joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4615b8
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb0
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebp, dword [esp + 0x14]
call sub.kernel32.dll_GetCurrentProcessId
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
xor edi, edi
mov ebx, dword [esp + 0xc]
shr ebx, 0x10
mov eax, ebx
shl eax, 0x10
mov ebx, eax
mov eax, edi
shl eax, 0x10
sub ebx, eax
mov eax, ebx
xor edx, edx
div ebp
imul ebp
mov ebx, eax
push 4
push 0x3000
push ebp
push ebx
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
test esi, esi
je 0x461636
cmp esi, ebx
je 0x461636
push 0x8000
push 0
push esi
call sub.kernel32.dll_VirtualFree_1
inc edi
jmp 0x4616af
test esi, esi
jne 0x4616b8
push 0x1c
lea eax, [esp + 0x38]
push eax
push ebx
call sub.kernel32.dll_VirtualQuery_1
cmp dword [esp + 0x40], 0x118
jb 0x4616ac
mov eax, dword [esp + 0x48]
and eax, 4
cmp eax, 4
jne 0x4616ac
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
cmp edx, dword [ebx + 4]
jne 0x4616ac
cmp eax, dword [ebx]
jne 0x4616ac
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
cmp edx, dword [ebx + 0x114]
jne 0x4616ac
cmp eax, dword [ebx + 0x110]
jne 0x4616ac
lea eax, [ebx + 8]
mov edx, dword [esp]
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402e68
je 0x4616b8
inc edi
xor ebx, ebx
cmp edi, 0x14
jle 0x4615ef
xor eax, eax
test esi, esi
je 0x46171e
cmp esi, ebx
jne 0x46173a
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
mov dword [ebx], eax
mov dword [ebx + 4], edx
lea eax, [ebx + 8]
mov edx, dword [esp]
call fcn.00402dbc
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
mov dword [ebx + 0x110], eax
mov dword [ebx + 0x114], edx
mov dword [ebx + 0x108], 1
lea eax, [ebx + 0x118]
mov edx, dword [esp + 4]
mov dword [edx], 1
jmp 0x46173a
test ebx, ebx
je 0x46173a
inc dword [ebx + 0x108]
lea eax, [ebx + 0x118]
mov edx, dword [esp + 4]
mov ecx, dword [ebx + 0x108]
mov dword [edx], ecx
add esp, 0x50
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x462fe0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
push 0x46305c
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x46304d
xor edx, edx
push ebp
push 0x463046
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x46306c
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x463029
push ebx
call eax
mov byte [ebp - 1], 1
jmp 0x46302f
push ebx
call sub.kernel32.dll_GetSystemInfo
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463053
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
push ebx
call sub.kernel32.dll_GetSystemInfo
mov al, byte [ebp - 1]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4630a4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x463264
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.00402ed8
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x477894], eax
mov eax, dword [ebp - 0xc]
mov dword [0x477898], eax
mov eax, dword [ebp - 0x24]
mov dword [0x47789c], eax
mov eax, dword [0x47839c]
cmp dword [eax], 2
sete byte [0x4773c4]
push 0x463270
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.004639f8
cmp byte [0x4773c4], 0
jne 0x463130
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00463a28
test al, al
je 0x463130
mov eax, dword [ebp - 0x4c]
mov dword [0x47a274], eax
jmp 0x463137
xor eax, eax
mov dword [0x47a274], eax
call fcn.00462de4
and eax, 0x7f
cmp eax, 0x10
ja case.0x463148.0
jmp dword [eax*4 + 0x46314f]
mov byte [0x4773b0], 1
jmp case.0x463148.0
mov byte [0x4773b4], 1
jmp case.0x463148.0
mov byte [0x4773b8], 1
jmp case.0x463148.0
mov byte [0x4773bc], 1
jmp case.0x463148.0
mov byte [0x4773c0], 1
jmp case.0x463148.0
mov byte [0x4773c8], 1
mov byte [0x4773cc], 1
jmp case.0x463148.0
mov byte [0x4773c8], 1
mov byte [0x4773d0], 1
jmp case.0x463148.0
mov byte [0x4773c8], 1
mov byte [0x4773d0], 1
mov byte [0x4773d4], 1
jmp case.0x463148.0
mov byte [0x4773d8], 1
jmp case.0x463148.0
mov byte [0x4773dc], 1
jmp case.0x463148.0
mov byte [0x4773e0], 1
jmp case.0x463148.0
mov byte [0x4773e4], 1
jmp case.0x463148.0
mov byte [0x4773e8], 1
jmp case.0x463148.0
mov byte [0x4773ec], 1
jmp case.0x463148.0
mov byte [0x4773f0], 1
jmp case.0x463148.0
mov byte [0x4773f4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46326b
lea eax, [ebp - 4]
call fcn.004043e0
ret

Function at 0x463a28
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x463acf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404890
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x463ab9
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404a1c
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404890
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x463ab9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x463ae0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x463ab9
cmp dword [ebp - 8], 0x34
jne 0x463ab9
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463ad6
lea eax, [ebp - 0x10]
call fcn.004043e0
ret
Function at 0x46d190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0046d858
test al, al
je 0x46d2a4
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa2], 0
jne 0x46d1eb
mov edx, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
mov ecx, ebx
call fcn.0046c674
test al, al
je 0x46d1d9
mov dword [ebp - 8], ebx
jmp 0x46d2a4
mov edx, 0x46d2b8
mov eax, dword [ebp - 4]
call fcn.0046ca84
jmp 0x46d2a4
mov eax, dword [ebp - 4]
call fcn.0046c944
xor eax, eax
push ebp
push 0x46d29d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x14
call fcn.00402ed8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x46d24f
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x46d24f
mov edx, 0x46d2f4
mov eax, dword [ebp - 4]
call fcn.0046ca84
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7c]
call fcn.0046a518
test al, al
je 0x46d271
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x46d287
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.kernel32.dll_GetOverlappedResult
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d2a4
mov eax, dword [ebp - 4]
call fcn.0046c950
ret
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46d30c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0046d858
test al, al
je 0x46d3e4
mov eax, dword [ebp - 4]
call fcn.0046c95c
xor eax, eax
push ebp
push 0x46d3dd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x14
call fcn.00402ed8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x46d38f
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x46d38f
mov edx, 0x46d3f8
mov eax, dword [ebp - 4]
call fcn.0046ca84
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7c]
call fcn.0046a518
test al, al
je 0x46d3b1
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x46d3c7
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.kernel32.dll_GetOverlappedResult
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d3e4
mov eax, dword [ebp - 4]
call fcn.0046c968
ret
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40288e
pop dword [ebp - 0x38]
mov eax, 0xb33a0630
add eax, 0x4d06225e
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x20d1a461
sub dword [ebp - 0x48], 0xd27f5f16
mov dword [ebp - 0x44], 0x33f01850
sub dword [ebp - 0x44], 0x1bccc0b
mov dword [ebp - 0x40], 0x69a5032e
sub dword [ebp - 0x40], 0x1d58bf00
mov dword [ebp - 0x3c], 0xd3311f66
add dword [ebp - 0x3c], 0x2ccee09a
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xd6e2513
add dword [ebp - 0x48], 0x67044443
mov dword [ebp - 0x44], 0xfdfe69ab
sub dword [ebp - 0x44], 0xbc920836
mov dword [ebp - 0x40], 0x844b1bdd
sub dword [ebp - 0x40], 0x20dbaf71
mov dword [ebp - 0x3c], 0xab141491
sub dword [ebp - 0x3c], 0xab141491
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3a71a
push 0
call eax
mov ecx, 0x5764
mov edx, eax
mov edi, 0x1110d90b
sub edi, 0x10cfd90b
add edi, dword [ebp - 0x38]
mov esi, 0x61cc8be7
add dword [ebp - 0x34], esi
mov ebx, dword [edi]
add dword [ebp - 0x2c], 0x2be3a130
xor ebx, esi
mov dword [ebp - 0x20], 0xc90f8625
mov dword [edx], ebx
add dword [ebp - 0x18], 0x6f39de78
add edx, 0x251b400d
add edx, 0xdae4bff7
add edi, 0x40e67397
sub edi, 0x40e67393
loop 0x40299a
add eax, 0x15063
xor ebx, ebx
add ebx, eax
add eax, 0xa2bfb340
sub eax, 0xa2bfb33b
mov ecx, 0x814d970c
sub ecx, 0x810d970c
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x40d0d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x40d130
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x492058]
test esi, esi
jle 0x40d21d
mov edi, dword [0x49205c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x40d164
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x40d216
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x40d150
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x40d25a
lea ebx, [esi + esi*2]
mov esi, dword [0x49205c]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x49205c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40d23a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40d20f
sub eax, 0x40
and eax, 0xffffffbf
je 0x40d20f
mov eax, dword [esp + 0x20]
add ebx, dword [0x49205c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x40d224
add dword [0x492058], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x40d16e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x49205c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x40ee00
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sym._strlen
mov esi, eax
lea eax, [eax + 0x41]
and eax, 0xfffffff0
call fcn.0040dca0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
lea edi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [esi + 0x10]
lea edx, [edi + eax]
mov dword [ebp - 0x20], eax
mov dword [edx], 0x61616161
mov dword [edx + 4], 0x61616161
mov dword [edx + 8], 0x61616161
mov dword [edx + 0xc], 0x61616161
mov dword [edx + 0x10], 0x61616161
mov dword [edx + 0x14], 0x61616161
mov dword [edx + 0x18], 0x61616161
mov dword [edx + 0x1c], 0x61616161
mov dword [ebp - 0x24], edx
mov byte [esp + esi + 0x3c], 0
mov byte [esp + esi + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [edi + esi + 0xf], 0x2d
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
mov edx, dword [ebp - 0x24]
je 0x40eeef
int3
mov dword [ebp - 0x24], edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
mov edx, dword [ebp - 0x24]
jne 0x40ef93
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
mov dword [esp], eax
call sym._malloc
mov edx, dword [ebp - 0x24]
mov ebx, eax
mov eax, 0x20
bt ebx, eax
jae 0x40ef2a
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x40ef22
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x40ef90
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call dbg.get_ptr_from_atom
cmp eax, ebx
mov esi, eax
je 0x40efaa
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x1c]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call dbg.get_ptr_from_atom
mov esi, eax
jmp 0x40ef64
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40ef64
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x40ef64
Function at 0x41a0b0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push esi
push ebx
mov esi, eax
sub esp, 0x2e4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
sub esp, 4
cmp eax, 0xffffffff
jne 0x41a0e0
add esp, 0x2e4
mov eax, 0xffffffff
pop ebx
pop esi
ret
lea eax, [esp + 0x14]
mov dword [esp], esi
mov dword [esp + 0x14], 0x10003
mov ebx, 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
sub esp, 8
test eax, eax
cmovne ebx, dword [esp + 0xcc]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
add esp, 0x2e4
mov eax, ebx
pop ebx
pop esi
ret
Function at 0x41c090
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x492e70]
test ebx, ebx
je 0x41c0c0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx], eax
mov eax, dword [0x492e70]
test eax, eax
je 0x41c0e5
cmp dword [eax], 0xffffffff
je 0x41c108
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov ebx, eax
mov dword [0x492e70], eax
jmp 0x41c09e
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e70], eax
jmp 0x41c0af
call sym._abort
lea esi, [esi]
Function at 0x41c5a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x492e74]
test eax, eax
je 0x41c6f4
call sym.__pthread_once_raw.constprop.5
mov eax, dword [0x492e70]
test eax, eax
je 0x41c720
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41c5e0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._pop_pthread_mem
test eax, eax
mov ebx, eax
je 0x41c76c
mov eax, dword [entry3]
test eax, eax
je 0x41c76c
mov dword [ebx + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x38], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub esp, 0x10
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x34], 0xffffffff
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x14], 0
call esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call esi
mov edx, eax
lea eax, [ebx + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x41c773
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
mov dword [ebx + 0x64], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x492e70]
test eax, eax
je 0x41c746
mov dword [esp + 4], ebx
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x41c773
mov eax, ebx
jmp 0x41c5d8
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_once_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e74], eax
jmp 0x41c5b4
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e70], eax
jmp 0x41c5c6
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e70], eax
jmp 0x41c6d3
xor eax, eax
jmp 0x41c5d8
call sym._abort
nop
lea esi, [esi]
Function at 0x41cce0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
cmp dword [esp + 0x24], 3
je 0x41cd00
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret 0xc
mov eax, dword [0x492e70]
test eax, eax
je 0x41ce70
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x41ccec
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41ccec
test byte [eax + 0x20], 0x30
je 0x41cdc0
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x41ce60
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x41cd70
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x41cd62
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x34], 0xffffffff
test edx, edx
je 0x41cec6
mov eax, dword [0x492e70]
test eax, eax
je 0x41cea0
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
mov eax, 1
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [eax + 0x64]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x41ce20
test eax, eax
je 0x41cdda
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x64], 1
test eax, eax
jne 0x41ce50
test byte [ebx + 0x24], 4
je 0x41ce37
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41cd69
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x41cd69
test eax, eax
je 0x41ce30
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov dword [ebx + 0x34], 0xffffffff
jmp 0x41ccec
call sym.__pthread_cleanup_dest.part.3
jmp 0x41cdf2
call sym.__pthread_cleanup_dest.part.3
jmp 0x41cd3e
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e70], eax
jmp 0x41cd0d
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e70], eax
jmp 0x41cd9d
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x41cd90