joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4191a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af78], 0
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x6af70], 0
jne 0x4191d7
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af78], 1
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af70], 0x10000
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af6c], 0
push 0x1fffc
push 0
mov edx, dword [ebp + 8]
add edx, 0x4af70
push edx
call dword [0x427b5c]
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax*8 + 0x424512]
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af98], ecx
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax*8 + 0x424510]
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af9c], ecx
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax*8 + 0x424514]
mov edx, dword [ebp + 8]
mov dword [edx + 0x6afa0], ecx
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax*8 + 0x424516]
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af94], ecx
cmp dword [ebp + 0xc], 2
jg 0x419262
mov eax, dword [ebp + 0x10]
movzx ecx, word [eax]
or ecx, 4
mov edx, dword [ebp + 0x10]
mov word [edx], cx
jmp 0x419277
cmp dword [ebp + 0xc], 8
jl 0x419277
mov eax, dword [ebp + 0x10]
movzx ecx, word [eax]
or ecx, 2
mov edx, dword [ebp + 0x10]
mov word [edx], cx
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af84], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af74], 0
mov dword [ebp - 4], 0x8000
mov edx, dword [ebp - 4]
shl edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x1af70
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af90], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x6af90], 0
je 0x4192de
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x6af90], 0xffffffff
jne 0x4192fa
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af8c], 1
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af90], 0
jmp 0x419373
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af8c], 0
mov edx, dword [ebp + 8]
cmp dword [edx + 0x6af90], 0x106
jae 0x419322
mov eax, dword [ebp + 8]
push eax
call fcn.00419660
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af7c], 0
mov dword [ebp - 4], 0
jmp 0x419341
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 2
jae 0x419373
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x6af7c]
shl ecx, 5
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx + 0x1af70]
xor ecx, eax
and ecx, 0x7fff
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af7c], ecx
jmp 0x419338
mov esp, ebp
pop ebp
ret
Function at 0x41b020
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x41b030
xor eax, eax
jmp 0x41b1cd
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x41b18e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x424560]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x424560]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x424560]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x424560]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x424560]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x424560]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x424560]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x424560]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x41b039
cmp dword [ebp + 0x10], 0
je 0x41b1c7
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x424560]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x41b194
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x41b1d0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, dword [ecx]
and eax, 0xff
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
shr ecx, 8
xor ecx, dword [eax*4 + 0x424560]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0xff
mov edx, dword [ebp + 8]
add ecx, dword [edx + 4]
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
imul edx, edx, 0x8088405
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shr edx, 0x18
mov eax, dword [ebp + 8]
xor edx, dword [eax + 8]
and edx, 0xff
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x424560]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
pop ebp
ret
Function at 0x43c04c
Capabilities:
Access peb ldr_data

Disassembly:
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov edi, dword [eax + 0x10]
call 0x43c061
pop esi
lea edx, [esi + 0x19f]
lea ecx, [edx + 0x80]
lea ebx, [esi + 0x29f]
lea ebp, [ebx + 0x20]
push edx
push ecx
push ebx
push ebp
call section.sect_4
add esp, 0x10
mov dword [edi + 0x279b4], edx
lea edx, [esi + 0x21f]
lea ecx, [edx + 0x80]
lea ebx, [esi + 0x2bf]
lea ebp, [ebx + 0x20]
push edx
push ecx
push ebx
push ebp
call section.sect_4
add esp, 0x10
mov dword [edi + 0x2730c], edx
popal
ret

Function at 0x43c0b2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
sub ebp, 1
jne 0x43c0b3
pop ebp
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov edi, dword [eax + 0x10]
call 0x43c0cd
pop esi
lea edx, [edi + 0x1000]
lea ecx, [edx + 0x1c800]
lea ebx, [esi + 0x273]
lea ebp, [ebx + 0x20]
push edx
push ecx
push ebx
push ebp
call section.sect_4
add esp, 0x10
lea eax, [edi + 0x8430]
jmp eax
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40701c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x407028
push 0x407024
push 0x407020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x407028]
push dword [0x407024]
push dword [0x407020]
mov dword [0x407014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push esi
push edi
xor edi, edi
mov dword [ebp - 0x84], 0
call fcn.004019a8
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, edi
or al, 0x40
push eax
lea eax, [0x4046e9]
lea edx, [fcn.00401a2c]
sub eax, edx
push eax
push fcn.00401a2c
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x401337
push edi
call fcn.00401883
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.004018d1
add esp, 0xc
mov eax, edi
add eax, 0x1e200
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x88]
mov edx, edi
inc edx
imul eax, edx
push eax
or edi, edi
je 0x401328
mov esi, 0
jmp 0x40132e
lea esi, [0x4070e4]
push esi
call fcn.00401a2c
add esp, 0xc
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x4019a8
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
and dword [ebp - 0x120], 0
xor edi, edi
push 0
push 0
call sub.USER32.DLL_GetWindow
push 0
push 0
call sub.SHLWAPI.DLL_PathAppendA
mov dword [ebp - 0x11c], 0x14
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
push 1
push 1
lea eax, [ebp - 0x104]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringW
call sub.KERNEL32.dll_GetLastError
push 0
push 0
call sub.SHLWAPI.DLL_PathAppendW
movzx eax, word [ebp - 0x118]
mov edi, eax
sub edi, 0x41
mov eax, edi
pop edi
leave
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x5a321933
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..text_1
nop
nop
mov ebx, 0x42f314
mov ecx, 0x59975903
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x408b71
Capabilities:
Create thread

Disassembly:
mov eax, 0x412d3b
call fcn.00411ca0
sub esp, 0xcc
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x78]
mov ecx, dword [edi + 0x18]
push dword [ecx + eax*8 + 4]
lea eax, [ecx + eax*8]
lea ecx, [ebp - 0xd8]
push dword [eax]
call fcn.0040822f
lea esi, [edi + 0x70]
lea eax, [ebp - 0xd8]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0040949b
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov ecx, dword [ecx + eax*4 - 4]
call fcn.00408378
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov eax, dword [edi + 0xb8]
mov ecx, dword [edx + ecx*4 - 4]
mov dword [ecx + 0x64], eax
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + eax*4 - 4]
lea ecx, [edi + 0xa0]
mov eax, dword [eax + 0x68]
push dword [eax]
call fcn.004093a8
mov dword [ebp - 0x14], ebx
add edi, 0x84
push ebx
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00409546
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov edx, dword [edi + 0xc]
mov eax, dword [ecx + eax*4 - 4]
mov ecx, dword [edi + 8]
lea esi, [edx + ecx*4 - 4]
lea ecx, [ebp - 0x10]
push ecx
push ebx
push eax
push 0x408c67
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
pop edi
pop esi
cmp eax, ebx
pop ebx
jne 0x408c4c
lea eax, [ebp - 0x10]
push 0x414b80
push eax
mov dword [ebp - 0x10], 0x425d0
call sub.MSVCRT.dll__CxxThrowException
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd8]
call fcn.004083ed
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x1f22aa8
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4be0527a
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x40464f9
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x65f268a3
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x562810d9
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
cmp eax, 1
je 0x56281105
test eax, eax
je 0x56281195
cmp eax, 3
jne 0x562810fb
push 0
call fcn.5628501d
add esp, 4
mov eax, 1
pop esi
pop ebx
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, eax
mov ebx, eax
and esi, 0xff
cmp esi, 3
je 0x56285c4b
inc dword [section..data]
call fcn.56283918
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [0x562b100c], eax
mov dword [sym.MSVCRT20.dll__winmajor], esi
shl esi, 8
mov al, bh
shr ebx, 0x10
and eax, 0xff
add esi, eax
mov dword [sym.MSVCRT20.dll__winminor], eax
mov dword [sym.MSVCRT20.dll__winver], esi
mov dword [sym.MSVCRT20.dll__osver], ebx
call fcn.562850b9
test eax, eax
je 0x56285c75
call fcn.56283727
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [sym.MSVCRT20.dll__acmdln], eax
call fcn.5628379a
mov dword [sym.MSVCRT20.dll__wcmdln], eax
call fcn.56282e20
call fcn.562837ff
call fcn.562851ee
jmp 0x562810fb
mov eax, dword [section..data]
test eax, eax
jle 0x56285c8b
dec eax
cmp dword [0x562b12a4], 0
mov dword [section..data], eax
je 0x56285c81
call fcn.56285697
call fcn.562857e4
jmp 0x562810fb
test ebx, 0x80000000
je 0x5628111e
push 0x12000
push 0x562b1018
push str.Error:_This_version_of_MSVCRT20.DLL_is_not_compatible_nwith_Win32s.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x56281100
call fcn.562857e4
xor eax, eax
jmp 0x56281100
call sym.MSVCRT20.dll__c_exit
jmp 0x562811b5
xor eax, eax
jmp 0x56281100
Function at 0x56284fbb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x70
xor edi, edi
push 1
call sym.MSVCRT20.dll_calloc
add esp, 8
mov esi, eax
cmp esi, edi
je 0x56288c5d
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push 0x56284f54
mov dword [esi + 0x48], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x14], 1
mov dword [esi + 0x50], 0x562b11e0
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x56288c55
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call sym.MSVCRT20.dll_free
add esp, 4
test edi, edi
je 0x56288c73
push edi
call fcn.56290737
add esp, 4
xor eax, eax
jmp 0x56285019

Function at 0x5628501d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x562b1434], 0xffffffff
push esi
je 0x56285088
mov esi, dword [esp + 8]
test esi, esi
je 0x5628508a
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x56288c7a
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x56288c88
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x56288c96
mov eax, dword [esi + 0x38]
test eax, eax
jne 0x56288ca4
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x56288cb2
mov eax, dword [esi + 0x44]
test eax, eax
jne 0x56288cc0
push esi
call sym.MSVCRT20.dll_free
add esp, 4
push 0
mov eax, dword [0x562b1434]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
ret
mov eax, dword [0x562b1434]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x5628507a
jmp 0x5628502f
push eax
call sym.MSVCRT20.dll_free
add esp, 4
jmp 0x5628503a
push eax
call sym.MSVCRT20.dll_free
add esp, 4
jmp 0x56285045
push eax
call sym.MSVCRT20.dll_free
add esp, 4
jmp 0x56285050
push eax
call sym.MSVCRT20.dll_free
add esp, 4
jmp 0x5628505b
push eax
call sym.MSVCRT20.dll_free
add esp, 4
jmp 0x56285066
push eax
call sym.MSVCRT20.dll_free
add esp, 4
jmp 0x56285071

Function at 0x5628509e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x562b1434]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x56288cce
mov eax, esi
pop esi
ret
push 0x70
push 1
call sym.MSVCRT20.dll_calloc
add esp, 8
mov esi, eax
test esi, esi
je 0x56288d13
push esi
mov eax, dword [0x562b1434]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x56288d13
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x14], 1
mov dword [esi + 0x50], 0x562b11e0
jmp 0x562850b5
push 0x10
call sym.MSVCRT20.dll__amsg_exit
add esp, 4
jmp 0x562850b5
Function at 0x562850b9
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.56283706
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x562b1434], eax
cmp eax, 0xffffffff
je 0x56288d22
push 0x70
push 1
call sym.MSVCRT20.dll_calloc
add esp, 8
mov esi, eax
test esi, esi
je 0x56288d22
push esi
mov eax, dword [0x562b1434]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x56288d22
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov eax, 1
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], 0x562b11e0
mov dword [esi + 0x14], 1
pop esi
ret
xor eax, eax
jmp 0x56285120

Function at 0x56285943
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
call fcn.56281d69
mov dword [0x562b12a4], 1
cmp dword [esp + 0x10], 0
mov ebx, dword [esp + 0x14]
mov byte [0x562b12a0], bl
jne 0x562859a4
cmp dword [0x562afbc4], 0
je 0x56285992
mov esi, dword [0x562afbc0]
sub esi, 4
cmp esi, dword [0x562afbc4]
jb 0x56285992
mov eax, dword [esi]
test eax, eax
je 0x56285987
call eax
sub esi, 4
cmp esi, dword [0x562afbc4]
jae 0x5628597f
push 0x562b8314
push 0x562b8304
call sym.MSVCRT20.dll__initterm
add esp, 8
push 0x562b831c
push 0x562b8318
call sym.MSVCRT20.dll__initterm
add esp, 8
test ebx, ebx
jne 0x56288f7b
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.562851e3
pop esi
pop ebx
ret

Function at 0x56290f57
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x56290f7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.56290737
add esp, 4
mov eax, 0xffffffff
ret
test al, 1
je 0x56290fa3
test byte [esp + 8], 2
je 0x56290fa3
call sym.MSVCRT20.dll__errno
mov dword [eax], 0xd
call sym.MSVCRT20.dll___doserrno
mov dword [eax], 5
mov eax, 0xffffffff
jmp 0x56290f7a
xor eax, eax
jmp 0x56290f7a

Function at 0x56291016
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
xor edi, edi
push 0x70
push 1
call sym.MSVCRT20.dll_calloc
add esp, 8
mov esi, eax
cmp esi, edi
je 0x5629106d
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
push esi
mov dword [esi + 0x48], eax
push 4
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x14], 1
mov dword [esi + 0x50], 0x562b11e0
push esi
push 0x5629109b
push dword [esp + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov edi, eax
test edi, edi
jne 0x5629108b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call sym.MSVCRT20.dll_free
add esp, 4
test edi, edi
je 0x56291083
push edi
call fcn.56290737
add esp, 4
mov eax, 0xffffffff
pop edi
pop esi
ret
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x56291065
mov eax, edi
jmp 0x56291088
Function at 0x5629127f
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x562912e4
lea eax, [ebp - 0x10c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x562912e4
mov byte [ebp - 4], 0x3d
movzx eax, byte [ebp - 0x10c]
push eax
call fcn.562caedf
add esp, 4
lea ecx, [ebp - 4]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
mov byte [ebp - 3], al
lea eax, [ebp - 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
mov eax, 0
jne 0x562912f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.56290737
add esp, 4
mov eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x562912fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp - 0x104]
xor esi, esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x5629133a
cmp byte [ebp - 0x103], 0x3a
jne 0x5629133a
movzx eax, byte [ebp - 0x104]
push eax
call sym.MSVCRT20.dll_toupper
add esp, 4
lea esi, [eax - 0x40]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x56291341
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 1
jl 0x562913ac
cmp ebx, 0x1f
jg 0x562913ac
push 0xc
add bl, 0x40
call fcn.56281b67
add esp, 4
mov byte [ebp - 4], bl
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0
lea ebx, [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x5629138c
push 0xc
call fcn.562810c3
add esp, 4
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.56290737
add esp, 4
push 0xc
call fcn.562810c3
add esp, 4
mov eax, 0xffffffff
jmp 0x56291387
call sym.MSVCRT20.dll__errno
mov dword [eax], 0xd
call sym.MSVCRT20.dll___doserrno
mov dword [eax], 0xf
jmp 0x562913a5

Function at 0x562913c4
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x562913ef
test byte [esp + 0xc], 0x80
je 0x56291405
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
mov eax, 0
jne 0x56291403
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.56290737
add esp, 4
mov eax, 0xffffffff
pop esi
ret
or al, 1
jmp 0x562913de