joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4440a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp], 0x7c7d7e7f
mov word [esp + 4], 0
mov eax, 0xaa5d26ff
mov ebx, 0x5568b640
nop
movzx ebp, byte [esp + eax + 0x55a2d901]
mov edi, ebx
xor edi, ebp
lea esi, [edi + edi]
not esi
add esi, edi
and esi, ebx
mov ecx, esi
and ecx, 0x5568b645
mov edx, esi
and edx, 2
mov edi, esi
or edi, 0xfffffffd
inc edi
imul edi, ecx
or esi, 2
imul esi, edx
add edi, ebp
sub edi, esi
add edi, eax
mov ecx, edi
and ecx, 1
xor edi, 1
lea ecx, [edi + ecx*2]
mov byte [esp + eax + 0x55a2d901], cl
inc eax
inc ebx
cmp eax, 0xaa5d2705
jne 0x4440c0
mov eax, dword [esp]
mov esi, dword [0x4510e4]
test esi, esi
je 0x444174
xor edi, edi
mov ebx, dword [0x4510e8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x5b126fe8
je 0x444140
inc edi
cmp esi, edi
jne 0x444130
jmp 0x444174
mov ebx, dword [ebx + edi*8 + 4]
cmp ebx, eax
je 0x444174
lea eax, [esp + 8]
push 0
push 0
push dword [esp + 0x34]
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x4510ec]
call fcn.004414e0
add esp, 0x30
cmp eax, 0x103
jne 0x444249
mov dword [esp], 0x7c7d7e7f
mov word [esp + 4], 0
mov eax, 0xaa5d26ff
mov ecx, 0x5568b640
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x55a2d901]
mov esi, ecx
xor esi, edx
lea edi, [esi + esi]
not edi
add edi, esi
and edi, ecx
mov ebx, edi
and ebx, 0x5568b645
mov ebp, edi
and ebp, 2
mov esi, edi
or esi, 0xfffffffd
inc esi
imul esi, ebx
or edi, 2
imul edi, ebp
add esi, edx
sub esi, edi
add esi, eax
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + eax + 0x55a2d901], dl
inc eax
inc ecx
cmp eax, 0xaa5d2705
jne 0x4441a0
mov eax, dword [esp]
mov ecx, dword [0x4510e4]
test ecx, ecx
je 0x444241
xor edx, edx
mov esi, dword [0x4510e8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x4c697c35
je 0x444220
inc edx
cmp ecx, edx
jne 0x444210
jmp 0x444241
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x444241
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x4510ec]
call fcn.004414e0
add esp, 0x18
test eax, eax
js 0x444249
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x444260
xor ecx, ecx
cmp eax, 0xc0000011
je 0x44425e
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444270
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp], 0x7c7d7e7f
mov word [esp + 4], 0
mov eax, 0xaa5d26ff
mov ebx, 0x5568b640
nop
movzx ebp, byte [esp + eax + 0x55a2d901]
mov edi, ebx
xor edi, ebp
lea esi, [edi + edi]
not esi
add esi, edi
and esi, ebx
mov ecx, esi
and ecx, 0x5568b645
mov edx, esi
and edx, 2
mov edi, esi
or edi, 0xfffffffd
inc edi
imul edi, ecx
or esi, 2
imul esi, edx
add edi, ebp
sub edi, esi
add edi, eax
mov ecx, edi
and ecx, 1
xor edi, 1
lea ecx, [edi + ecx*2]
mov byte [esp + eax + 0x55a2d901], cl
inc eax
inc ebx
cmp eax, 0xaa5d2705
jne 0x444290
mov eax, dword [esp]
mov esi, dword [0x4510e4]
test esi, esi
je 0x444344
xor edi, edi
mov ebx, dword [0x4510e8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xa2545bf7
je 0x444310
inc edi
cmp esi, edi
jne 0x444300
jmp 0x444344
mov ebx, dword [ebx + edi*8 + 4]
cmp ebx, eax
je 0x444344
lea eax, [esp + 8]
push 0
push 0
push dword [esp + 0x34]
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x4510ec]
call fcn.004414e0
add esp, 0x30
cmp eax, 0x103
jne 0x444419
mov dword [esp], 0x7c7d7e7f
mov word [esp + 4], 0
mov eax, 0xaa5d26ff
mov ecx, 0x5568b640
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x55a2d901]
mov esi, ecx
xor esi, edx
lea edi, [esi + esi]
not edi
add edi, esi
and edi, ecx
mov ebx, edi
and ebx, 0x5568b645
mov ebp, edi
and ebp, 2
mov esi, edi
or esi, 0xfffffffd
inc esi
imul esi, ebx
or edi, 2
imul edi, ebp
add esi, edx
sub esi, edi
add esi, eax
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + eax + 0x55a2d901], dl
inc eax
inc ecx
cmp eax, 0xaa5d2705
jne 0x444370
mov eax, dword [esp]
mov ecx, dword [0x4510e4]
test ecx, ecx
je 0x444411
xor edx, edx
mov esi, dword [0x4510e8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x4c697c35
je 0x4443f0
inc edx
cmp ecx, edx
jne 0x4443e0
jmp 0x444411
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x444411
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x4510ec]
call fcn.004414e0
add esp, 0x18
test eax, eax
js 0x444419
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x444427
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444430
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0x3c]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ecx], 0
lea ecx, [ecx + 2]
jne 0x444450
add ecx, 0xfffffffe
and ecx, 0xfffe
mov word [esp + 8], cx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x7c7d7e7f
mov word [esp + 4], 0
mov eax, 0xaa5d26ff
mov edi, 0x5568b640
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x55a2d901]
mov ebp, edi
xor ebp, ebx
lea ecx, [ebp*2]
not ecx
add ecx, ebp
and ecx, edi
mov edx, ecx
and edx, 0x5568b645
mov esi, ecx
and esi, 2
mov ebp, ecx
or ebp, 0xfffffffd
inc ebp
imul ebp, edx
or ecx, 2
imul ecx, esi
add ebp, ebx
sub ebp, ecx
add ebp, eax
mov ecx, ebp
and ecx, 1
xor ebp, 1
lea ecx, [ecx*2]
add ecx, ebp
mov byte [esp + eax + 0x55a2d901], cl
inc eax
inc edi
cmp eax, 0xaa5d2705
jne 0x4444c0
mov eax, dword [esp]
mov ecx, dword [0x4510e4]
test ecx, ecx
je 0x44457a
xor edi, edi
mov ebx, dword [0x4510e8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x40915fe0
je 0x444550
inc edi
cmp ecx, edi
jne 0x444540
jmp 0x44457a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, eax
je 0x44457a
lea eax, [esp + 0x10]
push dword [esp + 0x48]
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push 0x10
push ecx
push dword [0x4510ec]
call fcn.004414e0
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xaec058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xaec1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xaec07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaec06a
add dl, dl
jne 0xaec089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaec0dc
xor eax, eax
add dl, dl
jne 0xaec096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaec17d
add dl, dl
jne 0xaec0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaec0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaec0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaec0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xaec0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xaec075
mov eax, 1
add dl, dl
jne 0xaec0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaec0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaec0e1
sub eax, ebx
mov ebx, 1
jne 0xaec128
mov ecx, 1
add dl, dl
jne 0xaec10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaec119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaec105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaec075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xaec13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaec14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaec136
cmp eax, 0x7d00
jae 0xaec16d
cmp eax, 0x500
jb 0xaec168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaec075
cmp eax, 0x7f
ja 0xaec170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaec075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xaec19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xaec075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403780
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d5c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push esi
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x38], 0
je 0x4037b3
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x4037bf
mov al, 1
jmp 0x403962
mov dword [ebp - 0x2c], 8
call fcn.00405400
push eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x20], eax
call fcn.00405400
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.00405430
add esp, 8
movzx eax, al
test eax, eax
je 0x403802
xor al, al
jmp 0x403962
push 0
push 8
lea ecx, [ebp - 0x54]
call fcn.00401ad0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x30]
push edx
lea ecx, [ebp - 0x54]
call fcn.00404cc0
mov ecx, eax
call fcn.00402da0
mov esi, eax
lea ecx, [ebp - 0x54]
call fcn.00406560
add esi, eax
push esi
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x54]
call fcn.00404cc0
mov ecx, eax
call fcn.00402da0
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 0x38]
call fcn.00406a80
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40387d
cmp dword [ebp - 0x1c], 1
je 0x403884
cmp dword [ebp - 0x1c], 3
je 0x40391e
jmp 0x403936
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x3d], 0
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x54]
call fcn.00404cc0
mov ecx, eax
call fcn.00402da0
mov edx, dword [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x18], edx
je 0x4038e7
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x18]
push edx
push 1
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x54]
call fcn.00404cc0
mov ecx, eax
call fcn.00402da0
push eax
call fcn.00432450
add esp, 0x10
cmp dword [ebp - 0x18], eax
je 0x4038e7
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.004027d0
mov al, byte [ebp - 0xd]
jmp 0x403962
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x40390a
mov byte [ebp - 0xe], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.004027d0
mov al, byte [ebp - 0xe]
jmp 0x403962
cmp dword [ebp - 0x18], 0
jne 0x40391c
push 0
push 8
lea ecx, [ebp - 0x54]
call fcn.00404960
jmp 0x40394e
mov byte [ebp - 0xf], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.004027d0
mov al, byte [ebp - 0xf]
jmp 0x403962
mov byte [ebp - 0x10], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.004027d0
mov al, byte [ebp - 0x10]
jmp 0x403962
jmp 0x403815
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d0b0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x40d110
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x491054]
test esi, esi
jle 0x40d1fd
mov edi, dword [0x491058]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x40d144
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x40d1f6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x40d130
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x40d23a
lea ebx, [esi + esi*2]
mov esi, dword [0x491058]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x491058]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40d21a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40d1ef
sub eax, 0x40
and eax, 0xffffffbf
je 0x40d1ef
mov eax, dword [esp + 0x20]
add ebx, dword [0x491058]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x40d204
add dword [0x491054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x40d14e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x491058]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x40d700
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x491408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x491400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x40d755
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40d74e
test esi, esi
je 0x40d74e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40d730
mov dword [esp], 0x491408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40d970
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x40d9a8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40d99e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40d9aa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40d990
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40ede0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sym._strlen
mov esi, eax
lea eax, [eax + 0x41]
and eax, 0xfffffff0
call fcn.0040dc80
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
lea edi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [esi + 0x10]
lea edx, [edi + eax]
mov dword [ebp - 0x20], eax
mov dword [edx], 0x61616161
mov dword [edx + 4], 0x61616161
mov dword [edx + 8], 0x61616161
mov dword [edx + 0xc], 0x61616161
mov dword [edx + 0x10], 0x61616161
mov dword [edx + 0x14], 0x61616161
mov dword [edx + 0x18], 0x61616161
mov dword [edx + 0x1c], 0x61616161
mov dword [ebp - 0x24], edx
mov byte [esp + esi + 0x3c], 0
mov byte [esp + esi + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [edi + esi + 0xf], 0x2d
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
mov edx, dword [ebp - 0x24]
je 0x40eecf
int3
mov dword [ebp - 0x24], edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
mov edx, dword [ebp - 0x24]
jne 0x40ef73
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
mov dword [esp], eax
call sym._malloc
mov edx, dword [ebp - 0x24]
mov ebx, eax
mov eax, 0x20
bt ebx, eax
jae 0x40ef0a
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x40ef02
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x40ef70
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call dbg.get_ptr_from_atom
cmp eax, ebx
mov esi, eax
je 0x40ef8a
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x1c]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call dbg.get_ptr_from_atom
mov esi, eax
jmp 0x40ef44
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40ef44
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x40ef44
Function at 0x41b7c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x491e50]
test ebx, ebx
je 0x41b7f0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx], eax
mov eax, dword [0x491e50]
test eax, eax
je 0x41b815
cmp dword [eax], 0xffffffff
je 0x41b838
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov ebx, eax
mov dword [0x491e50], eax
jmp 0x41b7ce
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x491e50], eax
jmp 0x41b7df
call sym._abort
lea esi, [esi]
Function at 0x41bcd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x491e54]
test eax, eax
je 0x41be24
call sym.__pthread_once_raw.constprop.5
mov eax, dword [0x491e50]
test eax, eax
je 0x41be50
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41bd10
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._pop_pthread_mem
test eax, eax
mov ebx, eax
je 0x41be9c
mov eax, dword [entry3]
test eax, eax
je 0x41be9c
mov dword [ebx + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x38], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub esp, 0x10
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x34], 0xffffffff
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x14], 0
call esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call esi
mov edx, eax
lea eax, [ebx + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x41bea3
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
mov dword [ebx + 0x64], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x491e50]
test eax, eax
je 0x41be76
mov dword [esp + 4], ebx
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x41bea3
mov eax, ebx
jmp 0x41bd08
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_once_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x491e54], eax
jmp 0x41bce4
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x491e50], eax
jmp 0x41bcf6
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x491e50], eax
jmp 0x41be03
xor eax, eax
jmp 0x41bd08
call sym._abort
nop
lea esi, [esi]
Function at 0x41c410
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
cmp dword [esp + 0x24], 3
je 0x41c430
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret 0xc
mov eax, dword [0x491e50]
test eax, eax
je 0x41c5a0
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x41c41c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41c41c
test byte [eax + 0x20], 0x30
je 0x41c4f0
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x41c590
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x41c4a0
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x41c492
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x34], 0xffffffff
test edx, edx
je 0x41c5f6
mov eax, dword [0x491e50]
test eax, eax
je 0x41c5d0
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
mov eax, 1
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [eax + 0x64]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x41c550
test eax, eax
je 0x41c50a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x64], 1
test eax, eax
jne 0x41c580
test byte [ebx + 0x24], 4
je 0x41c567
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41c499
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x41c499
test eax, eax
je 0x41c560
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov dword [ebx + 0x34], 0xffffffff
jmp 0x41c41c
call sym.__pthread_cleanup_dest.part.3
jmp 0x41c522
call sym.__pthread_cleanup_dest.part.3
jmp 0x41c46e
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x491e50], eax
jmp 0x41c43d
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x491e50], eax
jmp 0x41c4cd
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x41c4c0