joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x53806c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x407d27
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x407d2e
mov al, 1
jmp 0x407e02
call fcn.00401920
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x40], eax
call fcn.00401920
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.004018a0
add esp, 8
movzx eax, al
test eax, eax
je 0x407d6a
xor al, al
jmp 0x407e02
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x38]
call fcn.00408610
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x407da6
cmp dword [ebp - 0x34], 1
je 0x407dad
cmp dword [ebp - 0x34], 3
je 0x407dfc
jmp 0x407e00
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x38], ecx
je 0x407ddc
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.004df6e1
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x407ddc
xor al, al
jmp 0x407e02
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x407df0
mov dword [ebp - 0x3c], 1
jmp 0x407df7
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x407e02
mov al, 1
jmp 0x407e02
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9f48
mov esp, ebp
pop ebp
ret
Function at 0x415ac0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x53806c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x4c], ecx
push 0x3c
push 0
lea eax, [ebp - 0x40]
push eax
call fcn.004d66a0
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x440
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0x5193a0
lea ecx, [ebp + 8]
call fcn.0040e230
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x40]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x415b43
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x41], 1
lea ecx, [ebp + 8]
call fcn.0040e2f0
mov al, byte [ebp - 0x41]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9f48
mov esp, ebp
pop ebp
ret 0x18
Function at 0x417d80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
xor eax, eax
je 0x417eab
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x417db3
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00419270
jmp 0x417ebf
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.004081a0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x417e59
jg 0x417ddf
cmp dword [ebp + 0xc], 0
jbe 0x417e59
cmp dword [ebp - 8], 0
jl 0x417e59
jg 0x417ded
cmp dword [ebp - 0xc], 0
jbe 0x417e59
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x417e0b
jl 0x417dff
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x417e0b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.004083a0
push eax
call fcn.00410c90
add esp, 0xc
push 0
push 2
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.004baa40
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
sbb ecx, dword [ebp - 8]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.0041b740
cmp dword [ebp + 0x10], 0
jl 0x417e9b
jg 0x417e67
cmp dword [ebp + 0xc], 0
jbe 0x417e9b
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x417e9b
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 2
mov ecx, dword [ebp + 8]
push ecx
call fcn.004df6e1
add esp, 0x10
xor edx, edx
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov eax, dword [ebp + 0x10]
sbb eax, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x417ebf
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00419270
mov esp, ebp
pop ebp
ret 0xc
Function at 0x417ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
xor eax, eax
je 0x418003
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x417f03
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.004193a0
jmp 0x418017
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.00408260
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x417fa9
jg 0x417f2f
cmp dword [ebp + 0xc], 0
jbe 0x417fa9
cmp dword [ebp - 8], 0
jl 0x417fa9
jg 0x417f3d
cmp dword [ebp - 0xc], 0
jbe 0x417fa9
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x417f5b
jl 0x417f4f
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x417f5b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.004083c0
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00410c90
add esp, 0xc
push 0
push 2
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.004baa40
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
sbb ecx, dword [ebp - 8]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.0041b870
cmp dword [ebp + 0x10], 0
jl 0x417ff3
jg 0x417fb7
cmp dword [ebp + 0xc], 0
jbe 0x417ff3
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x417ff3
mov ecx, dword [ebp - 4]
call fcn.0041ae10
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 2
mov ecx, dword [ebp + 8]
push ecx
call fcn.004dfce6
add esp, 0x10
xor edx, edx
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov eax, dword [ebp + 0x10]
sbb eax, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x418017
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.004193a0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4184b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x53806c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x38], ecx
call fcn.0041b9a0
mov word [ebp - 0x3e], ax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x3e]
push ecx
call fcn.0041ba10
add esp, 8
movzx edx, al
test edx, edx
je 0x4184f5
lea eax, [ebp + 8]
push eax
call fcn.0041b9b0
add esp, 4
jmp 0x418686
mov ecx, dword [ebp - 0x38]
call fcn.004083a0
test eax, eax
je 0x41853a
mov ecx, dword [ebp - 0x38]
call fcn.004083a0
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.0041b810
cmp esi, eax
jae 0x41853a
lea ecx, [ebp + 8]
push ecx
call fcn.004186a0
add esp, 4
mov si, ax
mov ecx, dword [ebp - 0x38]
call fcn.0041b6b0
mov word [eax], si
mov ax, word [ebp + 8]
jmp 0x418686
mov edx, dword [ebp - 0x38]
cmp dword [edx + 0x4c], 0
jne 0x41854d
call fcn.0041b9a0
jmp 0x418686
mov ecx, dword [ebp - 0x38]
call fcn.0041ae10
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x38], 0
jne 0x4185a0
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x4c]
push edx
lea eax, [ebp + 8]
push eax
call fcn.004186a0
add esp, 4
movzx ecx, ax
push ecx
call fcn.00413ef0
add esp, 8
movzx edx, al
test edx, edx
je 0x41858e
mov ax, word [ebp + 8]
mov word [ebp - 0x3a], ax
jmp 0x418597
call fcn.0041b9a0
mov word [ebp - 0x3a], ax
mov ax, word [ebp - 0x3a]
jmp 0x418686
mov dword [ebp - 0x4c], 0x20
lea ecx, [ebp + 8]
push ecx
call fcn.004186a0
add esp, 4
mov word [ebp - 0x2c], ax
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x2a]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x38]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x38]
call fcn.00406d70
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x418681
cmp dword [ebp - 0x44], 1
jle 0x4185ff
cmp dword [ebp - 0x44], 3
je 0x41864d
jmp 0x418681
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x48], ecx
je 0x418631
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x48]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.004df6e1
add esp, 0x10
cmp dword [ebp - 0x48], eax
je 0x418631
call fcn.0041b9a0
jmp 0x418686
mov ecx, dword [ebp - 0x38]
mov byte [ecx + 0x3e], 1
lea edx, [ebp - 0x2c]
cmp dword [ebp - 0x34], edx
je 0x418646
mov ax, word [ebp + 8]
jmp 0x418686
call fcn.0041b9a0
jmp 0x418686
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, word [ebp - 0x2c]
push edx
call fcn.00413ef0
add esp, 8
movzx eax, al
test eax, eax
je 0x418672
mov cx, word [ebp + 8]
mov word [ebp - 0x3c], cx
jmp 0x41867b
call fcn.0041b9a0
mov word [ebp - 0x3c], ax
mov ax, word [ebp - 0x3c]
jmp 0x418686
call fcn.0041b9a0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9f48
mov esp, ebp
pop ebp
ret 4
Function at 0x41aea0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x53806c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x41aec7
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3e]
test edx, edx
jne 0x41aece
mov al, 1
jmp 0x41afa7
call fcn.0041b9a0
movzx eax, ax
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
mov word [ebp - 0x32], ax
call fcn.0041b9a0
mov word [ebp - 0x34], ax
lea ecx, [ebp - 0x32]
push ecx
lea edx, [ebp - 0x34]
push edx
call fcn.0041ba10
add esp, 8
movzx eax, al
test eax, eax
je 0x41af0f
xor al, al
jmp 0x41afa7
mov dword [ebp - 0x44], 0x20
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x38]
call fcn.00408610
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x41af4b
cmp dword [ebp - 0x38], 1
je 0x41af52
cmp dword [ebp - 0x38], 3
je 0x41afa1
jmp 0x41afa5
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x3e], 0
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x3c], ecx
je 0x41af81
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.004df6e1
add esp, 0x10
cmp dword [ebp - 0x3c], eax
je 0x41af81
xor al, al
jmp 0x41afa7
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3e]
test edx, edx
jne 0x41af95
mov dword [ebp - 0x40], 1
jmp 0x41af9c
mov dword [ebp - 0x40], 0
mov al, byte [ebp - 0x40]
jmp 0x41afa7
mov al, 1
jmp 0x41afa7
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9f48
mov esp, ebp
pop ebp
ret

Function at 0x426c50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x10325476
pop ebp
ret
Function at 0x430470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x53806c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
jne 0x43049e
push 0
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0042e600
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x4305aa
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.004303c0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4304d8
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042e600
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x4305aa
mov dword [ebp - 0x18], 1
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x18]
push edx
call dword [0x538aa0]
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x430510
push 0
push 3
mov eax, dword [ebp + 8]
push eax
call fcn.0042e600
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x4305aa
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
push 1
mov eax, dword [ebp - 0xc]
push eax
call fcn.004dfce6
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 8]
je 0x430553
mov edx, dword [ebp - 0xc]
push edx
call dword [0x538aa4]
add esp, 4
push 0
push 2
mov eax, dword [ebp + 8]
push eax
call fcn.0042e600
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x4305aa
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x18]
push eax
call fcn.0042d870
add esp, 0xc
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x1c]
push ecx
push 1
push 1
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00430450
add esp, 0xc
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00430290
add esp, 0x28
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9f48
mov esp, ebp
pop ebp
ret
Function at 0x434ad0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff55a
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x53806c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x10], 0
je 0x434b1e
lea ecx, [esi + 0x48]
mov dword [esi + 0x10], 0x51d258
call fcn.00428980
mov dword [ebp - 0x10], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x10]
mov dword [esi], vtable.nbase::FrameworkThread.1.0
mov eax, dword [eax + 4]
mov dword [eax + esi + 0x10], vtable.nbase::FrameworkThread.0
mov word [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x2c], eax
push dword [ebp + 8]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00405640
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x434be0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff580
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x53806c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], vtable.nbase::FrameworkThread.1.0
mov eax, dword [eax + 4]
mov dword [eax + esi + 0x10], vtable.nbase::FrameworkThread.0
cmp byte [esi + 0x14], 0
je 0x434d25
cmp byte [esi + 0x15], 0
jne 0x434ce8
cmp dword [esi + 0x1c], 0
je 0x434ce8
sub esp, 0xc
mov dword [ebp - 0x48], 0x434dd0
mov eax, esp
mov dword [ebp - 0x44], 0
movq xmm0, qword [ebp - 0x48]
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x54]
mov byte [esi + 0x15], 1
mov dword [ebp - 0x3c], esi
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00435450
lea eax, [ebp - 0x38]
mov dword [ebp - 0x14], 0
push eax
push 0x20
call fcn.004015c0
add esp, 0x14
lea ecx, [ebp - 0x54]
push ecx
mov ecx, eax
call fcn.004357b0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x50]
test ecx, ecx
je 0x434caf
call fcn.004120f0
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 0x1c]
push eax
call fcn.004377a0
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x434ce8
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x14], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x434d1f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x434d0c
mov eax, dword [esi + 8]
test eax, eax
je 0x434d1f
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call edi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov word [esi + 0x14], 0
lea ecx, [esi + 0x30]
call fcn.004054e0
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x434d37
push eax
call edi
mov dword [ebp - 4], 2
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x434d4a
call fcn.004120c0
mov eax, dword [esi + 8]
mov dword [esi], vtable.nbase::Thread.0
test eax, eax
je 0x434d87
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x434d74
mov eax, dword [esi + 8]
test eax, eax
je 0x434d87
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call edi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b9f48
mov esp, ebp
pop ebp
ret
Function at 0x435230
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x53ecb0]
cmp eax, 2
je 0x4352c0
push esi
push 0
push 1
push 0x53ecb0
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x43529c
push 4
call fcn.004ba211
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
mov edx, 0x53ecb0
mov ecx, 0x435380
mov dword [0x53ecb4], esi
call fcn.00439730
mov eax, dword [0x53ecb4]
mov dword [0x53ecb0], 2
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 2
je 0x4352bf
mov eax, dword [0x53ecb0]
cmp eax, 2
je 0x4352bf
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call esi
mov eax, dword [0x53ecb0]
cmp eax, 2
jne 0x4352b1
pop esi
mov eax, dword [0x53ecb4]
mov esp, ebp
pop ebp
ret

Function at 0x435930
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff6f8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x53806c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.00435870
test edi, edi
js 0x4359d9
call fcn.00435230
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x4359d9
call fcn.00435870
mov esi, eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [ebx]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
call fcn.00435870
mov edi, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [edi + 0x18]
call fcn.004360d0
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x24]
push eax
lea ecx, [edi + 0x18]
call fcn.00436110
cmp byte [ebp - 0x20], 0
jne 0x4359ed
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x14]
cmp eax, dword [ebx]
je 0x4359ed
test esi, esi
je 0x4359d9
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc dword [ebx + 8]
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0xc], eax
test esi, esi
je 0x435a01
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435a20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff728
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x53806c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00435870
call fcn.00435230
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x435afb
mov ecx, dword [edi + 8]
cmp ecx, 1
jl 0x435afb
add ecx, 0xffffffff
mov dword [edi + 8], ecx
jne 0x435ae7
call fcn.00435870
mov esi, eax
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebx, [edi + 0xc]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00435870
lea ecx, [eax + 0x18]
call fcn.00435b30
call fcn.00435870
mov ecx, dword [eax + 0x18]
add eax, 0x18
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x10]
push eax
call fcn.00401940
mov edi, dword [ebp - 0x14]
cmp edi, dword [ebp - 0x10]
je 0x435ad6
call fcn.00435870
push edi
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [eax + 0x18]
call fcn.00435bd0
mov dword [ebx], 0xffffffff
test esi, esi
je 0x435ae7
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret