joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413670
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x2d
mov dword [esp + 4], str._buffer_overflow_detected_:_terminated_n
mov dword [esp], 2
call sub.msvcrt.dll__write
mov dword [esp], 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
sub esp, 4
test eax, eax
je 0x4136a9
mov ecx, 8
int 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], 0xc0000409
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x4136d0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x2c
mov dword [esp + 4], str._stack_smashing_detected_:_terminated_n
mov dword [esp], 2
call sub.msvcrt.dll__write
mov dword [esp], 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
sub esp, 4
test eax, eax
je 0x413709
mov ecx, 2
int 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], 0xc0000409
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x41a490
Capabilities:
Print debug messages

Disassembly:
push edi
pxor xmm0, xmm0
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push ebx
lea ebx, [ebp - 0x41]
sub esp, 0x50
movups xmmword [ebp - 0x21], xmm0
mov eax, dword [0x44b0f8]
mov dword [ebp - 0xc], eax
xor eax, eax
movups xmmword [ebp - 0x41], xmm0
movups xmmword [ebp - 0x31], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x35
mov dword [esp], ebx
call fcn.0041fa00
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sub.msvcrt.dll_abort
lea esi, cs:[esi]
lea esi, [esi]

Function at 0x41a880
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x44baf4], 1
je 0x41a920
push edi
mov eax, 0x44baf4
push esi
push ebx
sub esp, 0x10
call fcn.0041a280
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call fcn.00419b70
mov edi, dword [0x44baf4]
test edi, edi
jne 0x41a8f0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x432124], eax
cmp eax, 0xffffffff
je 0x431605
mov dword [0x44baf4], 1
mov dword [esp], esi
call fcn.00419ea0
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
jmp fcn.0041a510
cmp edi, 1
je 0x41a8d2
mov dword [esp], 2
call dword [0x43210c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x44baf4
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x41a8d2
ret
call sub.msvcrt.dll_abort
call sub.msvcrt.dll_abort
mov eax, dword [0x14]
ud2

Function at 0x41aa60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041a880
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41aa88
add esp, 0x1c
ret
add esp, 0x1c
jmp fcn.0041a930
Function at 0x41ad60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x41ad88
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x41ae80
add esp, 0x14
pop ebx
pop esi
ret 0xc
cmp eax, 1
je 0x41ae50
cmp eax, 3
jne 0x41ad79
mov eax, dword [0x432124]
cmp eax, 0xffffffff
je 0x41ad79
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41ad79
test byte [eax + 0x20], 0x30
je 0x41aeb0
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41adcb
call fcn.0041aa90
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x41adfd
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x41adef
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0041a040
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0041e0a0
cmp eax, 1
je 0x41af7e
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x41af72
mov eax, dword [0x432124]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x41ad79
mov eax, dword [0x44bacc]
test eax, eax
je 0x41ae9c
mov dword [esp + 4], 0x41a1f0
mov dword [esp], 1
call eax
mov dword [0x44bad0], eax
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [0x44bad0]
test eax, eax
je 0x41ad79
mov edx, dword [0x44bac8]
test edx, edx
je 0x41ae9c
mov dword [esp], eax
call edx
mov dword [0x44bad0], 0
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x41af24
test eax, eax
je 0x41aeca
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x41aee7
call fcn.0041aa90
test byte [ebx + 0x24], 4
je 0x41af62
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41adfd
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], eax
call fcn.0041a040
lea eax, [ebx + 0x38]
jmp 0x41ae0b
test eax, eax
je 0x41af62
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.0041a040
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0041e0a0
cmp eax, 1
je 0x41af7e
mov dword [ebx + 0x38], 0xffffffff
jmp 0x41ad79
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0041a040
lea eax, [ebx + 0x38]
jmp 0x41af49
mov eax, ebx
call fcn.0041a6c0
jmp 0x41ae31
call fcn.0041a490
lea esi, cs:[esi]
lea esi, cs:[esi]
Function at 0x41b250
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [0x44b0f8]
mov dword [esp + 0x2c], esi
mov esi, dword [esp + 0x54]
mov ebx, dword [esp + 0x50]
mov eax, dword [ebx]
test esi, esi
je 0x41b390
cmp eax, 1
je 0x41b2ae
mov eax, ebx
call fcn.0041a280
lea edi, [eax + 4]
mov dword [esp + 0x1c], eax
mov dword [esp], edi
call fcn.00419b70
mov ebp, dword [ebx]
test ebp, ebp
je 0x41b2d0
cmp ebp, 1
jne 0x41b360
mov dword [esp], edi
call fcn.00419ea0
mov eax, dword [esp + 0x1c]
call fcn.0041a510
xor eax, eax
mov edx, dword [esp + 0x2c]
sub edx, dword [0x44b0f8]
jne 0x41b3da
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], 0x41a5d0
mov dword [esp + 0x24], eax
call fcn.0041a880
mov eax, dword [0x432124]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41b3c8
mov eax, dword [eax + 0xc]
mov dword [esp + 0x28], eax
lock or dword [esp], 0
call fcn.0041a880
mov eax, dword [0x432124]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41b3b0
lea ecx, [esp + 0x20]
mov dword [eax + 0xc], ecx
lock or dword [esp], 0
call esi
call fcn.0041a880
mov eax, dword [0x432124]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41b3a0
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x41b29d
mov dword [esp], 2
call dword [0x43210c]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x41b29d
mov eax, 0x16
jmp 0x41b2b0
call fcn.0041a930
test eax, eax
jne 0x41b34a
jmp 0x43162f
call fcn.0041a930
test eax, eax
jne 0x41b326
jmp 0x431624
call fcn.0041a930
test eax, eax
jne 0x41b300
jmp 0x43161d
call fcn.004136d0
nop
mov eax, dword [pe_dos_header]
ud2
lea eax, [esp + 0x20]
mov dword [0], eax
ud2
mov eax, dword [esp + 0x28]
mov dword [0], eax
ud2

Function at 0x41b620
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0041a880
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41b698
lea ebp, [ebx + 0x38]
xor edi, edi
mov dword [esp], ebp
call fcn.0041e0b0
mov eax, dword [ebx + 0x28]
cmp dword [esp + 0x30], eax
jae 0x41b674
mov eax, dword [ebx + 0x30]
mov edx, dword [esp + 0x30]
cmp byte [eax + edx], 0
je 0x41b674
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + edx*4]
mov dword [esp], ebp
call fcn.0041e100
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041a930
mov ebx, eax
jmp 0x41b64b
Function at 0x41b6b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call fcn.0041a880
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41b7c8
lea edi, [ebx + 0x38]
mov dword [esp], edi
call fcn.0041e0b0
mov edx, dword [ebx + 0x2c]
cmp esi, dword [ebx + 0x28]
jb 0x41b794
lea ebp, [esi + 1]
mov dword [esp], edx
lea eax, [ebp*4]
mov dword [esp + 4], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x41b7d4
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x41b7d4
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x28]
mov edx, dword [esp + 0x18]
mov ecx, ebp
mov dword [esp + 4], 0
sub ecx, eax
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call fcn.0041e100
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041a930
mov ebx, eax
jmp 0x41b6e5
mov dword [esp], edi
call fcn.0041e100
mov eax, 0xc
jmp 0x41b7bc

Function at 0x41b870
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041a880
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41b898
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.0041a930
test eax, eax
jne 0x41b88d
add esp, 0x1c
ret

Function at 0x41b900
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041a880
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41b928
add eax, 0xc
add esp, 0x1c
ret
call fcn.0041a930
test eax, eax
jne 0x41b91d
jmp 0x41b920
Function at 0x41b960
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.0041aa60
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41b982
call fcn.0041aa90
test byte [ebx + 0x20], 0x30
jne 0x41b99c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x41b9dd
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x41ba1d
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x41b9d2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x41b9e6
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.0041a860
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x41b9dd
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41ba31
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x41b9fe

Function at 0x41ba40
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x44bafc]
test eax, eax
jne 0x41ba50
xor eax, eax
ret
sub esp, 0x1c
call fcn.0041a880
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41ba90
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x41ba80
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x41ba74
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x41ba76
call fcn.0041a930
test eax, eax
je 0x41ba74
jmp 0x41ba6d

Function at 0x41baa0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041a880
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41bae0
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x41bad0
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call fcn.0041a930
test eax, eax
jne 0x41babd
add esp, 0x1c
ret
Function at 0x41bbe0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.0041a880
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41bc50
test byte [ebx + 0x20], 0xc
jne 0x41bc10
mov eax, dword [0x44bafc]
test eax, eax
jne 0x41bc20
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.00419b70
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x41bc42
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x41bc42
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x41bc61
mov dword [esp], esi
call fcn.00419ea0
add esp, 0x14
pop ebx
pop esi
ret
call fcn.0041a930
mov ebx, eax
test eax, eax
jne 0x41bc01
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x41bc81
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.00419ea0
call fcn.0041baf0
nop
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x41bd00
mov dword [esp], eax
call fcn.0041d010
xor ecx, ecx
mov ebx, edx
mov edx, 0xffffffff
cmp edx, eax
sbb ecx, ebx
cmovae edx, eax
mov ebx, edx
call fcn.0041a880
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x41bd50
test ebx, ebx
je 0x41bd1a
call fcn.0041bbe0
mov eax, dword [esi + 0x18]
test eax, eax
je 0x41bd40
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0041d120
call fcn.0041bbe0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.0041a880
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41bd60
call fcn.0041bbe0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.0041bbe0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x41bcef
call fcn.0041a930
mov esi, eax
jmp 0x41bcd3
call fcn.0041a930
jmp 0x41bd1a
Function at 0x430160
Capabilities:
Query environment variable

Disassembly:
push edi
sub esp, 0x18
mov eax, dword [esp + 0x20]
lea edi, [eax + 0x60]
mov dword [esp], edi
call sub.msvcrt.dll_malloc
test eax, eax
je 0x42f602
mov edx, eax
lea edi, [edx + 4]
mov ecx, edx
xor eax, eax
mov dword [edx], 0
and edi, 0xfffffffc
mov dword [edx + 0x5c], 0
sub ecx, edi
add ecx, 0x60
shr ecx, 2
rep stosd dword es:[edi], eax
add esp, 0x18
lea eax, [edx + 0x60]
pop edi
ret
mov eax, edi
call fcn.004214b0
mov edx, eax
test eax, eax
je 0x430148
jmp 0x42f5d9
call fcn.004304c4
nop
nop
nop
call fcn.004304c4
nop
nop
nop
nop
nop
nop
nop
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x44b0f8]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 4], 0
mov dword [esp], 0x432188
call fcn.00419ff0
mov dword [esp], str.GLIBCXX_TUNABLES
mov dword [0x43218c], 0
mov dword [0x432190], 0
mov dword [0x432194], 0
call sub.msvcrt.dll_getenv
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], str.obj_size
mov ebx, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 9
mov dword [esp + 0x24], str.obj_count
mov dword [esp + 0x28], 0x40
test eax, eax
jne 0x430206
jmp 0x4302d7
mov dword [esp], ebx
mov dword [esp + 4], 0x3a
call sub.msvcrt.dll_strchr
mov ebx, eax
test eax, eax
je 0x430280
xor eax, eax
cmp byte [ebx], 0x3a
sete al
add ebx, eax
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
xor eax, 0x62696c67
xor edx, 0x2e787863
or eax, edx
jne 0x4301f0
mov eax, dword [ebx + 7]
mov edx, dword [ebx + 0xb]
xor eax, 0x5f68652e
xor edx, 0x6c6f6f70
or eax, edx
jne 0x4301f0
cmp byte [ebx + 0xf], 0x2e
jne 0x4301f0
add ebx, 0x10
lea esi, [esp + 0x14]
lea ebp, [esp + 0x2c]
mov edi, dword [esi]
test edi, edi
je 0x430267
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov eax, dword [esi + 4]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x430271
cmp byte [ebx + edi], 0x3d
je 0x430305
add esi, 0xc
cmp ebp, esi
jne 0x43024a
jmp 0x4301f0
mov eax, dword [esp + 0x28]
mov edx, 0x100
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [esp + 0x1c]
test eax, eax
cmove eax, ecx
add eax, 0x2c
imul eax, edx
lea ebx, [eax*4]
mov dword [0x432194], ebx
test ebx, ebx
jne 0x4302e6
mov dword [esp], 0x4300d0
call fcn.00401400
mov eax, dword [esp + 0x2c]
sub eax, dword [0x44b0f8]
jne 0x430350
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0x432194], 0x3200
mov ebx, 0x3200
mov dword [esp], ebx
call sub.msvcrt.dll_malloc
mov dword [0x432190], eax
test eax, eax
je 0x430343
xor edx, edx
mov dword [0x43218c], eax
mov dword [eax], ebx
mov dword [eax + 4], edx
jmp 0x4302b3
lea eax, [esp + 0x10]
xor ebp, ebp
mov dword [esp + 4], eax
lea eax, [ebx + edi + 1]
mov dword [esp + 8], ebp
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov ebx, dword [esp + 0x10]
movzx edx, byte [ebx]
cmp dl, 0x3a
je 0x430333
test dl, dl
jne 0x4301f0
test eax, eax
js 0x4301f0
mov dword [esi + 8], eax
jmp 0x4301f0
xor ecx, ecx
mov dword [0x432194], ecx
jmp 0x4302b3
call fcn.004136d0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.004304c4
nop
nop
nop
call fcn.004304c4
nop
nop
nop
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x19195bd1
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x57422a0b
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..3ean
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x745b469e
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x431060
nop
nop
nop
nop
nop
mov eax, section..7LWLf
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x47a0199c
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x1002477b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100248a1
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100247ae
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
jmp 0x1002489c
mov byte [ebp - 1], 0
mov dword [ebp - 0x20], 0xb7e
mov dword [ebp - 0x30], 0x10008e08
cmp dword [ebp - 0x20], 0xc4f
jle 0x10024872
and dword [ebp - 8], 0
jmp 0x100247da
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xfa2
jge 0x10024872
and dword [ebp - 0xc], 0
jmp 0x100247f4
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x6637
jge 0x1002486d
and dword [ebp - 0x10], 0
jmp 0x1002480a
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3947
jge 0x1002486b
and dword [ebp - 0x14], 0
jmp 0x10024820
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xddb
jge 0x10024869
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
and eax, dword [ebp - 0x14]
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x60]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x60]
call fcn.100208ae
jmp 0x10024819
jmp 0x10024803
jmp 0x100247ed
jmp 0x100247d3
lea eax, [ebp - 1]
push eax
push 0x7823
push 0
push 0x6d3b
call fcn.100249a3
add esp, 0x10
cmp dword [ebp - 0x20], 0xb6f
jge 0x1002489c
push dword [ebp - 0x30]
call fcn.1006abb3
pop ecx
jmp 0x1002494c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0x6010
mov dword [ebp - 0x38], 0x10008e28
cmp dword [ebp - 0x24], 0x63ce
jle 0x1002491a
and dword [ebp - 0x18], 0
jmp 0x100248cb
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1494
jge 0x1002490c
and dword [ebp - 0x1c], 0
jmp 0x100248e1
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4dd6
jge 0x1002490a
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x100248da
jmp 0x100248c4
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x79a8
push 0
push 0x6611
push 0x1e7f
push dword [ebp - 0x34]
call fcn.100409ea
add esp, 0x14
cmp dword [ebp - 0x24], 0x5cee
jge 0x1002494c
mov edx, dword [ebp - 0x38]
mov ecx, 0x10085b58
call fcn.10023628
mov esp, ebp
pop ebp
ret