joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460ec0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00460814
xor eax, eax
push ebp
push 0x461031
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x46101b
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x460f0b
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x460f15
call fcn.00403980
jmp 0x461038
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004159dc
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x461010
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x460fc3
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x460fb0
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403344
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.00460e78
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x461044]
cmp dl, byte [eax + 0x28]
je 0x461017
call fcn.0040b5dc
jmp 0x461017
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004159fc
jmp 0x461017
cmp ecx, ebx
jge 0x460fdf
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004159fc
jmp 0x460f15
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004159dc
cmp edx, dword [esp + 4]
jne 0x460fff
cmp eax, dword [esp]
pop edx
pop eax
jne 0x460f15
push ebp
call fcn.00460e78
pop ecx
jmp 0x461017
push ebp
call fcn.00460e78
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461038
mov eax, dword [ebp - 4]
call fcn.00460820
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461060
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x461182
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00460814
xor eax, eax
push ebp
push 0x461165
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4610b0
call fcn.00403980
jmp 0x46116c
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x46114f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x46114f
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403344
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x46114f
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040add0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x46119c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x467d88]
mov dl, 1
mov eax, dword [0x45fa80]
call fcn.0040b6f4
call fcn.004038d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46116c
mov eax, dword [ebp - 4]
call fcn.00460820
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461189
lea eax, [ebp - 0x28]
call fcn.00403f1c
ret
Function at 0x4611e8
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x461332
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00460814
xor eax, eax
push ebp
push 0x461315
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x46124d
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x46124d
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x4612ff
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x461260
call fcn.00403980
jmp 0x46131c
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4612ff
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4612ff
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403344
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4612ff
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040add0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x46134c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x467d88]
mov dl, 1
mov eax, dword [0x45fa80]
call fcn.0040b6f4
call fcn.004038d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46131c
mov eax, dword [ebp - 4]
call fcn.00460820
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461339
lea eax, [ebp - 0x28]
call fcn.00403f1c
ret
Function at 0x402680
Capabilities:
Get token membership

Disassembly:
sub esp, 0x4c
mov eax, 0x500
mov word [esp + 0x3e], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x3a], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x3a]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x220
mov dword [esp + 8], 0x20
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
sub esp, 0x2c
test eax, eax
mov dword [esp + 0x34], eax
je 0x402731
lea eax, [esp + 0x34]
mov dword [esp], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
sub esp, 0xc
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
sub esp, 4
mov eax, dword [esp + 0x34]
cmp eax, 1
sete al
add esp, 0x4c
ret

Function at 0x4030c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4e73c0]
test esi, esi
jle 0x4031d0
mov edi, dword [0x4e73c4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x4030f4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x403175
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x4030e0
mov dword [esp], eax
mov ebx, eax
call fcn.004039b0
test eax, eax
mov edi, eax
je 0x4031f7
mov eax, dword [0x4e73c4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00403ab0
add eax, dword [edi + 0xc]
mov edx, dword [0x4e73c4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4031d7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40316e
sub eax, 4
and eax, 0xfffffffb
jne 0x403180
add dword [0x4e73c0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x4e73c4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40316e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0049d1d0
lea esi, [esi]
xor esi, esi
jmp 0x4030fe
mov eax, dword [0x4e73c4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0049d1d0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0049d1d0
mov esi, esi
lea edi, [edi]
Function at 0x403630
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4e73d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4e73d0]
sub esp, 4
test ebx, ebx
je 0x403685
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40367e
test esi, esi
je 0x40367e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x403660
mov dword [esp], 0x4e73d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x416bc0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
lea ebx, [ecx - 1]
mov ecx, 0x66666667
sub esp, 0x2c
mov dword [esp + 0x1c], eax
mov eax, ebx
mov dword [esp + 0x10], ebx
sar eax, 0x1f
mov esi, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov eax, ebx
sar ebx, 0x1f
imul ecx
mov ecx, edx
sar ecx, 2
sub ecx, ebx
mov ebx, 1
je 0x416c13
mov ebp, 0x66666667
mov eax, ecx
sar ecx, 0x1f
add ebx, 1
imul ebp
sar edx, 2
sub edx, ecx
mov ecx, edx
jne 0x416c00
mov edx, dword [esi + 0x28]
cmp edx, 0xffffffff
je 0x416c90
mov ecx, dword [esi + 8]
cmp ebx, edx
cmovl ebx, edx
lea edx, [ebx + 2]
mov eax, ecx
sub eax, edx
cmp ecx, edx
mov edx, 0xffffffff
cmovle eax, edx
mov ecx, 1
mov edx, edi
mov dword [esi + 8], eax
mov eax, dword [esp + 0x1c]
add ebx, 1
mov dword [esp], esi
call fcn.00416470
mov eax, dword [esi + 0x28]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
mov edx, eax
and eax, 0x20
or edx, 0x1c0
or eax, 0x45
mov dword [esi + 4], edx
mov edx, esi
call fcn.00416040
add dword [esi + 8], ebx
mov eax, dword [esp + 0x10]
mov ecx, esi
mov edx, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004168b0
mov eax, dword [0x4a3054]
cmp eax, 0xffffffff
je 0x416cc5
test eax, eax
je 0x416cb5
mov edx, 2
mov dword [esi + 0x28], edx
jmp 0x416c1b
mov dword [0x4a3054], 0
call fcn.0041bc10
test al, 1
mov edx, 3
jne 0x416c9e
jmp 0x416ca3
mov dword [esp], str.PRINTF_EXPONENT_DIGITS
call sub.msvcrt.dll_getenv
test eax, eax
je 0x416cab
movsx eax, byte [eax]
sub eax, 0x30
cmp eax, 2
ja 0x416cab
mov dword [0x4a3054], 1
jmp 0x416c9e
Function at 0x41d7d0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x4a309c], eax
je 0x41d7e7
add esp, 0xc
ret
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x41dce0
Capabilities:
Print debug messages

Disassembly:
test eax, eax
je 0x41dd10
push edi
push esi
push ebx
mov ebx, eax
add esp, 0xffffff80
mov dword [esp], eax
call fcn.0041d690
cmp eax, 1
je 0x41dd12
mov dword [ebx], 0xffffffff
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
ret
repz ret
lea ebx, [esp + 0x15]
mov esi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
xor eax, eax
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x3d]
mov ecx, 0x43
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
mov eax, 0x27
jne 0x41dd65
jmp 0x41dd82
cmp eax, 0x6a
je 0x41dd73
add eax, 1
cmp byte [ebx + eax], 0
jne 0x41dd60
cmp eax, 0x6a
jne 0x41dd82
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sub.msvcrt.dll_abort
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + eax + 0x16], 0
jmp 0x41dd73
Function at 0x41de10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [0x4e7e48], 1
je 0x41de25
call fcn.0041dd90
mov eax, dword [0x4a309c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41de50
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041dc30
mov esi, eax
mov eax, dword [entry3]
test eax, eax
je 0x41de3c
test esi, esi
je 0x41de3c
mov dword [esi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x18], eax
lea eax, [esi + 0x38]
sub esp, 0x10
mov dword [esi + 0x1c], 0xffffffff
call fcn.0041dce0
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esi + 0x64], 0
mov dword [esi + 0x14], 0
call ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call ebx
lea edx, [esi + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebp
mov dword [esp + 0xc], edx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x41df52
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x6c], eax
movzx eax, byte [esi + 0x20]
sub esp, 4
mov dword [esi + 0x68], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [esi + 0x20], al
mov eax, dword [0x4a309c]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x41df52
add esp, 0x2c
mov ebx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll_abort
mov esi, esi
lea edi, [edi]
Function at 0x41e090
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x41e0c0
mov edi, dword [esp + 0x28]
test edi, edi
je 0x41e161
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x41e190
cmp eax, 3
jne 0x41e0aa
mov eax, dword [0x4a309c]
cmp eax, 0xffffffff
je 0x41e0aa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41e0aa
test byte [eax + 0x20], 0x30
je 0x41e1b2
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x41e2b4
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x41e134
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x41e126
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0041d4d0
lea eax, [ebx + 0x38]
call fcn.0041dce0
mov esi, dword [ebx + 0xb0]
test esi, esi
jne 0x41e239
mov eax, ebx
call fcn.0041d9d0
jmp 0x41e239
mov eax, dword [0x4e7e24]
test eax, eax
je 0x41e0aa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x4e7e24], 0
sub esp, 4
jmp 0x41e0aa
mov dword [esp + 4], 0x41d6f0
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x4e7e24], eax
jmp 0x41e0aa
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x41e260
test eax, eax
je 0x41e1d0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
jne 0x41e290
test byte [ebx + 0x24], 4
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
je 0x41e2a0
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41e215
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call fcn.0041d4d0
mov eax, esi
call fcn.0041dce0
mov ecx, dword [ebx + 0xb0]
test ecx, ecx
je 0x41e155
mov eax, dword [0x4a309c]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x41e0aa
test eax, eax
je 0x41e270
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.0041d4d0
lea eax, [ebx + 0x38]
call fcn.0041dce0
jmp 0x41e0aa
call fcn.0041dfa0
jmp 0x41e1ec
mov dword [esp], edi
call fcn.0041d4d0
mov eax, esi
call fcn.0041dce0
jmp 0x41e0aa
call fcn.0041dfa0
jmp 0x41e102
Function at 0x41ec20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.0041de10
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x41eca2
test byte [ebx + 0x20], 0x30
jne 0x41ec56
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_longjmp
mov eax, dword [0x4a309c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
push edx
mov ebx, eax
je 0x41ec99
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x41ece6
test eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x68], 1
je 0x41ec8c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x41eca9
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call fcn.0041dfa0
jmp 0x41ec3d
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x14], 0
je 0x41ed0d
mov eax, dword [0x4a309c]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x41ec99
test eax, eax
mov dword [ebx], 0xdeadbeef
je 0x41ecfa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jne 0x41eccc
mov eax, ebx
call fcn.0041d9d0
jmp 0x41eccc
Function at 0x423520
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x80]
mov esi, 0x4a63f1
sub esp, 0x9c
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 1]
mov dword [ebp - 0x8c], eax
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x4a6455]
mov dword [ebp - 0x1c], eax
lea eax, [edx + 0x87]
rep movsd dword es:[edi], dword [esi]
and eax, 0xfffffff0
call fcn.0040d2b0
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x8c]
mov byte [ebx + eax + 0x67], 0
mov dword [esp], ebx
call fcn.004969c0
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x4a4ab4], 0
jne 0x42360d
mov byte [0x4a4ab4], 1
call fcn.0049b750
test eax, eax
je 0x423651
mov ebx, dword [eax + 4]
cmp byte [ebx], 0x2a
je 0x42363f
lea eax, [esp + 0x1c]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
call fcn.0040d120
mov dword [esp], 2
mov edi, eax
mov esi, dword [fcn.0041bb20]
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
cmp dword [esp + 0x1c], 0
mov dword [esp], 2
je 0x4235fd
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4a54dd
call sub.msvcrt.dll_fwrite
cmp dword [esp + 0x1c], 0
je 0x423647
call fcn.0049bc30
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x4235c8
mov dword [esp], 2
call dword [0x4a3074]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
add ebx, 1
jmp 0x423553
mov dword [esp], edi
call fcn.0041ba10
jmp 0x4235f8
mov dword [esp], 2
call dword [0x4a3074]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
sub edx, 1
mov dword [esp], eax
jne 0x4236f7
call fcn.0049b5c0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
mov dword [esp], 2
mov ebx, eax
call esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xb
mov dword [esp + 4], 1
mov dword [esp], str.__what__:
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
call fcn.0049b7b0
jmp 0x42367e
call fcn.0049b5c0
call fcn.0049b7b0
jmp 0x42367e
Function at 0x49d1d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0041bb20
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0041bb20
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
cmp byte [0x4a30d8], 0
jne 0x49d240
mov byte [0x4a30d8], 1
cmp byte [0x4a30e0], 0
jne 0x49d250
mov byte [0x4a30e0], 1
cmp byte [0x4a3138], 0
jne 0x49d260
mov byte [0x4a3138], 1
cmp byte [0x4a3148], 0
jne 0x49d270
mov byte [0x4a3148], 1
cmp byte [0x4a3118], 0
jne 0x49d280
mov byte [0x4a3118], 1
cmp byte [0x4a3128], 0
jne 0x49d290
mov byte [0x4a3128], 1
cmp byte [0x4a3108], 0
jne 0x49d2a0
mov byte [0x4a3108], 1
cmp byte [0x4a30f8], 0
jne 0x49d2b0
mov byte [0x4a30f8], 1
repz ret