joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100030c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10003270
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1000318d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1000310a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1001b004]
ja 0x1000310a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100030da
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10007980
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10003130
jmp 0x1000318d
cmp dword [ebp - 0x14], 0x10000
jne 0x10003173
cmp dword [ebp - 0x18], 0x10000
jb 0x10003173
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10003166
mov eax, dword [ebp - 8]
jmp 0x1000318f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10003188
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10003270
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100030da
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100031a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.100032a0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10003265
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x100031e5
mov eax, dword [ebp - 4]
cmp eax, dword [0x1001b004]
ja 0x100031e5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100031b5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10007980
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1000320b
jmp 0x10003265
cmp dword [ebp - 0x14], 0x10000
jne 0x1000324e
cmp dword [ebp - 0x18], 0x10000
jb 0x1000324e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10003241
mov eax, dword [ebp - 8]
jmp 0x10003267
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10003260
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.100032a0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100031b5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100032d0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100036c0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x1001b87c], 0
jne 0x1000330d
cmp dword [0x1001b878], 0
je 0x1000330d
mov eax, dword [0x1001b878]
mov dword [0x1001b87c], eax
cmp dword [0x1001b87c], 0
je 0x1000338a
mov ecx, dword [0x1001b87c]
cmp dword [ecx + 8], 0
je 0x1000338a
mov edx, dword [0x1001b87c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x1000338a
mov ecx, dword [0x1001b87c]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1000338a
mov eax, dword [0x1001b87c]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x10003359
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x10003360
xor eax, eax
jmp 0x100034a9
mov ecx, dword [0x1001b87c]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.10007980
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x100034a9
mov edx, dword [0x1001b878]
mov dword [0x1001b87c], edx
jmp 0x100033a6
mov eax, dword [0x1001b87c]
mov ecx, dword [eax + 4]
mov dword [0x1001b87c], ecx
cmp dword [0x1001b87c], 0
je 0x100033e6
cmp dword [0x1001b87c], 0
je 0x100033e4
mov edx, dword [0x1001b87c]
cmp dword [edx + 8], 0
je 0x100033e4
mov eax, dword [0x1001b87c]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x100033e4
mov edx, dword [0x1001b87c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x100033e4
jmp 0x1000333e
jmp 0x10003398
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100034b0
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100034a7
mov eax, dword [ebp - 0x18]
mov dword [0x1001b87c], eax
mov ecx, dword [0x1001b87c]
mov dword [ecx], 0x52727464
mov edx, dword [0x1001b87c]
mov dword [edx + 8], 0
mov eax, dword [0x1001b87c]
mov ecx, dword [0x1001b878]
mov dword [eax + 4], ecx
mov edx, dword [0x1001b87c]
mov dword [0x1001b878], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x1001b87c]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x10003477
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x10003497
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1000346e
mov eax, dword [0x1001b87c]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1000333e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000fe15
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1000fe24
pop dword [ebp - 0x44]
mov eax, 0x3a4fe067
add eax, 0xd5b11dbd
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x37c19
push 0
mov eax, 0x24697167
sub eax, 0x14681027
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0xe2676ae
add ecx, 0xf1d9c848
xor edi, edi
add edi, eax
mov esi, 0x7064eda4
sub esi, 0x6062a9a4
add esi, dword [ebp - 0x44]
mov ebx, 0x25460845
add ebx, 0xa0116887
sub dword [ebp - 0x20], 0xbe5496d9
mov edx, dword [esi]
sub dword [ebp - 0x24], ebx
add edx, ebx
xor dword [ebp - 0x2c], 0x1055385a
mov dword [edi], edx
sub dword [ebp - 0x10], eax
add edi, 0x379bdc08
add edi, 0xc86423fc
add esi, 0xd5e84c39
sub esi, 0xd5e84c35
loop 0x1000fe85
add eax, 0x50e8fd2d
sub eax, 0x50e80e82
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x40185a
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x40188a
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x401885
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40186f
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x401877
cmp edx, ebx
jne 0x4019c5
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x401846
add eax, dword [eax + 4]
jmp 0x401833
mov dword [ebp + 0xc], ebx
jmp 0x401895
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4018ad
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4018cb
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x401929
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x401910
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x401919
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x401923
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x401905
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40188f
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x401976
dec eax
je 0x40196d
sub eax, 3
je 0x401964
mov dword [ebp - 4], 0x40
jmp 0x401993
mov dword [ebp - 4], 4
jmp 0x401979
mov dword [ebp - 4], 0x20
jmp 0x401979
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4019c5
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x401945
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004011d6
xchg esp, eax
call 0x763fe0c8
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x4019d1
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40560d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40561c
pop dword [ebp - 0x40]
mov eax, 0x48010f
sub eax, 0x7aaf3
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x90b5bbd8
add dword [ebp - 0x50], 0xbd9c8973
mov dword [ebp - 0x4c], 0x5cc57992
add dword [ebp - 0x4c], 0xd56dd2b3
mov dword [ebp - 0x48], 0x21d19685
add dword [ebp - 0x48], 0x2a7aada9
mov dword [ebp - 0x44], 0x700cca25
sub dword [ebp - 0x44], 0x700cca25
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x812244de
add dword [ebp - 0x50], 0xf3502478
mov dword [ebp - 0x4c], 0xff648547
sub dword [ebp - 0x4c], 0xbdf823d2
mov dword [ebp - 0x48], 0xaba81e1
add dword [ebp - 0x48], 0x58b4ea8b
mov dword [ebp - 0x44], 0xf3b5cecd
sub dword [ebp - 0x44], 0xf3b5cecd
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3c077
push 0
call eax
mov ecx, 0xaed9ef04
sub ecx, 0xaed99cfa
xor edi, edi
add edi, eax
mov ebx, 0x37b4eb07
sub ebx, 0x37733b07
add ebx, dword [ebp - 0x40]
mov edx, 0xb571bcec
sub edx, 0x4a801242
mov esi, dword [ebx]
sub dword [ebp - 0x24], ebx
xor esi, edx
mov dword [edi], esi
add dword [ebp - 0x38], 0xdc173805
add edi, 0xe96e749
add edi, 0xf16918bb
add ebx, 0xe350e660
sub ebx, 0xe350e65c
loop 0x405736
add eax, 0x73f3dafc
add eax, 0x8c0d5fff
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x10001064
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x40
push 0x3000
push dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10001084
xor al, al
jmp 0x100010a5
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.10001bb0
add esp, 0xc
call esi
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov al, 1
pop esi
pop ebp
ret

Function at 0x1000135b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], ebx
jb 0x10001370
mov eax, dword [eax]
push 0x1000c1b0
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.10002f8d
add esp, 0xc
test eax, eax
jne 0x100013e1
cmp dword [ebp + 0xc], ebx
je 0x100013e1
push esi
push edi
push 2
push ebx
push dword [ebp + 0xc]
call fcn.10002e55
push dword [ebp + 0xc]
call fcn.10002d66
mov esi, dword [ebp + 0x10]
push ebx
push ebx
push dword [ebp + 0xc]
mov dword [esi], eax
call fcn.10002e55
push dword [esi]
call fcn.10001977
push dword [ebp + 0xc]
mov edi, eax
push dword [esi]
push 1
push edi
call fcn.10002bb5
push dword [ebp + 0xc]
call fcn.100028f7
mov esi, dword [ebp + 8]
push ebx
mov dword [esi], edi
call fcn.10002331
add esp, 0x38
pop edi
mov eax, esi
pop esi
jmp 0x100013eb
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
mov eax, dword [ebp + 8]
mov dword [eax], ebx
pop ebx
leave
ret

Function at 0x100027ec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100110d8]
jne 0x100027f6
repz ret
jmp fcn.1000499c
Function at 0x10009f00
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100110d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100043d9
and dword [ebp - 0x14], 0
cmp dword [0x10012c58], 0
mov dword [ebp - 0x18], eax
jne 0x10009fb3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000a05b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000a05b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10012c58], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10012c5c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10012c60], eax
call edi
push eax
call esi
mov dword [0x10012c68], eax
test eax, eax
je 0x10009fb3
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10012c64], eax
mov eax, dword [0x10012c64]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000a00c
cmp dword [0x10012c68], ecx
je 0x1000a00c
push eax
call esi
push dword [0x10012c68]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000a00c
test ebx, ebx
je 0x1000a00c
call edi
test eax, eax
je 0x1000a003
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000a003
test byte [ebp - 8], 1
jne 0x1000a00c
or dword [ebp + 0x10], 0x200000
jmp 0x1000a03f
mov eax, dword [0x10012c5c]
cmp eax, dword [ebp - 0x18]
je 0x1000a03f
push eax
call esi
test eax, eax
je 0x1000a03f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000a03f
mov eax, dword [0x10012c60]
cmp eax, dword [ebp - 0x18]
je 0x1000a03f
push eax
call esi
test eax, eax
je 0x1000a03f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10012c58]
call esi
test eax, eax
je 0x1000a05b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000a05d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100027ec
leave
ret
Function at 0x41f52e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f56d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f56d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f56d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f56d
cmp dword [ecx + 0x74], 0xe
jbe 0x41f56d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4268cc
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x426969
push ebx
push esi
call fcn.00426895
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00426829
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x426916
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x426968
push edi
push eax
call fcn.0042522d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x426936
call fcn.0042527b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x426967
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00426829
add esp, 0x20
test eax, eax
jne 0x426955
push edi
call fcn.0042527b
jmp 0x42695d
push ebx
call fcn.0042527b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x427b78
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x430d20
push 0x430d18
push str.FlsAlloc
push 0x1f
call fcn.00427a37
mov esi, eax
add esp, 0x10
test esi, esi
je 0x427bac
push dword [ebp + 8]
mov ecx, esi
call dword [0x42e148]
call esi
jmp 0x427bb2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x427bf6
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x430d30
push 0x430d28
push str.FlsGetValue
push 0x21
call fcn.00427a37
mov esi, eax
add esp, 0x10
test esi, esi
je 0x427c2d
push dword [ebp + 8]
mov ecx, esi
call dword [0x42e148]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x427c35
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x430d38
push 0x430d30
push str.FlsSetValue
push 0x22
call fcn.00427a37
mov esi, eax
add esp, 0x10
test esi, esi
je 0x427c6f
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42e148]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x401ea0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x1070
call fcn.004054e0
call sym.test_embusb.exe__sys_init_0
call sym.test_embusb.exe__util_init_0
mov eax, 4
mov dword [0x434044], 0x400
mov word [esp], ax
movzx eax, word [0x42b6b8]
push eax
push dword [esp + 0x1080]
mov dword [0x434448], 0x100
push 0x434448
mov dword [0x43454c], 0x20
mov dword [0x432020], 0x2000
call sym.test_embusb.exe__string_vstring_12
mov byte [0x430f64], 1
call sub.KERNEL32.dll_GetCommandLineA
test eax, eax
je 0x401f21
movzx ecx, word [0x42b6b8]
push ecx
push eax
push 0x432020
call sym.test_embusb.exe__string_vstring_12
mov eax, 1
mov word [0x434024], ax
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x434024
push 0x432020
call sym.test_embusb.exe__string_token_16
mov ax, word [0x434024]
mov word [0x434026], ax
mov dword [0x434040], 1
mov byte [0x434570], 0
add esp, 0x1070
ret 0xc
Function at 0x403890
Capabilities:
Write file on windows

Disassembly:
push 1
call fcn.0040887c
push eax
push 0x21
push 1
push str._Program_aborted_on_error._
call fcn.00408b11
push 0x42d35c
call fcn.00401350
add esp, 0x18
jmp sym.test_embusb.exe__sys_exit_error_0

Function at 0x403a50
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x104
xor eax, eax
push ebx
mov ebx, dword [esp + 0x10c]
push esi
mov esi, dword [esp + 0x114]
mov word [esi + 2], ax
test ebx, ebx
jne 0x403a7d
pop esi
xor al, al
pop ebx
add esp, 0x104
ret 8
push ebp
push edi
cmp word [esi], ax
jle 0x403b83
push 0
push dword [0x430f68]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push dword [0x42d3b0]
push ebx
push 0
push 0x11ff
call sub.KERNEL32.dll_FormatMessageA
test eax, eax
je 0x403ac9
push eax
push dword [esp + 0x14]
push esi
call sym.test_embusb.exe__string_vstring_12
push dword [esp + 0x10]
call sub.KERNEL32.dll_LocalFree
jmp 0x403b7d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x403ad7
push eax
call sub.KERNEL32.dll_LocalFree
push str.RASAPI32.DLL
mov ebp, 1
call sub.KERNEL32.dll_LoadLibraryA
mov edi, eax
test edi, edi
jne 0x403b1c
push ebp
call fcn.0040887c
push eax
push 0x1c
push ebp
push str.Could_not_load_RASAIP32.DLL.
call fcn.00408b11
push 0x42d3ec
call fcn.00401350
add esp, 0x18
mov al, 1
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x104
ret 8
push str.RasGetErrorStringA
push edi
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
jne 0x403b50
push 1
call fcn.0040887c
push eax
push 0x2e
push 1
push str.Could_not_find_RasGetErrorStringA_entry_point.
call fcn.00408b11
push 0x42d420
call fcn.00401350
add esp, 0x18
jmp 0x403b60
push dword [0x42d3c4]
lea ecx, [esp + 0x18]
push ecx
push ebx
call eax
mov ebp, eax
push edi
call sub.KERNEL32.dll_FreeLibrary
test ebp, ebp
jne 0x403b83
movzx eax, word [0x42d3c8]
push eax
lea eax, [esp + 0x18]
push eax
push esi
call sym.test_embusb.exe__string_vstring_12
push esi
call sym.test_embusb.exe__string_unpad_4
pop edi
pop ebp
pop esi
mov al, 1
pop ebx
add esp, 0x104
ret 8
Function at 0x403ec0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1a14
call fcn.004054e0
mov eax, dword [0x430f88]
inc eax
mov dword [0x430f88], eax
push ebx
mov ebx, 0x84
mov word [esp + 4], bx
cmp eax, 1
jle 0x403f20
cmp byte [0x42d4ac], 0
jne 0x403f20
push 0x42d8b4
call fcn.00401350
push 1
call fcn.0040887c
push eax
push 0x35
push 1
push str.Recursive_call_to_message_routine.__Original_message:
call fcn.00408b11
push 0x42d9e0
call fcn.00401350
add esp, 0x1c
call fcn.00404160
push 0x42d458
push 0x42d4b0
push dword [esp + 0x1a28]
push dword [esp + 0x1a28]
call sym.test_embusb.exe__sys_message_resolve_16
cmp word [0x42d4b2], 0
mov byte [0x42d4ac], 0
jle 0x40414f
cmp word [0x42d45a], 0
jle 0x40414f
cmp dword [0x430f88], 1
jle 0x403fab
push 0x42d9e4
call fcn.00401350
push 1
call fcn.0040887c
push eax
push 0x3d
push 1
push str.Message_requested_while_attempting_to_print_previous_message:
call fcn.00408b11
push 0x42da28
call fcn.00401350
add esp, 0x1c
call fcn.00404160
dec dword [0x430f88]
pop ebx
add esp, 0x1a14
ret 0x10
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x10f8]
push eax
push dword [esp + 0x1a30]
push dword [esp + 0x1a30]
push 0x42d458
push 0x42d4b0
call sym.test_embusb.exe__file_open_read_msg_24
lea eax, [esp + 0x8c]
push eax
call sym.test_embusb.exe__file_not_found_4
test al, al
jne 0x403f96
lea eax, [esp + 0x8c]
push eax
call sym.test_embusb.exe__sys_error_4
test al, al
je 0x40402d
call fcn.00404160
push 0
push 0x430f70
push str.open_msg
push 0x42d8b8
lea eax, [esp + 0x9c]
push eax
call sym.test_embusb.exe__sys_error_print_20
dec dword [0x430f88]
pop ebx
add esp, 0x1a14
ret 0x10
push edi
call sym.test_embusb.exe__sys_width_stdout_0
lea edi, [eax - 1]
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0xc]
push eax
push edi
lea eax, [esp + 0x1104]
push eax
call sym.test_embusb.exe__file_read_msg_16
lea eax, [esp + 0x90]
push eax
call sym.test_embusb.exe__file_eof_4
test al, al
jne 0x40413a
push esi
nop word [eax + eax]
lea eax, [esp + 0x94]
push eax
call sym.test_embusb.exe__sys_error_4
test al, al
jne 0x404116
mov ax, word [esp + 0xe]
cmp ax, bx
jle 0x4040ad
cwde
push 0x430f74
sub eax, 0x84
push eax
push 0x42da2c
call fcn.00401350
mov ax, word [esp + 0x1a]
add esp, 0xc
test ax, ax
jle 0x4040c0
cmp ax, bx
jge 0x4040bc
movsx esi, ax
jmp 0x4040c2
mov esi, ebx
jmp 0x4040c2
xor esi, esi
push 1
call fcn.0040887c
push eax
push esi
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.00408b11
push 0x42da30
call fcn.00401350
add esp, 0x18
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x10]
push eax
push edi
lea eax, [esp + 0x1108]
push eax
call sym.test_embusb.exe__file_read_msg_16
lea eax, [esp + 0x94]
push eax
call sym.test_embusb.exe__file_eof_4
test al, al
je 0x404070
jmp 0x404139
call fcn.00404160
push 0
push 0x430f70
push str.read_msg
push 0x42d8b8
lea eax, [esp + 0xa4]
push eax
call sym.test_embusb.exe__sys_error_print_20
pop esi
lea eax, [esp + 0x10f8]
mov byte [0x42d4ac], 1
push eax
call sym.test_embusb.exe__file_close_4
pop edi
dec dword [0x430f88]
pop ebx
add esp, 0x1a14
ret 0x10