joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x58804c], 1
mov dword [0x588050], 1
mov dword [0x588054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret
Function at 0x401edb
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
mov edx, eax
shr eax, 4
leave
and eax, 1
inc edx
mov dl, 0
cmove eax, edx
movzx eax, al
ret

Function at 0x401f03
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x10c]
sub esp, 0x124
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
sub esp, 0xc
cmp eax, 0x102
jbe 0x401f41
mov dword [esp], 0x4de128
jmp 0x401f44
mov dword [esp], ebx
mov ecx, dword [ebp + 8]
call fcn.00401616
mov ebx, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
leave
ret

Function at 0x401f55
Capabilities:
Get token membership

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xe]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xe], ecx
mov word [ebp - 0xa], 0x500
mov dword [esp + 0xc], 0x220
mov dword [esp + 8], 0x20
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
sub esp, 0x2c
test eax, eax
je 0x401fe1
lea eax, [ebp - 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov eax, dword [ebp - 0x14]
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push edx
xor eax, eax
cmp dword [ebp - 0x18], 1
leave
sete al
ret
Function at 0x402bd9
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 0x18
mov dword [esp + 8], edx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
sub esp, 0x14
test eax, eax
jne 0x402c14
or eax, 0xffffffff
jmp 0x402cfd
lea eax, [ebp - 0x10]
mov dword [esp + 4], 0x800c
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
sub esp, 0x14
test eax, eax
je 0x402c0c
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
sub esp, 0x10
test eax, eax
je 0x402c0c
lea eax, [ebp - 0xc]
mov dword [esp + 4], 0x6610
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
sub esp, 0x14
test eax, eax
je 0x402c0c
lea eax, [ebp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
sub esp, 0x18
test eax, eax
je 0x402c0c
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x10]
push edx
push edx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0xc]
push ecx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push eax
xor eax, eax
leave
ret
Function at 0x403307
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov eax, 0x114c
mov ebp, esp
push edi
push esi
push ebx
call fcn.00414434
sub esp, eax
xor eax, eax
mov dword [ebp - 0x1138], eax
lea eax, [ebp - 0x1138]
mov dword [esp + 8], eax
lea eax, [ebp - 0x1018]
mov dword [esp + 4], 0x1000
mov dword [esp], eax
call sub.PSAPI.DLL_EnumProcesses
sub esp, 0xc
test eax, eax
jne 0x40334f
xor eax, eax
jmp 0x40340e
mov eax, dword [ebp - 0x1138]
xor ebx, ebx
shr eax, 2
mov dword [ebp - 0x113c], eax
mov eax, dword [ebp - 0x113c]
cmp ebx, eax
je 0x403348
mov eax, dword [ebp + ebx*4 - 0x1018]
test eax, eax
je 0x403408
xor ecx, ecx
mov dword [esp + 8], eax
lea esi, [ebp - 0x111c]
xor edi, edi
mov dword [esp + 4], ecx
mov dword [esp], 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], edi
lea edi, [ebp - 0x1134]
mov dword [esp + 0xc], 0x104
mov dword [esp], eax
mov dword [ebp - 0x1140], eax
call sub.PSAPI.DLL_GetModuleBaseNameA
mov eax, dword [ebp + 8]
mov ecx, edi
sub esp, 0x10
mov dword [esp], eax
call fcn.00401616
push eax
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.004ce4c0
mov ecx, edi
mov esi, eax
call fcn.004b03d0
mov eax, esi
mov edx, dword [ebp - 0x1140]
test al, al
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], edx
je 0x403405
call eax
push edx
mov eax, dword [ebp + ebx*4 - 0x1018]
jmp 0x40340e
call eax
push eax
inc ebx
jmp 0x403360
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403416
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x158]
push ebx
sub esp, 0x1ac
mov dword [esp + 8], 0x4de13c
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x170]
mov dword [esp], eax
call fcn.004ced10
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x170]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push edx
mov ebx, eax
lea ecx, [ebp - 0x170]
push edx
call fcn.004b03d0
cmp ebx, 0xffffffff
je 0x403592
lea eax, [ebp - 0x12c]
lea esi, [ebp - 0x1a0]
mov dword [esp], eax
mov ecx, esi
call fcn.00401616
push eax
mov dword [esp + 4], 0x4de13f
mov dword [esp], esi
call fcn.004ce4c0
test al, al
jne 0x403530
mov dword [esp + 4], 0x4de141
mov dword [esp], esi
call fcn.004ce4c0
test al, al
jne 0x403530
mov dword [esp + 8], 0x4de144
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x170]
mov dword [esp], eax
call fcn.004ced10
mov dword [esp], esi
lea ecx, [ebp - 0x170]
call fcn.004b19b0
push esi
lea esi, [ebp - 0x188]
mov ecx, esi
mov dword [esp], eax
call fcn.004b3660
lea ecx, [ebp - 0x170]
push eax
call fcn.004b03d0
mov dword [esp + 4], 6
mov eax, dword [ebp - 0x188]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ecx
push ecx
test byte [ebp - 0x158], 0x10
jne 0x403526
mov ecx, esi
call fcn.004b03d0
jmp 0x403530
mov dword [esp], esi
call fcn.00403416
jmp 0x40351d
lea ecx, [ebp - 0x1a0]
call fcn.004b03d0
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push edx
push edx
test eax, eax
jne 0x403470
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push eax
jmp 0x403592
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x413484
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004254ec
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort

Function at 0x414058
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x414077
mov eax, 0
jmp 0x4140bb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x41409a
mov eax, 0
jmp 0x4140bb
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x4140b6
mov eax, 0
jmp 0x4140bb
mov eax, 1
leave
ret

Function at 0x4140bd
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x41411c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x414114
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x414114
mov eax, dword [ebp - 4]
jmp 0x414130
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x4140f1
mov eax, 0
leave
ret
Function at 0x42851c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
cmp dword [ebp + 8], 0
je 0x4285e4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00427cc0
cmp eax, 1
jne 0x4285da
mov dword [ebp - 0x3d], 0
mov dword [ebp - 0x39], 0
mov dword [ebp - 0x35], 0
mov dword [ebp - 0x31], 0
mov dword [ebp - 0x2d], 0
mov dword [ebp - 0x29], 0
mov dword [ebp - 0x25], 0
mov dword [ebp - 0x21], 0
mov dword [ebp - 0x1d], 0
mov dword [ebp - 0x19], 0
mov dword [ebp - 0x15], 0
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
mov byte [ebp - 9], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 4], 0x35
lea eax, [ebp - 0x3d]
mov dword [esp], eax
call fcn.0042fbd0
lea eax, [ebp - 0x3d]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x4285e5
nop
leave
ret
Function at 0x42956a
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x4293d9
mov dword [esp], 0x588aa4
call fcn.00428b49
mov eax, dword [0x4dbd00]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4295b1
mov eax, dword [ebp - 0x20]
jmp 0x4296fc
call fcn.00428425
mov dword [ebp - 0x20], eax
mov eax, entry3
test eax, eax
je 0x4295c8
cmp dword [ebp - 0x20], 0
jne 0x4295d2
mov eax, 0
jmp 0x4296fc
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0042851c
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x4296a4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x4dbd00]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x4296f9
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4297c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.0042956a
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.004293fd
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x42981b
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
call eax
mov eax, dword [0x4dbd00]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x429945
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x4298ad
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x42986a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00428333
mov dword [ebp - 0x10], 0
mov eax, dword [0x4dbd00]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x429945
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4298dd
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x429945
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00428333
mov dword [ebp - 0x10], 0
mov eax, dword [0x4dbd00]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax
Function at 0x42b368
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x4dbd10
call fcn.00427cca
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xbab1f0ed
jne 0x42b394
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jg 0x42b3d6
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], str..._.._.._mingw_w64_libraries_winpthreads_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call fcn.00425578
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
sub edx, 1
mov dword [eax + 4], edx
mov dword [esp], 0x4dbd10
call fcn.00427d42
mov eax, dword [ebp + 0xc]
leave
ret

Function at 0x48ed30
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x48ed70
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
je 0x48ed41
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x4d1350
Capabilities:
Write file on windows

Disassembly:
push ebx
mov edx, 1
sub esp, 0x18
mov eax, dword [esp + 0x20]
test eax, eax
cmovne edx, eax
mov ebx, edx
mov dword [esp], ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test eax, eax
je 0x4d1375
add esp, 0x18
pop ebx
ret
call fcn.004cb680
test eax, eax
je 0x4d246c
call eax
jmp 0x4d1364

Function at 0x4d18c0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call fcn.004d1660
mov edx, dword [eax]
add dword [eax + 4], 1
test edx, edx
je 0x4d2464
mov ecx, dword [edx + 0x30]
mov ebx, dword [edx + 0x34]
mov esi, 1
add ecx, 0xbcd4d500
mov edi, ecx
adc ebx, 0xb8b1aabc
xor ecx, ecx
cmp esi, edi
sbb ecx, ebx
jae 0x4d1917
xor ecx, ecx
mov dword [eax], ecx
lea ebx, [edx + 0x30]
mov dword [esp], ebx
call fcn.004178c0
mov dword [esp], ebx
call fcn.004d1440
jmp 0x4d2464
neg dword [edx + 0x14]
jmp 0x4d18ff
Function at 0x4d2454
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [fcn.004d2444]
mov dword [esp], eax
call fcn.00431000
call fcn.004d2444
nop
nop
nop
mov dword [esp], 4
call fcn.004d13e0
mov dword [eax], fcn.004c92a0
mov dword [esp + 8], fcn.004c92a0
mov dword [esp + 4], 0x53f0b4
mov dword [esp], eax
call fcn.004d1920
nop
nop
nop
sub edx, 1
mov dword [esp], eax
jne 0x4d251d
call fcn.004d1440
mov ecx, eax
mov eax, dword [eax]
call dword [eax + 8]
mov dword [esp], 2
mov ebx, eax
call esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xb
mov dword [esp + 4], 1
mov dword [esp], str.__what__:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], 2
call esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call fcn.004d1540
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov dword [esp], edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
call fcn.004d18c0
call fcn.004d1440
call fcn.004d1540
jmp 0x4d250b
Function at 0x4d3b40
Capabilities:
Query environment variable

Disassembly:
push edi
sub esp, 0x18
mov eax, dword [esp + 0x20]
lea edi, [eax + 0x60]
mov dword [esp], edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test eax, eax
je 0x4d1422
mov edx, eax
lea edi, [edx + 4]
mov ecx, edx
xor eax, eax
mov dword [edx], 0
and edi, 0xfffffffc
mov dword [edx + 0x5c], 0
sub ecx, edi
add ecx, 0x60
shr ecx, 2
rep stosd dword es:[edi], eax
add esp, 0x18
lea eax, [edx + 0x60]
pop edi
ret
mov eax, edi
call fcn.00431320
mov edx, eax
test eax, eax
je 0x4d3b2c
jmp 0x4d13f9
call fcn.004d2444
nop
nop
nop
call fcn.004d2444
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x30
mov dword [esp + 4], 0
mov dword [esp], 0x4dc080
call fcn.004279f0
mov dword [esp], str.GLIBCXX_TUNABLES
mov dword [0x4dc084], 0
mov dword [0x4dc088], 0
mov dword [0x4dc08c], 0
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], str.obj_size
mov ebx, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 9
mov dword [esp + 0x28], str.obj_count
mov dword [esp + 0x2c], 0x40
test eax, eax
jne 0x4d3bd6
jmp 0x4d3c96
mov dword [esp], ebx
mov dword [esp + 4], 0x3a
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
mov ebx, eax
test eax, eax
je 0x4d3c50
xor eax, eax
cmp byte [ebx], 0x3a
sete al
add ebx, eax
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
xor eax, 0x62696c67
xor edx, 0x2e787863
or eax, edx
jne 0x4d3bc0
mov eax, dword [ebx + 7]
mov edx, dword [ebx + 0xb]
xor eax, 0x5f68652e
xor edx, 0x6c6f6f70
or eax, edx
jne 0x4d3bc0
cmp byte [ebx + 0xf], 0x2e
jne 0x4d3bc0
add ebx, 0x10
lea esi, [esp + 0x18]
mov edi, dword [esi]
test edi, edi
je 0x4d3c33
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov eax, dword [esi + 4]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
jne 0x4d3c3d
cmp byte [ebx + edi], 0x3d
je 0x4d3cc4
add esi, 0xc
lea eax, [esp + 0x30]
cmp eax, esi
jne 0x4d3c16
jmp 0x4d3bc0
mov eax, dword [esp + 0x2c]
mov edx, 0x100
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [esp + 0x20]
test eax, eax
cmove eax, ecx
add eax, 0x2c
imul eax, edx
lea ebx, [eax*4]
mov dword [0x4dc08c], ebx
test ebx, ebx
jne 0x4d3ca5
mov dword [esp], 0x4d22a0
call fcn.00401494
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov dword [0x4dc08c], 0x3200
mov ebx, 0x3200
mov dword [esp], ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov dword [0x4dc088], eax
test eax, eax
je 0x4d3d02
xor edx, edx
mov dword [0x4dc084], eax
mov dword [eax], ebx
mov dword [eax + 4], edx
jmp 0x4d3c83
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
lea eax, [ebx + edi + 1]
mov dword [esp], eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
mov ebx, dword [esp + 0x14]
movzx edx, byte [ebx]
cmp dl, 0x3a
je 0x4d3cf2
test dl, dl
jne 0x4d3bc0
test eax, eax
js 0x4d3bc0
mov dword [esi + 8], eax
jmp 0x4d3bc0
xor ecx, ecx
mov dword [0x4dc08c], ecx
jmp 0x4d3c83