joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428db0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x4b731c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x428dd6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x428dd8
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x428df8
cmp byte [ebp + 0xc], 0
je 0x428e48
cmp byte [esi + 4], 0
je 0x428e3a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x428e3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x428e0c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x428e0e
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x428e25
xor ebx, ebx
jmp 0x428eb6
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 0
je 0x428e76
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x428e78
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [esi + 4], 0
je 0x428e56
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x428e58
mov eax, dword [esi]
push eax
call fcn.004331b0
add esp, 4
mov ecx, dword [0x4ba920]
mov bl, 1
test ecx, ecx
je 0x428eb6
push edi
push eax
call fcn.0042f8e0
jmp 0x428eb6
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x428e8a
mov edi, dword [ebp - 0x14]
cmp byte [esi + 4], 0
je 0x428e98
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x428e9a
mov eax, dword [esi]
push eax
call fcn.004331b0
add esp, 4
mov ecx, dword [0x4ba920]
test ecx, ecx
je 0x428eb4
push edi
push eax
call fcn.0042f8e0
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004733c1
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x42bec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042bed0

Function at 0x431400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x4b731c]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov ebx, esp
push 0x1b0
push str..._.._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.00431f30
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.0043dc60
cmp byte [edi + 0xb], 0
jns 0x431466
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.0043dcc0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004733c1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x431490
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x4b731c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x21a]
push 0x20a
push 0xff
push edi
call fcn.004773d0
add esp, 0xc
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
add esi, 0xffffffff
cmp esi, 0x102
ja 0x431515
push edi
call fcn.0048a37d
add esp, 4
lea ebx, [ebp - 0x234]
mov ecx, ebx
push eax
push edi
call fcn.00423340
lea edi, [ebp - 0x228]
mov ecx, ebx
push edi
call fcn.00424310
mov ecx, dword [ebp + 8]
push edi
call fcn.00423480
mov ecx, edi
call fcn.00423400
mov ecx, ebx
call fcn.00423400
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004733c1
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x431540
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x4b731c]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.004773d0
sub esp, 8
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x4a01d0]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4315a8
cmp word [ebp - 0x214], 0
je 0x4315a8
push edi
call fcn.0048a37d
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00423340
jmp 0x431601
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x218], 0xffffffff
lea edi, [ebp - 0x220]
mov ecx, edi
call fcn.004232f0
push edi
call fcn.00431490
add esp, 4
mov ecx, esi
test al, al
je 0x4315ea
push edi
call fcn.00423310
jmp 0x4315f6
push 3
push 0x4a0222
call fcn.00423340
lea ecx, [ebp - 0x220]
call fcn.00423400
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004733c1
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret

Function at 0x431620
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x270
mov eax, dword [0x4b731c]
xor eax, ebp
mov dword [esp + 0x268], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x250], xmm0
movdqa xmmword [esp + 0x240], xmm0
movdqa xmmword [esp + 0x230], xmm0
movdqa xmmword [esp + 0x220], xmm0
lea edi, [esp + 0x18]
push 0x391
push str..._.._base_files_file_util_win.cc
push 0x4a022a
push edi
call fcn.00431f30
add esp, 0x10
lea ecx, [esp + 0x220]
push 0
push edi
call fcn.0043dc60
lea eax, [esp + 0x1a]
push 0x206
push 0xff
push eax
call fcn.004773d0
add esp, 0xc
mov word [esp + 0x18], 0
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
add esi, 0xffffffff
cmp esi, 0x103
ja 0x4316fe
push edi
call fcn.0048a37d
add esp, 4
mov ebx, esp
mov ecx, ebx
push eax
push edi
call fcn.00423340
lea edi, [esp + 0xc]
mov ecx, ebx
push edi
call fcn.00424310
mov ecx, dword [ebp + 8]
push edi
call fcn.00423480
mov ecx, edi
call fcn.00423400
mov ecx, ebx
call fcn.00423400
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x220]
call fcn.0043dcc0
mov ecx, dword [esp + 0x268]
xor ecx, ebp
call fcn.004733c1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x432450
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x4b731c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x128]
push 0x118
push 0
push eax
call fcn.004773d0
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x130], 0
lea eax, [ebp - 0x130]
push eax
push 0
push 0
push dword [ebp - 0x124]
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x50
call fcn.00473356
add esp, 4
mov esi, eax
mov ebx, dword [ebp - 0x130]
mov eax, dword [0x4ba95c]
mov ecx, dword [0x4ba8e0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x43250e
mov ecx, esi
push ebx
push 0x4ba938
push edi
call fcn.00432660
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004733c1
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4ba95c
call fcn.00473407
add esp, 4
cmp dword [0x4ba95c], 0xffffffff
jne 0x4324e9
xorps xmm0, xmm0
movups xmmword [0x4ba948], xmm0
movups xmmword [0x4ba938], xmm0
mov dword [0x4ba958], 0
push 0x4ba938
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x4ba95c
call fcn.0047347d
add esp, 4
jmp 0x4324e9

Function at 0x4325c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4ba95c]
mov ecx, dword [0x4ba8e0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x432611
movzx ecx, word [0x4ba938]
cmp ecx, 0xc
ja case.0x4325ee.1
xor eax, eax
jmp dword [ecx*4 + 0x4a06cc]
mov eax, 2
pop ebp
ret
mov eax, 4
pop ebp
ret
mov eax, 1
pop ebp
ret
mov eax, 3
pop ebp
ret
push 0x4ba95c
call fcn.00473407
add esp, 4
cmp dword [0x4ba95c], 0xffffffff
jne 0x4325e0
xorps xmm0, xmm0
movups xmmword [0x4ba948], xmm0
movups xmmword [0x4ba938], xmm0
mov dword [0x4ba958], 0
push 0x4ba938
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x4ba95c
call fcn.0047347d
add esp, 4
jmp 0x4325e0
Function at 0x432fa0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
mov eax, dword [ecx]
jne 0x432fcc
test eax, eax
jne 0x432fcc
xor eax, eax
cmp dword [esi + 0xc], 0
jne 0x432fcc
xor eax, eax
cmp dword [esi + 4], 0
mov edx, 0
je 0x433023
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x432feb
call fcn.00431f60
push dword [esi]
call fcn.00433240
add esp, 4
mov dword [esi], 0
xor eax, eax
mov ecx, dword [esi + 4]
lea edx, [ecx + 1]
cmp edx, 2
jb 0x433011
call fcn.00431f60
push dword [esi + 4]
call fcn.00433240
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi]
xor ecx, ecx
mov edx, eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, ecx
mov ebx, dword [edi]
cmp edx, ebx
je 0x43306c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x433050
call fcn.00431f60
push dword [esi]
call fcn.00433240
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x43305f
mov dword [esi], ebx
call fcn.00431f60
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp eax, ebx
je 0x4330b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
add eax, 1
cmp eax, 2
jb 0x43309d
call fcn.00431f60
push dword [esi + 4]
call fcn.00433240
add esp, 4
mov dword [esi + 4], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4330ad
mov dword [esi + 4], ebx
call fcn.00431f60
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x437ba0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test bl, bl
mov dword [ebp - 0x10], ecx
lea edx, [eax + ecx]
mov dword [ebp - 0x18], ebx
lea edi, [esi + ebx]
cmovs edi, edx
cmovs esi, eax
sub edi, esi
cmp edi, 4
jb 0x437c0d
mov edx, esi
mov eax, edi
nop word [eax + eax]
imul ecx, dword [edx], 0x5bd1e995
mov ebx, ecx
shr ebx, 0x18
xor ebx, ecx
imul ecx, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, ecx
add edx, 4
add edi, 0xfffffffc
cmp edi, 3
ja 0x437be0
cmp edi, 1
jne 0x437c16
jmp 0x437c32
mov eax, edi
mov edx, esi
cmp edi, 1
je 0x437c32
cmp edi, 2
je 0x437c29
cmp edi, 3
jne 0x437c3d
movzx ecx, byte [edx + 2]
shl ecx, 0x10
xor eax, ecx
movzx ecx, byte [edx + 1]
shl ecx, 8
xor eax, ecx
movzx ecx, byte [edx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
xor ecx, ecx
test edi, edi
je 0x437da8
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ebx, eax
shr ebx, 0xf
xor ebx, eax
mov eax, edi
shr eax, 1
and eax, 0x55555555
mov ecx, edi
sub ecx, eax
mov eax, ecx
and eax, 0x33333333
shr ecx, 2
and ecx, 0x33333333
add ecx, eax
mov eax, ecx
shr eax, 4
add eax, ecx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 1
ja 0x437ca6
mov eax, edx
lea edx, [edi - 1]
and edx, ebx
jmp 0x437cb7
mov eax, edx
mov edx, ebx
cmp ebx, edi
jb 0x437cb7
mov eax, ebx
xor edx, edx
div edi
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x437da6
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], edi
mov edx, dword [ebp - 0x18]
test dl, dl
mov ecx, dword [ebp - 0x10]
cmovns ecx, edx
mov dword [ebp - 0x10], ecx
mov ebx, dword [eax]
test ebx, ebx
mov ecx, 0
je 0x437da8
mov eax, dword [ebp - 0x20]
add eax, 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x437d18
and eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
cmp eax, ecx
jne 0x437da6
mov ebx, dword [ebx]
test ebx, ebx
je 0x437da6
mov eax, dword [ebx + 4]
cmp eax, dword [ebp - 0x14]
jne 0x437d70
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x437d2d
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x437d0e
lea ecx, [ebx + 8]
mov edx, dword [ecx]
test al, al
cmovs ecx, edx
js 0x437d88
cmp dword [ebp - 0x10], 0
je 0x437da2
cmp byte [esi], dl
jne 0x437d0e
add eax, 0xffffffff
xor ecx, ecx
nop dword [eax]
cmp eax, ecx
je 0x437da2
movzx edx, byte [ebx + ecx + 9]
lea edi, [ecx + 1]
cmp dl, byte [esi + ecx + 1]
mov ecx, edi
je 0x437d50
jmp 0x437d0e
cmp dword [ebp - 0x24], 1
jbe 0x437d00
mov ecx, dword [ebp - 0x20]
cmp eax, ecx
jb 0x437d03
xor edx, edx
div ecx
mov eax, edx
jmp 0x437d03
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x437da2
push eax
push esi
push ecx
call fcn.004759bd
add esp, 0xc
test eax, eax
jne 0x437d0e
mov ecx, ebx
jmp 0x437da8
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4387d0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x4b731c]
xor eax, ebp
mov dword [esp + 0x30], eax
movsd xmm1, qword [0x4bab80]
xorpd xmm0, xmm0
ucomisd xmm1, xmm0
jne 0x438954
jp 0x438954
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x4bab90]
mov ecx, dword [0x4ba8e0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x438979
mov eax, dword [0x4baba0]
mov ecx, dword [0x4ba8e0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4389b2
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
lea esi, [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub edi, dword [0x4bab98]
sbb ebx, dword [0x4bab9c]
movd xmm0, ebx
movd xmm1, edi
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x49b260]
subpd xmm1, xmmword [0x49b270]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
divsd xmm0, qword [esp + 0x20]
xorpd xmm1, xmm1
movsd xmm2, qword [0x4a0ca0]
ucomisd xmm2, xmm0
ja 0x438954
mov eax, dword [esp + 8]
sub eax, dword [0x4bab88]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x4bab8c]
movd xmm1, ecx
movd xmm2, eax
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x49b260]
subpd xmm2, xmmword [0x49b270]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x4bab80], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.004733c1
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4bab90
call fcn.00473407
add esp, 4
cmp dword [0x4bab90], 0xffffffff
jne 0x438842
rdtsc
mov dword [0x4bab88], eax
mov dword [0x4bab8c], edx
push 0x4bab90
call fcn.0047347d
add esp, 4
jmp 0x438842
push 0x4baba0
call fcn.00473407
add esp, 4
cmp dword [0x4baba0], 0xffffffff
jne 0x438863
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [0x4bab9c], ecx
mov dword [0x4bab98], eax
push 0x4baba0
call fcn.0047347d
add esp, 4
jmp 0x438863
Function at 0x43c4d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [0x4b731c]
xor edx, ebp
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x14]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x10]
push edx
push esi
push edi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x43c538
mov eax, dword [ebp - 0x10]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x43c538
cmp dword [ebp - 0x14], 4
jne 0x43c538
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004733c1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret 8

Function at 0x43c550
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.00473850
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x4b731c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x810]
push 0x800
push 0xff
push ebx
call fcn.004773d0
add esp, 0xc
mov dword [ebp - 0x1014], 1
mov dword [ebp - 0x1018], 0x800
lea eax, [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
push eax
push ebx
push ecx
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x43c624
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 2
je 0x43c5d9
mov edi, 0x3f4
cmp eax, 1
jne 0x43c624
mov ecx, esi
push ebx
jmp 0x43c61d
lea edi, [ebp - 0x1010]
push 0x800
push 0xff
push edi
call fcn.004773d0
add esp, 0xc
push 0x400
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xffffffff
mov edi, 0xea
cmp eax, 0x3ff
ja 0x43c624
mov ecx, esi
lea eax, [ebp - 0x1010]
push eax
call fcn.0041e3b6
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004733c1
mov eax, edi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x43e750
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.00473850
mov eax, dword [0x4b731c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4b8184]
cmp eax, 0xffffffff
je 0x43e8a6
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x43e8a6
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.004768d0
add esp, 0xc
mov ecx, dword [0x4b8184]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.004526f0
add esp, 8
test ebx, ebx
je 0x43e7cb
push ebx
call fcn.004733bc
add esp, 4
mov eax, dword [0x4bceac]
mov ecx, dword [0x4ba8e0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x43e8c7
mov esi, dword [0x4bcea8]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x43e8bb
lea eax, [ebp - 0x1410]
push 0xc00
push 0x4bc2a8
push eax
call fcn.004768d0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ebx, 0x100
jmp 0x43e83a
lea ecx, [ebx - 1]
cmp ebx, 2
mov ebx, ecx
jb 0x43e896
test al, 1
je 0x43e896
xor edi, edi
lea esi, [ebp - 0x1408]
xor eax, eax
jmp 0x43e85e
add edi, 1
add esi, 0xc
cmp edi, 0x100
je 0x43e830
mov ecx, dword [ebp + edi*8 - 0x810]
test ecx, ecx
je 0x43e850
cmp dword [esi - 8], 0
je 0x43e850
mov edx, dword [ebp + edi*8 - 0x80c]
cmp edx, dword [esi]
jne 0x43e850
mov edx, dword [esi - 4]
test edx, edx
je 0x43e850
mov dword [ebp + edi*8 - 0x810], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x43e850
push 2
push dword [ebp - 0x1414]
call fcn.004526f0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004733c1
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.00431740
jmp 0x43e801
push 0x4bceac
call fcn.00473407
add esp, 4
cmp dword [0x4bceac], 0xffffffff
jne 0x43e7ec
push 4
call fcn.00473356
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.00431730
mov dword [0x4bcea8], esi
push 0x4bceac
call fcn.0047347d
add esp, 4
jmp 0x43e7ec

Function at 0x43e910
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4b8184]
cmp eax, 0xffffffff
je 0x43e932
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
add eax, 0xffffffff
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x43e940
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [0x4b731c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4b8184]
cmp eax, 0xffffffff
je 0x43e96a
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x43e96f
call fcn.0043eb50
mov eax, dword [0x4bceac]
mov ecx, dword [0x4ba8e0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x43eb09
mov edi, dword [0x4bcea8]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x43eafd
mov ecx, dword [0x4bc2a4]
add ecx, 1
mov edx, 0x100
nop word cs:[eax + eax]
nop dword [eax]
movzx ebx, cl
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x4bc2a8], 0
je 0x43e9ed
lea eax, [ecx + 1]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x4bc2a8], 0
je 0x43e9ed
add ecx, 2
add edx, 0xfffffffe
jne 0x43e9c0
jmp 0x43ea1d
lea ecx, [eax*4 + 0x4bc2a8]
mov dword [ecx], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x4bc2ac], ecx
mov dword [0x4bc2a4], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x4bc2b0]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov dword [ebp - 0x14], 0xffffffff
mov ebx, dword [esi]
cmp ebx, 0xffffffff
jne 0x43ea86
push 0xffffffffffffffff
call fcn.00420120
add esp, 4
mov ebx, eax
push 0xffffffffffffffff
call fcn.00420120
add esp, 4
lea edi, [ebp - 0x14]
mov ecx, edi
push ebx
push eax
push str.slot____kInvalidSlotValue
call fcn.00420500
cmp dword [ebp - 0x14], 0
je 0x43ea84
lea ebx, [ebp - 0x18]
push edi
push 0x199
push str..._.._base_threading_thread_local_storage.cc
push ebx
call fcn.00420010
add esp, 0x10
mov ecx, ebx
call fcn.0041ffe0
mov ecx, ebx
call fcn.0041fff0
mov ebx, dword [esi]
mov dword [ebp - 0x14], 0xffffffff
cmp ebx, 0x100
jl 0x43eae9
push 0x100
call fcn.00420120
add esp, 4
mov edi, eax
push ebx
call fcn.00420120
add esp, 4
lea esi, [ebp - 0x14]
mov ecx, esi
push edi
push eax
push str.slot____kThreadLocalStorageSize
call fcn.00420500
cmp dword [ebp - 0x14], 0
je 0x43eae9
lea edi, [ebp - 0x18]
push esi
push 0x19a
push str..._.._base_threading_thread_local_storage.cc
push edi
call fcn.00420010
add esp, 0x10
mov ecx, edi
call fcn.0041ffe0
mov ecx, edi
call fcn.0041fff0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004733c1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ecx, edi
call fcn.00431740
jmp 0x43e9a5
push 0x4bceac
call fcn.00473407
add esp, 4
cmp dword [0x4bceac], 0xffffffff
jne 0x43e990
push 4
call fcn.00473356
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.00431730
mov dword [0x4bcea8], edi
push 0x4bceac
call fcn.0047347d
add esp, 4
jmp 0x43e990