joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4532a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9b6e
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x51df40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov esi, dword [ebx + 0x3c]
sub esi, dword [ebx + 0x38]
je 0x45337c
cmp esi, 0x7fffffff
ja 0x453484
cmp esi, 0x1000
jb 0x453348
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x453489
push eax
call fcn.004d4281
add esp, 4
test eax, eax
je 0x453342
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ebp - 0x14], ecx
mov dword [ecx - 4], eax
jmp 0x453356
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push esi
call fcn.004d4281
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, eax
mov dword [edi], ecx
lea eax, [ecx + esi]
mov dword [edi + 4], ecx
mov dword [edi + 8], eax
mov esi, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x38]
sub esi, eax
push esi
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x14]
add esp, 0xc
add eax, esi
mov dword [edi + 4], eax
mov eax, dword [ebx + 0x3c]
sub esp, 8
sub eax, dword [ebx + 0x38]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4df6d0]
movsd qword [esp], xmm0
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_log2]
fmul qword [0x4e48a0]
xor eax, eax
mov byte [ebx + 7], 1
add esp, 8
bswap eax
fadd qword [0x4df170]
fstp qword [ebp - 0x24]
cvttsd2si edx, qword [ebp - 0x24]
mov byte [ebx + 6], dl
mov ecx, dword [ebx + 0x3c]
sub ecx, dword [ebx + 0x38]
bswap ecx
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], ecx
mov ecx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], eax
cmp eax, ecx
je 0x45344c
mov eax, dword [eax]
xor esi, esi
mov dword [ebp - 0x1c], eax
test dl, dl
je 0x45343f
nop dword [eax]
movzx eax, dl
sub eax, esi
lea ecx, [eax*8 - 8]
mov eax, dword [ebp - 0x1c]
shr eax, cl
mov ecx, dword [edi + 4]
mov byte [ebp - 0xd], al
cmp ecx, dword [edi + 8]
je 0x453423
mov byte [ecx], al
inc dword [edi + 4]
jmp 0x45342f
lea eax, [ebp - 0xd]
push eax
push ecx
mov ecx, edi
call fcn.00428880
mov cl, byte [ebx + 6]
inc esi
movzx eax, cl
mov dl, cl
cmp esi, eax
jl 0x453400
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
cmp eax, ecx
jne 0x4533f2
mov edx, dword [ebx + 0x30]
xor ecx, ecx
sub edx, dword [ebx + 0x2c]
sar edx, 2
push 0x20
bswap ecx
bswap edx
mov dword [ebx + 8], ecx
mov ecx, edi
push ebx
mov dword [ebx + 0xc], edx
push dword [edi + 4]
call fcn.0041c9c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0040cf00
call fcn.0040cdd0
int3
Function at 0x458190
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push str.Opening_socket_n
mov dword [ebp - 0x10], 1
mov dword [0x52094c], eax
call fcn.00457a20
add esp, 4
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
jns 0x4581f3
push str.error_opening_socket
call fcn.00457a20
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 5]
push 1
push eax
push 0xa
push 0
push esi
mov byte [ebp - 5], 0x20
call edi
test eax, eax
jns 0x45822e
push str.error_setting_multicast_TTL
call fcn.00401410
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0xffff
push esi
call edi
test eax, eax
jns 0x458261
push str.error_setting_reuseaddr
call fcn.00457a20
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
push 1
lea eax, [ebp - 5]
mov byte [ebp - 5], 1
push eax
push 0xb
push 0
push esi
call edi
test eax, eax
jns 0x458295
push str.error_seeting_multicast_loop
call fcn.00457a20
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0x10], 0
xorps xmm0, xmm0
mov eax, 2
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x28], ax
je 0x4582ba
push 0x14e9
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x26], ax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x4582f0
push str.error_binding_socket
call fcn.00457a20
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 0xc]
push eax
push 9
push 0
push esi
call edi
test eax, eax
jns 0x458320
push str.bound_to_if_failed
call fcn.00457a20
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
push str.224.0.0.251
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
push 8
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 0xc
push 0
push esi
call edi
test eax, eax
jns 0x458364
push str.setsockopt_failed
call fcn.00457a20
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
push 0x20
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov dword [eax], esi
pop edi
mov dword [eax + 4], 0
pop esi
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
Function at 0x45a170
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 4
xor edi, edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov dword [eax], edi
call fcn.0045a850
push dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 8], esi
call fcn.0045a7f0
push esi
push eax
mov dword [ebp - 0xc], eax
call fcn.0045a900
mov esi, dword [ebp + 0x1c]
add esp, 0x14
mov dword [ebp - 4], eax
test esi, esi
je 0x45a1f4
cmp dword [esi], edi
je 0x45a1f4
push 0x10
push eax
call fcn.0045a8f0
add esp, 4
push eax
call fcn.0045b540
mov edi, eax
push edi
push dword [ebp + 8]
call fcn.0045ba10
mov ecx, dword [esi]
add esp, 0x10
test ecx, ecx
je 0x45a1f4
push ecx
push edi
call fcn.0045b4a0
mov ecx, dword [esi + 4]
lea esi, [esi + 4]
add esp, 8
test ecx, ecx
jne 0x45a1e0
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x45a203
push eax
call fcn.0045a850
jmp 0x45a20b
push dword [ebx + 0x24]
call fcn.0045a8f0
add esp, 4
push eax
push dword [ebp + 0x14]
push dword [ebp - 4]
call fcn.0045a8f0
add esp, 4
push eax
call fcn.0045b600
mov esi, eax
push esi
push dword [ebp + 8]
mov dword [ebp + 0x1c], esi
call fcn.0045ba10
push esi
push dword [ebp - 8]
call fcn.0045b5c0
add esp, 0x1c
mov dword [ebp + 0x18], eax
push eax
push str._t_services_a_dns_sd
call fcn.0045a8f0
add esp, 4
push eax
call fcn.0045b5c0
add esp, 8
mov dword [ebp - 8], eax
push 0xffffffffffffffff
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea esi, [ebx + 0x14]
test edi, edi
je 0x45a275
push edi
push esi
call fcn.0045b850
add esp, 8
push dword [ebp + 0x1c]
push esi
call fcn.0045b850
mov edi, dword [ebp + 0x18]
push edi
push esi
call fcn.0045b850
push dword [ebp - 8]
push esi
call fcn.0045b850
lea eax, [ebx + 0x18]
push edi
push eax
call fcn.0045ba10
lea eax, [ebx + 0x1c]
push edi
push eax
call fcn.0045ba10
add esp, 0x28
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 4]
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call esi
push dword [ebp - 0xc]
call esi
add esp, 8
push 0
push 1
push 0x4e4fd8
push dword [ebx + 0xc]
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a370
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Get local ipv4 addresses
Get socket information
Start tcp server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0xc]
push ebx
push esi
push edi
push 0x28
mov byte [0x520950], al
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, dword [sym.imp.WS2_32.dll_socket]
add esp, 4
mov edi, eax
xorps xmm0, xmm0
push 0
movups xmmword [edi], xmm0
push 1
movups xmmword [edi + 0x10], xmm0
push 2
movq qword [edi + 0x20], xmm0
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45a513
xorps xmm0, xmm0
mov eax, 2
push 0
movlpd qword [ebp - 0x10], xmm0
mov word [ebp - 0x18], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x7f000001
mov word [ebp - 0x16], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push 0x10
push eax
push ebx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x45a50c
push 1
push ebx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x45a50c
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x10
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x45a50c
push 0
push 1
push 2
call esi
mov dword [edi + 0xc], eax
cmp eax, 0xffffffff
je 0x45a50c
push dword [ebp - 8]
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x45a50c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_accept]
mov dword [edi + 8], eax
cmp eax, 0xffffffff
jne 0x45a48e
push dword [edi + 0xc]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push ebx
mov dword [edi + 0xc], 0xffffffff
call esi
jmp 0x45a513
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [ebp + 8]
call fcn.004597c0
add esp, 4
mov dword [edi + 4], eax
test eax, eax
jns 0x45a4ae
push str.unable_to_create_recv_socket_n
jmp 0x45a518
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0
push 0
push edi
push 0x459a00
push 0
push 0
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x45a4f9
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
push str.pipe__:__m_n
push 1
call fcn.0045a0c0
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
Function at 0x45a540
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x45a5dd
push esi
push 0
push 1
push 0x4e4fd8
mov dword [edi + 0x10], 1
push dword [edi + 0xc]
call dword [sym.imp.WS2_32.dll_send]
cmp dword [edi + 0x10], 2
je 0x45a582
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call esi
cmp dword [edi + 0x10], 2
jne 0x45a575
push dword [edi + 8]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push dword [edi + 0xc]
call esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [edi + 0x14]
call fcn.0045b950
push 0
push dword [edi + 0x18]
call fcn.0045ba70
push 0
push dword [edi + 0x1c]
call fcn.0045ba70
push 0
push dword [edi + 0x20]
call fcn.0045ba70
mov eax, dword [edi + 0x24]
add esp, 0x1c
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test eax, eax
je 0x45a5d6
push eax
call esi
add esp, 4
push edi
call esi
add esp, 4
pop esi
pop edi
pop ebp
ret
Function at 0x45bd00
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0xb
mov dword [ebp - 8], 0
mov dword [eax + 4], 0
call fcn.0045cf60
mov dword [ebp - 0x10], eax
test eax, eax
je 0x45be93
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x45bd3a
mov ebx, dword [ebx]
jmp 0x45bd3c
xor ebx, ebx
call fcn.0045d0c0
mov esi, eax
mov dword [ebp - 4], edx
test esi, esi
je 0x45be9c
mov eax, dword [esi + 0x88]
push 0x10
mov dword [ebp - 0xc], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
je 0x45be9c
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax], esi
mov dword [eax + 8], ecx
mov eax, dword [ebp + 0x14]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x9c]
mov dword [esi + 0x9c], eax
test ebx, ebx
je 0x45be06
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045cf50
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0045cf30
add esp, 0xc
test eax, eax
jne 0x45bdc3
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x9c], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x84], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x1c], ecx
test eax, eax
je 0x45bdf2
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov ecx, dword [ebp - 0x1c]
add esp, 4
mov dword [esi + 0xa0], eax
cmp dword [ebx + 0x14], 0
jne 0x45be08
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x88]
mov dword [ebp - 0xc], eax
jmp 0x45be08
xor ecx, ecx
lea eax, [esi + 0x98]
mov dword [esi + 0x18], 3
push eax
push 4
push edi
push 0x45d260
push ecx
push 0
mov dword [esi + 0x30], 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov edi, eax
add esp, 0x18
mov dword [ebp - 0x1c], edi
mov dword [esi + 8], edi
test edi, edi
je 0x45be68
test ebx, ebx
je 0x45be52
push dword [ebp - 0xc]
push 0
push dword [ebp - 4]
push esi
call fcn.0045d1b0
add esp, 0x10
push dword [esi + 0x9c]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov edi, 0xb
cmp dword [ebp - 0x1c], eax
cmovne edi, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
test edi, edi
jne 0x45be9c
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [ecx + 4], eax
mov eax, edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 4], esi
mov esi, dword [ebp - 0x20]
push dword [ebp - 4]
push esi
call fcn.0045d080
mov eax, dword [ebp - 8]
add esp, 8
test eax, eax
je 0x45beb9
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45dd30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.0045e490
mov esi, eax
mov dword [0x52098c], 1
push 0x400
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x45dd9f
push 0xc
push str.QUSEREX.DLL
lea eax, [ebp - 0x404]
push 0x400
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbcat_s]
add esp, 0x10
test eax, eax
jne 0x45dd9f
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x5209a8], eax
jmp 0x45dda4
mov eax, dword [0x5209a8]
test eax, eax
je 0x45ddc3
push str.QueueUserAPCEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [0x5209a8]
mov dword [0x520968], ecx
jmp 0x45ddc9
mov ecx, dword [0x520968]
test ecx, ecx
jne 0x45ddde
mov dword [0x520968], 0x45e420
test eax, eax
je 0x45de2b
push eax
jmp 0x45de25
push str.QueueUserAPCEx_Init
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45de15
call eax
test eax, eax
je 0x45de15
cmp dword [0x5209a8], 0
mov eax, esi
je 0x45de37
or dword [0x52098c], 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
push dword [0x5209a8]
mov dword [0x520968], 0x45e420
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov dword [0x5209a8], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret

Function at 0x45de50
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [0x52096c], 0
je 0x45dec1
push dword [0x520970]
call fcn.0045e0b0
add esp, 4
test eax, eax
je 0x45de95
cmp dword [eax + 0x84], 1
jne 0x45de95
push dword [eax + 0x10]
push dword [eax + 0xc]
call fcn.0045d080
mov eax, dword [0x520970]
add esp, 8
test eax, eax
je 0x45de95
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.0045e580
mov eax, dword [0x5209a8]
test eax, eax
je 0x45dec1
push str.QueueUserAPCEx_Fini
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45deb5
call eax
push dword [0x5209a8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
ret
Function at 0x45ded0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x52096c], 0
je 0x45df99
push esi
push dword [0x520970]
call fcn.0045e0b0
mov esi, eax
add esp, 4
test esi, esi
je 0x45df8f
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.0045e620
lea eax, [ebp - 0x14]
push eax
lea eax, [esi + 0x20]
push eax
call fcn.0045d4c0
lea eax, [ebp - 0x14]
mov dword [esi + 0x18], 7
push eax
call fcn.0045d550
mov eax, dword [esi + 0x7c]
add esp, 0x14
test eax, eax
je 0x45df65
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [eax]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push esi
push eax
call fcn.0045d780
mov eax, dword [ebp - 4]
add esp, 8
or ecx, 0xffffffff
mov eax, dword [eax + 0x18]
add eax, 4
xchg dword [eax], ecx
mov eax, dword [ebp - 4]
push dword [eax + 0x14]
call edi
mov eax, dword [esi + 0x7c]
test eax, eax
jne 0x45df35
pop edi
cmp dword [esi + 0x84], 1
jne 0x45df8f
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.0045d080
mov eax, dword [0x520970]
add esp, 8
test eax, eax
je 0x45df8f
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x45dfb0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x520970]
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, eax
je 0x45dfd4
call fcn.0045cf60
mov edi, eax
mov dword [ebp - 4], edx
test edi, edi
je 0x45dfe8
jmp 0x45e006
push eax
call fcn.0045e0b0
add esp, 4
test eax, eax
jne 0x45dffd
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x45dff3
pop edi
mov eax, 2
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov dword [ebp - 4], eax
jmp 0x45e009
mov edi, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
test esi, esi
je 0x45e084
test edi, edi
je 0x45e06f
cmp dword [esi + 4], ebx
je 0x45e06f
test ecx, ecx
je 0x45e06f
lea eax, [ebp - 0x20]
push eax
lea eax, [esi + 8]
push eax
call fcn.0045d4c0
lea eax, [ebp - 0x10]
push eax
lea eax, [edi + 0x1c]
push eax
call fcn.0045d4c0
mov eax, dword [edi + 0x30]
add esp, 0x10
test eax, eax
je 0x45e04d
cmp dword [eax + 4], esi
je 0x45e08d
mov eax, dword [eax + 8]
test eax, eax
jne 0x45e041
push esi
push edi
call fcn.0045e760
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
call fcn.0045d550
lea eax, [ebp - 0x20]
push eax
call fcn.0045d550
add esp, 0x10
test ebx, ebx
jne 0x45e084
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
mov ecx, 0xb
cmove ebx, ecx
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
call fcn.0045d550
lea eax, [ebp - 0x20]
push eax
call fcn.0045d550
add esp, 8
jmp 0x45e06f
Function at 0x45e250
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [0x520970]
call fcn.0045e0b0
mov edi, dword [ebp + 8]
mov esi, eax
add esp, 4
mov dword [esi + 0x18], 6
cmp edi, 2
je 0x45e282
cmp edi, 1
je 0x45e282
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
test byte [esi + 0x94], 1
je 0x45e2b0
mov eax, edi
xor ebx, ebx
sub eax, 1
je 0x45e29e
sub eax, 1
jne 0x45e2a1
or ebx, 0xffffffff
jmp 0x45e2a1
mov ebx, dword [esi + 0x28]
call fcn.0045ded0
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
add esp, 4
push 1
call fcn.0045e230
add esp, 4
lea eax, [esi + 0x38]
push edi
push eax
call sub.VCRUNTIME140.dll_longjmp
int3

Function at 0x45e620
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x45e74f
push esi
push edi
xor eax, eax
lea esi, [ebx + 0x1c]
nop dword [eax]
inc eax
xor edi, edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
push eax
push esi
mov dword [ebp + 0xc], edi
call fcn.0045d4c0
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x34], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0045d550
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.0045d4c0
mov esi, dword [ebx + 0x34]
add esp, 0x14
test esi, esi
je 0x45e733
nop word [eax + eax]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [esi + 4]
add eax, 8
push eax
call fcn.0045d610
add esp, 8
cmp eax, 0x10
jne 0x45e6ae
lea eax, [ebp - 0x1c]
push eax
call fcn.0045d550
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x45e715
mov eax, dword [esi + 8]
mov dword [ebx + 0x34], eax
mov edi, dword [esi + 4]
mov eax, dword [edi + 4]
push dword [edi]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
push dword [edi]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, dword [ebp - 8]
test edi, edi
je 0x45e6fa
cmp dword [ebp - 4], 4
jg 0x45e6fa
lea eax, [ebp - 0x1c]
push eax
call fcn.0045d550
lea eax, [ebp - 0x2c]
push eax
call fcn.0045d550
inc dword [ebp + 0xc]
push edi
call dword [ebp - 0xc]
jmp 0x45e712
push esi
call fcn.0045e990
lea eax, [ebp - 0x1c]
push eax
call fcn.0045d550
lea eax, [ebp - 0x2c]
push eax
call fcn.0045d550
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebx + 0x1c]
push eax
call fcn.0045d4c0
mov esi, dword [ebx + 0x34]
add esp, 8
test esi, esi
jne 0x45e680
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push eax
call fcn.0045d550
mov eax, dword [ebp - 4]
lea esi, [ebx + 0x1c]
add esp, 4
test edi, edi
jne 0x45e640
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e870
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov esi, eax
add esp, 8
test esi, esi
jne 0x45e892
mov eax, dword [ebp + 8]
mov dword [eax], esi
lea eax, [esi + 0xc]
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x45e8ba
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], 0
mov eax, 0xb
pop esi
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x45e8d5
mov dword [esi + 4], ecx
xor eax, eax
mov ecx, dword [ebp + 8]
mov dword [esi + 8], 0
mov dword [ecx], esi
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor eax, eax
pop esi
pop ebp
ret