joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406940
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x30], eax
mov ebx, dword [ecx + 0x18]
mov dword [ebp - 0x38], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x1c]
test byte [0x411020], 8
jne 0x4069f8
lea edx, [ebp - 0x1c]
mov eax, 1
call dbg.get_typeinfo
mov edx, eax
test eax, eax
js 0x4069e1
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x18], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esp + 4], eax
call dword [ecx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
movzx ecx, word [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
test eax, eax
je 0x406af0
mov ecx, eax
mov dword [ebp - 0x40], edx
shr ecx, 0x10
je 0x406ad8
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call dbg.wine_dbg_sprintf
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__p_____d__s__d__08x__p__p__p__p__n
mov dword [esp + 8], global___FUNCTION__.30
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x406983
movzx eax, ax
mov dword [esp], str._guid_0x_04hx_
mov dword [esp + 4], eax
call dbg.wine_dbg_sprintf
mov edx, dword [ebp - 0x40]
jmp 0x406a7a
mov eax, 0x41240b
jmp 0x406a7a
Function at 0x406d20
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x30], ebx
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x2c], eax
mov ebx, dword [ecx + 0x18]
mov dword [ebp - 0x34], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x1c]
test byte [0x411020], 8
jne 0x406dd0
lea edx, [ebp - 0x1c]
xor eax, eax
call dbg.get_typeinfo
mov edx, eax
test eax, eax
js 0x406dbe
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov ecx, dword [edx]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x30]
mov dword [esp], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x18], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 0x14], ebx
mov dword [esp + 4], eax
call dword [ecx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
movzx ecx, word [ebp - 0x30]
mov dword [ebp - 0x3c], ecx
test eax, eax
je 0x406ec0
mov ecx, eax
mov dword [ebp - 0x40], edx
shr ecx, 0x10
je 0x406ea8
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call dbg.wine_dbg_sprintf
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._d__s__d__08x__p__p__p__p_n
mov dword [esp + 8], global___FUNCTION__.6
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x406d63
movzx eax, ax
mov dword [esp], str._guid_0x_04hx_
mov dword [esp + 4], eax
call dbg.wine_dbg_sprintf
mov edx, dword [ebp - 0x40]
jmp 0x406e52
mov eax, 0x41240b
jmp 0x406e52
Function at 0x409e70
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x10
mov eax, dword [ecx]
lock xadd dword [eax + 8], ebx
sub ebx, 1
je 0x409ea8
lea esp, [ebp - 8]
mov eax, ebx
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
Function at 0x40d700
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
mov eax, dword fs:[0x18]
sub esp, 0x30
mov dword [esp + 8], 0x18
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x40d7bc
mov dword [eax + 8], esi
mov ebx, eax
mov eax, dword [0x41b430]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x4000000b
mov dword [esp + 8], 0
mov dword [esp + 4], str.Button
mov dword [esp], 0
call sym._CreateWindowExW_48
mov dword [ebx], 0x411074
mov dword [ebx + 0xc], eax
mov eax, dword [0x411078]
sub esp, 0x30
mov dword [ebx + 4], eax
mov dword [eax], ebx
mov dword [0x411078], ebx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x40e270
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
cmp dword [eax + 0x3b0], 3
ja 0x40e310
mov edx, dword [eax + 0x18]
mov esi, edi
test byte [global___dbch.1], 8
jne 0x40e2e0
mov eax, dword [ebx + 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call sym._SendNotifyMessageW_16
sub esp, 0x10
mov esi, eax
test eax, eax
jne 0x40e2ca
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x578
je 0x40e348
lea esp, [ebp - 0xc]
mov esi, 1
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.relaying_0x_x_n
mov dword [esp + 8], str.notify_owner
mov dword [esp + 4], global___dbch.1
mov dword [esp], 3
mov dword [ebp - 0x1c], edx
call sym._wine_dbg_log.constprop.0_4
mov edx, dword [ebp - 0x1c]
jmp 0x40e298
lea eax, [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [0x41b430]
mov dword [esp], eax
call sym._ClientToScreen_8
mov eax, dword [ebp + 0xc]
movzx edx, word [ebp + 8]
mov esi, dword [ebx + 0x18]
sub esp, 8
shl eax, 0x10
or edx, eax
shl esi, 0x10
movzx eax, di
or esi, eax
jmp 0x40e28f
test byte [global___dbch.1], 4
jne 0x40e3a0
mov eax, ebx
call sym._hide_icon.isra.0
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
mov dword [edx + 4], eax
mov edx, dword [ebx]
mov dword [eax], edx
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym._DestroyIcon_4
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x18]
mov dword [esp + 0xc], str.application_window_was_destroyed__removing_icon__u_n
mov dword [esp + 8], str.notify_owner
mov dword [esp + 0x10], eax
mov dword [esp + 4], global___dbch.1
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_4
jmp 0x40e351
Function at 0x40f220
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
movzx eax, word [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp eax, 1
je 0x40f270
cmp eax, 2
jne 0x40f261
mov eax, dword [0x411074]
cmp eax, 0x411074
je 0x40f25a
lea esi, [esi]
mov edx, dword [eax + 8]
mov esi, eax
mov eax, dword [eax]
cmp ebx, edx
je 0x40f2b8
cmp eax, 0x411074
jne 0x40f248
mov eax, ebx
call dbg.cleanup_systray_window
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
jmp dbg.sync_taskbar_buttons
mov eax, dword [0x41b420]
test eax, eax
jne 0x40f261
test ebx, ebx
je 0x40f2a1
lea eax, [ebp - 0xc]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._GetWindowThreadProcessId_8
sub esp, 8
test eax, eax
je 0x40f261
mov ecx, dword [ebp - 0xc]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x20], ecx
je 0x40f261
mov eax, ebx
call sym._add_taskbar_button.part.0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
jmp dbg.sync_taskbar_buttons
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [edx], eax
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call sym._DestroyWindow_4
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
call dbg.cleanup_systray_window
jmp 0x40f261

Function at 0x40fb30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x40fb8b
cmp byte [esi + ebx - 1], 0xa
je 0x40fb5f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x41b4c4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4100c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x41b4d4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x410280
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x41b4d4]
movzx eax, al
bt eax, esi
jae 0x4102e0
mov ecx, dword [0x41b4c4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x410186
test byte [0x4110b0], 8
jne 0x410220
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x4110c0], 8
jne 0x4101d0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x410155
cmp esi, 3
jbe 0x410190
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4178c8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x410155
mov ecx, dword [0x41b4d4]
test ecx, ecx
je 0x4102c0
mov dword [esp], 0x4110c0
call dword [0x41b4d4]
test al, 8
je 0x41012c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x41012c
mov ebx, dword [0x41b4d4]
test ebx, ebx
je 0x4102a0
mov dword [esp], 0x4110b0
call dword [0x41b4d4]
test al, 8
je 0x410119
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
shr edx, 6
imul ebx, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, ebx
lea ebx, [esp + 0x28]
mov dword [esp + 0xc], ecx
mov dword [esp], ebx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x41011f
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x41b4d4
call sym._load_func.part.0
jmp 0x4100e0
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x41b4d4
call sym._load_func.part.0
jmp 0x41022a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x41b4d4
call sym._load_func.part.0
jmp 0x4101de
mov eax, 0xffffffff
jmp 0x410186
Function at 0x4104a0
Capabilities:
Accept command line arguments
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.wmain
mov dword [esp], eax
call sym._exit

Function at 0x410510
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x4105ab
cmp ax, 9
je 0x410598
cmp ax, 0x20
je 0x410598
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp ax, 0x5c
je 0x410600
cmp ax, 0x22
je 0x410610
mov dword [ebp - 0x6c], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x4105ab
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x410550
test edi, 1
jne 0x410550
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x410598
cmp ax, 0x20
je 0x410598
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x410628
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.wWinMain@16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
add dword [ebp - 0x6c], 1
jmp 0x41056b
and dword [ebp - 0x6c], 1
jne 0x410564
xor edi, 1
jmp 0x41056b
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x4105c4
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40b100
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0041aa30
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0041aa30
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x40b160
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4fe068]
test esi, esi
jle 0x40b280
mov edi, dword [0x4fe06c]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x40b194
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x40b219
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x40b180
mov dword [esp], eax
mov ebx, eax
call fcn.0040baf0
mov edi, eax
test eax, eax
je 0x40b2a7
mov eax, dword [0x4fe06c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0040bc00
mov edx, dword [0x4fe06c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40b287
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40b212
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x40b220
add dword [0x4fe068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x4fe06c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40b212
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040b100
lea esi, [esi]
lea edi, [edi]
xor esi, esi
jmp 0x40b19e
mov eax, dword [0x4fe06c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040b100
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040b100
mov esi, esi
lea edi, [edi]
Function at 0x40b730
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4fe084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4fe07c]
sub esp, 4
test ebx, ebx
je 0x40b785
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40b77e
test esi, esi
je 0x40b77e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40b760
mov dword [esp], 0x4fe084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41c9e0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4b309c], eax
cmp eax, 0xffffffff
je 0x4acbd0
add esp, 0xc
ret

Function at 0x41cef0
Capabilities:
Print debug messages

Disassembly:
test eax, eax
je 0x41cf20
push edi
push esi
push ebx
mov ebx, eax
add esp, 0xffffff80
mov dword [esp], eax
call fcn.0041c8b0
cmp eax, 1
je 0x41cf21
mov dword [ebx], 0xffffffff
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
ret
ret
lea ebx, [esp + 0x15]
xor eax, eax
mov esi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x3d]
mov ecx, 0x43
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
mov eax, 0x27
jne 0x41cf75
jmp 0x41cf83
cmp eax, 0x6a
je 0x41cf8d
add eax, 1
cmp byte [ebx + eax], 0
jne 0x41cf70
cmp eax, 0x6a
je 0x41cf8d
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + eax + 0x16], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x41d030
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [0x4feaf4], 1
je 0x41d045
call fcn.0041cfa0
mov eax, dword [0x4b309c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x41d070
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041ce40
mov ebx, eax
mov eax, dword [entry3]
test eax, eax
je 0x41d05c
test ebx, ebx
je 0x41d05c
mov dword [ebx + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x18], eax
sub esp, 0x10
lea eax, [ebx + 0x38]
call fcn.0041cef0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call esi
lea edx, [ebx + 0x14]
mov dword [esp + 8], ebp
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x4acbd5
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x4b309c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x4acbd5
add esp, 0x2c
mov esi, ebx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret