joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9dfdb0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0xa39178]
mov esi, eax
add esp, 4
test esi, esi
jne 0x9dfddd
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esi + 0xc]
mov dword [esi], ebx
mov dword [esi + 4], ecx
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
push edi
lea edi, [ebx + 4]
cmp eax, dword [ebx + 0x10]
jbe 0x9dfe28
mov eax, dword [ebx]
push ecx
call eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push dword [ebp + 0xc]
push dword [esi + 4]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebx + 0xc]
push dword [esi + 4]
mov dword [ebp - 8], eax
push eax
mov eax, dword [ebx + 8]
call eax
mov eax, dword [ebx + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x9dfe2e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [esi + 4]
mov eax, dword [ebx]
call eax
push dword [esi + 8]
mov eax, dword [ebx]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x9dfe91
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
nop
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x9dfe50
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
lea edi, [eax + 4]
jmp 0x9dfe94
mov eax, dword [ebp + 8]
cmp ebx, dword [eax + 0x10]
jae 0x9dfec8
nop dword [eax]
mov eax, dword [edi]
push 1
push 0xa29be9
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0xa29bea
push dword [esi + 8]
call eax
mov eax, dword [ebp + 8]
inc ebx
add esp, 0x18
cmp ebx, dword [eax + 0x10]
jb 0x9dfea0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x9dff30
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000040
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x9dff55
mov eax, 0x1b
pop esi
pop ebp
ret
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x800c
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9dff85
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
mov eax, 2
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x9e0c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9e0c5c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9e0c22
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9e0cc0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9e0d12
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9e0d18
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x9f9205
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009f8ec5

Function at 0x9fdfff
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009fde7e

Function at 0xa035b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa035dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa035dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4016c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00407ac0
call sym.___main
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x4016f8
jmp 0x401796
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x4016f7
cmp cl, 0x22
je 0x401750
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x401770
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x401770
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x401730
jmp 0x401770
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x401750
cmp cl, 0x22
je 0x4017d2
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x401790
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x401780
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x4017b4
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call dbg.WinMain@16
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x401770

Function at 0x401db0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], esi
add eax, 0x20
mov dword [esp], eax
call sym._fclose
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fclose
mov eax, dword [0x412284]
test eax, eax
je 0x401df7
cmp byte [0x412060], 0
jne 0x401e40
cmp byte [0x412180], 0
jne 0x401e01
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 4], 0x410087
mov dword [esp], 0x412180
call sym._fopen
test eax, eax
mov ebx, eax
je 0x401df7
mov dword [esp], eax
call sym._fgetc
mov dword [esp], ebx
mov esi, eax
call sym._fclose
cmp esi, 0xffffffff
jne 0x401df7
mov dword [esp], 0x412180
call sym._remove
jmp 0x401df7
mov dword [esp + 4], 0x410087
mov dword [esp], 0x412060
call sym._fopen
test eax, eax
mov ebx, eax
je 0x401dee
mov dword [esp], eax
call sym._fgetc
mov dword [esp], ebx
mov esi, eax
call sym._fclose
cmp esi, 0xffffffff
jne 0x401dee
mov dword [esp], 0x412060
call sym._remove
jmp 0x401dee
Function at 0x402c30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x40f060]
mov edx, dword [0x40f064]
add eax, 1
adc edx, 0
mov ecx, eax
xor ecx, 1
mov dword [0x40f060], eax
or ecx, edx
mov dword [0x40f064], edx
je 0x402cd5
mov eax, dword [0x40f068]
mov edx, dword [0x40f06c]
add eax, 1
adc edx, 0
mov ecx, eax
xor ecx, 1
mov dword [0x40f068], eax
or ecx, edx
mov dword [0x40f06c], edx
je 0x402c82
leave
ret
mov eax, 8
mov dword [0x40f0b4], eax
mov eax, pe_nt_image_headers32
mov dword [0x40f0b8], eax
mov eax, 8
mov dword [0x40f0bc], eax
mov eax, 0xff0
mov dword [0x40f0c0], eax
mov eax, 0x1000
mov dword [0x40f0c4], eax
mov eax, 0xa
mov dword [0x40f0c8], eax
mov dword [esp], str.GLIBCXX_FORCE_NEW
call sym._getenv
test eax, eax
setne byte [0x40f0cc]
leave
ret
mov eax, 8
mov ecx, 0x1000
mov edx, 0xa
mov dword [0x40f070], eax
mov eax, pe_nt_image_headers32
mov dword [0x40f074], eax
mov eax, 8
mov dword [0x40f078], eax
mov eax, 0xff0
mov dword [0x40f07c], eax
mov dword [0x40f080], ecx
mov dword [0x40f084], edx
mov dword [esp], str.GLIBCXX_FORCE_NEW
call sym._getenv
test eax, eax
setne byte [0x40f088]
jmp 0x402c5b

Function at 0x404280
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4042b6
mov dword [0x4162c0], eax
mov edx, sym.get_globals_dtor_void_
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [0x40f040], eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x40f040], eax
leave
ret
Function at 0x4043a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], sym.___gxx_personality_sj0
mov dword [ebp - 0x24], 0x40e4a0
mov dword [ebp - 0x1c], 0x404460
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call sym.__Unwind_SjLj_Register
cmp dword [0x40f040], 0
mov dword [ebp - 0x44], 0x4162d0
je 0x404440
jl 0x404480
mov dword [ebp - 0x3c], 1
mov eax, dword [0x4162c0]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x404523
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x416370]
mov eax, 0xffffffff
test edx, edx
je 0x40449a
mov eax, dword [0x40f044]
test eax, eax
je 0x4044da
xor eax, eax
test eax, eax
jne 0x4044d0
mov edi, dword [0x40f040]
test edi, edi
js 0x4044d0
mov dword [ebp - 0x44], 0x4162d0
mov ebx, dword [0x40f040]
test ebx, ebx
je 0x404440
jmp 0x4043ee
xor esi, esi
mov dword [0x40f040], esi
jmp 0x4044a8
mov dword [esp], 0x40f048
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.dll_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x404561
mov eax, dword [0x40f044]
test eax, eax
jne 0x404498
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x40f044]
test eax, eax
je 0x4044fd
jmp 0x404498
mov dword [esp], 8
call sym._malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x404555
mov dword [esp + 4], eax
mov eax, dword [0x4162c0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x40458a
test edx, edx
je 0x404575
mov dword [ebp - 0x3c], 1
call method.std.terminate__
call sym.get_globals_init__
mov eax, 1
mov dword [0x40f044], eax
jmp 0x404498
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x404436
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
jmp 0x404551
Function at 0x406f60
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x4163b0]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x406fa0
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x407350
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x4163b0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40742c
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x407441
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x407400
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x407398
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x4073a8
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x4073f3
test edx, edx
jne 0x4073e6
test ecx, ecx
je 0x407390
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x407450
cmp eax, 8
je 0x407390
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x407382
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4163b0]
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x407374
call sym._fc_key_init_once
mov eax, dword [0x4163b0]
jmp 0x407374
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x4073eb
mov eax, dword [0x4163b0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x4074a3
mov edi, dword [eax + 0x30]
test edi, edi
js 0x4074ce
mov esi, dword [eax + 0x30]
test esi, esi
jne 0x4074af
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4163b0]
jmp 0x407481
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x407492
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x407492
call sym._fc_key_init_once
mov eax, dword [0x4163b0]
jmp 0x407488
Function at 0x4075d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov eax, dword [0x4163b0]
test eax, eax
je 0x407630
mov esi, dword [eax + 0x30]
test esi, esi
js 0x407650
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x407670
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x4076c0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4163b0]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x4075f2
jmp 0x407650
call sym._fc_key_init_once
mov eax, dword [0x4163b0]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x4075f9
jmp 0x407670
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
sub esp, 4
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x407621
lea esi, [esi]
mov eax, dword [0x4163b0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40770d
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x407719
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x4076ee
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4076dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4076dd
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4163b0]
jmp 0x4076cc
call sym._fc_key_init_once
mov eax, dword [0x4163b0]
jmp 0x4076d3
Function at 0x407730
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x4163b0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x4077c4
mov esi, dword [eax + 0x30]
test esi, esi
js 0x4077e0
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x407800
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x4077b8
lea edx, [ebp - 0x14]
mov eax, edi
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x40787f
mov eax, dword [0x4163b0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x407856
mov edx, dword [eax + 0x30]
test edx, edx
js 0x407870
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x407830
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
jmp 0x407775
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4163b0]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x407750
lea esi, [esi]
call sym._fc_key_init_once
mov eax, dword [0x4163b0]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x40775b
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40775e
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4077a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4077a7
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4163b0]
mov edx, dword [eax + 0x30]
test edx, edx
jns 0x407799
nop
lea esi, [esi]
call sym._fc_key_init_once
mov eax, dword [0x4163b0]
jmp 0x407799
call sym._abort
lea esi, [esi]
lea edi, [edi]
Function at 0x407890
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x407922
mov eax, dword [0x4163b0]
test eax, eax
je 0x407916
mov ebx, dword [eax + 0x30]
test ebx, ebx
js 0x407991
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x407937
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x4079af
mov eax, dword [0x4163b0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x407982
mov edx, dword [eax + 0x30]
test edx, edx
js 0x4079a0
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x407963
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4163b0]
jmp 0x4078b2
mov dword [esp], edi
call sym.__Unwind_SjLj_RaiseException
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x4078c7
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x407905
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x407905
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4163b0]
jmp 0x4078f0
call sym._fc_key_init_once
mov eax, dword [0x4163b0]
jmp 0x4078bd
call sym._fc_key_init_once
mov eax, dword [0x4163b0]
jmp 0x4078fb
call sym._abort
lea esi, [esi]
lea edi, [edi]

Function at 0x407b90
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov edx, eax
je 0x407bc0
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [esp + 4], eax
call sym.___mingwthr_key_dtor
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret

Function at 0x408120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x408710
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 4
mov ebx, dword [ebp + 8]
mov dword [ebx], 8
mov dword [ebx + 4], pe_nt_image_headers32
mov dword [ebx + 8], 8
mov dword [ebx + 0xc], 0xff0
mov dword [ebx + 0x10], 0x1000
mov dword [ebx + 0x14], 0xa
mov dword [esp], str.GLIBCXX_FORCE_NEW
call sym._getenv
test eax, eax
setne byte [ebx + 0x18]
pop eax
pop ebx
pop ebp
ret

Function at 0x4087a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 4
mov ebx, dword [ebp + 8]
mov dword [ebx], 8
mov dword [ebx + 4], pe_nt_image_headers32
mov dword [ebx + 8], 8
mov dword [ebx + 0xc], 0xff0
mov dword [ebx + 0x10], 0x1000
mov dword [ebx + 0x14], 0xa
mov dword [esp], str.GLIBCXX_FORCE_NEW
call sym._getenv
test eax, eax
setne byte [ebx + 0x18]
pop eax
pop ebx
pop ebp
ret
Function at 0x409090
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 4
mov ebx, dword [ebp + 8]
mov dword [ebx], 8
mov dword [ebx + 4], pe_nt_image_headers32
mov dword [ebx + 8], 8
mov dword [ebx + 0xc], 0xff0
mov dword [ebx + 0x10], 0x1000
mov dword [ebx + 0x14], 0xa
mov dword [esp], str.GLIBCXX_FORCE_NEW
call sym._getenv
test eax, eax
setne byte [ebx + 0x18]
pop eax
pop ebx
pop ebp
ret

Function at 0x409120
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 4
mov ebx, dword [ebp + 8]
mov dword [ebx], 8
mov dword [ebx + 4], pe_nt_image_headers32
mov dword [ebx + 8], 8
mov dword [ebx + 0xc], 0xff0
mov dword [ebx + 0x10], 0x1000
mov dword [ebx + 0x14], 0xa
mov dword [esp], str.GLIBCXX_FORCE_NEW
call sym._getenv
test eax, eax
setne byte [ebx + 0x18]
pop eax
pop ebx
pop ebp
ret