joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ad51
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x42abbe
mov dword [esp], 0x6b2d80
call fcn.0042a312
mov eax, dword [0x433674]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x42ad98
mov eax, dword [ebp - 0x20]
jmp 0x42aee3
call fcn.00429ba6
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x42adaf
cmp dword [ebp - 0x20], 0
jne 0x42adb9
mov eax, 0
jmp 0x42aee3
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00429c9d
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x42ae8b
call sub.msvcrt.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x433674]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x42aee0
call sub.msvcrt.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42afa7
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.0042ad51
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.0042abe2
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x42b002
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_longjmp]
call eax
mov eax, dword [0x433674]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x42b12c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x42b094
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x42b051
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00429ab4
mov dword [ebp - 0x10], 0
mov eax, dword [0x433674]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x42b12c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x42b0c4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x42b12c
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00429ab4
mov dword [ebp - 0x10], 0
mov eax, dword [0x433674]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__endthreadex]
call eax
Function at 0x402b52
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ecx, 0x200005
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0xc]
mov al, byte [edx]
test al, al
je 0x402b8a
movzx esi, al
test byte [esi + esi + 0x4312c0], 6
jne 0x402b87
sub eax, 0x2b
cmp al, 0x15
ja 0x402bac
bt ecx, eax
jae 0x402bac
inc edx
jmp 0x402b68
mov dword [esp], ebx
mov dword [esp + 4], 2
call fcn.00405c30
and byte [ebx + 0x50], 0xfc
mov dword [ebp + 8], ebx
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp fcn.00417434
xor eax, eax
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0041bf29
mov eax, dword [ebx + 0x14]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00402263
test byte [ebx + 0x50], 0x40
je 0x402be9
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.0040f611
test eax, eax
jne 0x402be9
mov al, byte [ebx + 0x50]
and eax, 0x3f
or eax, 0xffffff80
mov byte [ebx + 0x50], al
mov dword [ebp + 8], ebx
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp fcn.0040f02e
Function at 0x411617
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
test esi, esi
je 0x411657
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll__read
mov edi, eax
cmp eax, 0xffffffff
jne 0x411651
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x41162a
jmp 0x411664
test eax, eax
js 0x411664
jne 0x41165e
sub ebx, dword [ebp + 0xc]
mov edi, ebx
jmp 0x411664
sub esi, eax
add ebx, eax
jmp 0x411626
add esp, 0x1c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x411704
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x8c
cmp dword [0x431980], 0
jne 0x411892
xor ebx, ebx
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], str.MAKE_TMPDIR
xor esi, esi
mov dword [ebp - 0x58], str.TMPDIR
mov dword [ebp - 0x54], 0x42dadb
mov dword [ebp - 0x50], str.TEMP
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov ebx, dword [eax]
test ebx, ebx
je 0x411862
mov dword [esp], ebx
call sub.msvcrt.dll_getenv
mov dword [0x431980], eax
test eax, eax
je 0x411859
cmp byte [eax], 0
je 0x411859
lea eax, [ebp - 0x48]
mov dword [esp + 4], eax
mov eax, dword [0x431980]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__stati64]
cmp eax, 0xffffffff
je 0x411791
test eax, eax
jns 0x41180e
jmp 0x41179c
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x411771
mov ecx, dword [sym.imp.msvcrt.dll__errno]
mov dword [ebp - 0x74], ecx
call ecx
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp], ebx
mov edi, dword [0x431980]
mov dword [ebp - 0x70], eax
call sub.msvcrt.dll_strlen
mov dword [esp], edi
mov esi, eax
call sub.msvcrt.dll_strlen
mov ecx, dword [ebp - 0x74]
add esi, eax
call ecx
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x70]
xor ecx, ecx
mov dword [esp + 0x10], edi
add esi, eax
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], str._s_value__s:__s
mov dword [esp + 4], esi
mov dword [esp], ecx
call fcn.0041215f
jmp 0x411854
mov ax, word [ebp - 0x42]
mov edi, dword [0x431980]
and ax, 0xf000
cmp ax, 0x4000
je 0x411898
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [esp], edi
mov esi, eax
call sub.msvcrt.dll_strlen
xor edx, edx
mov dword [esp + 0x10], edi
add esi, eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._s_value__s:_not_a_directory
mov dword [esp + 4], esi
mov dword [esp], edx
call fcn.0041215f
mov esi, 1
add dword [ebp - 0x6c], 4
jmp 0x411746
mov dword [0x431980], 0x42db11
test esi, esi
je 0x411892
xor eax, eax
mov dword [esp + 0xc], 0x42db11
mov dword [esp + 8], str.using_default_temporary_directory__s
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.0041215f
mov edi, dword [0x431980]
add esp, 0x8c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x411b18
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x2c
mov dword [esp], edx
call sub.msvcrt.dll__fileno
mov dword [esp + 4], 0x8000
mov edi, dword [sym.imp.msvcrt.dll__setmode]
mov dword [esp], eax
call edi
mov dword [esp], esi
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
call fcn.00421a10
inc edx
jne 0x411b6b
inc eax
jne 0x411b6b
mov dword [esp], str.lseek__
call sub.msvcrt.dll_perror
mov dword [esp + 8], 0x2000
mov dword [esp + 4], 0x4319c0
mov dword [esp], esi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
jne 0x411b9c
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x411b6b
mov dword [esp], str.read__
jmp 0x411bc9
test eax, eax
js 0x411b93
je 0x411bda
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], 0x4319c0
call sub.msvcrt.dll_fwrite
test eax, eax
jne 0x411bd0
mov dword [esp], str.fwrite__
call sub.msvcrt.dll_perror
jmp 0x411bda
mov dword [esp], ebx
call fcn.00425884
jmp 0x411b6b
mov dword [esp], ebx
call sub.msvcrt.dll__fileno
mov ecx, dword [ebp - 0x1c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call edi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41267f
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x2c
mov dword [ebp - 0x20], ecx
movzx edx, byte [ebx]
mov edi, ebx
inc ebx
mov eax, edx
test byte [edx + edx + 0x4312c0], 6
jne 0x41268f
cmp dl, 0x3a
je 0x4126eb
jg 0x4126cb
cmp dl, 0x26
je 0x41271f
jg 0x4126c0
mov edx, 1
test al, al
je 0x41284b
cmp al, 0x21
jmp 0x4126c3
cmp dl, 0x2b
je 0x41274c
jmp 0x412725
mov edx, 7
cmp al, 0x3d
je 0x41284b
cmp al, 0x3f
je 0x41274c
mov edx, 6
cmp al, 0x3b
je 0x41284b
jmp 0x412725
mov al, byte [edi + 1]
cmp al, 0x3d
je 0x412752
mov edx, 4
cmp al, 0x3a
jne 0x41284b
cmp byte [edi + 3], 0x3d
je 0x412712
lea ebx, [edi + 2]
mov edx, 5
jmp 0x41284b
lea ebx, [edi + 3]
mov edx, 7
jmp 0x41284b
cmp byte [edi + 1], 0x3a
je 0x41272c
mov edx, 2
jmp 0x412774
cmp byte [edi + 2], 0x3a
je 0x41273f
lea ebx, [edi + 2]
mov edx, 8
jmp 0x41284b
lea ebx, [edi + 3]
mov edx, 9
jmp 0x41284b
cmp byte [edi + 1], 0x3d
jne 0x412725
lea ebx, [edi + 2]
jmp 0x412715
cmp al, 0x3a
je 0x412795
jg 0x412786
cmp al, 0x26
je 0x41282c
cmp al, 0x2b
je 0x412804
cmp al, 0x24
je 0x4127c5
mov al, byte [ebx]
inc ebx
movzx ecx, al
test byte [ecx + ecx + 0x4312c0], 7
je 0x412757
jmp 0x41284a
cmp al, 0x3f
je 0x412804
cmp al, 0x5c
je 0x412809
cmp al, 0x3d
jmp 0x41282f
mov eax, ebx
sub eax, edi
cmp eax, 2
je 0x4127ae
jle 0x41284a
cmp byte [ebx - 3], 0x28
jne 0x41284a
movzx eax, byte [ebx - 2]
mov dword [ebp - 0x1c], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_isalpha]
mov edx, dword [ebp - 0x1c]
test eax, eax
jmp 0x41282f
mov al, byte [ebx]
lea ecx, [ebx + 1]
cmp al, 0x24
je 0x412837
test al, al
je 0x412848
cmp al, 0x28
je 0x4127e2
mov ebx, ecx
cmp al, 0x7b
jne 0x41283e
mov byte [ebp - 0x1c], 0x7d
jmp 0x4127e6
mov byte [ebp - 0x1c], 0x29
mov ebx, ecx
xor ecx, ecx
mov dl, byte [ebx]
test dl, dl
je 0x41283e
cmp dl, al
lea ebx, [ebx + 1]
jne 0x4127fa
inc ecx
jmp 0x4127ea
cmp dl, byte [ebp - 0x1c]
jne 0x4127ea
dec ecx
jns 0x4127ea
jmp 0x41283e
cmp byte [ebx], 0x3d
jmp 0x41282f
mov al, byte [ebx]
cmp al, 0x3d
je 0x412826
jg 0x41281e
sub eax, 0x3a
cmp al, 1
ja 0x412771
jmp 0x412826
cmp al, 0x5c
jne 0x412771
inc ebx
jmp 0x412771
cmp byte [ebx], 0x3a
jne 0x412771
jmp 0x41284a
mov ebx, ecx
jmp 0x412771
mov edx, 3
jmp 0x412771
mov ebx, ecx
dec ebx
test esi, esi
je 0x412851
mov dword [esi], edi
cmp dword [ebp - 0x20], 0
je 0x41285e
mov eax, dword [ebp - 0x20]
sub ebx, edi
mov dword [eax], ebx
add esp, 0x2c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x413b68
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov al, byte [esi + 1]
cmp al, 0x2f
je 0x413b83
test al, al
je 0x413b83
xor eax, eax
jmp 0x413bfb
xor eax, eax
mov dword [esp], str.__HOME_
mov edi, dword [0x431518]
mov dword [esp + 4], eax
mov dword [0x431518], eax
call fcn.004040e9
mov dword [0x431518], edi
mov ebx, eax
mov al, byte [eax]
mov edi, eax
test al, al
jne 0x413bca
mov dword [esp], ebx
call fcn.004258bc
mov dword [esp], 0x42e0f9
call sub.msvcrt.dll_getenv
mov ebx, eax
test eax, eax
je 0x413b7f
inc esi
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp], 2
call fcn.004113f2
mov dword [esp], eax
call fcn.004114b6
mov edx, edi
test dl, dl
je 0x413bfb
mov dword [esp], ebx
mov dword [ebp - 0x1c], eax
call fcn.004258bc
mov eax, dword [ebp - 0x1c]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41d11b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
lea esi, [ebp - 0x11d]
push ebx
sub esp, 0x14c
mov dword [esp + 4], esi
mov dword [esp], 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebx, eax
push ecx
push ecx
mov dword [ebp - 0x124], 0x6d745f65
mov dword [ebp - 0x128], 0x6b616d67
mov dword [ebp - 0x121], 0x66706d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x12c], eax
test ebx, ebx
jne 0x41d18c
mov dword [esp + 4], esi
mov edi, 1
mov dword [esp], 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push edx
mov ebx, eax
push edx
mov eax, dword [0x434164]
inc eax
mov dword [0x434164], eax
cmp eax, 0xffff
jbe 0x41d1de
cmp dword [0x434160], 0
jne 0x41d1de
mov dword [0x434160], 1
mov dword [0x434164], 1
jmp 0x41d1de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x41d29a
mov eax, dword [0x434164]
inc eax
mov dword [0x434164], eax
cmp eax, 0x10000
je 0x41d19e
lea ecx, [ebx + 0x22]
mov eax, dword [0x434164]
cmp ecx, 0x104
ja 0x41d2e5
test ebx, ebx
je 0x41d2e5
cmp eax, 0xffff
ja 0x41d2d6
cmp byte [ebp + ebx - 0x11e], 0x5c
mov ecx, 0x42f515
jne 0x41d219
mov ecx, 0x42f514
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 8], ecx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x128]
mov dword [esp + 0xc], eax
lea eax, [esi + ebx]
mov dword [esp + 4], str._s_s_u__x.tmp
mov dword [esp], eax
call fcn.0041cf34
xor eax, eax
mov dword [esp], esi
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], 0x4000180
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 0xc0010000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x41d1bd
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [sym.imp.msvcrt.dll__open_osfhandle]
jmp 0x41d2fb
cmp eax, 0xb7
je 0x41d1cc
test edi, edi
jne 0x41d2c8
mov dword [esp + 4], esi
mov edi, 1
mov dword [esp], 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ebx, eax
push edx
push edx
jmp 0x41d1de
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0xd
jmp 0x41d2f8
cmp dword [0x434160], 0
je 0x41d205
jmp 0x41d2ec
cmp eax, 0xffff
jbe 0x41d2f8
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0x11
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x41d681
Capabilities:
Check mutex on windows

Disassembly:
push ebp
xor eax, eax
xor edx, edx
mov ebp, esp
push ebx
sub esp, 0x24
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0xc], 1
mov dword [esp + 8], edx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov dword [0x434168], eax
test eax, eax
jne 0x41d6f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], 2
mov ebx, eax
call dword [0x428f30]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.CreateMutex:_error__lu_n
mov dword [esp], eax
call fcn.0041cf85
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0x27
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x41f872
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, edx
mov dword [ebp + 8], edx
mov edx, dword [ebp + 0xc]
and ecx, 4
pop ebp
jmp fcn.0041efe0
Function at 0x4210b4
Capabilities:
Parse pe header

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
jne 0x4210d9
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x4210d9
xor edx, edx
cmp word [eax + 0x18], 0x10b
sete dl
mov eax, edx
pop ebp
ret

Function at 0x4210dd
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
add edx, dword [edx + 0x3c]
movzx eax, word [edx + 0x14]
movzx esi, word [edx + 6]
lea eax, [edx + eax + 0x18]
cmp ebx, esi
jae 0x421111
mov edx, dword [eax + 0xc]
cmp ecx, edx
jb 0x42110b
add edx, dword [eax + 8]
cmp ecx, edx
jb 0x421113
inc ebx
add eax, 0x28
jmp 0x4210f9
xor eax, eax
pop ebx
pop esi
pop ebp
ret

Function at 0x421340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [ebp + 8]
call sub.msvcrt.dll__errno
xor ecx, ecx
mov dword [eax], ecx
test ebx, ebx
jne 0x421369
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
jmp 0x421379
cmp byte [ebx], 0
jne 0x421380
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
xor ebx, ebx
jmp 0x421463
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edx
cmp eax, 0xffffffff
jne 0x42139c
call sub.msvcrt.dll__errno
mov dword [eax], 2
jmp 0x421379
test al, 0x10
je 0x42136e
lea edi, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], edi
call sub.msvcrt.dll__fullpath
mov dword [esp], edi
call sub.msvcrt.dll_strlen
add eax, 0x233
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
jne 0x4213e2
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
jmp 0x421379
lea esi, [eax + 0x22c]
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
cmp byte [ebx + 0x22c], 0
je 0x421424
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov al, byte [ebx + eax + 0x22b]
cmp al, 0x5c
je 0x421424
cmp al, 0x2f
je 0x421424
mov dword [esp + 4], 0x42fbf0
mov dword [esp], esi
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x42fbf2
mov dword [esp], esi
call sub.msvcrt.dll_strcat
xor eax, eax
lea edx, [ebx + 0x120]
mov ecx, 0x41
mov dword [ebx + 0x228], eax
mov edi, edx
mov dword [ebx + 0x118], eax
mov dword [ebx + 0x11c], eax
xor eax, eax
mov dword [ebx + 0x224], 0xffffffff
rep stosd dword es:[edi], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x406550
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40676e
sub esp, 0x10
movzx eax, byte [0x5c23a6]
test al, al
jne 0x406746
mov eax, dword [0x5c2550]
mov ecx, dword [esp + 0x1c]
imul eax, ecx
mov edx, dword [esp + 0x18]
add eax, edx
mov ebx, dword [esp + 0x14]
jmp 0x406601
mov edx, dword [ebx]
xor edx, eax
nop
nop
imul eax, edx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
nop
mov edx, dword [ebx + 4]
xor edx, ebp
nop
nop
imul edx, edx, 0xc70f85e1
rol edx, 0xf
imul ebp, edx, 0x319bca41
nop
mov edx, dword [ebx + 8]
xor edx, esi
nop
nop
imul edx, edx, 0x319bca41
rol edx, 0xf
imul esi, edx, 0x8b421a21
nop
mov edx, dword [ebx + 0xc]
xor edx, edi
nop
nop
imul edx, edx, 0x8b421a21
rol edx, 0xf
imul edi, edx, 0xbce2d621
nop
add ecx, 0xfffffff0
add ebx, 0x10
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
jae 0x406591
xor eax, ebp
xor eax, esi
xor eax, edi
test ecx, ecx
je 0x4066a0
cmp ecx, 4
jb 0x406711
je 0x4066fa
cmp ecx, 8
jbe 0x4066c9
cmp ecx, 0x10
jbe 0x406643
mov ebp, dword [0x5c2554]
imul ebp, edx
mov esi, dword [0x5c2558]
imul esi, edx
mov edi, dword [0x5c255c]
imul edi, edx
jmp 0x4065f6
mov edx, ebx
lea ebp, [ecx + ebx - 8]
lea ecx, [ecx + ebx - 4]
mov ebx, dword [edx]
xor eax, ebx
nop
nop
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [edx + 4]
nop
nop
nop
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [ebp]
nop
nop
nop
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [ecx]
nop
nop
nop
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor ecx, eax
imul eax, ecx, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0x20], eax
add esp, 0x10
ret
mov edx, ebx
lea ecx, [ecx + ebx - 4]
mov edx, dword [edx]
xor eax, edx
nop
nop
imul edx, eax, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
xor edx, dword [ecx]
nop
nop
nop
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x4066a0
mov ecx, dword [ebx]
xor eax, ecx
nop
nop
imul ecx, eax, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x4066a0
mov edx, ebx
lea ebx, [ecx + ebx - 1]
movzx ebp, byte [edx]
xor eax, ebp
shr ecx, 1
movzx ecx, byte [edx + ecx]
shl ecx, 8
xor ecx, eax
nop
movzx edx, byte [ebx]
shl edx, 0x10
xor edx, ecx
nop
nop
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x4066a0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.0044a630
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
call fcn.00449270
jmp fcn.00406550