joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410230
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, word [0x44c428]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
imul esi, dword [ebp + 0x10]
sub eax, 0x6f2f13b8
mov word [0x44c428], ax
mov dword [ebp - 4], 0
fld qword [0x44c0d8]
fsub qword [0x446280]
fstp qword [0x44c0d8]
test esi, esi
jne 0x41028f
mov cx, word [0x44c0b4]
movsx edx, cx
mov eax, 0x114ec47
sub eax, edx
add dword [0x44c3f0], eax
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
fld dword [0x44c1a4]
fsub qword [0x446278]
fadd qword [0x44c378]
mov eax, dword [0x44c280]
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
fmulp st(1)
fistp qword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [0x44c280], ecx
mov ecx, dword [ebp + 0x14]
fld qword [0x44c378]
fld1
fadd st(1), st(0)
fxch st(1)
fstp qword [0x44c378]
fsubr dword [0x44c1a4]
fstp dword [0x44c1a4]
call fcn.00414c50
movzx edx, word [0x44c1cc]
imul edx, edx, 0x1d442fd7
push 0
lea ecx, [ebp - 4]
push ecx
mov word [0x44c1cc], dx
mov edx, dword [ebp + 8]
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
fld dword [0x44c248]
mov eax, dword [ebp - 4]
fsub qword [0x446270]
div edi
fstp dword [0x44c248]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41ab00
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
fld qword [0x44c110]
fsub qword [0x445a80]
fstp qword [0x44c110]
fld dword [0x44c2ec]
fadd qword [0x44c110]
mov eax, dword [0x44c300]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fmulp st(1)
fistp qword [ebp - 8]
mov edx, dword [ebp - 8]
mov dword [0x44c300], edx
mov dword [ecx], 0
add dword [0x44c21c], 0x971dc2d3
mov dword [ecx + 4], 0
fld dword [0x44c284]
fmul qword [0x446568]
fstp dword [0x44c284]
mov dword [ecx + 8], 0x67452301
fld dword [0x44c214]
mov eax, dword [0x44c168]
fsub qword [0x446560]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
faddp st(1)
fistp qword [ebp - 8]
mov edx, dword [ebp - 8]
mov dword [0x44c168], edx
mov dword [ecx + 0xc], 0xefcdab89
fld dword [0x44c2bc]
fmul qword [0x446558]
fstp dword [0x44c2bc]
mov dword [ecx + 0x10], 0x98badcfe
fld qword [0x44c0c0]
fmul qword [0x446550]
fstp qword [0x44c0c0]
mov dword [ecx + 0x14], 0x10325476
fld qword [0x44c268]
mov ax, word [0x44c1cc]
fsubr qword [0x446548]
movsx ecx, ax
mov dword [ebp - 4], ecx
fsub qword [0x446540]
fild dword [ebp - 4]
faddp st(1)
fistp qword [ebp - 8]
mov dx, word [ebp - 8]
mov word [0x44c1cc], dx
mov esp, ebp
pop ebp
ret
Function at 0x41d660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
fld dword [0x44c164]
sub esp, 0x10
fld1
fadd st(1), st(0)
fxch st(1)
fstp dword [0x44c164]
fld dword [0x44c164]
fadd qword [0x446680]
fcomp qword [0x446678]
fnstsw ax
test ah, 0x44
jp 0x41d6a2
mov eax, dword [0x44c054]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fstp qword [0x44c100]
push esi
or esi, 0xffffffff
add word [0x44c210], si
movzx ecx, word [0x44c210]
mov edx, dword [0x44c298]
movsx eax, cx
lea eax, [edx + eax + 0x986b12e]
mov dword [0x44c298], eax
movzx ecx, word [0x44c020]
movsx eax, cx
sub dword [0x44c2f8], eax
movzx eax, word [0x44c428]
imul eax, eax, 0x29a7a307
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov word [0x44c428], ax
mov eax, dword [0x44c0f8]
add eax, dword [0x44c16c]
push edi
mov dword [0x44c16c], eax
add dword [0x44c0f8], esi
add word [0x44c3ec], si
movzx eax, word [0x44c3ec]
mov esi, dword [0x44c3a0]
cwde
imul esi, eax
lea edi, [edx + ecx*4]
mov ecx, dword [ebp + 0x10]
mov dword [0x44c3a0], esi
cmp edx, edi
je 0x41d885
fld qword [0x446670]
push ebx
fld qword [0x446668]
fld qword [0x446660]
fld qword [0x446658]
fld dword [0x44c148]
fadd st(5)
fstp dword [0x44c148]
fld dword [0x44c314]
fld dword [0x44c148]
fsub qword [0x446650]
fadd dword [0x44c10c]
fsubp st(1)
fstp dword [0x44c314]
fld dword [0x44c10c]
fadd st(5)
fstp dword [0x44c10c]
xor dword [edx], ecx
fld qword [0x44c3a8]
fsub qword [0x446648]
fcomp qword [0x446640]
fnstsw ax
test ah, 1
jne 0x41d7b7
fld qword [0x44c228]
fadd qword [0x446638]
fstp qword [0x44c228]
inc dword [0x44c350]
ror ecx, 1
mov eax, ecx
movzx ecx, word [0x44c0e0]
movsx ecx, cx
mov dword [ebp + 0xc], ecx
mov ecx, dword [0x44c350]
mov dword [ebp + 8], eax
fild dword [ebp + 0xc]
mov dword [ebp + 0xc], ecx
shr eax, 8
add edx, 4
fild dword [ebp + 0xc]
fld qword [0x44c208]
fadd st(6)
fsubp st(1)
fsubp st(1)
fistp qword [ebp - 8]
movzx ecx, word [ebp - 8]
mov word [0x44c0e0], cx
mov cl, byte [ebp + 8]
fld dword [0x44c094]
add al, cl
fsub st(3)
add cl, al
mov byte [ebp + 9], al
mov byte [ebp + 8], cl
fstp dword [0x44c094]
mov si, word [0x44c2a0]
movzx ebx, word [0x44c23c]
movsx esi, si
lea esi, [ebx + esi - 0x65ba155]
mov word [0x44c23c], si
fld qword [0x44c440]
movzx eax, word [0x44c0b8]
fadd st(2)
movsx ecx, ax
fadd st(1)
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp + 8]
fild dword [ebp + 0xc]
fmulp st(1)
fistp qword [ebp - 0x10]
movzx eax, word [ebp - 0x10]
mov word [0x44c0b8], ax
fld qword [0x44c440]
fsub st(5)
fstp qword [0x44c440]
cmp edx, edi
jne 0x41d74e
fstp st(4)
pop ebx
fstp st(2)
fstp st(0)
fstp st(0)
mov edx, 0x3daa
fstp st(0)
pop edi
mov word [0x44c40c], dx
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41f7c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ax, word [0x44c414]
mov cx, word [0x44c414]
cwde
movsx edx, cx
sub eax, edx
sub esp, 8
cmp eax, 0x73484280
je 0x41f83c
fld dword [0x44c0a4]
fld qword [0x44c2e0]
fadd qword [0x447490]
fsubr qword [0x447488]
fcompp
fnstsw ax
test ah, 1
jne 0x41f83c
mov ax, word [0x44c074]
movsx ecx, ax
mov dword [ebp - 4], ecx
fild dword [ebp - 4]
fstp dword [ebp - 4]
fld dword [0x44c360]
fsubr dword [ebp - 4]
fistp qword [ebp - 8]
mov dx, word [ebp - 8]
mov word [0x44c074], dx
fld dword [0x44c360]
fadd qword [0x445a80]
fstp dword [0x44c360]
call fcn.00424af0
dec dword [0x44c190]
mov eax, dword [0x44c190]
mov cx, word [0x44c1d0]
inc word [0x44c1d0]
movsx edx, cx
add eax, 0x4e9728cc
cmp edx, eax
je 0x41f871
mov eax, 0xffff9ee9
mov word [0x44c308], ax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x436020
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [0x44c40c]
movsx ecx, ax
mov dword [ebp - 4], ecx
push esi
mov esi, 1
fild dword [ebp - 4]
fmul dword [str.4ZN]
fstp dword [str.4ZN]
add word [0x44c40c], si
call fcn.004242d0
fld dword [0x44c270]
fsub qword [0x44b260]
fmul dword [0x44c344]
fstp dword [0x44c344]
fld dword [0x44c270]
fadd qword [0x445a80]
fstp dword [0x44c270]
call fcn.004227b0
mov edx, dword [0x44c300]
add edx, dword [0x44c0e4]
push 0x442128
mov dword [0x44c0e4], edx
add dword [0x44c300], esi
push 0x442120
call fcn.00422970
movzx eax, word [0x44c1d0]
mov ecx, dword [0x44c298]
cwde
add ecx, eax
mov dword [ebp - 4], ecx
or eax, 0xffffffff
add esp, 8
fild dword [ebp - 4]
fmul qword [0x44c240]
fstp qword [0x44c240]
add dword [0x44c298], eax
add word [0x44c1d0], ax
call fcn.00401450
fld qword [0x44b258]
fstp qword [0x44c278]
mov esi, eax
call fcn.00424af0
mov eax, dword [section..data]
mov edx, dword [0x44c394]
add eax, 0xa62218d6
add edx, eax
push esi
mov dword [section..data], edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40dd80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [0x43d080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0x1acb7370
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
sub eax, 0x5641a5a
je 0x40de0d
jmp 0x40ddb5
mov eax, dword [ebp - 0x14]
sub eax, 0x1acb7370
je 0x40ddcd
jmp 0x40ddc8
jmp 0x40de1e
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
not byte [edi]
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
add byte [edi], 0x79
sub byte [edi], 0x35
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
imul byte [edi]
inc edi
loop 0x40ddde
mov dword [ebp - 0x10], 0x5641a5a
jmp 0x40de1e
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00426c20
add esp, 0xc
pop edi
pop ebx
pop ebp
ret
jmp 0x40dd9f
Function at 0x4274eb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42752a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42752a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42752a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42752a
cmp dword [ecx + 0x74], 0xe
jbe 0x42752a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42ec8b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42ed28
push ebx
push esi
call fcn.0042ec54
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042ebe8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42ecd5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42ed27
push edi
push eax
call fcn.0042d720
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42ecf5
call fcn.0042d76e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42ed26
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042ebe8
add esp, 0x20
test eax, eax
jne 0x42ed14
push edi
call fcn.0042d76e
jmp 0x42ed1c
push ebx
call fcn.0042d76e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42ff37
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x438c20
push 0x438c18
push str.FlsAlloc
push 0x1f
call fcn.0042fdf6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42ff6b
push dword [ebp + 8]
mov ecx, esi
call dword [0x436144]
call esi
jmp 0x42ff71
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42ffb5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x438c30
push 0x438c28
push str.FlsGetValue
push 0x21
call fcn.0042fdf6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42ffec
push dword [ebp + 8]
mov ecx, esi
call dword [0x436144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42fff4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x438c38
push 0x438c30
push str.FlsSetValue
push 0x22
call fcn.0042fdf6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43002e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x436144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x435310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43533d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43533d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x63f4a570
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.63f5ab80
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.63f5ab80
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x63f4a5d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6406e054]
test esi, esi
jle 0x63f4a6f0
mov eax, dword [0x6406e058]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x63f4a604
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x63f4a687
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x63f4a5f0
mov dword [esp], ebx
call fcn.63f4ad30
mov edi, eax
test eax, eax
je 0x63f4a717
mov eax, dword [0x6406e058]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.63f4ae70
mov edx, dword [0x6406e058]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x63f4a6f7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x63f4a680
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x63f4a690
add dword [0x6406e054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6406e058]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x63f4a680
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.63f4a570
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x63f4a60e
mov eax, dword [0x6406e058]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.63f4a570
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.63f4a570
lea esi, [esi]
nop
Function at 0x63f4a9b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6406e064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6406e05c]
sub esp, 4
test ebx, ebx
je 0x63f4aa05
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x63f4a9fe
test esi, esi
je 0x63f4a9fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x63f4a9e0
mov dword [esp], 0x6406e064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x63f4ad30
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x63f40000], 0x5a4d
jne 0x63f4ad55
mov ecx, dword [0x63f4003c]
cmp dword [ecx + 0x63f40000], 0x4550
lea edx, [ecx + 0x63f40000]
je 0x63f4ad60
ret
cmp word [ecx + 0x63f40018], 0x10b
jne 0x63f4ad55
push esi
movzx eax, word [ecx + 0x63f40014]
push ebx
movzx esi, word [ecx + 0x63f40006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x63f40000
test esi, esi
je 0x63f4ada8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x63f4ad9e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x63f4adaa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x63f4ad90
xor eax, eax
pop ebx
pop esi
ret

Function at 0x63f4b320
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x6406e060]
test eax, eax
jne 0x63f4aa30
ret
push ebx
sub esp, 0x18
mov dword [esp + 4], 0xc
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x63f4aa90
mov eax, dword [esp + 0x20]
mov dword [esp], 0x6406e064
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x6406e05c]
mov dword [0x6406e05c], ebx
sub esp, 4
mov dword [ebx + 8], eax
mov dword [esp], 0x6406e064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
or eax, 0xffffffff
jmp 0x63f4aa8b
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x63f4b350
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp 0x63f5ad80
add esp, 4
pop ebx
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 8]
test eax, eax
jne 0x63f5ad90
xor eax, eax
ret
jmp 0x63f4aa20

Function at 0x63f4b390
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x63f4b3d0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x63f4b3f8
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x63f5add8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x5c
mov eax, dword [esp + 0x60]
mov dword [esp + 0x1c], eax
mov eax, dword [0x6406e02c]
mov dword [esp + 0x4c], eax
xor eax, eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x63f5ae40
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.63fa9900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x64028432
mov ecx, eax
call fcn.63fe6b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.63fa9930
jmp 0x63f5afb0
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_OpenClipboard]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x63f5ae92
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.63fa9900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x64028432
mov ecx, eax
call fcn.63fe6b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.63fa9930
jmp 0x63f5afb0
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetClipboardData]
call eax
sub esp, 4
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
jne 0x63f5aeed
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.63fa9900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x64028432
mov ecx, eax
call fcn.63fe6b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.63fa9930
jmp 0x63f5afb0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalLock]
call eax
sub esp, 4
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
jne 0x63f5af45
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.63fa9900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x64028432
mov ecx, eax
call fcn.63fe6b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.63fa9930
jmp 0x63f5afb0
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.63fa9900
lea eax, [esp + 0x34]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x30]
mov dword [esp], edx
mov ecx, eax
call fcn.63fe6b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.63fa9930
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call eax
sub esp, 4
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x34]
mov dword [esp], edx
mov ecx, eax
call fcn.63fe6a50
sub esp, 4
lea eax, [esp + 0x34]
mov ecx, eax
call fcn.63fe7640
mov eax, dword [esp + 0x4c]
sub eax, dword [0x6406e02c]
je 0x63f5afc1
call fcn.63f415c0
mov eax, dword [esp + 0x1c]
add esp, 0x5c
ret
Function at 0x63f5f590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x64029e11
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x64029e75]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.63f4b010
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.6401eae0
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x6402726c], 0
jne 0x63f5f6b6
mov byte [0x6402726c], 1
call fcn.6401cbd0
test eax, eax
je 0x63f5f684
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.63f4a220
mov dword [esp], 2
mov esi, dword [fcn.63f5ab80]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x63f5f674
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6402a555
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x6401f360
jmp 0x6401f358
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x63f5f63a
mov dword [esp], 2
call dword [0x64026178]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x6401f353
mov dword [esp], 2
call dword [0x64026178]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6402a504
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
mov dword [esp], edi
call fcn.63f5a428
call fcn.6401cfa0
call fcn.6401cab0
call fcn.6401cc20
jmp 0x6401f353