joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8120b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00812200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8120d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8120c2
add dl, dl
jne 0x8120e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x812134
xor eax, eax
add dl, dl
jne 0x8120ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8121d5
add dl, dl
jne 0x8120fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x812108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x812113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x81211e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x81212a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8120cd
mov eax, 1
add dl, dl
jne 0x812142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x81214d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x812139
sub eax, ebx
mov ebx, 1
jne 0x812180
mov ecx, 1
add dl, dl
jne 0x812166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x812171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x81215d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8120cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x812197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8121a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x81218e
cmp eax, 0x7d00
jae 0x8121c5
cmp eax, 0x500
jb 0x8121c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8120cd
cmp eax, 0x7f
ja 0x8121c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8120cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8121f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8120cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5ab67729
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..text_1
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0xce237e0
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x3eb21807
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x1e870aea
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x403b90
Capabilities:
Write file on windows

Disassembly:
push ebp
sub esp, 0x68
lea eax, [esp + 0x60]
mov dword [esp + 0x34], sym.___gxx_personality_sj0
mov dword [esp + 0x38], 0x4197ec
mov dword [esp + 0x40], 0x403d01
mov dword [esp + 0x44], esp
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
mov dword [esp], eax
call dbg._Unwind_SjLj_Register
cmp byte [0x41f028], 0
jne 0x403cc6
mov byte [0x41f028], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x403d82
mov eax, dword [eax + 4]
xor edx, edx
cmp byte [eax], 0x2a
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x5c], 0xffffffff
mov dword [esp + 0x20], 0xffffffff
sete dl
add eax, edx
mov edx, eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x5c]
mov dword [esp], edx
mov dword [esp + 0xc], eax
call sym.___cxa_demangle
mov edx, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x30
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
mov dword [esp + 0x14], eax
lea ecx, [edx + 0x40]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
call sym._fwrite
cmp dword [esp + 0x5c], 0
je 0x403cb0
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym._fputs
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x41b1d5
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
cmp dword [esp + 0x5c], 0
je 0x403cf3
mov dword [esp + 0x20], 1
call sym.___cxa_rethrow
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym._fputs
jmp 0x403c74
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
call sym._abort
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._free
jmp 0x403ca3
call sym._abort
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
jmp 0x403d7d

Function at 0x40f830
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sym._fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
lea edi, [edi]
Function at 0x40f890
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x40f986
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x40f900
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x40f8d5
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sym._memcpy
cmp byte [esp + 0x1f], 0
je 0x40f8e5
cmp byte [esp + 0x1e], 0
je 0x40f8e5
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x40f8e5
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call sym.___report_error
nop

Function at 0x40fc20
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x41f054
call sym._EnterCriticalSection_4
mov ebx, dword [0x41f06c]
sub esp, 4
test ebx, ebx
je 0x40fc6b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x40fc64
test esi, esi
je 0x40fc64
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40fc40
mov dword [esp], 0x41f054
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x410f20
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
add eax, 0x31
mov dword [ebp - 0x1c], eax
lea eax, [ebx + 0x41]
shr eax, 4
shl eax, 4
call fcn.004110f0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateMutexA_12
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
test eax, eax
je 0x411010
int3
mov dword [esp], esi
call sym._FindAtomA_4
sub esp, 4
test ax, ax
jne 0x4110b0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x411048
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x411040
mov dword [esp], esi
call sym._AddAtomA_4
sub esp, 4
test ax, ax
je 0x4110a4
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call dbg.get_ptr_from_atom
cmp ebx, eax
mov esi, eax
je 0x4110c7
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call sym._ReleaseMutex_4
sub esp, 4
mov dword [esp], edi
call sym._CloseHandle_4
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call dbg.get_ptr_from_atom
mov esi, eax
jmp 0x411081
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x411081
mov dword [esp], esi
call dword [ebp + 0x10]
jmp 0x411081
Function at 0x411d40
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x41f0b8]
test ebx, ebx
je 0x411d70
call sym._TlsAlloc_0
mov dword [ebx], eax
mov eax, dword [0x41f0b8]
test eax, eax
je 0x411d95
cmp dword [eax], 0xffffffff
je 0x411db8
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov ebx, eax
mov dword [0x41f0b8], eax
jmp 0x411d4e
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x41f0b8], eax
jmp 0x411d5e
call sym._abort
lea esi, [esi]

Function at 0x412240
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [0x41f0bc]
test eax, eax
je 0x412390
cmp dword [eax], 1
je 0x41225d
call sym.__pthread_once_raw.part.1.constprop.5
mov eax, dword [0x41f0b8]
test eax, eax
je 0x4123c0
mov eax, dword [eax]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
test eax, eax
je 0x412282
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call sym._pop_pthread_mem
mov ebx, eax
mov eax, dword [entry3]
test eax, eax
je 0x41240c
test ebx, ebx
je 0x41240c
mov dword [ebx + 0x24], 1
call sym._GetCurrentThreadId_0
mov dword [ebx + 0x38], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sym._CreateEventA_16
mov dword [ebx + 0x1c], 0xffffffff
sub esp, 0x10
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x34], 0xffffffff
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x14], 0
call sym._GetCurrentProcess_0
mov edi, eax
call sym._GetCurrentThread_0
mov esi, eax
call sym._GetCurrentProcess_0
lea edx, [ebx + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._DuplicateHandle_28
sub esp, 0x1c
test eax, eax
je 0x412413
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call sym._GetThreadPriority_4
mov dword [ebx + 0x68], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
mov dword [ebx + 0x64], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x41f0b8]
test eax, eax
je 0x4123e6
mov dword [esp + 4], ebx
mov eax, dword [eax]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
je 0x412413
mov eax, ebx
jmp 0x41227b
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_once_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x41f0bc], eax
jmp 0x412253
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x41f0b8], eax
jmp 0x41226a
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x41f0b8], eax
jmp 0x41236e
xor eax, eax
jmp 0x41227b
call sym._abort
nop
lea esi, [esi]
Function at 0x412990
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
cmp dword [esp + 0x24], 3
je 0x4129b0
add esp, 0x18
mov eax, 1
pop ebx
ret 0xc
mov eax, dword [0x41f0b8]
test eax, eax
je 0x412b20
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x41299b
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41299b
test byte [eax + 0x20], 0x30
je 0x412a70
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x412b10
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x412a1f
mov dword [esp], eax
call sym._CloseHandle_4
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x412a11
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x34], 0xffffffff
test edx, edx
je 0x412b76
mov eax, dword [0x41f0b8]
test eax, eax
je 0x412b50
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
mov eax, 1
add esp, 0x18
pop ebx
ret 0xc
mov eax, dword [eax + 0x64]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x412ad0
test eax, eax
je 0x412a89
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x64], 1
test eax, eax
jne 0x412b00
test byte [ebx + 0x24], 4
je 0x412ae6
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x412a18
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x412a18
test eax, eax
je 0x412adf
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov dword [ebx + 0x34], 0xffffffff
jmp 0x41299b
call sym.__pthread_cleanup_dest.part.3
jmp 0x412aa1
call sym.__pthread_cleanup_dest.part.3
jmp 0x4129ed
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x41f0b8], eax
jmp 0x4129bd
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x41f0b8], eax
jmp 0x412a4c
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x412a3f
Function at 0x413cf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x413d80
test byte [ebx + 0x20], 0x30
je 0x413e76
mov eax, dword [0x41f0b8]
test eax, eax
je 0x413e20
mov eax, dword [eax]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
test eax, eax
mov ebx, eax
je 0x413d6b
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x413de5
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x413d5e
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x413d90
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp sym.__endthreadex
call sym.__pthread_cleanup_dest.part.3
jmp 0x413d0d
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call sym._CloseHandle_4
mov eax, dword [ebx + 0xac]
sub esp, 4
mov dword [ebx + 0x14], 0
test eax, eax
je 0x413e11
mov eax, dword [0x41f0b8]
test eax, eax
je 0x413e50
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp sym.__endthreadex
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x413dfd
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
test edx, edx
jne 0x413db5
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x413db5
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x41f0b8], eax
jmp 0x413d24
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x41f0b8], eax
jmp 0x413dc2
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
lea esi, [esi]
Function at 0x416150
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
add eax, 0x30
mov dword [ebp - 0x1c], eax
lea eax, [ebx + 0x40]
shr eax, 4
shl eax, 4
call fcn.004110f0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateMutexA_12
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
test eax, eax
je 0x416240
int3
mov dword [esp], esi
call sym._FindAtomA_4
sub esp, 4
test ax, ax
jne 0x4162e0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x416278
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x416270
mov dword [esp], esi
call sym._AddAtomA_4
sub esp, 4
test ax, ax
je 0x4162d4
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
cmp ebx, eax
mov esi, eax
je 0x4162f7
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call sym._ReleaseMutex_4
sub esp, 4
mov dword [esp], edi
call sym._CloseHandle_4
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x4162b1
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4162b1
mov dword [esp], esi
call dword [ebp + 0x10]
jmp 0x4162b1
Function at 0x4195f0
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call sym.___main
call sym._GetCommandLineA_0
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._GetStartupInfoA_4
sub esp, 4
test ebx, ebx
jne 0x419626
jmp 0x419665
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x419623
cmp al, 0x20
je 0x419623
cmp al, 0x22
jne 0x419649
jmp 0x4196b4
cmp al, 0x20
lea esi, [esi]
je 0x419650
test al, al
je 0x419665
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x419637
movzx eax, byte [ebx]
cmp al, 0x20
jne 0x4196ca
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x419657
cmp al, 0x20
je 0x419657
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x419674
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
je 0x4196be
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x4196b0
cmp al, 0x22
sete al
movzx eax, al
add ebx, eax
jmp 0x419650
cmp al, 9
je 0x419657
jmp 0x419665