joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409454
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x4094e3
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040444c
push dword [ebp - 0x10c]
push 0x4094f8
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4094ea
lea eax, [ebp - 0x10c]
call fcn.004041ec
lea eax, [ebp - 4]
call fcn.004041ec
ret

Function at 0x4094fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
jmp loc.00419334

Function at 0x409624
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], edx
mov esi, eax
mov eax, esi
call fcn.00404464
mov edi, eax
mov ebx, edi
cmp ebx, 1
jl 0x409662
jmp loc.00418efd
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x409668
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], edx
mov esi, eax
mov eax, esi
call fcn.00404464
mov edi, eax
mov ebx, edi
cmp ebx, 1
jl 0x4096a2
mov al, byte [esi + ebx - 1]
cmp al, 0x2e
jne 0x40969d
mov eax, dword [esp]
push eax
mov ecx, edi
sub ecx, ebx
lea edx, [ebx + 1]
mov eax, esi
jmp loc.0041baa0
dec ebx
test ebx, ebx
jne 0x409681
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4096a8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, esi
call fcn.00404464
mov ebx, eax
mov eax, edi
mov edx, ebx
jmp loc.00418df3

Function at 0x4097b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x578], ebx
mov dword [ebp - 0x568], ebx
mov dword [ebp - 0x56c], ebx
mov dword [ebp - 0x570], ebx
mov dword [ebp - 0x574], ebx
jmp loc.00414248

Function at 0x409afc
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
xor edx, edx
mov dword [ebp - 0x194], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409b71
jmp loc.0041384b

Function at 0x409c74
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x198], edx
mov dword [ebp - 0x194], edx
mov edi, eax
xor eax, eax
push ebp
push 0x409d8a
jmp loc.00414270

Function at 0x409dd8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, edx
mov eax, ebx
call fcn.00404664
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409df5
and eax, 0x10
cmp eax, 0x10
je 0x409df9
xor eax, eax
jmp 0x409dfb
mov al, 1
neg al
sbb eax, eax
pop ebx
ret
Function at 0x409e04
Capabilities:
Packed with generic packer

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
jmp loc.0041b2cc

Function at 0x40a060
Capabilities:
Connect network resource
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x54], ecx
jmp loc.004165a9

Function at 0x40a62c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
jmp loc.00418a5d

Function at 0x40a914
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ecx
mov ebx, eax
mov eax, dword [0x40b19c]
mov dword [eax], 0xffffffff
call fcn.00402bcc
test bx, bx
jbe 0x40a949
push 0
jmp loc.0041a0b0
pop edx
pop ebx
ret

Function at 0x4135ab
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push edi
push 0x8001
push ebx
push ebx
cmp eax, ebx
add esp, 0x14
leave
popal
popfd
call fcn.00405694
jmp fcn.0040750a

Function at 0x413e59
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
xor al, 0
pop edi
push ebx
dec edi
pop edi
dec edi
add al, 6
add al, 0x3f
dec ecx
and al, 0
add al, 0
popal
popfd
call sub.kernel32.dll_GetStartupInfoA
jmp loc.00401177

Function at 0x414ed3
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
pop eax
push ebx
dec edi
pop edi
dec edi
mov dh, 2
push ebx
dec ecx
xchg edx, eax
xor al, 0
leave
popal
popfd
jmp fcn.0040297c

Function at 0x416602
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
pop edi
push ebx
dec edi
pop edi
dec edi
add al, cl
dec ecx
and al, 0
add al, 0
popal
popfd
push 0xeedfadf
jmp loc.004039dc

Function at 0x4192d5
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0x60
push 0x411538
push eax
mov edi, 0x94
push edi
push 0
mov ebx, dword [0x40f08c]
push eax
add esp, 0x18
leave
popal
popfd
mov eax, dword [edx + 0xc]
and dword [eax + 4], 0xfffffffd
jmp loc.00403c41
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x57fb08
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x57fb04]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call sym.__amsg_exit
jmp 0x4011d3
mov eax, dword [0x57fb04]
test eax, eax
jne 0x4011c9
mov dword [0x57fb04], 1
mov dword [esp + 4], 0x582014
mov dword [esp], 0x58200c
call sym.__initterm
jmp 0x4011d3
mov dword [0x57f01c], 1
mov eax, dword [0x57fb04]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x582008
mov dword [esp], section..CRT
call sym.__initterm
mov dword [0x57fb04], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x57fb08
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call sym.__pei386_runtime_relocator
mov dword [esp], sym.__gnu_exception_handler_4
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x57f074], eax
mov dword [esp], sym.___mingw_invalidParameterHandler
call sym.__set_invalid_parameter_handler
call sym.__fpreset
mov eax, dword [0x57f004]
mov dword [esp + 4], 0x57f008
mov dword [esp], eax
call sym._duplicate_ppstrings
call sym.___main
mov eax, dword [0x4d521c]
mov edx, dword [0x57f00c]
mov dword [eax], edx
mov ecx, dword [0x57f00c]
mov edx, dword [0x57f008]
mov eax, dword [0x57f004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._main
mov dword [0x57f014], eax
mov eax, dword [0x57f018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x57f014]
mov dword [esp], eax
call sym._exit
mov eax, dword [0x57f01c]
test eax, eax
jne 0x4012de
call sym.__cexit
mov eax, dword [0x57f014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x57f04c], 1
mov dword [0x57f050], 1
mov dword [0x57f054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret
Function at 0x401d97
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x1154
call fcn.0040ef34
sub esp, eax
mov dword [ebp - 0x1038], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1038]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1000
lea eax, [ebp - 0x1034]
mov dword [esp], eax
call sym._EnumProcesses_12
sub esp, 0xc
test eax, eax
sete al
test al, al
je 0x401df5
mov eax, 0
jmp 0x401f2b
mov eax, dword [ebp - 0x1038]
shr eax, 2
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x401ef3
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x1034]
test eax, eax
je 0x401eef
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x1034]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x410
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
call eax
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 0xc], 0x104
lea eax, [ebp - 0x113c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._GetModuleBaseNameA_16
sub esp, 0x10
lea eax, [ebp - 0x19]
mov dword [ebp - 0x18], eax
nop
nop
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x19]
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
sub esp, 8
lea eax, [ebp - 0x113c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp], eax
call method.bool_std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
mov ebx, eax
lea eax, [ebp - 0x34]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea eax, [ebp - 0x19]
mov ecx, eax
call method.std::__new_allocator_char_.__new_allocator__
nop
test bl, bl
je 0x401edf
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x1034]
jmp 0x401f2b
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jb 0x401e0d
mov eax, 0
jmp 0x401f2b
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x401f30
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call eax
sub esp, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401f86
mov eax, 0xffffffff
jmp 0x40203e
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x401fc2
mov eax, 0xffffffff
jmp 0x40203e
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call eax
sub esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402039
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, 0
jmp 0x40203e
mov eax, 0xffffffff
leave
ret
Function at 0x402040
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 0x18
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x402089
mov eax, 0xffffffff
jmp 0x4021c8
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x10]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x800c
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x4020cb
mov eax, 0xffffffff
jmp 0x4021c8
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0x14]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptHashData]
call eax
sub esp, 0x10
test eax, eax
sete al
test al, al
je 0x402104
mov eax, 0xffffffff
jmp 0x4021c8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x14]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], 0x6610
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x402145
mov eax, 0xffffffff
jmp 0x4021c8
mov eax, dword [ebp - 0x14]
lea edx, [ebp + 0xc]
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
call eax
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x40218b
mov eax, 0xffffffff
jmp 0x4021c8
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call eax
sub esp, 8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
call eax
sub esp, 4
mov eax, 0
leave
ret
Function at 0x4021ca
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x14], 0x5d40505c
mov dword [ebp - 0x24], 0x6475676b
mov dword [ebp - 0x20], 0x36707163
mov dword [ebp - 0x1c], 0x376d3965
mov dword [ebp - 0x18], 0x74455452
mov dword [esp + 0xc], 0x10
lea eax, [ebp - 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], 4
lea eax, [ebp - 0x14]
mov dword [esp], eax
call sym.XOR_char__unsigned_int__char__unsigned_int_
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4d717a
lea eax, [ebp - 0x14]
mov dword [esp], eax
call sym._sscanf_s
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
jmp 0x40224c
mov eax, dword [ebp - 0xc]
shl eax, 5
mov edx, eax
mov eax, dword [ebp - 0xc]
add edx, eax
mov eax, dword [ebp - 0x10]
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov dword [ebp + 8], edx
movzx eax, byte [eax]
movsx eax, al
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne al
test al, al
jne 0x402237
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x40df84
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort

Function at 0x40eb58
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40eb77
mov eax, 0
jmp 0x40ebbb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40eb9a
mov eax, 0
jmp 0x40ebbb
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40ebb6
mov eax, 0
jmp 0x40ebbb
mov eax, 1
leave
ret

Function at 0x40ebbd
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x40ec1c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x40ec14
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x40ec14
mov eax, dword [ebp - 4]
jmp 0x40ec30
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x40ebf1
mov eax, 0
leave
ret
Function at 0x420700
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
cmp dword [ebp + 8], 0
je 0x4207c8
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._pthread_spin_destroy
cmp eax, 1
jne 0x4207be
mov dword [ebp - 0x3d], 0
mov dword [ebp - 0x39], 0
mov dword [ebp - 0x35], 0
mov dword [ebp - 0x31], 0
mov dword [ebp - 0x2d], 0
mov dword [ebp - 0x29], 0
mov dword [ebp - 0x25], 0
mov dword [ebp - 0x21], 0
mov dword [ebp - 0x1d], 0
mov dword [ebp - 0x19], 0
mov dword [ebp - 0x15], 0
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
mov byte [ebp - 9], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 4], 0x35
lea eax, [ebp - 0x3d]
mov dword [esp], eax
call sym._snprintf
lea eax, [ebp - 0x3d]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sym._abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x4207c9
nop
leave
ret
Function at 0x4215bd
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call eax
mov dword [0x4d526c], eax
mov eax, dword [0x4d526c]
cmp eax, 0xffffffff
jne 0x4215de
call sym._abort
nop
leave
ret

Function at 0x42174e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], sym._pthread_tls_init
mov dword [esp], 0x57fac4
call sym.__pthread_once_raw
mov eax, dword [0x4d526c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x421795
mov eax, dword [ebp - 0x20]
jmp 0x4218e0
call sym._pop_pthread_mem
mov dword [ebp - 0x20], eax
mov eax, entry3
test eax, eax
je 0x4217ac
cmp dword [ebp - 0x20], 0
jne 0x4217b6
mov eax, 0
jmp 0x4218e0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._replace_spin_keys
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x421888
call sym._abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x4d526c]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x4218dd
call sym._abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret