joyce8/EMBER2024-capa huggingface dataset:
Function at 0x130e9d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x130ea5e
push 0xbbf966b4
push dword [0x1320368]
call fcn.01313a90
add esp, 8
test eax, eax
je 0x130ea29
mov ecx, dword [esi]
test ecx, ecx
je 0x130ea5b
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x130ea37
cmp dword [esp], 0
je 0x130ea37
mov dword [esi + 4], 3
jmp 0x130ea5b
mov dword [esi + 4], 1
mov ecx, dword [esi]
jmp 0x130eae7
lea eax, [esp + 4]
push eax
call fcn.01314320
add esp, 4
test al, al
je 0x130ea5b
mov eax, dword [esp + 4]
mov ecx, 2
cmp eax, 3
je 0x130ea58
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, 2
jne 0x130eae7
mov dword [esp], 0xf4f5f6f7
mov eax, 0x92bb3fd4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x6d44c02c]
xor edx, eax
mov esi, edx
not esi
add edx, 0x2257c0db
or esi, edx
and esi, 1
or edx, 1
add edx, esi
mov byte [esp + eax + 0x6d44c02c], dl
inc eax
cmp eax, 0x92bb3fd8
jne 0x130ea80
mov eax, dword [esp]
mov edx, dword [0x1320374]
test edx, edx
je 0x130eb94
mov ebp, ebx
xor esi, esi
mov ebx, dword [0x1320378]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xc3cdc4a6
je 0x130eb70
inc esi
cmp edx, esi
jne 0x130ead0
jmp 0x130eb94
mov dword [esp], 0xf4f5f6f7
mov eax, 0x92bb3fd4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x6d44c02c]
xor edx, eax
mov esi, edx
not esi
add edx, 0x2257c0db
or esi, edx
and esi, 1
or edx, 1
add edx, esi
mov byte [esp + eax + 0x6d44c02c], dl
inc eax
cmp eax, 0x92bb3fd8
jne 0x130eb00
mov eax, dword [esp]
mov edx, dword [0x1320374]
test edx, edx
je 0x130eb94
xor esi, esi
mov ebx, dword [0x1320378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xae6e2b0b
je 0x130eb60
inc esi
cmp edx, esi
jne 0x130eb50
jmp 0x130eb94
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x130eb94
push ebp
push edi
push dword [esp + 0x28]
jmp 0x130eb7e
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x130eb94
push dword [esp + 0x28]
push edi
push ebp
push dword [esp + 0x28]
push ecx
push 5
push dword [0x132037c]
push edx
call fcn.01310f10
add esp, 0x20
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x130eeb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x130eec9
lea edi, [esp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x130eeda
cmp eax, 2
je 0x130ef4c
jmp 0x130ef79
push 0xbbf966b4
push dword [0x1320368]
call fcn.01313a90
add esp, 8
test eax, eax
je 0x130ef17
mov ecx, dword [esi]
test ecx, ecx
je 0x130ef44
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x130ef20
cmp dword [esp], 0
je 0x130ef20
mov dword [esi + 4], 3
jmp 0x130ef44
mov dword [esi + 4], 1
jmp 0x130ef79
lea eax, [esp + 4]
push eax
call fcn.01314320
add esp, 4
test al, al
je 0x130ef44
mov eax, dword [esp + 4]
mov ecx, 2
cmp eax, 3
je 0x130ef41
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x130ef79
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x1328390]
call fcn.01313a90
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x130f014
mov ecx, dword [esi]
mov dword [esp], 0xf4f5f6f7
mov eax, 0x92bb3fd4
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x6d44c02c]
xor edx, eax
mov esi, edx
not esi
add edx, 0x2257c0db
or esi, edx
and esi, 1
or edx, 1
add edx, esi
mov byte [esp + eax + 0x6d44c02c], dl
inc eax
cmp eax, 0x92bb3fd8
jne 0x130ef90
mov eax, dword [esp]
mov edx, dword [0x1320374]
test edx, edx
je 0x130f014
xor esi, esi
mov ebx, dword [0x1320378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x130eff0
inc esi
cmp edx, esi
jne 0x130efe0
jmp 0x130f014
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x130f014
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x132037c]
push edx
call fcn.01310f10
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x13124e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc eax, 0
xor edx, edx
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, eax
mov esi, dword [esp + 0x28]
jb 0x1312550
mov ecx, ebx
shr ecx, 2
mov eax, ebp
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, edx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
test bl, 1
je 0x13126ee
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x13126ee
mov dword [esp], 0x282b2a25
mov byte [esp + 4], 0
nop
nop
nop
nop
mov ebp, edx
shr ebp, 1
and ebp, 1
movzx ecx, byte [esp + edx]
mov edi, edx
and edi, 5
mov eax, edx
or eax, 0xfffffffd
inc eax
imul eax, edi
mov edi, edx
or edi, 2
imul edi, ebp
add edi, edi
sub eax, edi
add eax, edx
add eax, 0x3773c848
xor eax, ecx
mov ecx, eax
not ecx
and ecx, 1
xor eax, 0xfe
lea eax, [eax + ecx*2]
add al, 0x6c
mov byte [esp + edx], al
inc edx
cmp edx, 5
jne 0x1312560
mov eax, dword [esp]
mov ecx, dword [0x1320374]
test ecx, ecx
je 0x13125e0
xor edx, edx
mov edi, dword [0x1320378]
mov ebp, dword [esp + 0x20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x13125e6
inc edx
cmp ecx, edx
jne 0x13125d0
jmp 0x1312610
mov ebp, dword [esp + 0x20]
jmp 0x1312610
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x1312610
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x132037c]
push ecx
call fcn.01310f10
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x24]
js 0x13126ee
push 0x732f71fd
push dword [0x1328390]
call fcn.01313a90
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x282b2a25
mov byte [esp + 4], 0
xor edx, edx
nop
mov edi, edx
shr edi, 1
and edi, 1
movzx esi, byte [esp + edx]
mov ebx, edx
and ebx, 5
mov ebp, edx
or ebp, 0xfffffffd
inc ebp
imul ebp, ebx
mov ebx, edx
or ebx, 2
imul ebx, edi
add ebx, ebx
sub ebp, ebx
lea edi, [edx + ebp]
add edi, 0x3773c848
xor edi, esi
mov esi, edi
not esi
and esi, 1
xor edi, 0xfe
lea ebx, [edi + esi*2]
add bl, 0x6c
mov byte [esp + edx], bl
inc edx
cmp edx, 5
jne 0x1312650
mov edx, dword [0x1320374]
test edx, edx
je 0x13126ee
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x1320378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x13126d0
inc edi
cmp edx, edi
jne 0x13126c0
jmp 0x13126ee
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x13126ee
push ecx
push 1
push dword [0x132037c]
push edx
mov esi, eax
call fcn.01310f10
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x13138c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x717e7f8c
mov word [esp + 4], 0
mov eax, esp
mov edx, 0x4e93f7ea
nop
movzx edi, byte [eax]
mov ebx, edx
or ebx, edi
not ebx
lea esi, [edx - 0x4e93f700]
and esi, edi
or esi, ebx
mov edi, esi
and edi, 0x16
mov ebx, esi
xor ebx, 0x96
lea ebx, [ebx + edi*2]
and esi, 1
xor ebx, 1
or ebx, esi
add ebx, esi
mov byte [eax], bl
inc eax
dec edx
cmp edx, 0x4e93f7e4
jne 0x13138e0
mov eax, dword [esp]
mov eax, dword fs:[eax]
mov edx, dword [case.0x1313869.8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x13139c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x14]
mov dword [esp], 0x191a1bec
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x7b
xor dl, byte [esp + eax]
add dl, 0x99
mov byte [esp + eax], dl
inc eax
cmp eax, 4
jne case.default.0x1313a01
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x131eeb4]

Function at 0x1313a90
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x48]
movzx eax, word [eax]
mov dword [esp], 0x1065d53
mov word [esp + 4], 0
mov ecx, 0x13da8e83
mov edx, 0x7e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x13da8e83]
mov edi, esi
not edi
or edi, edx
lea esi, [esi + edi*2]
add esi, ecx
mov edi, esi
and edi, 0x7a
xor esi, 0x7a
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + ecx - 0x13da8e83], bl
inc ecx
dec edx
cmp ecx, 0x13da8e89
jne 0x1313ac0
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x131eef4]
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1003a98
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x1003af0
call fcn.01003b0c
xor eax, eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1003ae7
cmp ecx, 0xffffffff
je 0x1003ae7
and dword [ebp - 4], eax
mov edx, 0x5a4d
cmp word [ecx], dx
jne 0x1003ae0
mov edx, dword [ecx + 0x3c]
test edx, edx
jl 0x1003ae0
cmp edx, 0x10000000
jae 0x1003ae0
lea eax, [edx + ecx]
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
jne 0x1006d0b
mov dword [ebp - 4], 0xfffffffe
call fcn.010023d0
ret 4
je 0x1006d56
outsb dx, byte [esi]
je 0x1006d75
jb 0x1006d7c
dec esp
and ch, byte [edx]
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x513ae8
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x513ae4]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call fcn.00420244
jmp 0x4011d3
mov eax, dword [0x513ae4]
test eax, eax
jne 0x4011c9
mov dword [0x513ae4], 1
mov dword [esp + 4], 0x516014
mov dword [esp], 0x51600c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x4011d3
mov dword [0x51301c], 1
mov eax, dword [0x513ae4]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x516008
mov dword [esp], section..CRT
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x513ae4], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x513ae8
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call fcn.00410f9d
mov dword [esp], 0x4110b8
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x513074], eax
mov dword [esp], section..text
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.0041093c
mov eax, dword [0x513004]
mov dword [esp + 4], 0x513008
mov dword [esp], eax
call fcn.004013c8
call fcn.00410778
mov eax, dword [0x4c97f0]
mov edx, dword [0x51300c]
mov dword [eax], edx
mov ecx, dword [0x51300c]
mov edx, dword [0x513008]
mov eax, dword [0x513004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004105c0
mov dword [0x513014], eax
mov eax, dword [0x513018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x513014]
mov dword [esp], eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x51301c]
test eax, eax
jne 0x4012de
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x513014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x51304c], 1
mov dword [0x513050], 1
mov dword [0x513054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret

Function at 0x401e49
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
mov edx, eax
shr eax, 4
leave
and eax, 1
inc edx
mov dl, 0
cmove eax, edx
movzx eax, al
ret
Function at 0x410944
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00420064
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort

Function at 0x411518
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x411537
mov eax, 0
jmp 0x41157b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x41155a
mov eax, 0
jmp 0x41157b
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x411576
mov eax, 0
jmp 0x41157b
mov eax, 1
leave
ret

Function at 0x41157d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x4115dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x4115d4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x4115d4
mov eax, dword [ebp - 4]
jmp 0x4115f0
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x4115b1
mov eax, 0
leave
ret
Function at 0x423004
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
cmp dword [ebp + 8], 0
je 0x4230cc
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004227a8
cmp eax, 1
jne 0x4230c2
mov dword [ebp - 0x3d], 0
mov dword [ebp - 0x39], 0
mov dword [ebp - 0x35], 0
mov dword [ebp - 0x31], 0
mov dword [ebp - 0x2d], 0
mov dword [ebp - 0x29], 0
mov dword [ebp - 0x25], 0
mov dword [ebp - 0x21], 0
mov dword [ebp - 0x1d], 0
mov dword [ebp - 0x19], 0
mov dword [ebp - 0x15], 0
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
mov byte [ebp - 9], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 4], 0x35
lea eax, [ebp - 0x3d]
mov dword [esp], eax
call fcn.0042b0f0
lea eax, [ebp - 0x3d]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x4230cd
nop
leave
ret
Function at 0x424052
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x423ec1
mov dword [esp], 0x513aa4
call fcn.00423631
mov eax, dword [0x4c9840]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x424099
mov eax, dword [ebp - 0x20]
jmp 0x4241e4
call fcn.00422f0d
mov dword [ebp - 0x20], eax
mov eax, entry3
test eax, eax
je 0x4240b0
cmp dword [ebp - 0x20], 0
jne 0x4240ba
mov eax, 0
jmp 0x4241e4
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00423004
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x42418c
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x4c9840]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x4241e1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret