joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4196fb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
push ebx
push edi
mov edi, ecx
mov dword [ebp - 0x10], 1
call fcn.00419897
xor ebx, ebx
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x4197af
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysFreeString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4197a1
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push ebx
push str.ProxyEnable
mov dword [ebp - 8], 4
push dword [ebp - 4]
call esi
test eax, eax
je 0x419765
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x824
push eax
lea eax, [ebp - 0x838]
push eax
push ebx
push ebx
push str.AutoConfigURL
push dword [ebp - 4]
call esi
test eax, eax
pop esi
je 0x41978e
mov byte [ebp - 0x838], bl
cmp dword [ebp - 0xc], ebx
jne 0x41979b
cmp byte [ebp - 0x838], bl
je 0x4197a1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], ebx
je 0x4197af
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0041936f
add esp, 0x14
cmp dword [ebp + 0xc], ebx
mov dword [edi + 4], eax
je 0x4197d4
cmp dword [ebp + 0xc], 4
jne 0x419800
cmp dword [ebp - 0x14], ebx
jne 0x419800
mov ax, word [edi + 0x14]
cmp ax, 3
jne 0x4197ec
mov ecx, edi
call fcn.00419db2
jmp 0x419800
cmp ax, 4
mov ecx, edi
jne 0x4197fb
call fcn.00419f93
jmp 0x419800
call fcn.0041a367
xor eax, eax
cmp dword [edi + 4], ebx
pop edi
pop ebx
setne al
leave
ret 0x14
Function at 0x419db2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1190
call fcn.0041e1c0
and byte [ebp - 0x96c], 0
push ebx
push esi
mov dword [ebp - 0x10], ecx
mov edx, 0x208
push edi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x96b]
and byte [ebp - 0x1190], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x118f]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push str.SOFTWARENetscapeNetscape_NavigatorProxy_Information
push SysFreeString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x419f80
lea eax, [ebp - 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push str.Proxy_Type
push dword [ebp - 4]
mov dword [ebp - 0x48], str.http
mov dword [ebp - 0x44], str.HTTP_Proxy
mov dword [ebp - 0x40], str.HTTP_ProxyPort
mov dword [ebp - 0x3c], str.https
mov dword [ebp - 0x38], str.HTTPS_Proxy
mov dword [ebp - 0x34], str.HTTPS_ProxyPort
mov dword [ebp - 0x30], str.ftp
mov dword [ebp - 0x2c], str.FTP_Proxy
mov dword [ebp - 0x28], str.FTP_ProxyPort
mov dword [ebp - 8], 4
call ebx
test eax, eax
jne 0x419f80
cmp dword [ebp - 0x14], 1
jne 0x419f80
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edi, [ebp - 0x48]
mov dword [ebp - 0xc], 3
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x100
push eax
lea eax, [ebp - 0x148]
push eax
push 0
push 0
push dword [edi + 4]
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x419f43
cmp byte [ebp - 0x148], al
je 0x419f43
push dword [edi]
lea eax, [ebp - 0x96c]
push eax
call esi
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x96c]
push eax
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push dword [edi + 8]
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x419f35
lea eax, [ebp - 0x96c]
push 0x431a84
push eax
call esi
push dword [ebp - 0x18]
lea eax, [ebp - 0x96c]
push 0x430c18
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x96c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x96c]
push 0x430814
push eax
call esi
add edi, 0xc
dec dword [ebp - 0xc]
jne 0x419e99
lea eax, [ebp - 0x96c]
push 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1190]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x10]
push 0x26
mov dword [ebp - 0x24], 3
push dword [eax + 4]
call fcn.00419580
add esp, 0x10
xor esi, esi
cmp dword [ebp - 4], esi
je 0x419f8e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41af07
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
sub eax, dword [esi + 0xf4]
cmp eax, 0x7530
jbe 0x41af6a
mov ecx, dword [esi + 0xe8]
lea eax, [esi + 0xe8]
mov edx, dword [esi + 0xf0]
mov dword [esi + 0xdc], ecx
xor ecx, ecx
mov dword [esi + 0xe4], edx
mov dword [eax], ecx
lea eax, [esi + 0xf0]
mov edx, dword [esi + 0xec]
mov dword [esi + 0xec], ecx
mov dword [eax], ecx
lea eax, [esi + 0xec]
mov dword [esi + 0xe0], edx
call edi
mov dword [esi + 0xf4], eax
mov edi, dword [esi + 0xe4]
test edi, edi
jne 0x41af7c
mov eax, dword [esi + 0xdc]
jmp 0x41afd4
push ebx
push ebp
push 0xa
xor eax, eax
pop ecx
xor ebp, ebp
test eax, eax
jne 0x41afd2
or eax, 0xffffffff
xor edx, edx
div ecx
mov ebx, dword [esi + 0xdc]
cmp ebx, eax
jbe 0x41afaa
shr ebx, 1
shr edi, 1
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe4], edi
mov eax, dword [esi + 0xdc]
mov edi, dword [esi + 0xe4]
imul eax, ecx
xor edx, edx
div edi
xor edx, edx
imul eax, eax, 0x3e8
div ecx
lea ecx, [ecx + ecx*4]
inc ebp
shl ecx, 1
cmp ebp, 3
jb 0x41af85
pop ebp
pop ebx
pop edi
pop esi
ret

Function at 0x41b836
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push ebx
push eax
mov ebx, ecx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 4], eax
je 0x41b888
push eax
call fcn.0041d7f8
pop ecx
mov dword [ebx + 0x40], eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x41b888
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x430d0c
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x41b88c
xor al, al
jmp 0x41b8ed
push esi
push edi
mov edi, ebx
lea eax, [ebx + 4]
neg edi
sbb edi, edi
mov esi, dword [ebp - 0xc]
push 0xd
and edi, eax
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
rep movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
pop edi
pop esi
test eax, eax
je 0x41b8eb
mov eax, dword [ebp - 4]
shr eax, 2
mov dword [ebx + 0x3c], eax
shl eax, 2
push eax
call fcn.0041d7f8
mov dword [ebx + 0x38], eax
xor eax, eax
cmp dword [ebx + 0x3c], eax
pop ecx
jbe 0x41b8eb
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 0x3c]
jb 0x41b8d9
mov al, 1
pop ebx
leave
ret 4
Function at 0x426076
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x434900
cmp edx, dword [eax]
je 0x426098
add eax, 8
inc ecx
cmp eax, 0x434990
jl 0x426089
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x434900]
jne 0x4261c6
mov eax, dword [0x437f48]
cmp eax, 1
je 0x4261a0
test eax, eax
jne 0x4260c9
cmp dword [0x431ef4], 1
je 0x4261a0
cmp edx, 0xfc
je 0x4261c6
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x426100
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0041dbb0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041db30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x426143
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041db30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42c4c8
push edi
call fcn.0041da30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0041dbb0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041dbc0
lea eax, [ebp - 0xa0]
push 0x42c4a8
push eax
call fcn.0041dbc0
push dword [esi + 0x434904]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041dbc0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00427e18
add esp, 0x2c
pop edi
jmp 0x4261c6
lea eax, [ebp + 8]
lea esi, [esi + 0x434904]
push 0
push eax
push dword [esi]
call fcn.0041db30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x438ca3
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x438a14
sub ebx, ebx
or esi, ebx
add esi, 1
call fcn.00438ce4
mov ebx, 0xc25dc38b
xor dword [edi], ecx
push ebx
pop esi
add esi, 1
add esi, esi
inc edi
sub ebx, 0x631e550d
or esi, esi
cmp edi, edx
jne fcn.00438ca3
sub ebx, 0x5e5cefcf
ret
Function at 0x40d060
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.0040d0c0

Function at 0x40d0c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x491054]
test esi, esi
jle 0x40d1ad
mov edi, dword [0x491058]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x40d0f4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x40d1a6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x40d0e0
mov dword [esp], eax
mov ebx, eax
call fcn.0040da00
test eax, eax
mov edi, eax
je 0x40d1ea
lea ebx, [esi + esi*2]
mov esi, dword [0x491058]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.0040db00
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x491058]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40d1ca
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40d19f
sub eax, 0x40
and eax, 0xffffffbf
je 0x40d19f
mov eax, dword [esp + 0x20]
add ebx, dword [0x491058]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x40d1b4
add dword [0x491054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x40d0fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040d060
mov eax, dword [0x491058]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040d060
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040d060
lea esi, [esi]
Function at 0x40d6b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x491408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x491400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x40d705
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40d6fe
test esi, esi
je 0x40d6fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40d6e0
mov dword [esp], 0x491408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40d920
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x40d958
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40d94e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40d95a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40d940
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40f000
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov esi, eax
lea eax, [eax + 0x41]
and eax, 0xfffffff0
call fcn.0040dc30
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
lea edi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sub.msvcrt.dll_memcpy
lea eax, [esi + 0x10]
lea edx, [edi + eax]
mov dword [ebp - 0x20], eax
mov dword [edx], 0x61616161
mov dword [edx + 4], 0x61616161
mov dword [edx + 8], 0x61616161
mov dword [edx + 0xc], 0x61616161
mov dword [edx + 0x10], 0x61616161
mov dword [edx + 0x14], 0x61616161
mov dword [edx + 0x18], 0x61616161
mov dword [edx + 0x1c], 0x61616161
mov dword [ebp - 0x24], edx
mov byte [esp + esi + 0x3c], 0
mov byte [esp + esi + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [edi + esi + 0xf], 0x2d
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
mov edx, dword [ebp - 0x24]
je 0x40f0ef
int3
mov dword [ebp - 0x24], edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
mov edx, dword [ebp - 0x24]
jne 0x40f193
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, dword [ebp - 0x24]
mov ebx, eax
mov eax, 0x20
bt ebx, eax
jae 0x40f12a
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x40f122
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x40f190
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call fcn.0040ef80
cmp eax, ebx
mov esi, eax
je 0x40f1aa
mov dword [esp], ebx
call fcn.004198d8
mov edi, dword [ebp - 0x1c]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call fcn.0040ef80
mov esi, eax
jmp 0x40f164
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40f164
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x40f164
Function at 0x41b770
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x491e50]
test ebx, ebx
je 0x41b7a0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx], eax
mov eax, dword [0x491e50]
test eax, eax
je 0x41b7c5
cmp dword [eax], 0xffffffff
je 0x41b7e8
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], 0x41ac00
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.004200f0
mov ebx, eax
mov dword [0x491e50], eax
jmp 0x41b77e
mov dword [esp + 8], 0x41ac00
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.004200f0
mov dword [0x491e50], eax
jmp 0x41b78f
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x41bc80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x491e54]
test eax, eax
je 0x41bdd4
call fcn.0041bc00
mov eax, dword [0x491e50]
test eax, eax
je 0x41be00
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41bcc0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041b5c0
test eax, eax
mov ebx, eax
je 0x41be4c
mov eax, dword [entry3]
test eax, eax
je 0x41be4c
mov dword [ebx + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x38], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub esp, 0x10
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x34], 0xffffffff
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x14], 0
call esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call esi
mov edx, eax
lea eax, [ebx + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x41be53
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
mov dword [ebx + 0x64], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x491e50]
test eax, eax
je 0x41be26
mov dword [esp + 4], ebx
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x41be53
mov eax, ebx
jmp 0x41bcb8
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_once_shmem
call fcn.004200f0
mov dword [0x491e54], eax
jmp 0x41bc94
mov dword [esp + 8], 0x41ac00
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.004200f0
mov dword [0x491e50], eax
jmp 0x41bca6
mov dword [esp + 8], 0x41ac00
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.004200f0
mov dword [0x491e50], eax
jmp 0x41bdb3
xor eax, eax
jmp 0x41bcb8
call sub.msvcrt.dll_abort
nop
lea esi, [esi]
sub esp, 0x1c
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_key_dest_shmem
call fcn.004200f0
add esp, 0x1c
ret
Function at 0x41c3c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
cmp dword [esp + 0x24], 3
je 0x41c3e0
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret 0xc
mov eax, dword [0x491e50]
test eax, eax
je 0x41c550
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x41c3cc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41c3cc
test byte [eax + 0x20], 0x30
je 0x41c4a0
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x41c540
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x41c450
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x41c442
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0041a9b0
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x34], 0xffffffff
test edx, edx
je 0x41c5a6
mov eax, dword [0x491e50]
test eax, eax
je 0x41c580
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
mov eax, 1
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [eax + 0x64]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x41c500
test eax, eax
je 0x41c4ba
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x64], 1
test eax, eax
jne 0x41c530
test byte [ebx + 0x24], 4
je 0x41c517
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41c449
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x41c449
test eax, eax
je 0x41c510
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0041a9b0
mov dword [ebx + 0x34], 0xffffffff
jmp 0x41c3cc
call fcn.0041c1d0
jmp 0x41c4d2
call fcn.0041c1d0
jmp 0x41c41e
mov dword [esp + 8], 0x41ac00
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.004200f0
mov dword [0x491e50], eax
jmp 0x41c3ed
mov dword [esp + 8], 0x41ac00
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.004200f0
mov dword [0x491e50], eax
jmp 0x41c47d
mov eax, ebx
call fcn.0041b7f0
jmp 0x41c470
Function at 0x41d740
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.0041bc80
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x41d7bb
test byte [ebx + 0x20], 0x30
je 0x41d7c2
mov eax, dword [0x491e50]
test eax, eax
je 0x41d84b
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41d7b2
cmp dword [eax + 0x14], 0
je 0x41d7d5
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41d7a5
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x41d81f
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call fcn.0041c1d0
jmp 0x41d75d
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_longjmp
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41d7ec
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
je 0x41d842
mov eax, dword [0x491e50]
test eax, eax
je 0x41d871
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x41d7b2
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x14], 0
jne 0x41d7ff
mov eax, ebx
call fcn.0041b7f0
jmp 0x41d7ff
mov dword [esp + 8], 0x41ac00
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.004200f0
mov dword [0x491e50], eax
jmp 0x41d770
mov dword [esp + 8], 0x41ac00
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.004200f0
mov dword [0x491e50], eax
jmp 0x41d808