joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c969cb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x1d01324]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov edi, 0x7fffffff
cmp eax, edi
cmovb edi, eax
lea eax, [ebp - 0x14]
mov dword [eax], 0xffffffff
push 0
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c96a6e
xor eax, eax
dec eax
mov dword [ebp - 0x18], eax
push str.bytes_read___static_cast_DWORD___1_
push eax
push dword [ebp - 0x14]
lea ebx, [ebp - 0x18]
push ebx
call fcn.01c9698b
add esp, 0x10
cmp dword [ebp - 0x18], 0
je 0x1c96a4d
push ebx
push 0x7e
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea ebx, [ebp - 0x1c]
push ebx
call fcn.01c4ce10
add esp, 0x10
mov ecx, ebx
call fcn.01c4cde0
mov ecx, ebx
call fcn.01c4cdf0
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x1c96a83
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x1c96a80
mov dword [ebp - 0x14], 0xffffffff
push 0
lea eax, [ebp - 0x14]
jmp 0x1c969fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x1c96a83
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c97043
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xb0
mov esi, dword [ebp + 8]
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.01c96f52
add esp, 0x10
or edx, eax
jne 0x1c970c6
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
jne 0x1c970c6
push 2
call fcn.01c60df0
add esp, 4
test al, al
je 0x1c970c4
call fcn.01c618c0
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0xf4
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
call fcn.01c61a60
lea eax, [ebp - 0xb0]
push 0xc
push 0x1cf0a14
push eax
call fcn.01c23924
add esp, 0xc
mov ecx, esi
call fcn.01c61b10
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01cb3141
mov eax, ebx
add esp, 0xb0
pop esi
pop ebx
pop ebp
ret

Function at 0x1c9716c
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.01c95ac7
Function at 0x1ca6230
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x1d01324]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
jne 0x1ca6304
mov dword [ebp - 0x14], 0x1ca6320
lea eax, [ebp - 0x14]
push 0
push eax
push 0x1ca6210
push 0x1d16210
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1ca6318
cmp dword [0x1d16214], 0
jne 0x1ca6304
push dword [0x1d16218]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1ca6304
mov esi, eax
push 0x1d1621c
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov ebx, dword [0x1d16220]
mov edi, dword [0x1d16224]
mov eax, dword [0x1d16228]
mov dword [ebp - 0x18], eax
mov eax, dword [0x1d1622c]
mov dword [ebp - 0x1c], eax
push 0x1d1621c
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test ebx, ebx
je 0x1ca62d1
push dword [esi]
call ebx
add esp, 4
test edi, edi
je 0x1ca62dd
push dword [esi + 4]
call edi
add esp, 4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1ca62ec
push dword [esi + 8]
call eax
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1ca62fb
push dword [esi + 0xc]
call eax
add esp, 4
push esi
call fcn.01ca5730
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
call fcn.01cc6b80
int3
Function at 0x1cb26bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1cb26ee
movzx edx, word [ebp + 8]
mov dword [ecx], 0
xor eax, eax
test dl, 1
jne 0x1cb26fb
xor ebx, ebx
movzx edx, dx
shr edx, 1
inc ebx
mov esi, edx
test dl, 1
je 0x1cb26df
jmp 0x1cb2700
xor eax, eax
inc eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
jmp 0x1cb2833
movzx esi, dx
xor ebx, ebx
mov dword [ebp - 0x18], edx
test esi, esi
je 0x1cb2710
bsr eax, esi
xor eax, 0xffffffe0
add eax, 0x21
mov dword [ebp - 0x1c], esi
mov edx, eax
imul edx, edi
cmp edx, 0xde3
jg 0x1cb283d
xor esi, esi
inc esi
mov edx, esi
add esi, esi
cmp edx, edi
jle 0x1cb2727
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ecx
sar edx, 2
mov cl, 0x40
sub cl, al
xor eax, eax
dec eax
mov edi, eax
shl edi, cl
xor esi, esi
test cl, 0x20
cmovne eax, edi
mov dword [ebp - 0x28], eax
cmovne edi, esi
mov dword [ebp - 0x24], edi
test edx, edx
je 0x1cb27b4
movzx edi, word [ebp - 0x18]
mov dword [ebp - 0x10], 0
xor ebx, ebx
mov esi, edx
mov ecx, ebx
mov eax, edi
mul edi
imul ecx, edi
mov ebx, edx
add ebx, ecx
add ebx, ecx
mov edi, eax
test dword [ebp + 0xc], esi
je 0x1cb27aa
mov eax, edi
and eax, dword [ebp - 0x24]
mov ecx, ebx
and ecx, dword [ebp - 0x28]
or ecx, eax
movzx eax, word [ebp - 0x18]
mov edx, 1
cmovne eax, edx
mov ecx, dword [ebp - 0x10]
movzx ecx, cl
cmovne ecx, edx
mov dword [ebp - 0x10], ecx
imul ebx, eax
mul edi
add ebx, edx
mov edi, eax
sar esi, 1
je 0x1cb27c1
test ebx, ebx
je 0x1cb2767
jmp 0x1cb27c1
movzx edi, word [ebp - 0x18]
xor ebx, ebx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
mov eax, edi
or eax, ebx
je 0x1cb27f2
xor eax, eax
mov edx, dword [ebp - 0x14]
mov ecx, ebx
shld ecx, edi, 4
and edi, 0xfffffff
mov dword [edx + eax*4 + 4], edi
shr ebx, 0x1c
inc eax
mov edi, ecx
or ecx, ebx
jne 0x1cb27d5
mov word [edx], ax
test byte [ebp - 0x10], 1
mov edi, dword [ebp - 0x14]
je 0x1cb2805
mov ecx, edi
push dword [ebp - 0x1c]
call fcn.01cb236c
test esi, esi
mov ebx, dword [ebp + 0xc]
je 0x1cb2825
mov ecx, edi
call fcn.01cb2508
test esi, ebx
je 0x1cb2821
mov ecx, edi
push dword [ebp - 0x1c]
call fcn.01cb236c
sar esi, 1
jne 0x1cb280c
mov eax, dword [ebp - 0x20]
imul eax, ebx
mov ecx, edi
push eax
call fcn.01cb22c2
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.01c8867c
Function at 0x1cb2cd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x1cb2d49
mov ecx, dword [ebp + 0xc]
cmp ebx, 1
jne 0x1cb2cec
xor esi, esi
jmp 0x1cb2d2e
and ebx, 0xfffffffe
xor esi, esi
nop word cs:[eax + eax]
nop dword [eax + eax]
movzx edi, al
movzx edx, byte [ecx + esi]
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x1cf1770]
movzx edx, al
movzx edi, byte [ecx + esi + 1]
xor edi, edx
shr eax, 8
xor eax, dword [edi*4 + 0x1cf1770]
add esi, 2
cmp ebx, esi
jne 0x1cb2d00
mov edx, dword [ebp + 0x10]
test dl, 1
je 0x1cb2d49
movzx edx, al
movzx ecx, byte [ecx + esi]
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x1cf1770]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1cd6f11
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01cd715a

Function at 0x1cda1d5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01cda1e0
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x409660
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7000]
push edi
jmp 0x40967a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x409681
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x409670
mov eax, 1
add ebx, ebx
jne 0x409693
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x409688
jne 0x4096a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x409688
xor ecx, ecx
sub eax, 3
jb 0x4096b8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40972a
mov ebp, eax
add ebx, ebx
jne 0x4096c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4096d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4096f4
inc ecx
add ebx, ebx
jne 0x4096e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4096d5
jne 0x4096f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4096d5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x409714
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x409705
jmp 0x409676
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x409714
add edi, ecx
jmp 0x409676
pop esi
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x40977c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbb24]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbb90]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x409731
mov ecx, edi
jns 0x409760
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbb98]
or eax, eax
je 0x409776
mov dword [ebx], eax
add ebx, 4
jmp 0x40974e
call dword [esi + 0xbb94]
mov ebp, dword [esi + 0xbb9c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4097b0
sub esp, 0xffffff80
jmp 0x4017e0
Function at 0x405d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
xor esi, esi
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea edi, [esi + eax]
jne 0x405d90
cmp esi, edi
ja 0x405dfb
cmp edi, dword [ebp + 0x10]
ja 0x405e09
add esi, dword [ebp + 0xc]
nop word [eax + eax]
test eax, eax
je 0x405d92
dec eax
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x405d80
jmp 0x405def
ja 0x405d99
cmp edx, dword [ebp - 0x10]
mov esi, edi
jne 0x405d55
mov edi, dword [ebp + 0x18]
movzx ecx, cx
mov al, 1
add edi, ebx
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebx]
lea esi, [ebx + 1]
test dl, dl
js 0x405dd0
mov ebx, esi
sub ecx, edx
jns 0x405de7
jmp 0x405df1
cmp esi, edi
je 0x405e18
movzx esi, byte [ebx + 1]
and edx, 0x7f
add ebx, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x405df1
xor al, 1
cmp ebx, edi
jne 0x405db0
jmp 0x405df1
xor eax, eax
and al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x499374
call fcn.00404b20
mov edx, dword [ebp + 0x10]
mov ecx, edi
push 0x499374
call fcn.00403ab0
mov ecx, 0x499364
call fcn.00404b80
nop word cs:[eax + eax]
nop dword [eax]

Function at 0x40f3b0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x40f41e
mov eax, dword [entry1]
lea ebx, [esi + 0xc]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push 0
push ebx
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
mov dword [ebp - 0x30], eax
jne 0x40f454
cmp dword [ebp - 0x14], 0
je 0x40f43b
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40f466
mov edi, eax
mov eax, dword [0x4a50cc]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x4a50cc], esi
jne 0x40f400
mov eax, edi
inc eax
mov dword [esi], eax
push 0
push 0
push ebx
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x40f44a
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x40f4a0
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x40f43f
mov edi, dword [ebp - 0x10]
jmp 0x40f44a
mov edi, dword [esi]
jmp 0x40f449
mov edi, eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
call fcn.004102a0
push 0
push 4
push ebx
call sub.KERNEL32.dll_InitOnceComplete
lea ecx, [ebp - 0x2c]
mov edx, 0x49cda8
mov dword [ebp - 0x2c], 0x49cd6c
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 0
call fcn.00403350
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x49cd6c
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.004102e0
nop
Function at 0x40fca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov edi, edx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x103
lea edx, [ebp - 0x18]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x40fcf0
push 0xffffffffffffffff
push edi
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x18]
cmp eax, 0x103
je 0x40fd10
test eax, eax
js 0x40fcfb
mov eax, dword [ebp - 0x14]
mov bl, 4
jmp 0x40fd03
xor ebx, ebx
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov dword [esi + 4], eax
mov byte [esi], bl
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x10]
mov dword [ebp - 0x38], 0x49c808
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x1c], 0
lea ecx, [ebp - 0x20]
lea esi, [ebp - 0x40]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x2c], 0
push eax
push ecx
push esi
call fcn.0040f530
add esp, 0xc
mov ecx, esi
call fcn.0040f640
mov ecx, 7
int 0x29
ud2
Function at 0x410360
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x410377
test eax, eax
jne 0x4104de
mov al, 1
mov dword [ebp - 0x10], eax
mov esi, dword [0x4a50cc]
nop word cs:[eax + eax]
nop dword [eax]
test esi, esi
je 0x4103cc
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x410521
mov esi, dword [esi + 8]
test ebx, ebx
je 0x410390
dec ebx
push ebx
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x410390
push 0
push ebx
mov ebx, eax
call sub.KERNEL32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x410390
test byte [ebp - 0x10], 1
jne 0x4104de
mov al, 1
mov dword [ebp - 0x10], eax
mov esi, dword [0x4a50cc]
nop word cs:[eax + eax]
nop dword [eax + eax]
test esi, esi
je 0x41042c
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x410521
mov esi, dword [esi + 8]
test ebx, ebx
je 0x4103f0
dec ebx
push ebx
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x4103f0
push 0
push ebx
mov ebx, eax
call sub.KERNEL32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x4103f0
test byte [ebp - 0x10], 1
jne 0x4104de
mov al, 1
mov dword [ebp - 0x10], eax
mov esi, dword [0x4a50cc]
nop word cs:[eax + eax]
nop dword [eax + eax]
test esi, esi
je 0x41048c
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x410521
mov esi, dword [esi + 8]
test ebx, ebx
je 0x410450
dec ebx
push ebx
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x410450
push 0
push ebx
mov ebx, eax
call sub.KERNEL32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x410450
test byte [ebp - 0x10], 1
jne 0x4104de
mov al, 1
mov dword [ebp - 0x10], eax
mov esi, dword [0x4a50cc]
nop dword [eax]
test esi, esi
je 0x4104d8
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x410521
mov esi, dword [esi + 8]
test ebx, ebx
je 0x4104a0
dec ebx
push ebx
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x4104a0
push 0
push ebx
mov ebx, eax
call sub.KERNEL32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x4104a0
test byte [ebp - 0x10], 1
je 0x4104e8
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov edi, dword [0x4a50cc]
nop
test edi, edi
je 0x4104de
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x410521
mov edi, dword [edi + 8]
test esi, esi
je 0x4104f0
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x4104f0
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
jmp 0x4104f0
mov ecx, 0x49cddc
call fcn.00404b80
ud2
Function at 0x410b50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
xchg dword [ecx], edx
mov eax, edx
and eax, 3
cmp eax, 2
mov dword [ebp - 0x10], eax
jne 0x410bd6
add edx, 0xfffffffe
je 0x410bc4
mov edi, dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
jmp 0x410b86
test ebx, ebx
mov edx, ebx
je 0x410bc4
mov esi, dword [edx]
mov ebx, dword [edx + 4]
mov dword [edx], 0
test esi, esi
je 0x410bcc
mov byte [edx + 8], 1
mov al, 1
xchg byte [esi + 0x1c], al
cmp al, 0xff
je 0x410bb0
lock dec dword [esi]
jne 0x410b80
jmp 0x410bbb
lea eax, [esi + 0x1c]
push eax
call edi
lock dec dword [esi]
jne 0x410b80
mov ecx, esi
call fcn.004105c0
jmp 0x410b80
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x49cff0
call fcn.00404b80
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x10]
mov edx, 0x49d000
push 0x49d004
push eax
call fcn.00410130
nop word cs:[eax + eax]
nop dword [eax]

Function at 0x410c00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x447058]
test eax, eax
je 0x410ca5
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x410c24
add eax, 4
jmp 0x410ca0
je 0x410c9e
movzx eax, byte [0x4a5058]
mov ecx, 8
call fcn.0043cf80
test eax, eax
je 0x410ccc
mov dword [eax], 0x447058
mov dword [eax + 4], 0
mov edi, eax
mov ebx, eax
mov eax, dword [0x447058]
test eax, eax
je 0x410cb4
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
mov esi, eax
mov eax, dword [0x447058]
test eax, eax
je 0x410cc0
dec eax
add edi, 4
push ebx
push eax
call sub.KERNEL32.dll_TlsSetValue
test esi, esi
je 0x410c9a
mov eax, dword [esi + 4]
test eax, eax
je 0x410c8e
lock dec dword [eax]
jne 0x410c8e
mov ecx, dword [esi + 4]
call fcn.004105c0
mov ecx, esi
mov edx, 4
call fcn.004028a0
mov eax, edi
jmp 0x410ca0
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x447058
call fcn.0040f3b0
jmp 0x410c14
mov ecx, 0x447058
call fcn.0040f3b0
jmp 0x410c5a
mov ecx, 0x447058
call fcn.0040f3b0
jmp 0x410c6c
mov ecx, 4
mov edx, 8
call fcn.00402c10
nop dword [eax + eax]
Function at 0x411080
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x447038]
test eax, eax
je 0x411106
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x4110a0
add eax, 4
jmp 0x411101
je 0x4110ff
movzx eax, byte [0x4a5058]
mov ecx, 8
call fcn.0043cf80
test eax, eax
je 0x41112d
mov dword [eax], 0x447038
mov byte [eax + 4], 0
mov edi, eax
mov ebx, eax
mov eax, dword [0x447038]
test eax, eax
je 0x411115
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
mov esi, eax
mov eax, dword [0x447038]
test eax, eax
je 0x411121
dec eax
add edi, 4
push ebx
push eax
call sub.KERNEL32.dll_TlsSetValue
test esi, esi
je 0x4110fb
mov ecx, esi
mov edx, 4
call fcn.004028a0
mov eax, edi
jmp 0x411101
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x447038
call fcn.0040f3b0
jmp 0x411090
mov ecx, 0x447038
call fcn.0040f3b0
jmp 0x4110cf
mov ecx, 0x447038
call fcn.0040f3b0
jmp 0x4110e1
mov ecx, 4
mov edx, 8
call fcn.00402c10
nop dword [eax]

Function at 0x411570
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x447028]
test eax, eax
je 0x4115fd
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x411590
add eax, 4
jmp 0x4115f8
je 0x4115f6
movzx eax, byte [0x4a5058]
mov ecx, 0xc
call fcn.0043cf80
test eax, eax
je 0x411624
mov dword [eax], 0x447028
mov dword [eax + 4], 0
mov byte [eax + 8], 0
mov edi, eax
mov ebx, eax
mov eax, dword [0x447028]
test eax, eax
je 0x41160c
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
mov esi, eax
mov eax, dword [0x447028]
test eax, eax
je 0x411618
dec eax
add edi, 4
push ebx
push eax
call sub.KERNEL32.dll_TlsSetValue
test esi, esi
je 0x4115f2
mov ecx, esi
mov edx, 4
call fcn.004028a0
mov eax, edi
jmp 0x4115f8
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x447028
call fcn.0040f3b0
jmp 0x411580
mov ecx, 0x447028
call fcn.0040f3b0
jmp 0x4115c6
mov ecx, 0x447028
call fcn.0040f3b0
jmp 0x4115d8
mov ecx, 4
mov edx, 0xc
call fcn.00402c10
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x412750
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x42c
mov esi, 0x200
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 2
cmp esi, 0x201
jae 0x4127c0
jmp 0x4127ae
jbe 0x41282c
cmp esi, 0x201
jae 0x4127c0
mov dword [ebp - 0x24], 0x200
lea edi, [ebp - 0x438]
mov ebx, esi
jmp 0x4127ea
mov ebx, dword [ebp - 0x28]
sub esi, ebx
je 0x4127de
mov edx, ebx
lea ecx, [ebp - 0x18]
push esi
call fcn.00414480
add esp, 4
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
push 0
call sub.KERNEL32.dll_SetLastError
push edi
push ebx
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov esi, eax
test eax, eax
jne 0x412807
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x412875
cmp esi, ebx
jne 0x4127a0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x412892
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x4127ae
jmp 0x4127c0
mov edx, dword [ebp - 0x24]
cmp esi, edx
ja 0x4128ab
mov edx, edi
lea ecx, [ebp - 0x38]
push esi
call fcn.00412fd0
add esp, 4
movsd xmm0, qword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
movsd xmm1, qword [ebp - 0x30]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
cmp dword [ebp - 0x18], 0
je 0x41286a
mov ecx, dword [ebp - 0x14]
mov edx, 2
call fcn.004028a0
add esp, 0x42c
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 0x80000000
cmp dword [ebp - 0x18], 0
jne 0x41285d
jmp 0x41286a
mov edx, 0x28
mov ecx, str.internal_error:_entered_unreachable_code_
push 0x49ce64
call fcn.00403d90
add esp, 4
jmp 0x4128ba
mov ecx, esi
push 0x49ce54
call fcn.00403ab0
add esp, 4
ud2