joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e032
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0045e225
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.00468d7a
xor ebx, ebx
cmp eax, ebx
jne 0x45e1e0
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0045e225
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.00465a59
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4b734e
add esp, 0x10
test eax, eax
jne 0x45e0fb
push esi
call fcn.0045b6e4
mov esi, eax
cmp esi, ebx
pop ecx
je 0x45e0fb
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x45e0e6
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x45e0fb
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x45e0f4
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0046a28d
cmp byte [esp + 0x13], bl
je 0x45e12b
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0045e262
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x45e19b
push 0x14
call fcn.004b65bb
cmp eax, ebx
pop ecx
je 0x45e155
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x45e157
xor edi, edi
cmp edi, ebx
je 0x45e19b
push esi
push edi
call fcn.0045d788
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0045d850
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0045d979
add esp, 0x18
call fcn.0045e225
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.00468447
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x45e1b2
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x45e1c4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x45e207
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x45e207
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0045d850
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0045d979
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47c75e
Capabilities:
Encode data using xor

Disassembly:
add dl, byte [ebx - 0x2cc582df]
imul edi, dword [edi + 0x345304c8], 0x4f
Function at 0x4968c7
Capabilities:
Encode data using xor

Disassembly:
call [esi + 0x75]
cwde
sbb dl, byte [eax + 0x76db4121]
and edx, dword [edx - 0x7f]
salc
in eax, 0x7e
jbe 0x49684d
shl byte [ebp + 0x54], 1
push esp
sti
mov byte [0x1c6863e1], al
xor eax, dword [ecx + 0x52]
pop ds
loop 0x4968c6
rcl dword [0x8351c97a], 0x46
sub al, 0x95
mov eax, dword [0x5bb0d18f]
push ss
sub al, 0xb6
jge 0x49689d
inc esp
sub dh, ah
popal
aam 0x3a
mov ecx, 0x70ee5409
sbb byte gs:[edi], cl
sbb byte [eax + 0x43], 0x31
stosb byte es:[edi], al
dec edi
into
sbb ecx, dword [ecx - 0x381d88ab]
imul eax, dword [eax], 0xf343a734
xchg edx, eax
xor ecx, dword [edi]
in eax, dx
ror byte [ecx - 0x4f59e1c], 0x60
push edx
pop edi
pop ds
loop 0x496948
cmp al, 0x5a
pop edx
push cs
rol byte [esi + 0x37f55be0], 0xca
jno 0x496961
outsd dx, dword [esi]
movsd dword es:[edi], dword [esi]
shl byte [edi - 0x63927b5f], 0x7a
push eax
sub bl, byte [eax - 0xa]
sub dword [edi - 0x1db7a6b2], 9
add dword [edx + edi*8 + 0x610da799], ebx
jge 0x49691a
mov byte [esi + 0x74c5b376], bh
invalid
mov bl, 0xc5
je 0x496955
sti
lds esp, [edi]
nop
sbb byte [ebp - 0xb995165], al
mov eax, 0x154c25d4
das
mov eax, 0x6ec9fb40
int3

Function at 0x49fb51
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sbb byte [edx - 0x74522459], bh
ja 0x49fbd8
invalid
and al, 0x46
mov edi, esi
mov edx, dword [ebx]
sar edi, 0x10
inc dword [ebx]
and edi, 0xff
mov eax, edi
mov byte [edx], al
dec dword [ebx + 4]
jne 0x49fbe7
mov eax, ebx
call fcn.0049fb58
test eax, eax
jne 0x49fbe7
xor eax, eax
jmp 0x49fc20
cmp edi, 0xff
jne 0x49fc0a
mov edx, dword [ebx]
inc dword [ebx]
mov byte [edx], 0
dec dword [ebx + 4]
jne 0x49fc0a
mov eax, ebx
call fcn.0049fb58
test eax, eax
jne 0x49fc0a
xor eax, eax
jmp 0x49fc20
shl esi, 8
sub ebp, 8
cmp ebp, 8
jge 0x49fbc0
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], ebp
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x49fd5b
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
and byte [esi + 0x2fe65a86], ah
push ebp
adc bl, 0x35
cdq
mov eax, 0xf80a7f97
Function at 0x4a27a2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.004a2995
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call int.004ad4ea
xor ebx, ebx
cmp eax, ebx
jne 0x4a2950
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.004a2995
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.004aa1c9
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4fbabe
add esp, 0x10
test eax, eax
jne 0x4a286b
push esi
call 0x49fe54
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4a286b
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x4a2856
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4a286b
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a2864
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.004ae9fd
cmp byte [esp + 0x13], bl
je 0x4a289b
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.004a29d2
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4a290b
push 0x14
call 0x4fad2b
cmp eax, ebx
pop ecx
je 0x4a28c5
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x4a28c7
xor edi, edi
cmp edi, ebx
je 0x4a290b
push esi
push edi
call fcn.004a1ef8
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004a1fc0
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a20e9
add esp, 0x18
call fcn.004a2995
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.004acbb7
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a2922
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4a2934
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4a2977
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x4a2977
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.004a1fc0
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a20e9
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a883c
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
push ss
loopne 0x4a885f
setl byte [edi + 0x2088663e]
invalid
inc esi
dec esp
xchg esi, eax
inc ebx
mov ah, 0x86
push 0x67
clc
mov byte [edi], 0xea
ja 0x4a8863
add cl, byte [esi + edx*8 - 0x68ab689c]
and edi, ebp
lcall 0xe024, 0x48986167
push ss
imul edx, dword [esi - 0x5f8c68c9], 0x7a90c843
test al, 0xde
add eax, 0x8613c232
test dh, bh
jecxz 0x4a88fc
xor al, dl
adc eax, dword [esi - 0x1c017bc2]
push 0xf6d4d229
sub edx, edx
aam 0xf6
out dx, al
invalid
jo 0x4a888b
rol eax, 1
mov ebx, 0x5b9ee675
xor al, 0x57
imul edi, dword [esi - 0x186ce9], 0xfffffff3
invalid
add edi, dword [ecx + eax*8]
pushfd
xor esp, dword [edx + 0x23372e11]
or cl, 0xbe
push 0xffffffffffffffd2
lahf
loopne 0x4a88a7
dec ecx
xor dl, byte [edx]
adc dword [edx + 0x79], edx
aas
fcomp dword [0x6a694e0e]
jg 0x4a8953
mov edi, 0x327a1793
fldenv [ecx]
push ss
xchg edx, eax
dec ecx
push 0x27
lcall 0xe0b4, 0x19df0372
leave
loopne 0x4a88c7
xchg edx, eax
invalid
xor al, byte [ebx - 0x1f]
xor al, 0xc3
sbb al, 0x19
lea esi, [edx - 0x5e]
jmp 0xd33af998

Function at 0x4adb60
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
aas
imul esi, dword [esi + 0x18], 0x72
call 0xd4cdefed
mov eax, dword [0xcfc61d]
and al, 0xb5
xchg bl, cl
dec ebp
push 0x4e52b477
xor ecx, dword [edi + esi*2 + 0x3e94adb7]
push ds
fdiv dword [edx]
movsd dword es:[edi], dword [esi]
xchg esp, eax
aad 0xdd
das
rol dword [edi + 0xe], cl
pop esp
xchg edx, eax
mov cl, dl
sal dword [esi + 0x57], 0xee
mov esp, 0xa925e56d
and byte [ecx + 0x696a6507], dl
dec edi
and esp, ebp
mov al, 0xdf
mov dword [ebx], esi
and al, 0x65
fld qword [edi]
jl 0x4adb7f
ljmp 0x55c8:0x45737b2f
fadd dword [ebx]
sub dword [ebx + 0x46], esi
test dword [ecx + 0x5e], 0x855cdf52
sahf
loope 0x4adaf7
loope 0x4adbc9
rcl dword [ebx - 0x47], cl
cmp al, 0xd7
xchg ebp, eax
mov ch, 0x62
test dword [esi + edx*2], 0x240fab55
jg 0x4adbbc
and al, 0x7f
cmp bl, byte [ebx + edx*4 - 0x43]
mov dword [edi], esp
lodsb al, byte [esi]
sar edx, 1
pop esp
xchg ebx, eax
mov ebp, 0xd1ac2789
cli
nop
mov bl, dh
mov ah, 0xa9
pop ebp
std
xor bl, byte [esi + 0x4fee4b6a]
or esp, ecx
adc ebp, esp
sbb al, dl
fst dword [edx]
adc dh, byte [ebx - 0x1d]
mov esi, 0x6a41aa3a
imul esp, dword [eax + 0x1084b3c9], 0x3324682a
das
aad 0x5b
mov bl, 0x84
adc byte [edx], ch
push 0xd52f3324
pop ebx
jne 0x4adbb9
xor eax, 0x90c80059
nop
mov ebp, 0xbb3518d1
sbb eax, 0x63f33a3a
pop ebx
adc byte [ebp - 0x41e6e64d], bl
je 0x4adba9
sbb byte [0x3a3a1dbb], dh
arpl word [ebx + 0x10], bx
popfd
mov bl, 0x19
sbb dword [esi + 0x26c5dc74], edi
lds esp, [esi]
xor eax, 0xfe43dc5d
push ss
mov cl, pe_nt_image_headers32
into
cli
mov ecx, 0x6b54c360
pushal
pop ss
fidiv dword [eax - 0x53057123]
lodsd eax, dword [esi]
mov ebp, 0xed10ef69
pop ss
push esi
xchg edi, eax
lodsd eax, dword [esi]
inc ebp
stc
invalid
Function at 0x6210a570
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6211ab80
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6211ab80
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x6210a5d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6222e054]
test esi, esi
jle 0x6210a6f0
mov eax, dword [0x6222e058]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x6210a604
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6210a687
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6210a5f0
mov dword [esp], ebx
call fcn.6210ad30
mov edi, eax
test eax, eax
je 0x6210a717
mov eax, dword [0x6222e058]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6210ae70
mov edx, dword [0x6222e058]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6210a6f7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6210a680
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6210a690
add dword [0x6222e054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6222e058]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6210a680
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6210a570
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6210a60e
mov eax, dword [0x6222e058]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6210a570
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6210a570
lea esi, [esi]
nop
Function at 0x6210a9b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6222e064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6222e05c]
sub esp, 4
test ebx, ebx
je 0x6210aa05
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6210a9fe
test esi, esi
je 0x6210a9fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6210a9e0
mov dword [esp], 0x6222e064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6210ad30
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x62100000], 0x5a4d
jne 0x6210ad55
mov ecx, dword [0x6210003c]
cmp dword [ecx + 0x62100000], 0x4550
lea edx, [ecx + 0x62100000]
je 0x6210ad60
ret
cmp word [ecx + 0x62100018], 0x10b
jne 0x6210ad55
push esi
movzx eax, word [ecx + 0x62100014]
push ebx
movzx esi, word [ecx + 0x62100006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x62100000
test esi, esi
je 0x6210ada8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6210ad9e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6210adaa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6210ad90
xor eax, eax
pop ebx
pop esi
ret

Function at 0x6210b320
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x6222e060]
test eax, eax
jne 0x6210aa30
ret
push ebx
sub esp, 0x18
mov dword [esp + 4], 0xc
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x6210aa90
mov eax, dword [esp + 0x20]
mov dword [esp], 0x6222e064
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x6222e05c]
mov dword [0x6222e05c], ebx
sub esp, 4
mov dword [ebx + 8], eax
mov dword [esp], 0x6222e064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
or eax, 0xffffffff
jmp 0x6210aa8b
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x6210b350
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp 0x6211ad80
add esp, 4
pop ebx
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 8]
test eax, eax
jne 0x6211ad90
xor eax, eax
ret
jmp 0x6210aa20

Function at 0x6210b390
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x6210b3d0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x6210b3f8
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x6211add8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x5c
mov eax, dword [esp + 0x60]
mov dword [esp + 0x1c], eax
mov eax, dword [0x6222e02c]
mov dword [esp + 0x4c], eax
xor eax, eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x6211ae40
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62169900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x621e8432
mov ecx, eax
call fcn.621a6b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62169930
jmp 0x6211afb0
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_OpenClipboard]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x6211ae92
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62169900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x621e8432
mov ecx, eax
call fcn.621a6b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62169930
jmp 0x6211afb0
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetClipboardData]
call eax
sub esp, 4
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
jne 0x6211aeed
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62169900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x621e8432
mov ecx, eax
call fcn.621a6b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62169930
jmp 0x6211afb0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalLock]
call eax
sub esp, 4
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
jne 0x6211af45
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62169900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x621e8432
mov ecx, eax
call fcn.621a6b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62169930
jmp 0x6211afb0
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62169900
lea eax, [esp + 0x34]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x30]
mov dword [esp], edx
mov ecx, eax
call fcn.621a6b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62169930
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call eax
sub esp, 4
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x34]
mov dword [esp], edx
mov ecx, eax
call fcn.621a6a50
sub esp, 4
lea eax, [esp + 0x34]
mov ecx, eax
call fcn.621a7640
mov eax, dword [esp + 0x4c]
sub eax, dword [0x6222e02c]
je 0x6211afc1
call fcn.621015c0
mov eax, dword [esp + 0x1c]
add esp, 0x5c
ret
Function at 0x6211f590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x621e9e11
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x621e9e75]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.6210b010
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.621deae0
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x621e726c], 0
jne 0x6211f6b6
mov byte [0x621e726c], 1
call fcn.621dcbd0
test eax, eax
je 0x6211f684
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.6210a220
mov dword [esp], 2
mov esi, dword [fcn.6211ab80]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x6211f674
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x621ea555
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x621df360
jmp 0x621df358
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x6211f63a
mov dword [esp], 2
call dword [0x621e6178]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x621df353
mov dword [esp], 2
call dword [0x621e6178]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x621ea504
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
mov dword [esp], edi
call fcn.6211a428
call fcn.621dcfa0
call fcn.621dcab0
call fcn.621dcc20
jmp 0x621df353