joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53cbdb
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0053cb57
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x53cd53
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x53cd53
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x53cd02
jg 0x53cc34
test eax, eax
je 0x53ccf8
push 1
push 0x1000
call fcn.00530101
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x53cc5a
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x53ccef
push 0x8000
push ebx
call fcn.0052a583
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x53cc86
jg 0x53cc81
cmp ecx, 0x1000
jb 0x53cc86
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0053382f
add esp, 0x10
cmp eax, 0xffffffff
je 0x53cccb
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x53cc81
jl 0x53ccb2
test ecx, ecx
jne 0x53cc73
push dword [ebp - 0xc]
push ebx
call fcn.0052a583
push esi
call fcn.0053015e
add esp, 0xc
xor edi, edi
jmp 0x53cd64
cmp byte [edi + 0x24], 0
je 0x53cce2
cmp dword [edi + 0x20], 5
jne 0x53cce2
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x53cced
mov edi, dword [edi + 0x18]
jmp 0x53ccef
xor edi, edi
push esi
call fcn.0053015e
pop ecx
jmp 0x53cd64
test ecx, ecx
jg 0x53ccc4
jl 0x53cd02
test eax, eax
jae 0x53ccc4
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0052fe97
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x53cd25
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x53ccc4
jmp 0x53cd5c
push ebx
call fcn.005367bb
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x53ccc4
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x53cd64
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x53cd61
mov edi, dword [edi + 0x18]
jmp 0x53cd64
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0052fe97
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x414dd2
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], edi
mov edx, 0x29c39769
push edx
mov esi, dword [esp]
add esp, 4
add ecx, 4
sub edx, 0x1f3e1cc1
sub eax, edx
sub eax, esi
cmp ecx, ebx
jne fcn.00414dd2
or esi, esi
add eax, 0xf948195b
dec edx
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x4f505c], 1
mov dword [0x4f5058], 1
mov dword [0x4f5054], 1
mov dword [0x4f504c], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x4f5014], eax
mov eax, dword [0x4f5068]
test eax, eax
je 0x4010b0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x4f507c]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x4f5064]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x4e706c], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060

Function at 0x401520
Capabilities:
Generate random numbers via winapi
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4f5028]
test eax, eax
jne 0x401577
mov dword [esp + 0x10], 0xf0000040
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x4f5028
mov eax, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x401577
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov eax, dword [0x4f5028]
lea edx, [ebp - 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], 4
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0xc]
and eax, 0x7fffffff
leave
ret
Function at 0x4120e0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x412140
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x4f5070]
test esi, esi
jle 0x412260
mov eax, dword [0x4f5074]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x412174
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4121f7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x412160
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x412287
mov eax, dword [0x4f5074]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x4f5074]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x412267
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4121f0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x412200
add dword [0x4f5070], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x4f5074]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4121f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x41217e
mov eax, dword [0x4f5074]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x412720
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4f508c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4f5084]
sub esp, 4
test ebx, ebx
je 0x412775
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x41276e
test esi, esi
je 0x41276e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x412750
mov dword [esp], 0x4f508c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x412aa0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x412ac5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x412ad0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x412ac5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x412b18
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x412b0e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x412b1a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x412b00
xor eax, eax
pop ebx
pop esi
ret

Function at 0x413000
Capabilities:
Print debug messages

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x34
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413020
add esp, 0x34
pop ebx
pop esi
ret
lea edx, [esp + 0x2c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
sub esp, 0x1c
test eax, eax
jne 0x413070
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x413011
int3
mov eax, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esp], eax
call esi
sub esp, 4
mov dword [esp], ebx
call esi
sub esp, 4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
jmp 0x413060
Function at 0x4130a0
Capabilities:
Check mutex on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp + 8], 0x4f5104
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
jne 0x413168
mov edx, dword [0x4f50c0]
mov eax, dword [edx + 4]
test eax, eax
je 0x413130
cmp edx, 0x4f50c0
jne 0x413115
mov dword [0x4f50c0], eax
cmp eax, 0x4f50c0
je 0x41311c
lea esi, [esi]
nop
test eax, eax
je 0x413145
mov edx, dword [edx]
mov dword [eax], edx
mov edx, eax
mov eax, dword [edx + 4]
cmp eax, 0x4f50c0
jne 0x413108
mov eax, dword [0x4f50c4]
mov dword [edx + 4], eax
test eax, eax
je 0x413145
mov edx, eax
jmp 0x413112
mov dword [esp], 0x4f5140
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x413185
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
mov eax, 0x4ed784
call dbg.__eh_shmem_get_error
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
movzx eax, ax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
sub esp, 4
jmp 0x413145
Function at 0x4131a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + edx + 0x1c]
mov ecx, eax
and eax, 0xf
shr cl, 4
add eax, 0x61
add ecx, 0x41
mov byte [edx + edx + 0x4f5105], al
mov byte [edx + edx + 0x4f5104], cl
add edx, 1
cmp edx, 4
jne 0x4131b3
xor eax, eax
mov edx, 0x5f
jmp 0x4131ef
movzx edx, byte [eax + str.__eh_shmem3_gcc_tdm_]
mov byte [eax + 0x4f510c], dl
add eax, 1
cmp eax, 0x15
jne 0x4131e8
xor eax, eax
mov edx, 0x5f
jmp 0x413217
movzx edx, byte [eax + str.__eh_shmem3_gcc_tdm_]
mov byte [eax + 0x4f5140], dl
add eax, 1
cmp eax, 0x14
jne 0x413210
mov byte [0x4f5154], 0x2d
mov dword [0x4f5155], 0x61616161
mov dword [0x4f5159], 0x61616161
mov dword [0x4f515d], 0x61616161
mov dword [0x4f5161], 0x61616161
mov dword [0x4f5165], 0x61616161
mov dword [0x4f5169], 0x61616161
mov dword [0x4f516d], 0x61616161
mov dword [0x4f5171], 0x61616161
mov byte [0x4f5175], 0
mov dword [esp + 8], 0x4f5104
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov esi, eax
test eax, eax
jne 0x41340a
mov dword [esp], 0x4f5140
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x413360
mov edx, 0x4f50c0
mov eax, 0x20
lea esi, [esi]
lea esi, [esi]
bt edx, eax
jae 0x413300
mov ecx, eax
neg ecx
mov byte [ecx + 0x4f5175], 0x41
sub eax, 1
jne 0x4132f0
mov dword [esp], 0x4f5140
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x4133f9
mov dword [esp], dbg.__eh_shmem3_gcc_tdm_cleanup_local_region
mov dword [0x4f50c0], 0x4f50c0
call sym.__onexit
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4f50c0]
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, ax
mov ebp, 0x20
mov edi, 1
mov dword [esp + 8], 0x36
mov dword [esp + 4], 0x4f5140
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
mov edx, eax
sub esp, 0xc
xor eax, eax
test edx, edx
je 0x41342a
lea esi, [esi]
cmp byte [eax + 0x4f5155], 0x41
jne 0x4133ab
mov ecx, ebp
mov edx, edi
sub ecx, eax
shl edx, cl
or esi, edx
add eax, 1
cmp eax, 0x20
jne 0x413398
mov eax, esi
mov dword [0x4f50c0], eax
jmp 0x4133cc
cmp edx, 0x4f50c0
je 0x413334
mov edx, eax
mov eax, dword [eax + 4]
test eax, eax
jne 0x4133c0
cmp edx, 0x4f50c0
je 0x413334
mov dword [edx + 4], 0x4f50c0
mov dword [esp], dbg.__eh_shmem3_gcc_tdm_cleanup_local_region
call sym.__onexit
jmp 0x413334
mov eax, 0x4ed7e0
call dbg.__eh_shmem_get_error
xor eax, eax
jmp 0x413351
mov eax, 0x4ed7bc
call dbg.__eh_shmem_get_error
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x4ed804
call dbg.__eh_shmem_get_error
xor eax, eax
jmp 0x4133b5
Function at 0x417660
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 8
mov eax, dword [0x4f51e0]
test eax, eax
je 0x4176e8
mov edx, dword [eax + 0x18]
test edx, edx
jne 0x417710
mov dword [eax + 0x18], 0x4e7030
mov ebx, 0x4e7030
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx], eax
mov eax, dword [0x4f51e0]
test eax, eax
je 0x4176c0
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x4176e0
mov dword [eax + 0x18], 0x4e7030
mov eax, 0x4e7030
cmp dword [eax], 0xffffffff
je sym._pthread_tls_init.cold
add esp, 8
pop ebx
ret
call sym.___shmem3_winpthreads_tdm_init_local_region
mov edx, eax
mov eax, dword [0x4f51e0]
mov edx, dword [edx + 0x18]
test edx, edx
je 0x41769c
test eax, eax
jne 0x4176e0
call sym.___shmem3_winpthreads_tdm_init_local_region
lea esi, [esi]
mov eax, dword [eax + 0x18]
jmp 0x4176a8
call sym.___shmem3_winpthreads_tdm_init_local_region
mov ebx, dword [eax + 0x18]
mov eax, dword [0x4f51e0]
test ebx, ebx
je 0x417678
test eax, eax
jne 0x417710
call sym.___shmem3_winpthreads_tdm_init_local_region
lea esi, [esi]
lea esi, [esi]
mov ebx, dword [eax + 0x18]
jmp 0x417684

Function at 0x417720
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push edi
xor eax, eax
mov ecx, 0x10
sub esp, 0x88
lea edi, [esp + 0x40]
mov dword [esp + 0x15], 0x6f727245
mov dword [esp + 0x19], 0x6c632072
mov dword [esp + 0x1d], 0x696e6165
mov dword [esp + 0x21], 0x7520676e
mov dword [esp + 0x25], 0x70732070
mov dword [esp + 0x29], 0x6b5f6e69
mov dword [esp + 0x2d], 0x20737965
mov dword [esp + 0x31], 0x20726f66
mov dword [esp + 0x35], 0x65726874
mov dword [esp + 0x39], 0x206461
mov dword [esp + 0x3d], 0
mov dword [esp + 0x7c], 0
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
je 0x4177fb
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x4177cd
cmp eax, 0x6a
je 0x4177ea
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0x4177c8
cmp eax, 0x6a
je 0x4177ea
add ecx, 2
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + ecx + 0x15], 0
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sym._abort
mov ecx, 0x28
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x4177e0
Function at 0x41a9d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41a9f2
call sym.__pthread_cleanup_dest.part.0
test byte [ebx + 0x20], 0x30
je 0x41aa69
mov eax, dword [0x4f51e0]
mov edx, eax
test eax, eax
je 0x41ab0f
cmp dword [eax + 0x18], 0
jne 0x41aa64
mov dword [eax + 0x18], 0x4e7030
mov eax, 0x4e7030
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41aa5b
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x41aa7d
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x41aa4e
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [ebx + 0x18], 0
test byte [ebx + 0x24], 4
jne 0x41aacf
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [edx + 0x18]
jmp 0x41aa19
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41aa91
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov dword [ebx + 0x18], 0
mov eax, ebx
mov esi, dword [ebx + 4]
call sym._push_pthread_mem
mov eax, dword [0x4f51e0]
test eax, eax
je 0x41ab51
cmp dword [eax + 0x18], 0
je 0x41ab01
mov eax, dword [eax + 0x18]
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x41aa5b
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
push edx
mov dword [ebx + 0x14], 0
call sym._push_pthread_mem
mov eax, dword [0x4f51e0]
mov edx, eax
test eax, eax
je 0x41ab75
cmp dword [eax + 0x18], 0
jne 0x41ab49
mov dword [eax + 0x18], 0x4e7030
mov eax, 0x4e7030
jmp 0x41aab8
call sym.___shmem3_winpthreads_tdm_init_local_region
cmp dword [eax + 0x18], 0
jne 0x41ab24
mov eax, dword [0x4f51e0]
jmp 0x41aa0d
mov edx, dword [0x4f51e0]
test edx, edx
jne 0x41aa64
call sym.___shmem3_winpthreads_tdm_init_local_region
mov eax, dword [eax + 0x18]
jmp 0x41aa19
mov edx, dword [0x4f51e0]
test edx, edx
je 0x41ab6b
mov eax, dword [edx + 0x18]
jmp 0x41aab8
call sym.___shmem3_winpthreads_tdm_init_local_region
mov edx, eax
mov eax, dword [0x4f51e0]
cmp dword [edx + 0x18], 0
je 0x41ab01
test eax, eax
jne 0x41aab5
call sym.___shmem3_winpthreads_tdm_init_local_region
jmp 0x41aab5
call sym.___shmem3_winpthreads_tdm_init_local_region
cmp dword [eax + 0x18], 0
jne 0x41ab3f
mov eax, dword [0x4f51e0]
jmp 0x41ab01
Function at 0x41c790
Capabilities:
Print debug messages

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x34
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41c7b0
add esp, 0x34
pop ebx
pop esi
ret
lea edx, [esp + 0x2c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
sub esp, 0x1c
test eax, eax
jne 0x41c800
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41c7a1
int3
mov eax, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esp], eax
call esi
sub esp, 4
mov dword [esp], ebx
call esi
sub esp, 4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
jmp 0x41c7f0

Function at 0x41c830
Capabilities:
Check mutex on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp + 8], 0x4f5240
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
jne 0x41c8f8
mov edx, dword [0x4f51e0]
mov eax, dword [edx + 4]
test eax, eax
je 0x41c8c0
cmp edx, 0x4f51e0
jne 0x41c8a5
mov dword [0x4f51e0], eax
cmp eax, 0x4f51e0
je 0x41c8ac
lea esi, [esi]
nop
test eax, eax
je 0x41c8d5
mov edx, dword [edx]
mov dword [eax], edx
mov edx, eax
mov eax, dword [edx + 4]
cmp eax, 0x4f51e0
jne 0x41c898
mov eax, dword [0x4f51e4]
mov dword [edx + 4], eax
test eax, eax
je 0x41c8d5
mov edx, eax
jmp 0x41c8a2
mov dword [esp], 0x4f5280
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x41c915
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
mov eax, str.failed_to_to_lock_cleanup_mutex_n
call sym.___shmem_get_error
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
movzx eax, ax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
sub esp, 4
jmp 0x41c8d5
Function at 0x429170
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x4ee120
mov esi, dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 4
mov dword [esp + 4], str.rand_s
mov dword [esp], eax
call ebx
sub esp, 8
test eax, eax
je 0x4291b8
mov dword [esp + 0x20], esi
mov dword [dbg.init_rand_s], eax
add esp, 0x14
pop ebx
pop esi
jmp eax
mov dword [esp], str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
sub esp, 4
mov dword [esp + 4], str.SystemFunction036
mov dword [esp], eax
call ebx
mov dword [0x4f5d90], eax
sub esp, 8
mov eax, dbg.mingw_rand_s
jmp 0x4291a3

Function at 0x42ca20
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
mov ebx, ecx
sub esp, 0x14
mov eax, dword [ecx + 0x20]
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._fread
mov edx, 0xffffffff
test eax, eax
jle 0x42ca58
movzx edx, byte [esi + eax - 1]
mov dword [ebx + 0x24], edx
add esp, 0x14
pop ebx
pop esi
ret 8

Function at 0x42ca70
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [ecx + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._fwrite
add esp, 0x1c
ret 8