joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fa10
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x74
mov ebx, dword [0x51a4d0]
test ebx, ebx
je 0x45fa38
mov edx, dword [0x51e4e8]
xor ebx, ebx
test edx, edx
setne bl
add esp, 0x74
mov eax, ebx
pop ebx
pop esi
ret
mov dword [esp], str.GC_USE_GETWRITEWATCH
call sub.msvcrt.dll_getenv
test eax, eax
je 0x45fa51
cmp byte [eax], 0x30
je 0x45fb48
mov dword [esp], 0x4907b2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
test eax, eax
je 0x45fb24
mov dword [esp + 4], str.GetWriteWatch
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x51e4e8], eax
sub esp, 8
test eax, eax
je 0x45fb30
mov eax, dword [0x51a4c4]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x202000
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov esi, eax
test eax, eax
je 0x45fb78
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [0x51a4c4]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], 1
call dword [0x51e4e8]
sub esp, 0x18
test eax, eax
jne 0x45fb68
mov dword [0x51e4e4], 0x200000
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
sub esp, 0xc
mov eax, dword [0x51e4e8]
xor ebx, ebx
test eax, eax
setne bl
mov dword [0x51a4d0], 1
add esp, 0x74
mov eax, ebx
pop ebx
pop esi
ret
cmp byte [eax + 1], 0
jne 0x45fa51
mov dword [0x51a4d0], 1
jmp 0x45fa1f
mov dword [0x51e4e8], 0
jmp 0x45fb08
mov dword [0x51e4e8], 0
jmp 0x45fb30
Function at 0x45fbb0
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x78
cmp dword [0x4b1564], 2
je 0x45fda0
test word [0x51a4c4], 0xfff
je 0x45fbdf
mov dword [esp], str.Page_size_not_multiple_of_HBLKSIZE
call dword [0x488200]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov ecx, dword [0x51a4d0]
test ecx, ecx
je 0x45fc10
mov eax, dword [0x51e4e8]
test eax, eax
je 0x45fd20
mov edx, dword [0x4b1564]
test edx, edx
jne 0x45fdd0
add esp, 0x78
mov eax, 1
pop ebx
ret
mov dword [esp], str.GC_USE_GETWRITEWATCH
call sub.msvcrt.dll_getenv
test eax, eax
je 0x45fc29
cmp byte [eax], 0x30
je 0x45fd80
mov dword [esp], 0x4907b2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
test eax, eax
je 0x45fd00
mov dword [esp + 4], str.GetWriteWatch
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x51e4e8], eax
sub esp, 8
test eax, eax
je 0x45fd6a
mov eax, dword [0x51a4c4]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x202000
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov ebx, eax
test eax, eax
je 0x45fd60
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [0x51a4c4]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], 1
call dword [0x51e4e8]
sub esp, 0x18
test eax, eax
jne 0x45fde8
mov dword [0x51e4e4], 0x200000
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
sub esp, 0xc
mov eax, dword [0x51e4e8]
mov dword [0x51a4d0], 1
test eax, eax
jne 0x45fbf6
lea esi, [esi]
nop
mov dword [esp], 0x45ee70
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [0x51a4d4], eax
sub esp, 4
test eax, eax
je 0x45fdb8
mov eax, dword [0x4b1564]
test eax, eax
je 0x45fc04
mov dword [esp], str.Replaced_other_UnhandledExceptionFilter_n
call fcn.0045aed0
jmp 0x45fc04
mov dword [0x51e4e8], 0
mov dword [0x51a4d0], 1
jmp 0x45fd20
cmp byte [eax + 1], 0
jne 0x45fc29
mov dword [0x51a4d0], 1
jmp 0x45fbe9
mov dword [esp], str.Initializing_mprotect_virtual_dirty_bit_implementation_n
call fcn.0045aed0
jmp 0x45fbc1
mov dword [0x51a4d4], 0xffffffff
jmp 0x45fc04
mov dword [esp], str.Using_GetWriteWatch___n
call fcn.0045aed0
jmp 0x45fc04
mov dword [0x51e4e8], 0
jmp 0x45fce4
Function at 0x460350
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [0x51a3c8]
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
test esi, esi
je 0x460381
mov ebx, dword [0x51a440]
test ebx, ebx
jne 0x460381
mov ecx, dword [0x51e4e8]
test ecx, ecx
je 0x460390
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [0x51a4c4]
shl eax, 0xc
mov esi, ebp
lea edi, [ebp + eax]
mov ecx, ebx
lea ebx, [ebx + edi - 1]
neg ecx
and esi, ecx
and ebx, ecx
lea eax, [esi + 0x1000]
cmp ebx, eax
je 0x4604ba
test edx, edx
mov eax, esi
mov edx, 1
sete byte [esp + 0x1b]
cmp esi, ebx
jae 0x460455
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
lea esi, [esi]
nop
cmp eax, ebp
mov edi, dword [esp + 0x14]
setb cl
mov esi, ecx
cmp eax, edi
setae cl
mov ebx, esi
or cl, bl
jne 0x4603fd
cmp byte [esp + 0x1b], 0
je 0x460442
mov ebx, dword [esp + 0x10]
lea esi, [esi]
mov ecx, edx
xchg byte [0x51a444], cl
test cl, cl
jne 0x460408
mov esi, eax
mov ecx, eax
mov dword [esp + 0x10], ebx
mov ebx, 1
shr esi, 0x11
shr ecx, 0xc
mov edi, dword [esi*4 + 0x4d5b80]
shl ebx, cl
mov ecx, ebx
or ecx, edi
mov dword [esi*4 + 0x4d5b80], ecx
mov byte [0x51a444], 0
mov edi, dword [esp + 0x10]
add eax, 0x1000
cmp eax, edi
jb 0x4603e0
mov esi, dword [esp + 0x1c]
mov ebx, edi
cmp dword [0x51e4f0], 1
mov dword [esp + 0xc], 0x51a4d8
sbb eax, eax
sub ebx, esi
mov dword [esp], esi
and eax, 0xffffffc4
mov dword [esp + 4], ebx
add eax, 0x40
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x460381
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.un_VirtualProtect_failed:_errcode_0x_X_n
mov dword [esp + 4], eax
call fcn.0045aed0
mov dword [esp], str.un_VirtualProtect_failed
call dword [0x488200]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_DebugBreak]
mov eax, esi
shr eax, 0x11
add eax, 0x9180
mov ecx, dword [eax*4 + 0x4b1580]
mov eax, esi
shr eax, 0xc
bt ecx, eax
jae 0x4603b9
jmp 0x460381
Function at 0x4649f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x3c
mov ebx, dword [edx]
mov dword [esp + 0x24], eax
mov eax, dword [eax]
mov dword [esp + 0x28], edx
lea ebp, [ebx + 1]
mov dword [esp + 0x20], 0
test eax, eax
je 0x464a21
mov eax, 1
mov ecx, ebx
shl eax, cl
mov dword [esp + 0x20], eax
cmp ebx, 0xb
jbe 0x464a33
mov eax, dword [0x51a3c8]
test eax, eax
je 0x464b35
mov ecx, ebp
mov eax, 4
mov dword [esp + 4], 1
shl eax, cl
mov dword [esp], eax
call fcn.00467a80
mov esi, eax
test eax, eax
je 0x464b5d
mov edi, dword [esp + 0x20]
test edi, edi
je 0x464af1
mov ecx, ebp
mov edi, 0xffffffff
mov dword [esp + 0x14], 0
mov dword [esp + 0x2c], ebp
shl edi, cl
lea ecx, [ebx + 4]
not edi
lea esi, [esi]
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x14]
mov eax, dword [eax]
mov ebp, dword [eax + ebx*4]
test ebp, ebp
je 0x464ade
mov eax, dword [ebp]
mov ebx, dword [ebp + 4]
not eax
mov edx, eax
shr eax, cl
shr edx, 3
xor edx, eax
and edx, edi
lea eax, [esi + edx*4]
mov edx, dword [eax]
mov dword [ebp + 4], edx
mov edx, dword [0x51a440]
test edx, edx
jne 0x464b10
mov dword [eax], ebp
test ebx, ebx
je 0x464ade
mov eax, dword [ebx]
mov edx, ebx
mov ebx, dword [ebx + 4]
not eax
mov ebp, eax
shr eax, 3
shr ebp, cl
xor eax, ebp
and eax, edi
lea eax, [esi + eax*4]
mov ebp, dword [eax]
mov dword [edx + 4], ebp
mov dword [eax], edx
test ebx, ebx
jne 0x464abc
add dword [esp + 0x14], 1
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x20], eax
jne 0x464a80
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov dword [eax], ebp
mov eax, dword [esp + 0x24]
mov ecx, dword [0x51a440]
mov dword [eax], esi
test ecx, ecx
jne 0x464b7f
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
call fcn.0045fe30
mov eax, dword [esp + 0x1c]
test ebx, ebx
mov ecx, dword [esp + 0x18]
mov dword [eax], ebp
je 0x464ade
mov ebp, ebx
jmp 0x464a91
mov dword [esp], 0x45bf60
call fcn.0045d830
mov edx, dword [esi]
mov ecx, ebx
mov eax, 1
shl eax, cl
mov ecx, edx
shr ecx, 2
sub eax, ecx
cmp edx, eax
jae 0x464a33
jmp 0x464b07
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
test eax, eax
jne 0x464b07
mov dword [esp], str.Insufficient_space_for_initial_table_allocation
call dword [0x488200]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x464a56
mov dword [esp], esi
call fcn.0045fe30
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4691b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
shr edx, 8
xor edx, eax
movzx edx, dl
mov edx, dword [edx*4 + 0x51e580]
test edx, edx
jne 0x4691de
jmp 0x47af77
mov edx, dword [edx]
test edx, edx
je 0x469219
cmp eax, dword [edx + 8]
jne 0x4691d8
mov eax, dword [edx + 4]
movzx ecx, byte [eax + 0x10]
test cl, cl
je 0x469204
movzx ebx, word [eax + 0x12]
lea edx, [ebx + 1]
movzx ebx, dx
shr ebx, cl
test ebx, ebx
je 0x469211
xor edx, edx
mov word [eax + 0x12], dx
add ecx, 1
add eax, 0x10
mov byte [eax], cl
add esp, 8
pop ebx
ret
mov word [eax + 0x12], dx
xor eax, eax
jmp 0x46920c
jmp 0x47af77
mov eax, dword [4]
ud2
Function at 0x46aca0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, eax
push edi
push esi
push ebx
sub esp, 0x2ec
mov dword [esp], eax
call fcn.00468f00
mov ecx, 1
lea esi, [esi]
mov eax, ecx
xchg byte [0x51a444], al
test al, al
jne 0x46acc0
xor ebx, ebx
lea edi, [esp + 0x10]
mov dword [esp + 4], edi
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
sub esp, 8
test eax, eax
je 0x46acf7
cmp dword [esp + 0x10], 0x103
jne 0x46add0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
sub esp, 4
cmp eax, 0xffffffff
je 0x46ad68
cmp dword [0x51eb9c], 1
sbb eax, eax
and eax, 0xbffffffc
add eax, 0x40010007
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
sub esp, 8
test eax, eax
jne 0x46adf0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
cmp eax, 0xffffffff
jne 0x46ad68
mov dword [esp], str.ResumeThread_failed_in_suspend_loop
call dword [0x488200]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
lea esi, [ebx + 1]
cmp ebx, 1
ja 0x46ad80
mov ebx, esi
jmp 0x46acd2
mov byte [0x51a444], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 1
sub esp, 4
lea esi, [esi]
mov eax, edx
xchg byte [0x51a444], al
test al, al
jne 0x46ada0
cmp esi, 0xf423f
jle 0x46ad70
mov dword [esp], str.SuspendThread_loop_failed
mov ebx, esi
call dword [0x488200]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x46acd2
mov byte [0x51a444], 0
mov dword [esp], ebp
call fcn.00469090
add esp, 0x2ec
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x14]
or byte [ebp + 0x10], 0x40
mov dword [ebp + 0x18], edx
mov edx, dword [esp + 0xa4]
mov dword [ebp + 0x1c], edx
mov edx, dword [esp + 0xb0]
mov dword [ebp + 0x20], edx
mov edx, dword [esp + 0xb4]
mov dword [ebp + 0x24], edx
mov edx, dword [esp + 0xb8]
mov dword [ebp + 0x28], edx
mov edx, dword [esp + 0xbc]
mov dword [ebp + 0x2c], edx
mov edx, dword [esp + 0xc0]
mov dword [ebp + 0x30], edx
mov edx, dword [esp + 0xc4]
mov dword [ebp + 0x34], edx
mov edx, dword [esp + 0xc8]
mov dword [ebp + 0x38], edx
mov edx, dword [esp + 0xd8]
mov dword [ebp + 0x14], edx
mov byte [0x51a444], 0
mov edx, dword [0x4b1520]
test edx, edx
je 0x46addf
mov eax, dword [ebp + 0xc]
mov dword [esp], 0xa
mov dword [esp + 4], eax
call edx
add esp, 0x2ec
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x46b6f0
Capabilities:
Resume thread

Disassembly:
push ebp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x1c
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov ebx, dword [esi*4 + 0x51e580]
test ebx, ebx
je 0x46b76e
mov ebp, dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x46b71e
mov ebx, dword [ebx]
test ebx, ebx
je 0x46b76e
test byte [ebx + 0x10], 0x40
je 0x46b718
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call edi
sub esp, 4
cmp eax, 0xffffffff
jne 0x46b743
mov dword [esp], str.ResumeThread_failed
call dword [0x488200]
call ebp
mov dword [esp], ebx
call fcn.00468f00
mov eax, dword [0x4b1520]
and byte [ebx + 0x10], 0xbf
test eax, eax
je 0x46b718
mov edx, dword [ebx + 0xc]
mov dword [esp], 0xb
mov dword [esp + 4], edx
call eax
mov ebx, dword [ebx]
test ebx, ebx
jne 0x46b71e
add esi, 1
cmp esi, 0x100
jne 0x46b700
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x46bd30
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x51e980]
test eax, eax
jle 0x46bef0
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [0x51a3c4]
test ebx, ebx
je 0x46bd60
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 1
xor ebp, ebp
call fcn.004692d0
mov eax, dword [0x51e980]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edi, dword [sym.imp.KERNEL32.dll_DebugBreak]
mov dword [0x51a3c4], eax
test eax, eax
jle 0x46bef8
lea esi, [esi]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call esi
mov dword [ebp*4 + 0x51eb40], eax
sub esp, 0x10
test eax, eax
je 0x46bec8
mov eax, dword [0x51a3c4]
add ebp, 1
cmp eax, ebp
jg 0x46bd90
test eax, eax
jle 0x46bef8
mov esi, dword [sym.imp.msvcrt.dll__beginthreadex]
lea edi, [esp + 0x2c]
jmp 0x46bdf7
add ebx, 1
cmp dword [0x51a3c4], ebx
jle 0x46bf28
mov dword [ebx*4 + 0x51eac0], 0xffffffff
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x468d70
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub eax, 1
cmp eax, 0xfffffffd
jbe 0x46bde8
mov dword [esp + 4], ebx
mov dword [esp], str.GC_Warning:_Marker_thread__ld_creation_failed_n
call dword [0x488204]
mov eax, dword [0x51a3c4]
cmp ebx, eax
jge 0x46be78
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [esi]
nop
sub eax, 1
mov dword [0x51a3c4], eax
mov eax, dword [eax*4 + 0x51eb40]
mov dword [esp], eax
call esi
mov eax, dword [0x51a3c4]
sub esp, 4
cmp eax, ebx
jg 0x46be58
call fcn.00463270
mov edx, dword [0x4b1564]
test edx, edx
jne 0x46bf40
test ebx, ebx
jne 0x46bd4e
mov eax, dword [0x51eb18]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call ebx
mov eax, dword [0x51eb1c]
sub esp, 4
mov dword [esp], eax
call ebx
mov eax, dword [0x51eb20]
sub esp, 4
mov dword [esp], eax
call ebx
sub esp, 4
jmp 0x46bd4e
mov dword [esp], str.CreateEvent_failed
add ebp, 1
call dword [0x488200]
call edi
mov eax, dword [0x51a3c4]
cmp ebp, eax
jl 0x46bd90
jmp 0x46bdcf
ret
call fcn.00463270
mov ecx, dword [0x4b1564]
test ecx, ecx
je 0x46be93
mov eax, dword [0x51a3c4]
mov dword [esp], str.Started__d_mark_helper_threads_n
mov dword [esp + 4], eax
call fcn.0045aed0
jmp 0x46be93
call fcn.00463270
mov eax, dword [0x4b1564]
test eax, eax
je 0x46bd4e
lea esi, [esi]
mov eax, dword [0x51a3c4]
mov dword [esp], str.Started__d_mark_helper_threads_n
mov dword [esp + 4], eax
call fcn.0045aed0
jmp 0x46be8b
Function at 0x46c4c0
Capabilities:
Create thread

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [0x4b153c]
test ebx, ebx
je 0x46c588
mov dword [esp], 8
call fcn.004686f0
mov ebx, eax
test eax, eax
je 0x46c570
mov eax, dword [esp + 0x38]
mov ecx, dword [0x51a440]
mov dword [ebx], eax
mov eax, dword [esp + 0x3c]
mov dword [ebx + 4], eax
test ecx, ecx
jne 0x46c560
mov edx, dword [0x51a3c4]
test edx, edx
je 0x46c598
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], ebx
mov dword [0x51e9dc], 1
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 0x46ae90
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
test eax, eax
je 0x46c5b0
add esp, 0x28
pop ebx
ret 0x18
mov dword [esp], ebx
call fcn.0045fe30
jmp 0x46c4ff
mov dword [esp], 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
jmp 0x46c54f
call fcn.0045acb0
jmp 0x46c4d2
mov eax, dword [0x51e980]
test eax, eax
jle 0x46c50d
call fcn.0045a330
jmp 0x46c50d
mov dword [esp], ebx
call fcn.00468a50
xor eax, eax
jmp 0x46c54f
Function at 0x46c6f0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp], str.kernel32.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov esi, eax
test eax, eax
je 0x46c750
mov dword [esp + 4], str.IsWow64Process
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov ebx, eax
test eax, eax
je 0x46c750
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], 0x51eb9c
mov dword [esp], eax
call ebx
sub esp, 8
test eax, eax
je 0x46c910
lea esi, [esi]
mov dword [esp], str.GC_MARKERS
mov eax, dword [0x4b1574]
mov dword [esp + 0x14], eax
call sub.msvcrt.dll_getenv
mov ebx, dword [0x51e564]
test eax, eax
je 0x46c850
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov ebx, eax
lea eax, [eax - 1]
cmp eax, 0xf
jbe 0x46c857
mov dword [esp + 4], ebx
mov dword [esp], str.GC_Warning:_Too_big_or_invalid_number_of_mark_threads:__ld__using_maximum_threads_n
call dword [0x488204]
mov dword [0x51e980], 0xf
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
sub esp, 0x10
mov dword [0x51eb20], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call ebx
sub esp, 0x10
mov dword [0x51eb1c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call ebx
mov ecx, dword [0x51eb20]
mov dword [0x51eb18], eax
sub esp, 0x10
test ecx, ecx
je 0x46c898
mov edx, dword [0x51eb1c]
test edx, edx
je 0x46c898
test eax, eax
je 0x46c898
mov dword [esp], esi
call fcn.00468d40
jmp 0x46c87c
lea eax, [ebx - 1]
test ebx, ebx
je 0x46c8b8
mov dword [0x51e980], eax
test eax, eax
jg 0x46c7a4
mov ebx, dword [0x4b1564]
mov dword [0x51a3c4], 0
test ebx, ebx
jne 0x46c930
lea eax, [esp + 0x14]
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.0046b4c0
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp], str.CreateEvent_failed
call dword [0x488200]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov dword [esp], esi
call fcn.00468d40
jmp 0x46c87c
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x1c]
mov dword [esp + 8], edx
lea edx, [esp + 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
sub esp, 0xc
test eax, eax
je 0x46c920
mov eax, dword [esp + 0x18]
test eax, eax
je 0x46c920
nop
lea edx, [eax - 1]
add ebx, 1
and eax, edx
jne 0x46c8f0
mov eax, 0x10
cmp ebx, eax
cmovg ebx, eax
lea eax, [ebx - 1]
jmp 0x46c857
mov dword [0x51eb9c], 0
jmp 0x46c750
mov dword [0x51e980], 0xffffffff
jmp 0x46c864
mov dword [esp], str.Single_marker_thread__turning_off_parallel_marking_n
call fcn.0045aed0
jmp 0x46c87c
Function at 0x46df80
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xbc
mov edx, dword [0x51e9dc]
test edx, edx
jne 0x46dfb0
mov ecx, dword [0x51ec0c]
test ecx, ecx
je 0x46dfcd
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x51eafc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x51ec0c]
sub esp, 4
test eax, eax
jne 0x46e060
mov ebx, dword [0x51ec00]
mov edi, dword [0x51ec10]
mov dword [0x51ec0c], 1
test edi, edi
jne 0x46e090
mov eax, dword [0x51e9dc]
test eax, eax
jne 0x46e150
mov eax, dword [0x4b1578]
test eax, eax
je 0x46e048
call dword [0x51a3b0]
test ebx, ebx
jne 0x46e11c
mov esi, dword [0x51e9dc]
test esi, esi
je 0x46e048
mov dword [esp], 0x51eafc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x51e9dc]
mov dword [0x51ec0c], 0
sub esp, 4
test ebx, ebx
jne 0x46e06d
jmp 0x46df9e
mov dword [0x51ec0c], 0
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x51e9dc]
test eax, eax
je 0x46df9e
mov dword [esp], 0x51eafc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [edi*4]
lea ebp, [esp + 0x10]
mov dword [esp + 4], 0x51ec20
mov dword [esp + 8], ebx
mov dword [esp], ebp
call sub.msvcrt.dll_memcpy
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0x51ec20
mov dword [0x51ec10], 0
call sub.msvcrt.dll_memset
mov eax, dword [0x51e9dc]
test eax, eax
jne 0x46e178
mov edx, dword [0x4b1578]
test edx, edx
je 0x46e0ee
call dword [0x51a3b0]
mov dword [esp + 4], edi
xor ebx, ebx
mov dword [esp], str.Found__u_leaked_objects:_n
call fcn.0045a490
mov esi, dword [ebp + ebx*4]
add ebx, 1
mov dword [esp], esi
call dword [0x4883a0]
mov dword [esp], esi
call fcn.00468a50
cmp ebx, edi
jb 0x46e100
mov dword [esp], str.GC_ABORT_ON_LEAK
call sub.msvcrt.dll_getenv
test eax, eax
je 0x46e00f
mov dword [esp], str.Leaked_or_smashed_objects_encountered
call dword [0x488200]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x46e00f
mov dword [esp], 0x51eafc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x4b1578]
sub esp, 4
test eax, eax
je 0x46e00f
jmp 0x46e001
mov dword [esp], 0x51eafc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x46e0de
Function at 0x472d00
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0047a4b0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0047a4b0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x472d60
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x51efc4]
test esi, esi
jle 0x472e80
mov edi, dword [0x51efc8]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x472d94
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x472e19
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x472d80
mov dword [esp], eax
mov ebx, eax
call fcn.00473760
mov edi, eax
test eax, eax
je 0x472ea7
mov eax, dword [0x51efc8]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00473870
mov edx, dword [0x51efc8]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x472e87
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x472e12
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x472e20
add dword [0x51efc4], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x51efc8]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x472e12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00472d00
lea esi, [esi]
lea edi, [edi]
xor esi, esi
jmp 0x472d9e
mov eax, dword [0x51efc8]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00472d00
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00472d00
mov esi, esi
lea edi, [edi]