
pop esi
jne 0x43f42a
xor ecx, ecx
xchg dword [ebx], ecx
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x43f670
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e49c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x208
push esi
push edi
mov edi, ecx
push 0x43f930
push 0x43f5e0
push 0x26
lea esi, [edi + 8]
mov dword [ebp - 0x14], edi
push 0x48
lea eax, [esi + 0x400]
mov dword [edi], vtable.CStdMemAlloc.0
push eax
mov dword [ebp - 0x10], esi
call fcn.00457c75
mov dword [ebp - 4], 0
call fcn.00440ce0
mov dword [esi + 0xeb0], eax
mov dword [ebp - 4], 1
lea esi, [edi + 0xec0]
push 0x43f930
push 0x43f5e0
push 0x26
push 0x48
lea eax, [esi + 0x400]
mov dword [ebp - 0x10], esi
push eax
call fcn.00457c75
mov byte [ebp - 4], 2
call fcn.00440d90
mov dword [esi + 0xeb0], eax
mov byte [ebp - 4], 3
lea esi, [edi + 0x1d78]
push 0x43f930
push 0x43f5e0
push 0x26
push 0x48
lea eax, [esi + 0x400]
mov dword [ebp - 0x10], esi
push eax
call fcn.00457c75
mov byte [ebp - 4], 4
call fcn.00440e40
mov dword [esi + 0xeb0], eax
mov byte [ebp - 4], 5
lea ecx, [edi + 0x2c40]
mov dword [edi + 0x2c30], 0
mov dword [edi + 0x2c34], 0
mov dword [edi + 0x2c38], 0x44b5b0
mov dword [edi + 0x2c3c], 0
mov dword [ecx], 0
mov dword [ebp - 0x10], ecx
mov dword [ecx + 4], 0
add ecx, 8
call fcn.00442f90
mov byte [ebp - 4], 7
mov byte [edi + 0x2c68], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x43f7cc
push 0x1ff
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.004524e0
lea eax, [ebp - 0x214]
mov byte [ebp - 0x15], 0
push eax
call fcn.00458010
lea eax, [ebp - 0x214]
push eax
call fcn.00449610
add esp, 0x14
mov dword [edi + 0x2c6c], 0
mov dword [edi + 0x2c70], 0
mov dword [edi + 0x2c74], 0
mov dword [edi + 0x2c78], 0
mov dword [edi + 0x2c7c], 0
mov dword [edi + 0x2c80], 0
mov dword [edi + 0x2c84], 0
mov dword [edi + 0x2c88], 0
mov dword [edi + 0x2c8c], 0
mov dword [edi + 0x2c94], 0
mov dword [edi + 0x2c98], 0
mov dword [edi + 0x2c9c], 0
mov dword [edi + 0x2ca0], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x441f70
Capabilities:
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00442500

Function at 0x442500
Capabilities:
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push esi
mov esi, dword [ebp + 8]
mov dword [ecx + 0x2c3c], esi
call fcn.0043ef90
test al, al
je 0x44251d
int3
push 0
push esi
push str._OUT_OF_MEMORY__attempted_allocation_size:__llu__n
lea eax, [ebp - 0x100]
push 0x100
push eax
call fcn.00453979
add esp, 0x14
mov byte [ebp - 1], 0
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.0043ef90
pop esi
test al, al
jne 0x442592
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x200]
push str.Fatal_Assertion_Failed:__s
push eax
call fcn.004158e0
push 0
push 0x96f
push str.memstd.cpp
push 1
push eax
call fcn.0043eb80
add esp, 0x20
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret 4
Function at 0x442f30
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x442f88
push str.Bad_thread_local
lea eax, [ebp - 0x100]
push str.Assertion_Failed:__s
push eax
call fcn.004158e0
push 0
push 0x94d
push str.threadtools.cpp
push 0
push eax
call fcn.0043eb80
add esp, 0x20
cmp dword [esi], 0xffffffff
jne 0x442f88
push str.Out_of_thread_local_storage__n
call fcn.0043ee00
add esp, 4
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x443040
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
sub esp, 0x100
cmp eax, 0xffffffff
je 0x44305b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
push str.Bad_thread_local
lea eax, [ebp - 0x100]
push str.Assertion_Failed:__s
push eax
call fcn.004158e0
push 0
push 0x96c
push str.threadtools.cpp
push 0
push eax
call fcn.0043eb80
add esp, 0x20
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x443270
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
sub esp, 0x100
cmp eax, 0xffffffff
je 0x443290
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 4
push str.Bad_thread_local
lea eax, [ebp - 0x100]
push str.Assertion_Failed:__s
push eax
call fcn.004158e0
push 0
push 0x97e
push str.threadtools.cpp
push 0
push eax
call fcn.0043eb80
add esp, 0x20
mov esp, ebp
pop ebp
ret 4

Function at 0x4470b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00453200
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1000]
push 0x1000
push eax
call fcn.004512c0
add esp, 0x10
test eax, eax
jg 0x4470f7
push 0
push 0x193
push str.platform.cpp
push 0
push str.Assertion_Failed:_len___0
call fcn.0043eb80
add esp, 0x14
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esp, ebp
pop ebp
ret
Function at 0x447e40
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
shrd edi, esi, 5
push eax
sar esi, 5
call ebx
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
call fcn.0041fda0
lea esp, [esp]
lea eax, [ebp - 0x10]
push eax
call ebx
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
sbb eax, dword [ebp - 0x14]
cmp eax, esi
jl 0x447ed0
jg 0x447eec
cmp ecx, edi
jb 0x447ed0
lea ecx, [ebp - 0x38]
call fcn.0041fda0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
sbb eax, dword [ebp - 0x3c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
fild qword [ebp - 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
sbb eax, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
fild qword [ebp - 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fild qword [ebp - 0x20]
fstp qword [ebp - 8]
fdiv qword [ebp - 8]
fdivp st(1)
call fcn.004528d6
pop edi
mov ecx, eax
or ecx, edx
pop esi
pop ebx
jne 0x447f5a
mov eax, 0x77359400
xor edx, edx
mov esp, ebp
pop ebp
ret
Function at 0x448de0
Capabilities:
Accept command line arguments
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
call sub.KERNEL32.dll_GetCommandLineA
push str._noassert
push eax
call fcn.004585d9
add esp, 8
test eax, eax
jne 0x448e44
call sub.KERNEL32.dll_GetCommandLineA
push str._nocrashdialog
push eax
call fcn.004585d9
add esp, 8
test eax, eax
jne 0x448e44
call fcn.004435b0
test al, al
jne 0x448e20
pop ebp
jmp fcn.0043ef90
call sub.KERNEL32.dll_GetCommandLineA
push str._debugbreak
push eax
call fcn.004585d9
add esp, 8
test eax, eax
je 0x448e3b
mov al, 1
pop ebp
ret
cmp byte [0x5580e8], 0
jne 0x448e48
xor al, al
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
call fcn.00448960
add esp, 8
test al, al
jne 0x448e62
pop edi
pop esi
pop ebp
ret
mov dword [0x648e7c], esi
mov esi, dword [ebp + 0x10]
mov dword [0x648e78], edi
mov dword [0x648e80], esi
mov byte [0x648e70], 0
mov dword [0x648e84], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x448da0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x648e84]
test eax, eax
jne 0x448ebe
push 0x2000
push str.Assert_Dialog
push esi
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov al, byte [0x648e70]
pop edi
pop esi
pop ebp
ret
push 0
push 0x448a10
push eax
push 0x65
push dword [0x648e68]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov al, byte [0x648e70]
pop edi
pop esi
pop ebp
ret

Function at 0x448f00
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [ecx + 0xa0]
xor esi, esi
mov dword [ecx + 0xa8], 0
mov dword [ecx + 0xac], 0
test edi, edi
jle 0x448f67
jmp 0x448f30
mov eax, dword [ecx + 0xa8]
mov edx, dword [ecx + 0xac]
shld edx, eax, 2
shl eax, 2
mov dword [ecx + 0xa8], eax
mov dword [ecx + 0xac], edx
mov eax, dword [ecx + esi*8]
xor dword [ecx + 0xa8], eax
mov eax, dword [ecx + esi*8 + 4]
inc esi
xor dword [ecx + 0xac], eax
cmp esi, edi
jl 0x448f30
pop edi
pop esi
ret

Function at 0x4497b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e510e
push eax
mov dword fs:[0], esp
mov eax, dword [0x648efc]
push ebx
push esi
test al, 1
jne 0x4497fe
or eax, 1
mov dword [0x648efc], eax
mov dword [ebp - 4], 0
mov dword [0x648ed8], 0x5034e8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x648edc], eax
mov dword [ebp - 4], 0xffffffff
cmp byte [0x648f00], 0
jne 0x449857
mov bl, byte [ebp + 8]
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test bl, bl
mov ecx, 8
cmovne eax, ecx
cmp byte [0x648ed0], 0
mov dword [0x648ee0], eax
je 0x449831
push str.PageHeap_is_on._Memory_use_will_be_larger_than_normal._n
jmp 0x449836
push str.PageHeap_is_off._Memory_use_will_be_normal._n
call esi
test bl, bl
je 0x449843
push str.__HEAP_ZERO_MEMORY_is_specified._n
call esi
push 0x648ed8
call fcn.004424e0
add esp, 4
mov byte [0x648f00], 1
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret