joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423520
Capabilities:
Parse pe header

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
mov bl, byte [edi]
test bl, bl
je 0x4235e6
lea ebx, [ebx]
mov cl, byte [ebp]
test cl, cl
je 0x4235e6
test esi, esi
je 0x4235ea
movsx eax, bl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x42355e
jmp dword [eax*4 + 0x42361c]
mov bl, 0x41
jmp case.default.0x42355e
mov bl, 0x42
jmp case.default.0x42355e
mov bl, 0x43
jmp case.default.0x42355e
mov bl, 0x44
jmp case.default.0x42355e
mov bl, 0x45
jmp case.default.0x42355e
mov bl, 0x46
jmp case.default.0x42355e
mov bl, 0x47
jmp case.default.0x42355e
mov bl, 0x48
jmp case.default.0x42355e
mov bl, 0x49
jmp case.default.0x42355e
mov bl, 0x4a
jmp case.default.0x42355e
mov bl, 0x4b
jmp case.default.0x42355e
mov bl, 0x4c
jmp case.default.0x42355e
mov bl, 0x4d
jmp case.default.0x42355e
mov bl, 0x4e
jmp case.default.0x42355e
mov bl, 0x4f
jmp case.default.0x42355e
mov bl, 0x50
jmp case.default.0x42355e
mov bl, 0x51
jmp case.default.0x42355e
mov bl, 0x52
jmp case.default.0x42355e
mov bl, 0x53
jmp case.default.0x42355e
mov bl, 0x54
jmp case.default.0x42355e
mov bl, 0x55
jmp case.default.0x42355e
mov bl, 0x56
jmp case.default.0x42355e
mov bl, 0x57
jmp case.default.0x42355e
mov bl, 0x58
jmp case.default.0x42355e
mov bl, 0x59
jmp case.default.0x42355e
mov bl, 0x5a
push ecx
call fcn.00423690
add esp, 4
cmp bl, al
jne 0x4235e6
mov bl, byte [edi + 1]
inc edi
dec esi
inc ebp
test bl, bl
jne 0x423540
test esi, esi
jne 0x4235f4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
movzx eax, byte [edi]
push eax
call fcn.00423690
movzx ecx, byte [ebp]
mov bl, al
push ecx
call fcn.00423690
add esp, 8
xor ecx, ecx
cmp bl, al
sete cl
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x423690
Capabilities:
Parse pe header

Disassembly:
mov cl, byte [esp + 4]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x42369f
jmp dword [eax*4 + 0x4236f8]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
mov al, cl
ret
Function at 0x423760
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, dword [esp + 0x10]
cmp esi, 1
jb 0x42380c
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
sub edi, edx
lea esp, [esp]
mov cl, byte [edx]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x42378d
jmp dword [eax*4 + 0x423810]
mov cl, 0x41
jmp case.default.0x42378d
mov cl, 0x42
jmp case.default.0x42378d
mov cl, 0x43
jmp case.default.0x42378d
mov cl, 0x44
jmp case.default.0x42378d
mov cl, 0x45
jmp case.default.0x42378d
mov cl, 0x46
jmp case.default.0x42378d
mov cl, 0x47
jmp case.default.0x42378d
mov cl, 0x48
jmp case.default.0x42378d
mov cl, 0x49
jmp case.default.0x42378d
mov cl, 0x4a
jmp case.default.0x42378d
mov cl, 0x4b
jmp case.default.0x42378d
mov cl, 0x4c
jmp case.default.0x42378d
mov cl, 0x4d
jmp case.default.0x42378d
mov cl, 0x4e
jmp case.default.0x42378d
mov cl, 0x4f
jmp case.default.0x42378d
mov cl, 0x50
jmp case.default.0x42378d
mov cl, 0x51
jmp case.default.0x42378d
mov cl, 0x52
jmp case.default.0x42378d
mov cl, 0x53
jmp case.default.0x42378d
mov cl, 0x54
jmp case.default.0x42378d
mov cl, 0x55
jmp case.default.0x42378d
mov cl, 0x56
jmp case.default.0x42378d
mov cl, 0x57
jmp case.default.0x42378d
mov cl, 0x58
jmp case.default.0x42378d
mov cl, 0x59
jmp case.default.0x42378d
mov cl, 0x5a
mov byte [edi + edx], cl
mov al, byte [edx]
inc edx
test al, al
je 0x42380b
dec esi
jne 0x423780
pop edi
pop esi
ret
Function at 0x429270
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push dword [esp + 0x108]
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x4292b9
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4292b9
lea eax, [esp]
push eax
call dword [0x43c7b4]
add esp, 4
add esp, 0x104
ret
xor eax, eax
add esp, 0x104
ret
Function at 0x42e100
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
mov dword [esp + 4], ebp
mov dword [eax], ebp
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.DLL_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x42e293
push ebx
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x42e27d
push esi
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x42e14f
lea ebx, [eax + 0xe]
jmp 0x42e15b
cmp eax, 0x17
jne 0x42e20a
lea ebx, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x42e20a
mov eax, dword [edi + 0x10]
test eax, eax
je 0x42e20a
cmp eax, ebx
jb 0x42e20a
push 0x20
call dword [0x43c7a8]
mov esi, eax
add esp, 4
test esi, esi
je 0x42e272
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x43c7a8]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x42e261
push ebx
push dword [edi + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x42e1f5
push eax
call dword [0x43c7b4]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x42e247
test ebp, ebp
jne 0x42e1fb
mov ebp, esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42e206
mov dword [eax + 0x1c], esi
mov dword [esp + 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x42e142
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop esi
test eax, eax
je 0x42e229
push eax
call dword [sym.imp.WS2_32.DLL_freeaddrinfo]
test ebx, ebx
je 0x42e279
push ebp
call fcn.0042e0c0
mov eax, dword [esp + 0x2c]
add esp, 4
xor ebp, ebp
mov dword [eax], ebp
mov eax, ebx
pop edi
pop ebx
pop ebp
add esp, 0xc
ret
push dword [esi + 0x18]
mov ebx, 8
call dword [0x43c7ac]
push esi
call dword [0x43c7ac]
add esp, 8
jmp 0x42e219
push esi
mov ebx, 8
call dword [0x43c7ac]
add esp, 4
jmp 0x42e219
mov ebx, 8
jmp 0x42e219
test ebp, ebp
jne 0x42e289
mov ebx, 0x2af9
push ebx
call dword [sym.imp.WSOCK32.DLL_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], ebp
mov eax, ebx
pop ebx
pop ebp
add esp, 0xc
ret

Function at 0x42e6e0
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x264], 2
je fcn.0042e690
mov al, 1
ret
Function at 0x43412b
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov edi, ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov esi, 0x43e318
cmp dword [0x43e314], edi
jne 0x43415a
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x43e314], 1
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x43e310]
test esi, esi
je 0x4341b5
test edi, edi
jne 0x4342fc
xor eax, eax
lea ecx, [esi + 0x114]
inc eax
cmp ebx, dword [ecx]
je 0x43418b
inc eax
add ecx, 4
cmp eax, 0x40
jl 0x43417c
jmp 0x4341a7
push dword [esp + 0x1c]
add eax, 0x84
push dword [esp + 0x1c]
lea eax, [esi + eax*4]
push eax
call fcn.004340d4
xor edi, edi
add esp, 0xc
inc edi
mov esi, dword [esi]
test esi, esi
jne 0x43416b
test edi, edi
jne 0x4342fc
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x10]
push ebp
push ebp
push 0x100000
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x4342fc
mov esi, dword [0x43e310]
jmp 0x4341f6
cmp dword [esi + 0xc], 0x3f
jl 0x434297
mov esi, dword [esi]
test esi, esi
jne 0x4341ea
push 0x310
push 8
push dword [0x43e01c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x4342f6
push ebp
push 1
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi + 8], eax
test eax, eax
je 0x4342e8
push ebp
push ebp
push esi
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x1c]
push 0x43430f
mov dword [esi + 0x114], ebx
lea ebx, [esi + 0x214]
push 0x1000
mov dword [esi + 0x14], eax
mov dword [ebx], ebp
push ebp
mov dword [esi + 0xc], 2
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4342e3
push eax
call edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebx
call fcn.004340d4
mov eax, dword [0x43e310]
add esp, 0xc
mov dword [esi + 4], ebp
mov dword [esi], eax
test eax, eax
je 0x43428f
mov dword [eax + 4], esi
mov dword [0x43e310], esi
jmp 0x4342fc
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0x10]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
mov dword [esi + ecx*4 + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x110], ebx
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x210], ebp
mov eax, dword [esi + 0xc]
add eax, 0x84
lea eax, [esi + eax*4]
push eax
call fcn.004340d4
add esp, 0xc
inc dword [esi + 0xc]
push ebp
push 1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x4342fc
push dword [esi + 8]
call edi
push esi
push ebp
push dword [0x43e01c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x10]
call edi
push 0x43e318
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ed0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x76d5648
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x42814030
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x441ced
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x441d1b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x441d39
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00441c57
jmp 0x441d39
mov eax, dword [esi + 0x14]
test eax, eax
je 0x441d39
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00441c57
test edi, edi
mov eax, edi
jne 0x441d23
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x56c4b4]
test ecx, ecx
je 0x441dec
jmp 0x441cec
ret 8

Function at 0x10171986
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shr dh, cl
xadd ah, dh
neg al
shr al, cl
add cl, cl
jmp 0x10165e8e
push 0xf4378d87
lea esp, [esp + 0x38]
je 0x1016353f
bswap eax
lea eax, [ebx + edx*4]
pushfd
pushal
pushfd
lea esp, [esp + 0x28]
call fcn.10163b5a
pushfd
call fcn.10169588
xor dh, dl
push dword [esp]
stc
test dh, 1
push dword [esp + 8]
push eax
mov dh, 0
pushal
jmp 0x1016ee73
Function at 0x4161c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004212b0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004212b0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x416220
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x45806c]
test esi, esi
jle 0x416340
mov eax, dword [0x458070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x416254
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4162d7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x416240
mov dword [esp], ebx
call fcn.00416c10
mov edi, eax
test eax, eax
je 0x416367
mov eax, dword [0x458070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00416d50
mov edx, dword [0x458070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x416347
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x4162d0
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x4162e0
add dword [0x45806c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x458070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4162d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004161c0
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x41625e
mov eax, dword [0x458070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004161c0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004161c0
lea esi, cs:[esi]
nop
Function at 0x416880
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x458088
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x458080]
sub esp, 4
test ebx, ebx
je 0x4168d5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x4168ce
test eax, eax
jne 0x4168ce
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4168b0
mov dword [esp], 0x458088
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x416c10
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x416c35
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x416c40
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x416c35
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x416c88
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x416c7e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x416c8a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x416c70
xor eax, eax
pop ebx
pop esi
ret
Function at 0x41bd20
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x2d
mov dword [esp + 4], str._buffer_overflow_detected_:_terminated_n
mov dword [esp], 2
call sub.msvcrt.dll__write
mov dword [esp], 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
sub esp, 4
test eax, eax
je 0x41bd59
mov ecx, 8
int 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], 0xc0000409
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x41bd80
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x2c
mov dword [esp + 4], str._stack_smashing_detected_:_terminated_n
mov dword [esp], 2
call sub.msvcrt.dll__write
mov dword [esp], 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
sub esp, 4
test eax, eax
je 0x41bdb9
mov ecx, 2
int 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], 0xc0000409
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x422440
Capabilities:
Print debug messages

Disassembly:
push edi
pxor xmm0, xmm0
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push ebx
lea ebx, [ebp - 0x41]
sub esp, 0x50
movups xmmword [ebp - 0x21], xmm0
mov eax, dword [0x4580ec]
mov dword [ebp - 0xc], eax
xor eax, eax
movups xmmword [ebp - 0x41], xmm0
movups xmmword [ebp - 0x31], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x35
mov dword [esp], ebx
call fcn.00427d80
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sub.msvcrt.dll_abort
lea esi, cs:[esi]
lea esi, [esi]

Function at 0x422830
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x458af4], 1
je 0x4228e8
push edi
mov eax, 0x458af4
push esi
push ebx
sub esp, 0x10
call fcn.00422220
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call fcn.00421b10
mov edi, dword [0x458af4]
test edi, edi
jne 0x4228a0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x43e064], eax
cmp eax, 0xffffffff
je 0x43cf05
mov dword [0x458af4], 1
mov dword [esp], esi
call fcn.00421e40
test ebx, ebx
je 0x4228da
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
jmp fcn.004224c0
cmp edi, 1
je 0x422882
mov dword [esp], 2
call dword [0x43e04c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x458af4
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], esi
call fcn.00421e40
test ebx, ebx
jne 0x42288e
add esp, 0x10
pop ebx
pop esi
pop edi
ret
ret
call sub.msvcrt.dll_abort
call sub.msvcrt.dll_abort
mov eax, dword [0x14]
ud2

Function at 0x422a20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.00422830
mov eax, dword [0x43e064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x422a48
add esp, 0x1c
ret
add esp, 0x1c
jmp fcn.004228f0
Function at 0x422d10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x422d38
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x422e30
add esp, 0x14
pop ebx
pop esi
ret 0xc
cmp eax, 1
je 0x422e00
cmp eax, 3
jne 0x422d29
mov eax, dword [0x43e064]
cmp eax, 0xffffffff
je 0x422d29
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x422d29
test byte [eax + 0x20], 0x30
je 0x422e60
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x422d7b
call fcn.00422a50
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x422dad
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x422d9f
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.00421fe0
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.00426280
cmp eax, 1
je 0x422f2e
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x422f22
mov eax, dword [0x43e064]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x422d29
mov eax, dword [0x458acc]
test eax, eax
je 0x422e4c
mov dword [esp + 4], 0x422190
mov dword [esp], 1
call eax
mov dword [0x458ad0], eax
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [0x458ad0]
test eax, eax
je 0x422d29
mov edx, dword [0x458ac8]
test edx, edx
je 0x422e4c
mov dword [esp], eax
call edx
mov dword [0x458ad0], 0
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x422ed4
test eax, eax
je 0x422e7a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x422e97
call fcn.00422a50
test byte [ebx + 0x24], 4
je 0x422f12
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x422dad
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x14], 0
sub esp, 4
mov dword [esp], eax
call fcn.00421fe0
lea eax, [ebx + 0x38]
jmp 0x422dbb
test eax, eax
je 0x422f12
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
sub esp, 4
mov dword [esp], eax
call fcn.00421fe0
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.00426280
cmp eax, 1
je 0x422f2e
mov dword [ebx + 0x38], 0xffffffff
jmp 0x422d29
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.00421fe0
lea eax, [ebx + 0x38]
jmp 0x422ef9
mov eax, ebx
call fcn.00422670
jmp 0x422de1
call fcn.00422440
lea esi, cs:[esi]
lea esi, cs:[esi]