joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63e57cd0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, 1
push edi
mov edi, eax
push esi
mov esi, ecx
push ebx
mov ebx, edx
sub esp, 0x3c
mov eax, dword [eax + 0xc]
mov ecx, dword [edx]
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x10]
mov dword [esp + 0x24], eax
jmp 0x63e57d0f
mov eax, dword [ebx]
mov ecx, dword [eax]
mov dword [0x63f72074], edx
mov dword [ebx], ecx
add ebp, 1
mov eax, dword [edi]
mov edx, dword [edi + 4]
test ecx, ecx
je 0x63e57df8
mov esi, dword [ecx + 0x18]
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
call eax
test eax, eax
jne 0x63e57e31
test esi, esi
je 0x63e57d90
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp + 4], 0xa
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp], 1
call esi
cmp eax, 7
je 0x63e57f10
cmp eax, 8
jne 0x63e57e31
mov eax, dword [ebx]
mov edx, dword [eax]
mov eax, dword [0x63f62638]
test eax, eax
js 0x63e57dd0
test eax, eax
je 0x63e57d00
mov eax, dword [0x63f72070]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x63e57e40
mov eax, dword [ebx]
mov ecx, dword [eax]
jmp 0x63e57d0a
mov eax, dword [0x63f6262c]
mov ecx, edx
test eax, eax
je 0x63e57de5
mov esi, dword [0x63f62630]
test esi, esi
je 0x63e57e50
mov dword [0x63f62638], 0
jmp 0x63e57d04
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0x14], ebx
mov esi, dword [esp + 0x28]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x1a
mov dword [esp], 1
call eax
test eax, eax
je 0x63e57eb0
add esp, 0x3c
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x63e57dc2
lock add dword [0x63f62634], 1
jne 0x63e57ec0
mov dword [esp + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edx, dword [esp + 0x2c]
cmp eax, 0xffffffff
je 0x63e57f18
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0x63f72070], eax
call sym.___mingwthr_key_dtor
mov edx, dword [esp + 0x2c]
mov dword [0x63f62630], 1
test eax, eax
sete al
movzx eax, al
mov dword [0x63f62638], eax
jmp 0x63e57d9d
mov dword [esi], ebp
mov eax, 5
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [0x63f62630]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test ecx, ecx
jne 0x63e57ef1
mov dword [esp + 0x2c], edx
lea esi, [esi]
mov dword [esp], 0
call esi
mov eax, dword [0x63f62630]
sub esp, 4
test eax, eax
je 0x63e57ed8
mov edx, dword [esp + 0x2c]
mov eax, dword [0x63f62638]
test eax, eax
jns 0x63e57d9d
mov eax, dword [ebx]
mov ecx, dword [eax]
jmp 0x63e57de5
mov esi, dword [esp + 0x28]
mov dword [esi], ebp
jmp 0x63e57eb7
mov dword [esp + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x2c]
jmp 0x63e57e8a
Function at 0x63e57f30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x63f62638]
mov ebx, dword [esp + 0x30]
test eax, eax
js 0x63e57fb0
test eax, eax
jne 0x63e57f60
mov eax, dword [0x63f72074]
mov dword [0x63f72074], ebx
mov dword [ebx], eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [0x63f72070]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x63f72070]
mov dword [ebx], esi
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x63e57f55
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
jmp eax
call sym._fc_key_init_once
mov eax, dword [0x63f62638]
jmp 0x63e57f44

Function at 0x63e57fc0
Capabilities:
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov ebx, dword [eax]
mov eax, dword [0x63f62638]
test eax, eax
js 0x63e58010
test eax, eax
jne 0x63e57fe8
mov dword [0x63f72074], ebx
add esp, 0x18
pop ebx
ret
mov eax, dword [0x63f72070]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x63e57fdd
add esp, 0x18
pop ebx
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
call sym._fc_key_init_once
mov eax, dword [0x63f62638]
jmp 0x63e57fd3
Function at 0x63e62d80
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], str.msvcrt.dll
mov esi, dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 4
mov dword [esp + 4], str.rand_s
mov dword [esp], eax
call ebx
sub esp, 8
test eax, eax
je 0x63e62dc8
mov dword [esp + 0x20], esi
mov dword [sym._init_rand_s], eax
add esp, 0x14
pop ebx
pop esi
jmp eax
mov dword [esp], str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
sub esp, 4
mov dword [esp + 4], str.SystemFunction036
mov dword [esp], eax
call ebx
mov dword [0x63f72b24], eax
sub esp, 8
mov eax, sym._mingw_rand_s
jmp 0x63e62db3
Function at 0x63e7e810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], ecx
mov ecx, 0x63f635ac
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
call dbg.std::locale::id::_M_id() const
mov edx, dword [esi + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x63e7e96a
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x63e7e96a
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x44]
mov ecx, dword [esp + 0x38]
mov eax, dword [eax + 8]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call fcn.63e80ac0
mov ecx, ebp
sub esp, 0x24
mov esi, eax
mov ebx, edx
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call dbg.std::__time_get_state::_M_finalize_state(tm*)
sub esp, 4
cmp ebx, 0xffffffff
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x63e7e948
cmp dword [esp + 0x34], 0xffffffff
sete al
test edi, edi
je 0x63e7e8fe
test al, al
jne 0x63e7e920
cmp dl, al
jne 0x63e7e90c
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x63e7e8fe
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x63e7e8fe
mov eax, dword [esi + 0xc]
cmp dword [esi + 8], eax
jae 0x63e7e958
xor edx, edx
jmp 0x63e7e8ee
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
cmp eax, 0xffffffff
jne 0x63e7e950
mov edx, ebp
xor esi, esi
jmp 0x63e7e8ee
call dbg.std::__throw_bad_cast()
nop
Function at 0x63e7e970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], ecx
mov ecx, 0x63f635ac
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
call dbg.std::locale::id::_M_id() const
mov edx, dword [esi + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x63e7eaca
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x63e7eaca
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x44]
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x48], 0
mov eax, dword [eax + 0x10]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x4c], 0
call fcn.63e80ac0
mov ecx, ebp
sub esp, 0x24
mov esi, eax
mov ebx, edx
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call dbg.std::__time_get_state::_M_finalize_state(tm*)
sub esp, 4
cmp ebx, 0xffffffff
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x63e7eaa8
cmp dword [esp + 0x34], 0xffffffff
sete al
test edi, edi
je 0x63e7ea5e
test al, al
jne 0x63e7ea80
cmp dl, al
jne 0x63e7ea6c
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x63e7ea5e
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x63e7ea5e
mov eax, dword [esi + 0xc]
cmp dword [esi + 8], eax
jae 0x63e7eab8
xor edx, edx
jmp 0x63e7ea4e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
cmp eax, 0xffffffff
jne 0x63e7eab0
mov edx, ebp
xor esi, esi
jmp 0x63e7ea4e
call dbg.std::__throw_bad_cast()
nop
Function at 0x63eafbf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x70]
mov ecx, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
mov edx, dword [esp + 0x6c]
mov edi, dword [esi + 0xc]
mov eax, edi
and eax, 0xffffffb5
or eax, 8
mov dword [esi + 0xc], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, ebp
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call method.std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t____std::num_get_wchar_t__std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____._M_extract_int_unsigned_long__std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____std::is
sub esp, 0x1c
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
movzx eax, word [esp + 0x2c]
mov dword [esp + 0x28], edx
mov ecx, edx
mov edx, ebx
mov ebx, dword [esp + 0x3c]
or edx, eax
mov eax, dword [esp + 0x78]
mov dword [esi + 0xc], edi
mov dword [eax], ebx
add esp, 0x4c
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
Function at 0x63eb5060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], ecx
mov ecx, 0x63f635ac
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
call dbg.std::locale::id::_M_id() const
mov edx, dword [esi + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x63eb51ba
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x63eb51ba
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x44]
mov ecx, dword [esp + 0x38]
mov eax, dword [eax + 8]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call fcn.63eb6f30
mov ecx, ebp
sub esp, 0x24
mov esi, eax
mov ebx, edx
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call dbg.std::__time_get_state::_M_finalize_state(tm*)
sub esp, 4
cmp ebx, 0xffffffff
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x63eb5198
cmp dword [esp + 0x34], 0xffffffff
sete al
test edi, edi
je 0x63eb514e
test al, al
jne 0x63eb5170
cmp dl, al
jne 0x63eb515c
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x63eb514e
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x63eb514e
mov eax, dword [esi + 0xc]
cmp dword [esi + 8], eax
jae 0x63eb51a8
xor edx, edx
jmp 0x63eb513e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
cmp eax, 0xffffffff
jne 0x63eb51a0
mov edx, ebp
xor esi, esi
jmp 0x63eb513e
call dbg.std::__throw_bad_cast()
nop
Function at 0x63eb51c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], ecx
mov ecx, 0x63f635ac
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
call dbg.std::locale::id::_M_id() const
mov edx, dword [esi + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x63eb531a
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x63eb531a
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x44]
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x48], 0
mov eax, dword [eax + 0x10]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x4c], 0
call fcn.63eb6f30
mov ecx, ebp
sub esp, 0x24
mov esi, eax
mov ebx, edx
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call dbg.std::__time_get_state::_M_finalize_state(tm*)
sub esp, 4
cmp ebx, 0xffffffff
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x63eb52f8
cmp dword [esp + 0x34], 0xffffffff
sete al
test edi, edi
je 0x63eb52ae
test al, al
jne 0x63eb52d0
cmp dl, al
jne 0x63eb52bc
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x63eb52ae
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x63eb52ae
mov eax, dword [esi + 0xc]
cmp dword [esi + 8], eax
jae 0x63eb5308
xor edx, edx
jmp 0x63eb529e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
cmp eax, 0xffffffff
jne 0x63eb5300
mov edx, ebp
xor esi, esi
jmp 0x63eb529e
call dbg.std::__throw_bad_cast()
nop
Function at 0x63ef0360
Capabilities:
Read file on windows

Disassembly:
push ebp
sub esp, 0x58
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], ecx
mov dword [esp], eax
mov dword [esp + 0x34], dbg.__gxx_personality_sj0
mov dword [esp + 0x38], 0x63f51150
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], 0x63ef0405
mov dword [esp + 0x44], esp
call dbg._Unwind_SjLj_Register
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov dword [esp + 0x20], 1
mov dword [esp], eax
call sym._fileno
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x60]
mov dword [esp], eax
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
call sym._read
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x63ef03f0
lea eax, [esp + 0x1c]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
mov eax, dword [esp + 0x14]
add esp, 0x58
pop ebp
ret 8
mov dword [esp + 0x20], 0xffffffff
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
jne 0x63ef03d3
jmp 0x63ef0394
Function at 0x63f4ec80
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x7c
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], dbg.__gxx_personality_sj0
mov dword [esp], esi
mov dword [esp + 0x38], 0x63f51110
call dbg._Unwind_SjLj_Register
mov ebp, dword [0x63f6262c]
test ebp, ebp
jne 0x63f4ee75
mov dword [esp], str.GLIBCXX_TUNABLES
mov dword [0x63f62998], 0
mov dword [0x63f6299c], 0
mov dword [0x63f629a0], 0
call sym._getenv
mov dword [esp + 0x58], 8
mov dword [esp + 0x5c], str.obj_size
mov ebx, eax
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 9
mov dword [esp + 0x68], str.obj_count
mov dword [esp + 0x6c], 0x40
test eax, eax
jne 0x63f4ed36
jmp 0x63f4ee44
mov dword [esp], ebx
mov dword [esp + 4], 0x3a
call sym._strchr
mov ebx, eax
test eax, eax
je 0x63f4edb0
xor eax, eax
cmp byte [ebx], 0x3a
sete al
add ebx, eax
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
xor eax, 0x62696c67
xor edx, 0x2e787863
or eax, edx
jne 0x63f4ed20
mov eax, dword [ebx + 7]
mov edx, dword [ebx + 0xb]
xor eax, 0x5f68652e
xor edx, 0x6c6f6f70
or eax, edx
jne 0x63f4ed20
cmp byte [ebx + 0xf], 0x2e
jne 0x63f4ed20
lea ebp, [ebx + 0x10]
mov dword [esp + 8], 8
mov dword [esp + 4], ebp
mov dword [esp], str.obj_size
call sym._memcmp
test eax, eax
jne 0x63f4ed98
cmp byte [ebx + 0x18], 0x3d
je 0x63f4ee8c
mov edi, dword [esp + 0x64]
test edi, edi
jne 0x63f4edff
mov ebx, ebp
jmp 0x63f4ed20
mov eax, dword [esp + 0x6c]
mov edx, 0x100
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [esp + 0x60]
test eax, eax
cmove eax, ecx
add eax, 0x2c
imul eax, edx
lea ebx, [eax*4]
mov dword [0x63f629a0], ebx
test ebx, ebx
jne 0x63f4ee53
mov dword [esp], sym.___tcf_0
call sym._atexit
mov dword [esp], esi
call sym.__Unwind_SjLj_Unregister
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 9
mov dword [esp + 4], ebp
cmp edi, eax
mov dword [esp], str.obj_count
cmovbe eax, edi
mov dword [esp + 8], eax
call sym._memcmp
test eax, eax
jne 0x63f4eda0
cmp edi, 8
jbe 0x63f4eda0
cmp byte [ebx + 0x19], 0x3d
mov eax, 9
lea edi, [esp + 0x64]
je 0x63f4ee95
mov ebx, ebp
jmp 0x63f4ed20
mov dword [0x63f629a0], 0x3200
mov ebx, 0x3200
mov dword [esp], ebx
call sym._malloc
mov dword [0x63f6299c], eax
test eax, eax
je 0x63f4eed3
xor edx, edx
mov dword [0x63f62998], eax
mov dword [eax], ebx
mov dword [eax + 4], edx
jmp 0x63f4ede3
mov dword [esp], 0x63f62980
xor edi, edi
mov dword [esp + 0x20], edi
call dbg.__gthr_win32_mutex_init_function
jmp 0x63f4ecb1
mov eax, 8
lea edi, [esp + 0x58]
lea edx, [esp + 0x54]
xor ebx, ebx
lea eax, [ebp + eax + 1]
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strtoul
mov ebx, dword [esp + 0x54]
movzx edx, byte [ebx]
cmp dl, 0x3a
je 0x63f4eec3
test dl, dl
jne 0x63f4ed20
test eax, eax
js 0x63f4ed20
mov dword [edi + 8], eax
jmp 0x63f4ed20
xor ecx, ecx
mov dword [0x63f629a0], ecx
jmp 0x63f4ede3
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5b8222cc
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x333411e0
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0xad76a0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0xad76a6
pop ebp
sub ebp, 0x44054c
lea edi, [ebp + 0x442155]
mov esi, edi
mov ecx, 0x92
xor ebx, ebx
lodsb al, byte [esi]
xor al, 0x44
sub al, bl
rol al, 2
stosb byte es:[edi], al
inc ebx
loop 0xad76bc
mov eax, dword [esp + 0x20]
inc eax
js 0xad76d9
mov dword [ebp + 0x442159], 1
cmp dword [ebp + 0x442159], 0
jne 0xad76e4
jmp 0xad76fa
push ebp
lea eax, [ebp + 0x4405c2]
push eax
mov eax, 0x30
push eax
call fcn.00ad7789
pop ebp
jmp 0xad770e
push ebp
lea eax, [ebp + 0x4405c2]
push eax
mov eax, 0x30
push eax
call fcn.00ad7a16
pop ebp
mov ecx, 0x17a7
lea edi, [ebp + 0x4409ae]
mov esi, edi
lodsb al, byte [esi]
sub eax, 0xe861eb26
sar al, 1
out 0x84, al
retf 0xc762
Function at 0xad7789
Capabilities:
Check for trap flag exception

Disassembly:
mov ebp, esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x44215d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x442155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add ecx, dword [ebx + 0x33020875]
fild dword [esi]
mov edx, 0x8b030001
dec ebp
add al, 3
mov edi, dword [ebp + 0xc]
push es
lea edi, [edi + 0x442155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x44215d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x442155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add cl, byte [edx + 0x7d8b0306]
or al, 6
lea edi, [edi + 0x442155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
push ebx
push ecx
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x44215d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x442155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add dh, byte [ecx + 0x7d8b0300]
or al, 6
lea edi, [edi + 0x442155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x44215d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x442155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add dh, byte [ebx]
fild dword [ebx]
mov bx, dx
add al, 0x66
and ebx, 1
add dl, dl
jecxz 0xad78d1
xor al, bl
add esp, dword [esi - 0x2f]
loop 0xad78d9
mov bx, dx
add eax, 0xe38166
add byte [edx], 0xb5
add byte [ebx], 0x8b
jge 0xad78f2
push es
lea edi, [edi + 0x442155]
push es
mov dword [edi], 0
add byte [eax], al
pop dword fs:[0]
add esp, 4
cmp bh, ch
jne 0xad7956
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x44215d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x442155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add eax, 0x3f28166
add byte [ebx], 0x8b
jge 0xad794a
push es
lea edi, [edi + 0x442155]
push es
mov dword [edi], 0
add byte [eax], al
pop dword fs:[0]
add esp, 4
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x44215d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x442155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add bh, dh
rol dword [edx], 0xb5
or byte [ebx], al
mov edi, dword [ebp + 0xc]
push es
lea edi, [edi + 0x442155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
cmp cl, ch
jne 0xad788d
pop ecx
pop ebx
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x44215d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x442155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add cl, byte [eax + 0x1460106]
inc ebx
add ecx, dword [ebx - 0x72f9f383]
mov edi, 0x442155
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
cmp ecx, ebx
jne 0xad77e9
mov esp, ebp
ret 8