joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035e2e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x10035e50
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x10035e50
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10035e50
ret
cmp word [ebx + 4], 0x14c
jne 0x10035e50
test word [ebx + 0x16], 2
je 0x10035e50
test word [ebx + 0x16], 0x100
je 0x10035e50
cmp word [ebx + 0x18], 0x10b
jne 0x10035e50
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x10035e50
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x10035edc
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10035e70
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1001cdbb
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x10035e50
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x10035edc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x10035e50
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x10035e50
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10035e50
ret
cmp word [ebx + 4], 0x14c
jne 0x10035e50
test word [ebx + 0x16], 2
je 0x10035e50
test word [ebx + 0x16], 0x100
je 0x10035e50
cmp word [ebx + 0x18], 0x10b
jne 0x10035e50
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x10035e50
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x10035edc
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10035e70
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1001cdbb
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x10035e50
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x10035f93
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10035fec
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10035f93
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10035fa2
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1043bc45
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10035ff3
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1001ce69
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10036092
add edi, 4
add eax, 2
dec ecx
jne 0x10035fd8
call 0x1003603f
loope 0x10036035
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1003608f
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100360a0
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10036053
cmp eax, ecx
ja 0x10036053
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100360dd
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100360d3
lea edi, [ebp - 0x100]
push pe_nt_image_headers32
push edi
push esi
call fcn.1001d348
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10035fa2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10035fec
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10035f93
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10035fa2
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1043bc45
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10035ff3
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1001ce69
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10036092
add edi, 4
add eax, 2
dec ecx
jne 0x10035fd8
call 0x1003603f
loope 0x10036035
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1003608f
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100360a0
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10036053
cmp eax, ecx
ja 0x10036053
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100360dd
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100360d3
lea edi, [ebp - 0x100]
push pe_nt_image_headers32
push edi
push esi
call fcn.1001d348
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10004377
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10004386
pop dword [ebp - 0x24]
mov eax, 0x1556fa94
add eax, 0xfaa948f2
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x2b7a34c8
add dword [ebp - 0x34], 0x22d81083
mov dword [ebp - 0x30], 0x960d6394
sub dword [ebp - 0x30], 0x63da174f
mov dword [ebp - 0x2c], 0x9ca4f1cd
add dword [ebp - 0x2c], 0xafa75261
mov dword [ebp - 0x28], 0xeb45090d
add dword [ebp - 0x28], 0x14baf6f3
lea eax, [ebp - 0x34]
push eax
mov eax, 0xcaaf70d8
add eax, 0x4550df80
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x1f77abf2
sub dword [ebp - 0x34], 0xab05429c
mov dword [ebp - 0x30], 0xc52b3f6a
add dword [ebp - 0x30], 0x7c41220b
mov dword [ebp - 0x2c], 0x39d4cbe2
sub dword [ebp - 0x2c], 0xd6655f76
mov dword [ebp - 0x28], 0x81037e2f
sub dword [ebp - 0x28], 0x81037e2f
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x37d9c
push 0
call eax
mov ecx, 0x4d35
xor edx, edx
add edx, eax
mov esi, 0x1000a800
add esi, dword [ebp - 0x24]
mov ebx, 0xf1df477e
sub dword [ebp - 4], edx
mov edi, dword [esi]
xor dword [ebp - 0x14], edx
add edi, ebx
xor dword [ebp - 8], edx
mov dword [edx], edi
add dword [ebp - 0x1c], ecx
add edx, 0x91c760c9
add edx, 0x6e389f3b
add esi, 0x280fc107
sub esi, 0x280fc103
loop 0x10004493
add eax, 0x127a7
xor ebx, ebx
add ebx, eax
add eax, 0x2f46467c
add eax, 0xd0b9b989
mov ecx, 0xfa6bd50f
add ecx, 0x15942af1
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401a24
Capabilities:
Clear file content
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x400
push esi
push edi
xor esi, esi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, 0x58ced85
jg 0x401a48
inc edi
cmp edi, 0x1f6502b1
jl 0x401a30
cmp dword [0x2be8a9c], 0x400
jne 0x401a9d
push str.gacaxavu_nitalozoxoxideligasozitosucanuzi_razoxuce_hihuwadozosasazipojapena_jam
push str.cuvolixu
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeKeepStringHandle]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push esi
push 0x4351a8
call fcn.004020b2
push esi
push esi
push esi
call fcn.00402098
push esi
push esi
call fcn.00401eb4
push esi
call fcn.004022a7
push esi
call fcn.004022b6
add esp, 0x24
xor edi, edi
cmp edi, 0xd0fe
jge 0x401aae
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
cmp edi, 0x3a37ee
jg 0x401ad5
inc edi
cmp edi, 0xe52f
jl 0x401a9f
mov eax, dword [0x42a2d4]
mov dword [0x2be8a9c], eax
call fcn.00401763
mov edi, 0x3078f
cmp dword [0x2be8a9c], 0x51f
jne 0x401b01
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x401ae9
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x40800d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x429410]
jne 0x408017
repz ret
jmp fcn.0040aa50
Function at 0x40907f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x429410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405736
and dword [ebp - 0x14], 0
cmp dword [0x434e68], 0
mov dword [ebp - 0x18], eax
jne 0x409132
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4091da
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4091da
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x434e68], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x434e6c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x434e70], eax
call edi
push eax
call esi
mov dword [0x434e78], eax
test eax, eax
je 0x409132
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x434e74], eax
mov eax, dword [0x434e74]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40918b
cmp dword [0x434e78], ecx
je 0x40918b
push eax
call esi
push dword [0x434e78]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40918b
test ebx, ebx
je 0x40918b
call edi
test eax, eax
je 0x409182
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x409182
test byte [ebp - 8], 1
jne 0x40918b
or dword [ebp + 0x10], 0x200000
jmp 0x4091be
mov eax, dword [0x434e6c]
cmp eax, dword [ebp - 0x18]
je 0x4091be
push eax
call esi
test eax, eax
je 0x4091be
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4091be
mov eax, dword [0x434e70]
cmp eax, dword [ebp - 0x18]
je 0x4091be
push eax
call esi
test eax, eax
je 0x4091be
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x434e68]
call esi
test eax, eax
je 0x4091da
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4091dc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040800d
leave
ret

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc
Function at 0x40e310
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00419910
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00419910
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x40e370
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x44c07c]
test esi, esi
jle 0x40e490
mov eax, dword [0x44c080]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x40e3a4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40e427
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40e390
mov dword [esp], ebx
call fcn.0040ed70
mov edi, eax
test eax, eax
je 0x40e4b7
mov eax, dword [0x44c080]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0040eeb0
mov edx, dword [0x44c080]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40e497
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40e420
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x40e430
add dword [0x44c07c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x44c080]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40e420
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040e310
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x40e3ae
mov eax, dword [0x44c080]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040e310
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040e310
lea esi, cs:[esi]
nop
Function at 0x40e9e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x44c098
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x44c090]
sub esp, 4
test ebx, ebx
je 0x40ea35
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x40ea2e
test eax, eax
jne 0x40ea2e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40ea10
mov dword [esp], 0x44c098
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40ed70
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x40ed95
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x40eda0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x40ed95
push esi
push ebx
mov ebx, dword [esp + 0xc]
movzx eax, word [ecx + 0x400014]
movzx esi, word [ecx + 0x400006]
sub ebx, 0x400000
lea eax, [edx + eax + 0x18]
test si, si
je 0x40ede8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40edde
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40edea
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x40edd0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x413dc0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x2d
mov dword [esp + 4], str._buffer_overflow_detected_:_terminated_n
mov dword [esp], 2
call sub.msvcrt.dll__write
mov dword [esp], 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
sub esp, 4
test eax, eax
je 0x413df9
mov ecx, 8
int 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], 0xc0000409
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x413e20
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x2c
mov dword [esp + 4], str._stack_smashing_detected_:_terminated_n
mov dword [esp], 2
call sub.msvcrt.dll__write
mov dword [esp], 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
sub esp, 4
test eax, eax
je 0x413e59
mov ecx, 2
int 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], 0xc0000409
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x41aad0
Capabilities:
Print debug messages

Disassembly:
push edi
pxor xmm0, xmm0
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push ebx
lea ebx, [ebp - 0x41]
sub esp, 0x50
movups xmmword [ebp - 0x21], xmm0
mov eax, dword [0x44c0fc]
mov dword [ebp - 0xc], eax
xor eax, eax
movups xmmword [ebp - 0x41], xmm0
movups xmmword [ebp - 0x31], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x35
mov dword [esp], ebx
call fcn.00420040
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sub.msvcrt.dll_abort
lea esi, cs:[esi]
lea esi, [esi]

Function at 0x41aec0
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x44caf4], 1
je 0x41af60
push edi
mov eax, 0x44caf4
push esi
push ebx
sub esp, 0x10
call fcn.0041a8c0
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call fcn.0041a1b0
mov edi, dword [0x44caf4]
test edi, edi
jne 0x41af30
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x433120], eax
cmp eax, 0xffffffff
je 0x431d15
mov dword [0x44caf4], 1
mov dword [esp], esi
call fcn.0041a4e0
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
jmp fcn.0041ab50
cmp edi, 1
je 0x41af12
mov dword [esp], 2
call dword [0x433108]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x44caf4
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x41af12
ret
call sub.msvcrt.dll_abort
call sub.msvcrt.dll_abort
mov eax, dword [0x14]
ud2

Function at 0x41b0a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041aec0
mov eax, dword [0x433120]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41b0c8
add esp, 0x1c
ret
add esp, 0x1c
jmp fcn.0041af70
Function at 0x41b3a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x41b3c8
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x41b4c0
add esp, 0x14
pop ebx
pop esi
ret 0xc
cmp eax, 1
je 0x41b490
cmp eax, 3
jne 0x41b3b9
mov eax, dword [0x433120]
cmp eax, 0xffffffff
je 0x41b3b9
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41b3b9
test byte [eax + 0x20], 0x30
je 0x41b4f0
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41b40b
call fcn.0041b0d0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x41b43d
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x41b42f
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0041a680
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0041e6e0
cmp eax, 1
je 0x41b5be
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x41b5b2
mov eax, dword [0x433120]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x41b3b9
mov eax, dword [0x44cacc]
test eax, eax
je 0x41b4dc
mov dword [esp + 4], 0x41a830
mov dword [esp], 1
call eax
mov dword [0x44cad0], eax
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [0x44cad0]
test eax, eax
je 0x41b3b9
mov edx, dword [0x44cac8]
test edx, edx
je 0x41b4dc
mov dword [esp], eax
call edx
mov dword [0x44cad0], 0
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x41b564
test eax, eax
je 0x41b50a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x41b527
call fcn.0041b0d0
test byte [ebx + 0x24], 4
je 0x41b5a2
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41b43d
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], eax
call fcn.0041a680
lea eax, [ebx + 0x38]
jmp 0x41b44b
test eax, eax
je 0x41b5a2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.0041a680
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0041e6e0
cmp eax, 1
je 0x41b5be
mov dword [ebx + 0x38], 0xffffffff
jmp 0x41b3b9
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0041a680
lea eax, [ebx + 0x38]
jmp 0x41b589
mov eax, ebx
call fcn.0041ad00
jmp 0x41b471
call fcn.0041aad0
lea esi, cs:[esi]
lea esi, cs:[esi]