joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100da9ed
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100da969
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100dab65
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100dab65
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100dab14
jg 0x100daa46
test eax, eax
je 0x100dab0a
push 1
push 0x1000
call fcn.100cba75
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100daa6c
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x100dab01
push 0x8000
push ebx
call fcn.100da89a
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100daa98
jg 0x100daa93
cmp ecx, 0x1000
jb 0x100daa98
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100ca39b
add esp, 0x10
cmp eax, 0xffffffff
je 0x100daadd
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100daa93
jl 0x100daac4
test ecx, ecx
jne 0x100daa85
push dword [ebp - 0xc]
push ebx
call fcn.100da89a
push esi
call fcn.100c732b
add esp, 0xc
xor edi, edi
jmp 0x100dab76
cmp byte [edi + 0x24], 0
je 0x100daaf4
cmp dword [edi + 0x20], 5
jne 0x100daaf4
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100daaff
mov edi, dword [edi + 0x18]
jmp 0x100dab01
xor edi, edi
push esi
call fcn.100c732b
pop ecx
jmp 0x100dab76
test ecx, ecx
jg 0x100daad6
jl 0x100dab14
test eax, eax
jae 0x100daad6
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100ceb15
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100dab37
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x100daad6
jmp 0x100dab6e
push ebx
call fcn.100d5187
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100daad6
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x100dab76
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x100dab73
mov edi, dword [edi + 0x18]
jmp 0x100dab76
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100ceb15
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404688
Capabilities:
Encode data using xor

Disassembly:
mov dword [reloc.MSVCRT.dll_strncpy], eax
test ebx, ebp
aas
dec esi
in eax, dx
cmp eax, 0xe3bed79a
arpl word [edi], si
jecxz 0x4046fb
aaa
call 0xab35bd54
std
lahf
push edx
xor cl, byte [ecx - 0x29]
or byte [edi + 0x2045e664], bl
sub dword [edi + 0x35], 0x6d
sti
test al, 0x1b
sbb ebp, dword [ebx]
stosb byte es:[edi], al
add eax, 0x3bd46c3
add dword [ecx - 0x25], edi
add dword [ecx - 0x25], edi
lodsb al, byte [esi]
fisubr word [ecx - 0x553f13a0]
in eax, 1
push ss
jle 0x404704
pop edx
mov ebp, 0x888489a1
fimul dword [esi + 0x74]
jle 0x4046b8
test byte [eax + 0x7e744eda], cl
out 0x18, al
adc eax, 0xf45e6638
sbb byte [0xf45e6638], dl
loopne 0x40473c
stc
sbb al, 0xc5
or eax, 0xa66930af
stosd dword es:[edi], eax
push ebx
xchg esp, eax
fiadd dword [esi + 0x2747eca0]
adc al, 0xac
je 0x4046cb
sub ebp, dword [ebx - reloc.MSVCRT.dll_strncpy]
push ebp
test dword [edi + edx*4 + reloc.MSVCRT.dll_strncpy], 0xfe6874b6
sbb al, 0xc6
pushal
pop ecx
adc dh, byte [esi + 0x1cfe6874]
invalid
adc eax, 0xe1a30ad4
pop dword [esi - 0x12f545c8]
or dword [esp + edx*2 - 0x65], eax
jmp 0x404702
lahf
xor dword [bp + si - reloc.MSVCRT.dll_strncpy], edx
out dx, eax
xor byte [ebx - 0x196af074], ch
fcomi st(7)
jmp 0x5c4250be
Function at 0x55ec71
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec cx
xchg ecx, edx
clc
sub esp, 0xa
pop dword [esp]
mov ch, byte [esp + 1]
jmp 0x55ecd5
mov ebx, edi
clc
jmp 0x55ec7a
jg 0x55ec5b
dec cx
xchg ecx, edx
jmp 0x55ec86
clc
sub esp, 0xa
pop dword [esp]
jmp 0x55ec66
lea esp, [esp + 2]
jmp 0x55ece5
bsr cx, dx
jae 0x55ecbf
lea esp, [esp + 2]
jmp 0x55ece5
rol edi, 0
mov eax, ebx
sub esp, 0x1d
jl 0x55f0b9
jge 0x55ed38
mov bl, 0x29
mov ecx, 0xc8ea2bd8
lea esp, [esp + 0x1a]
lea esp, [esp + 3]
jmp 0x55f0ce
lea ecx, [ecx*4]
mov dl, al
xchg byte [esp + 0xc], cl
jmp 0x55ed22
lea eax, [esi*4]
rdtsc
bts ax, dx
call fcn.0055ef14
and dword [ebx], reloc.MSVCRT.dll_strncpy
salc
and eax, 0xfa64fb92
popfd
insb byte es:[edi], dx
rcl dword [ecx], cl
nop
adc ecx, dword [edx + reloc.MSVCRT.dll_strncpy]
mov ecx, dword [esp]
mov ah, byte [esp]
mov cx, word [esp]
jmp 0x55ed47
neg ax
jl 0x55ed69
mov ah, byte [esp]
mov cx, word [esp]
lea eax, [esi*4]
rdtsc
bts ax, dx
jmp 0x55ed54
lea ecx, [ecx*4]
mov dl, al
xchg byte [esp + 0xc], cl
lea esp, [esp + 0x1a]
lea esp, [esp + 3]
lea esp, [esp + 4]
sub edi, 0x52bac130
jmp 0x55ef49

Function at 0x56811d
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x54ceb2
pushfd
or dword [esp], 0x100
popfd
cpuid
nop
jmp 0x54cec9
pop ebx
ret
lea esp, [esp + 8]
jmp 0x54cea6

Function at 0x57f8b6
Capabilities:
Encrypt data using speck

Disassembly:
push bp
call fcn.0054a0a3
ror byte [ebp - 0x16fddb9c], cl
lea esp, [esp + 2]
jmp 0x57f971
fisub dword [ebx - reloc.MSVCRT.dll_strncpy]
fcomp qword [esi + 0x6d36bdda]
mov byte [ebx], ch
inc edx
outsd dx, dword [esi]
jmp 0x57f8de
lea esp, [esp + 4]
push ecx
push esp
sub esp, 0xb
lea esp, [esp + 3]
jmp 0x57f929
pushfd
mov dword [esp], edx
mov dword [esp], edx
jmp 0x57f885
mov dword [esp], ebp
mov ebp, esp
jmp 0x57f89b
push sp
lea esp, [esp + 2]
jmp 0x57f8fb
stc
push edi
mov edi, dword [esp]
mov edi, eax
jmp 0x57f8bd
cmp al, 0x61
call 0x57f94b
cmp al, 0x7a
jmp 0x57f935
mov al, byte [ecx]
cmp al, 0x41
jb 0x54a108
call fcn.0057f8dc
mov dword [esp], esp
and al, 0x24
lea esp, [esp + 4]
cmp al, 0x5a
jbe 0x54a0bc
ja 0x54a108
push ecx
enter 0x395e, 0xffffffffffffffc8
jp 0x57f90b
adc al, 0x87
mov dword cs:[esp + 8], ecx
mov dword [esp + 8], ecx
lea esp, [esp + 8]
push ebx
cmc
jmp 0x57f8d3
jbe 0x54a0bc
ja 0x54a09b
and eax, 0xbb4829b9
or byte [eax], bl
jnp 0x57f99c
int 0xff
je 0x57f972
add ecx, dword [ebp + reloc.MSVCRT.dll_strncpy]
add byte [edx - 0x59], 0xfc
push dword [ebx - 0x76]
and al, 4
mov ah, 0xd3
sahf
xlatb
or dword ds:[eax - reloc.MSVCRT.dll_strncpy], ebp
or byte [eax], al
add byte [ecx], dl
test byte [eax], al
xchg esi, eax
int1
add byte [ebx + 0x342dbd3a], dh
invalid
Function at 0x57fa7e
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 4]
je 0x54a11e
push si
lea esp, [esp + 2]
jmp 0x57fc04
jmp 0x57fa68
cmp bl, 0x2f

Function at 0x57fa80
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.0057fb32
inc esp
rcl dword [ecx + 0x30], 0xc3
jb 0x57fa51
inc edi
xlatb
mov dl, 0x41
cld
jp 0x57fae8
les esi, [edi + 0x5e]
nop

Function at 0x58e199
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.0058e1c2
push word [esp + 6]
lea esp, [esp + 2]
jmp 0x58e1c4
lea esp, [esp + 8]
mov cl, byte [esi]
movzx eax, byte [edx]
neg di
jmp 0x58e2cf
clc
movzx edi, cl
call fcn.0058e2a1
mov dl, byte [eax]
clc
jmp 0x58e3ee
movzx eax, byte [eax]
jmp 0x58f436
dec dword [ebp - 4]
jmp 0x58f44c
cmp dl, byte [ecx]
push sp
lea esp, [esp + 2]
jmp 0x58e41c
inc eax
jmp 0x58f54d
jne 0x58e2ee
je 0x58e406
jbe 0x58e487
mov al, byte [0xf47754e3]
xor esp, dword [esi - 0x75]
lds esp, [eax + 0x64751a81]
xchg edi, eax
inc byte [ebp - 0x7f]
iretd
out 0x70, eax
xor byte [ebp - 0x203070e8], cl
add edi, dword [esi + 0x35]
push ss
adc byte [ecx + 0x7d], cl
mov ss, word [edi + 0x14]
or esi, dword [ebp - 0x58]
jmp 0x58e492
push ebp
jmp 0x58f471
mov edx, dword [ebp - 4]
jne 0x58e2d8
je 0x58e2ee
sub eax, ecx
call fcn.0058f4e1
pop ebp
lodsb al, byte [esi]
mov edi, 0x607d6386
sub ebx, edx
imul esp, dword [ebx + reloc.MSVCRT.dll_strncpy], 0xb60fe98b
dec ebp
add byte [ebp + 0x60], bl
mov ebp, ecx
movzx ecx, byte [ebp]
pop ebp
pushal
jmp 0x58f45b
inc ecx
jmp 0x58e320

Function at 0x642f15
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dh, bh
lea ebp, [edi*4]
inc esi
not cx
pop bp
bswap esi
jmp 0x642f8f
mov dword [esp + 1], ebp
push word [esp + 6]
mov edi, 0xae4ceed5
pop cx
jmp 0x642eeb
mov bp, cx
cpuid
mov si, 0x47d3
sub esp, 0xa
adc bh, cl
dec edx
jmp 0x642f3c
xchg word [esp], ax
std
sub esp, 7
cld
pop word [esp + 4]
rdtsc
jmp 0x642f68
add esp, 0
xchg bp, ax
mov cx, word [esp + 1]
bt ecx, esp
pop ecx
bsf di, dx
jmp 0x642f27
dec dx
push word [esp + 9]
mov dl, 0xbd
mov word [esp + 9], bp
rdtsc
not edx
jmp 0x642fb9
std
setbe ch
cpuid
rdtsc
lea esp, [esp + 4]
lea ebx, [edx + 0x9f]
jmp 0x642f53
bsf dx, dx
mov dword [esp + 2], ebp
mov dword [esp + 5], eax
bsr si, sp
jmp 0x642fe6
xchg dword [esp + 0xa], esi
xchg word [esp + 0xb], si
mov ebp, 0x4823fec4
pop dx
inc edx
mov dword [esp + 6], edx
jmp 0x642fa3
pop cx
call 0x642fd0
Function at 0x64343f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, 0x6e66acfd
cld
push bx
mov dh, 0x59
rdtsc
jmp 0x64345d
Function at 0x920058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009201a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x92007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x92006a
add dl, dl
jne 0x920089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9200dc
xor eax, eax
add dl, dl
jne 0x920096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x92017d
add dl, dl
jne 0x9200a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9200b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9200bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9200c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9200d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x920075
mov eax, 1
add dl, dl
jne 0x9200ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9200f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9200e1
sub eax, ebx
mov ebx, 1
jne 0x920128
mov ecx, 1
add dl, dl
jne 0x92010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x920119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x920105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x920075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x92013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x92014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x920136
cmp eax, 0x7d00
jae 0x92016d
cmp eax, 0x500
jb 0x920168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x920075
cmp eax, 0x7f
ja 0x920170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x920075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x92019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x920075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
inc ebp
or byte [ebx + 0x40c0c80d], cl
add byte [eax - 0x7d], dl
rol dword [eax + 0x68], 0x74
sbb edx, dword [ecx]
add byte [ecx - 0x4f], dl
adc byte [eax + 0x1d0040c1], al
lodsb al, byte [esi]
add al, byte [ecx]
test ah, al
or al, 0x85
sal byte [edi + ecx + 0x3c], 0x68
push esp
mov eax, dword [0x15ff0040]
rol dword fs:[eax], 0x83
les ecx, [eax]
cmp al, byte [ecx]
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
mov ebp, esp
sub esp, 0x1200b8
mov eax, dword [0x37410278]
test eax, eax
mov eax, dword [0x41404c]
sahf
adc al, 0x1c
inc eax
pop esp
insd dword es:[edi], dx
add byte [eax - 0x18], dl
sahf
sub dl, bl
add byte [esi - 0x75], ah
or eax, 0xbec20274
jecxz 0x4017b6
add al, dl
mov esi, 0x158bfbe3
add byte [eax], bl
inc ecx
add byte [edx - 0x49], dl
call 0x405850
mov cx, word [0x41dcfb]
mov edx, dword [0x411800]
push edx
mov bh, pe_nt_image_headers32
mov byte [eax], al
add byte [esi - 0x75], ah
or eax, 0x41dcfb
dec dword [eax]
mov al, byte [0x29a10041]
add al, byte [esi - 0x74a9ad00]
xor eax, 0x40c1cf
sbb ecx, dword [ecx - 0x27f4e3f3]
je 0x40176e
rcl byte [edi + 0x75], 0x5d
mov edx, dword [0xae411800]
push edx
push 0x40d44a
jmp dword [ebx - 0x7fd8767]
Function at 0x4022a4
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 8]
mov dword [esp], 0x447105
call sub.msvcrt.dll_system
mov dword [esp + 4], 0x4472d8
mov dword [esp], 0x44be70
call fcn.00442d34
lea eax, [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x44bf10
call fcn.0042b80c
mov dword [esp + 4], str._nWhat_is_the_angle_of_the_unbalance_on_the_disc:_t
mov dword [esp], 0x44be70
call fcn.00442d34
lea eax, [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], 0x44bf10
call fcn.0042b80c
fld qword [ebp - 0x18]
fld qword [0x447340]
fdivp st(1)
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fld qword [0x447348]
fmulp st(1)
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fstp qword [esp + 8]
fld qword [ebp - 0x10]
fstp qword [esp]
call fcn.00402980
fstp qword [ebp - 0x20]
fld qword [ebp - 0x18]
fstp qword [esp + 8]
fld qword [ebp - 0x10]
fstp qword [esp]
call fcn.0040299c
fld qword [ebp - 0x20]
fstp qword [esp + 0xc]
fstp qword [esp + 4]
mov dword [esp], ebx
call fcn.00412494
mov eax, dword [ebx]
mov dword [0x44a3d0], eax
mov eax, dword [ebx + 4]
mov dword [0x44a3d4], eax
mov eax, dword [ebx + 8]
mov dword [0x44a3d8], eax
mov eax, dword [ebx + 0xc]
mov dword [0x44a3dc], eax
mov eax, ebx
add esp, 0x34
pop ebx
pop ebp
ret 4
Function at 0x4059f0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x405a26
mov dword [0x44ffd0], eax
mov edx, 0x4059d0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040e6c0
test eax, eax
sete al
movzx eax, al
mov dword [0x446030], eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x446030], eax
leave
ret

Function at 0x405b10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], 0x402f20
mov dword [ebp - 0x24], 0x445050
mov dword [ebp - 0x1c], 0x405bd0
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.0040eb20
cmp dword [0x446030], 0
mov dword [ebp - 0x44], 0x44ffe0
je 0x405bb0
jl 0x405bf0
mov dword [ebp - 0x3c], 1
mov eax, dword [0x44ffd0]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x405c93
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.0040ec00
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x450680]
mov eax, 0xffffffff
test edx, edx
je 0x405c0a
mov eax, dword [0x446034]
test eax, eax
je 0x405c4a
xor eax, eax
test eax, eax
jne 0x405c40
mov edi, dword [0x446030]
test edi, edi
js 0x405c40
mov dword [ebp - 0x44], 0x44ffe0
mov ebx, dword [0x446030]
test ebx, ebx
je 0x405bb0
jmp 0x405b5e
xor esi, esi
mov dword [0x446030], esi
jmp 0x405c18
mov dword [esp], 0x446038
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.dll_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x405cd1
mov eax, dword [0x446034]
test eax, eax
jne 0x405c08
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x446034]
test eax, eax
je 0x405c6d
jmp 0x405c08
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x405cc5
mov dword [esp + 4], eax
mov eax, dword [0x44ffd0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x405cfa
test edx, edx
je 0x405ce5
mov dword [ebp - 0x3c], 1
call fcn.00405570
call fcn.004059f0
mov eax, 1
mov dword [0x446034], eax
jmp 0x405c08
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x405ba6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
jmp 0x405cc1
Function at 0x40b380
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0040b360
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x40b3cc
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x40b3a0
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40ea10
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x4506d0]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40ea50
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.0040e6c0
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x40ee00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x4506d0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40eedc
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x40eef1
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x40eeb0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x40ee48
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x40ee58
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x40eea3
test edx, edx
jne 0x40ee96
test ecx, ecx
je 0x40ee40
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x40ef00
cmp eax, 8
je 0x40ee40
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40ee32
call fcn.0040e7d0
mov eax, dword [0x4506d0]
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x40ee24
call fcn.0040ea70
mov eax, dword [0x4506d0]
jmp 0x40ee24
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.0040ed70
cmp eax, 7
jne 0x40ee9b
mov eax, dword [0x4506d0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40ef53
mov edi, dword [eax + 0x30]
test edi, edi
js 0x40ef7e
mov esi, dword [eax + 0x30]
test esi, esi
jne 0x40ef5f
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.0040e7d0
mov eax, dword [0x4506d0]
jmp 0x40ef31
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40ef42
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40ef42
call fcn.0040ea70
mov eax, dword [0x4506d0]
jmp 0x40ef38
Function at 0x40f1e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x4506d0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40f274
mov esi, dword [eax + 0x30]
test esi, esi
js 0x40f290
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x40f2b0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x40f268
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0040ed70
cmp eax, 7
jne 0x40f32f
mov eax, dword [0x4506d0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40f306
mov edx, dword [eax + 0x30]
test edx, edx
js 0x40f320
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x40f2e0
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0040ef90
jmp 0x40f225
call fcn.0040e7d0
mov eax, dword [0x4506d0]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x40f200
lea esi, [esi]
call fcn.0040ea70
mov eax, dword [0x4506d0]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x40f20b
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40f20e
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40f257
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40f257
call fcn.0040e7d0
mov eax, dword [0x4506d0]
mov edx, dword [eax + 0x30]
test edx, edx
jns 0x40f249
nop
lea esi, [esi]
call fcn.0040ea70
mov eax, dword [0x4506d0]
jmp 0x40f249
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]