joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e34
Capabilities:
Parse pe header

Disassembly:
push 0x60
push 0x10011e0
call fcn.01002c88
mov edi, 0x94
mov eax, edi
call fcn.01002df0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x10010a8]
mov ecx, dword [esi + 0x10]
mov dword [0x10062b8], ecx
mov eax, dword [esi + 4]
mov dword [0x10062c4], eax
mov edx, dword [esi + 8]
mov dword [0x10062c8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x10062bc], esi
cmp ecx, 2
je 0x1001e94
or esi, 0x8000
mov dword [0x10062bc], esi
shl eax, 8
add eax, edx
mov dword [0x10062c0], eax
cmp word [0x1000000], 0x5a4d
jne 0x1001ed0
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x1001ed0
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1001ee9
cmp ecx, 0x20b
je 0x1001ed6
and dword [ebp - 0x1c], 0
jmp 0x1001efd
cmp dword [eax + 0x84], 0xe
jbe 0x1001ed0
xor ecx, ecx
cmp dword [eax + 0xf8], ecx
jmp 0x1001ef7
cmp dword [eax + 0x74], 0xe
jbe 0x1001ed0
xor ecx, ecx
cmp dword [eax + 0xe8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
push 0
call fcn.01002c2a
pop ecx
test eax, eax
jne 0x1001f2a
cmp dword [0x10062a8], 1
jne 0x1001f17
call fcn.01002406
push 0x1c
call fcn.01002219
push 0xff
call fcn.01002078
pop ecx
pop ecx
and dword [ebp - 4], 0
call fcn.01002a5a
test eax, eax
jge 0x1001f3f
push 0x1b
call fcn.01001e05
pop ecx
call dword [0x10010ac]
mov dword [0x1006854], eax
call fcn.0100292d
mov dword [0x10062a0], eax
call fcn.01002884
test eax, eax
jge 0x1001f65
push 8
call fcn.01001e05
pop ecx
call fcn.0100262a
test eax, eax
jge 0x1001f76
push 9
call fcn.01001e05
pop ecx
call fcn.010020d2
mov dword [ebp - 0x28], eax
test eax, eax
je 0x1001f89
push eax
call fcn.01001e05
pop ecx
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [fcn.010010b0]
call fcn.010025bc
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x1001fab
movzx eax, word [ebp - 0x40]
jmp 0x1001fae
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push 0
push 0x1000000
call fcn.01001c3d
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x1c], 0
jne 0x1001fcf
push esi
call fcn.010021b2
call fcn.010021ea
jmp 0x1002001
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x7c]
call fcn.01002cc3
ret

Function at 0xff1b1c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xff1b26
pushal
call 0xff1b2c
pop ebp
sub ebp, 0x10
sub ebp, 0xbf1b1c
jmp 0xff1b42
mov eax, 0xbf1b1c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d7
mov edx, 0x73e21e4a
xor byte [eax], dl
inc eax
dec ecx
jne 0xff1b59
jmp 0xff1b6c
rol dword [edi + 0x4a76c3c1], 0x4a
dec edx
retf
Function at 0x409d10
Capabilities:
Create thread

Disassembly:
push ebp
mov edx, 0xffffffff
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x409d70
lea edx, [ebp - 0x10]
mov ecx, 8
mov dword [esp], edx
mov dword [esp + 4], ecx
call sub.WINMM.DLL_timeGetDevCaps
sub esp, 8
xor edx, edx
test eax, eax
jne 0x409d70
mov eax, dword [ebp - 0x10]
cmp eax, 0xa
ja 0x409d51
cmp dword [ebp - 0xc], 9
ja 0x409d77
mov dword [esp], str.create_thread..._could_not_retrieve_timer_caps_
call fcn.00404670
mov edx, 0xffffffff
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [ebp - 4]
mov eax, edx
leave
ret
mov dword [ebx + 0x24], 0xa
cmp eax, 6
sbb eax, eax
and eax, 0xfffffffb
add eax, 0xa
mov dword [ebx + 0x20], eax
mov dword [esp], eax
call sub.WINMM.DLL_timeBeginPeriod
sub esp, 4
test eax, eax
jne 0x409e70
mov dword [esp + 0xc], ebx
mov ecx, 1
mov edx, 0x409ef0
mov dword [esp + 0x10], ecx
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x20]
mov dword [esp + 4], eax
mov ecx, dword [ebx + 0x24]
mov dword [esp], ecx
call sub.WINMM.DLL_timeSetEvent
mov dword [ebx + 0x28], eax
sub esp, 0x14
test eax, eax
je 0x409eac
mov dword [esp], 0
xor ecx, ecx
xor edx, edx
mov dword [esp + 0xc], ecx
mov eax, 1
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_CreateEventA
mov dword [ebx + 8], eax
sub esp, 0x10
test eax, eax
je 0x409ebd
mov dword [esp + 0xc], ebx
lea eax, [ebx + 0x14]
xor ecx, ecx
mov dword [esp + 0x14], eax
mov edx, 0x40bd40
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
mov dword [ebx + 0x10], eax
sub esp, 0x18
test eax, eax
je 0x409ece
mov dword [esp], eax
mov ebx, 2
mov dword [esp + 4], ebx
call sub.KERNEL32.dll_SetThreadPriority
sub esp, 8
test eax, eax
je 0x409edf
mov dword [esp], str.create_thread..._OK
call fcn.00404670
mov ebx, dword [ebp - 4]
xor edx, edx
mov eax, edx
leave
ret
mov edx, dword [ebx + 0x24]
mov dword [ebx + 0x20], edx
mov dword [esp], edx
call sub.WINMM.DLL_timeBeginPeriod
sub esp, 4
test eax, eax
je 0x409d9f
mov dword [ebx + 0x20], 0
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp], str.create_thread..._could_not_set_timer_period___i__
call fcn.00404610
mov edx, 0xffffffff
jmp 0x409d70
mov dword [esp], str.create_thread..._could_not_create_timer_handler_
call fcn.00404670
jmp 0x409d5d
mov dword [esp], str.create_thread..._could_not_allocate_event_
call fcn.00404670
jmp 0x409d5d
mov dword [esp], str.create_thread..._could_not_create_thread_
call fcn.00404670
jmp 0x409d5d
mov dword [esp], str.create_thread..._could_not_set_thread_priority_
call fcn.00404670
jmp 0x409d5d
Function at 0x4176c0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
movzx ebx, byte [edx]
movzx eax, byte [edx + 1]
movzx esi, byte [edx + 2]
shl ebx, 0x18
shl eax, 0x10
or ebx, eax
movzx eax, byte [edx + 3]
shl esi, 8
add edx, 4
mov dword [ebp - 0x14], 0x20
or ebx, esi
mov esi, ecx
mov dword [ebp - 0x18], edx
or ebx, eax
add esi, esi
je 0x4177a4
mov esi, esi
dec esi
test ebx, ebx
js 0x417830
test ebx, 0x40000000
je 0x4177c0
test ebx, 0x20000000
je 0x4177e4
test ebx, 0x10000000
mov edx, 0xf
mov ecx, 4
jne 0x417760
test ebx, 0x8000000
mov edx, 6
mov ecx, 5
je 0x417824
lea esi, [esi]
sub dword [ebp - 0x14], ecx
shl ebx, cl
cmp dword [ebp - 0x14], 0x18
ja 0x417788
mov eax, dword [ebp - 0x14]
mov ecx, 0x18
sub ecx, eax
mov eax, dword [ebp - 0x18]
shr ebx, cl
movzx eax, byte [eax]
add dword [ebp - 0x14], 8
inc dword [ebp - 0x18]
or ebx, eax
shl ebx, cl
test byte [ebp - 0x10], 1
je 0x4177b0
movzx ecx, byte [edi]
and cl, 0xf0
or cl, dl
mov byte [edi], cl
inc edi
inc dword [ebp - 0x10]
test esi, esi
jne 0x417710
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret
mov al, dl
shl al, 4
mov byte [edi], al
inc dword [ebp - 0x10]
test esi, esi
jmp 0x41779e
test ebx, 0x20000000
je 0x417804
test ebx, 0x10000000
mov edx, 0xc
mov ecx, 4
jne 0x417760
mov edx, 0xb
jmp 0x417760
test ebx, 0x10000000
mov edx, 9
mov ecx, 4
jne 0x417760
mov edx, 5
jmp 0x417760
test ebx, 0x10000000
mov edx, 2
mov ecx, 4
jne 0x417760
mov edx, 1
jmp 0x417760
mov edx, 0xa
jmp 0x417760
xor edx, edx
test ebx, 0x40000000
mov ecx, 2
je 0x417760
test ebx, 0x20000000
je 0x417881
test ebx, 0x10000000
mov edx, 8
mov ecx, 4
jne 0x417760
test ebx, 0x8000000
mov edx, 3
mov ecx, 5
jne 0x417760
mov edx, 0xd
jmp 0x417760
test ebx, 0x10000000
mov edx, 4
mov ecx, 4
je 0x417760
test ebx, 0x8000000
mov edx, 7
mov ecx, 5
jne 0x417760
mov edx, 0xe
jmp 0x417760
Function at 0x421c40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0xd4]
test eax, eax
jne 0x421c70
cmp byte [ebx + 0x114], 0
je 0x421d57
lea esi, [esi]
lea edi, [edi]
cmp byte [ebx + 0x113], 0
je case.default.0x421d50
test byte [ebx + 0x60], 2
jne 0x421d40
movzx ecx, byte [ebx + 0x11b]
movzx eax, byte [ebx + 0x118]
movzx edx, byte [ebx + 0x116]
mov byte [ebx + 0xfa], cl
mov byte [ebx + 0xf9], al
mul cl
mov byte [ebx + 0xf8], dl
mov edx, dword [ebx + 0xc4]
movzx ecx, al
mov dword [ebx + 0xf0], edx
imul edx, ecx
mov byte [ebx + 0xfb], al
add edx, 7
shr edx, 3
mov dword [ebx + 0xf4], edx
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov esi, dword [ebx + 0xdc]
mov dword [esp], ebx
inc esi
mov dword [esp + 4], esi
call fcn.0041a0b0
cmp byte [ebx + 0x113], 0
je 0x421d78
movzx eax, byte [ebx + 0x114]
cmp al, 5
ja 0x421d78
mov edx, dword [ebx + 0x60]
lea esi, [ebx + 0xf0]
test dl, 2
je 0x421d81
movzx edx, al
mov dword [esp + 8], edx
mov ecx, dword [ebx + 0xdc]
mov dword [esp], esi
inc ecx
mov dword [esp + 4], ecx
call fcn.00424f00
mov eax, dword [ebx + 0xf0]
test eax, eax
je 0x421e40
mov edx, dword [ebx + 0x60]
jmp 0x421d81
movzx eax, byte [ebx + 0x114]
cmp eax, 6
ja case.default.0x421d50
jmp dword [eax*4 + 0x556dd0]
test byte [ebx + 0x59], 4
je 0x421de1
test byte [ebx + 0x61], 0x80
jne 0x421df7
mov dword [esp], ebx
call fcn.00424af0
jmp 0x421c70
mov edx, dword [ebx + 0x60]
lea esi, [ebx + 0xf0]
test edx, edx
jne 0x421db4
test byte [ebx + 0x1a8], 4
je 0x421d97
cmp byte [ebx + 0x1b0], 0x40
je 0x421e0d
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004252d0
mov edx, dword [ebx + 0x184]
test edx, edx
jne 0x421dc0
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
mov dword [esp], ebx
call fcn.00422710
jmp 0x421d85
movzx ecx, byte [ebx + 0x114]
mov dword [esp + 8], ecx
mov esi, dword [ebx + 0xd4]
mov dword [esp], ebx
mov dword [esp + 4], esi
call edx
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
mov dword [esp], ebx
mov edx, str.png_write_info_was_never_called_before_png_write_row.
mov dword [esp + 4], edx
call fcn.004183e0
jmp 0x421d61
mov dword [esp], ebx
mov ecx, str.PNG_WRITE_FILLER_SUPPORTED_is_not_defined.
mov dword [esp + 4], ecx
call fcn.004181f0
jmp 0x421d6b
mov eax, dword [ebx + 0xdc]
mov dword [esp], esi
inc eax
mov dword [esp + 4], eax
call fcn.00422720
jmp 0x421d97
test byte [ebx + 0xd4], 1
jne 0x421e40
cmp dword [ebx + 0xb8], 1
ja case.default.0x421d50
nop
lea esi, [esi]
mov dword [ebp + 8], ebx
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp fcn.00424cd0
test byte [ebx + 0xd4], 1
jne case.default.0x421d50
jmp 0x421e40
mov edx, dword [ebx + 0xd4]
and edx, 3
cmp edx, 2
jne 0x421e40
jmp case.default.0x421d50
test byte [ebx + 0xd4], 3
jne 0x421e40
cmp dword [ebx + 0xb8], 2
jmp 0x421e35
mov eax, dword [ebx + 0xd4]
and eax, 7
cmp eax, 4
jmp 0x421e69
test byte [ebx + 0xd4], 7
jne 0x421e40
cmp dword [ebx + 0xb8], 4
jmp 0x421e35
test byte [ebx + 0xd4], 7
jmp 0x421e69
Function at 0x424cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xd4]
inc eax
cmp eax, dword [esi + 0xc0]
jb 0x424e60
cmp byte [esi + 0x113], 0
je 0x424e6e
xor eax, eax
test byte [esi + 0x60], 2
mov dword [esi + 0xd4], eax
jne 0x424e79
movzx ebx, byte [esi + 0x114]
lea esi, [esi]
lea edi, [edi]
inc bl
cmp bl, 6
mov byte [ebp - 0xd], bl
ja 0x424d8b
movzx ecx, bl
mov eax, dword [esi + 0xb8]
mov edx, dword [ecx*4 + 0x5553b0]
mov edi, dword [ecx*4 + 0x5553cc]
add eax, edx
sub eax, edi
dec eax
mov edi, edx
xor edx, edx
div edi
mov edx, dword [ecx*4 + 0x555378]
mov edi, dword [ecx*4 + 0x555394]
mov ecx, edx
mov dword [ebp - 0x14], eax
mov dword [esi + 0xc4], eax
mov eax, dword [esi + 0xbc]
add eax, edx
sub eax, edi
xor edx, edx
dec eax
div ecx
xor edx, edx
test dl, dl
mov dword [esi + 0xc0], eax
jne 0x424d8b
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x424d20
test eax, eax
je 0x424d20
movzx eax, byte [ebp - 0xd]
cmp bl, 6
mov byte [esi + 0x114], al
jbe 0x424e91
lea edi, [esi + 0x64]
jmp 0x424db0
mov dword [esp], edi
mov ecx, 4
mov dword [esp + 4], ecx
call fcn.0042ab40
test eax, eax
mov ebx, eax
jne 0x424e20
mov ebx, dword [esi + 0x74]
test ebx, ebx
jne 0x424db0
mov ebx, dword [esi + 0x9c]
mov ecx, str.IDAT
mov edx, dword [esi + 0xa0]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edx
mov dword [esp], esi
call fcn.004229d0
or dword [esi + 0x58], 4
mov ecx, 4
mov eax, dword [esi + 0x9c]
mov edx, dword [esi + 0xa0]
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], edx
mov dword [esp + 4], ecx
mov dword [esp], edi
call fcn.0042ab40
test eax, eax
mov ebx, eax
je 0x424dc7
cmp eax, 1
je 0x424e44
mov eax, dword [esi + 0x7c]
test eax, eax
jne 0x424e31
mov eax, str.zlib_error
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.004183e0
dec ebx
jne 0x424db0
mov ecx, dword [esi + 0x74]
mov edx, dword [esi + 0xa0]
cmp ecx, edx
jb 0x424ed0
mov dword [ebp + 8], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0042b0c0
mov dword [esi + 0xd4], eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esi + 0xd4], eax
jmp 0x424d9e
movzx ebx, byte [esi + 0x114]
inc bl
cmp bl, 6
mov byte [esi + 0x114], bl
ja 0x424d9e
mov ecx, dword [esi + 0xd8]
test ecx, ecx
je 0x424e66
movzx edi, byte [esi + 0x11b]
xor ebx, ebx
mov edx, dword [esi + 0xb8]
movzx eax, byte [esi + 0x118]
mov dword [esp + 4], ebx
mov dword [esp], ecx
imul edi, eax
imul edi, edx
add edi, 7
shr edi, 3
inc edi
mov dword [esp + 8], edi
call sub.msvcrt.dll_memset
jmp 0x424e66
mov ebx, dword [esi + 0x9c]
sub edx, ecx
mov eax, str.IDAT
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ebx
mov dword [esp], esi
call fcn.004229d0
or dword [esi + 0x58], 4
jmp 0x424e51
Function at 0x42a7f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x42a8ec
mov eax, dword [ebp + 8]
mov ecx, eax
not ecx
jmp 0x42a8c2
movzx eax, byte [ebx]
sub esi, 8
xor al, cl
movzx edx, al
mov eax, ecx
mov ecx, dword [edx*4 + 0x557768]
shr eax, 8
xor eax, ecx
movzx ecx, byte [ebx + 1]
xor cl, al
movzx edx, cl
mov ecx, dword [edx*4 + 0x557768]
shr eax, 8
xor eax, ecx
movzx ecx, byte [ebx + 2]
xor cl, al
movzx edx, cl
mov ecx, dword [edx*4 + 0x557768]
shr eax, 8
xor eax, ecx
movzx ecx, byte [ebx + 3]
xor cl, al
movzx edx, cl
mov ecx, dword [edx*4 + 0x557768]
shr eax, 8
xor eax, ecx
movzx ecx, byte [ebx + 4]
xor cl, al
movzx edx, cl
mov ecx, dword [edx*4 + 0x557768]
shr eax, 8
xor eax, ecx
movzx ecx, byte [ebx + 5]
xor cl, al
movzx edx, cl
mov ecx, dword [edx*4 + 0x557768]
shr eax, 8
xor eax, ecx
movzx ecx, byte [ebx + 6]
xor cl, al
movzx edx, cl
mov ecx, dword [edx*4 + 0x557768]
shr eax, 8
xor eax, ecx
movzx ecx, byte [ebx + 7]
add ebx, 8
xor cl, al
movzx edx, cl
mov ecx, eax
mov eax, dword [edx*4 + 0x557768]
shr ecx, 8
xor ecx, eax
cmp esi, 7
ja 0x42a811
test esi, esi
jmp 0x42a8e6
movzx edx, byte [ebx]
inc ebx
xor dl, cl
movzx eax, dl
shr ecx, 8
mov edx, dword [eax*4 + 0x557768]
xor ecx, edx
dec esi
jne 0x42a8d0
mov eax, ecx
not eax
pop ebx
pop esi
pop ebp
ret

Function at 0x42b0c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov edx, dword [ebp + 8]
test edx, edx
je 0x42b0f0
mov ebx, dword [edx + 0x1c]
test ebx, ebx
je 0x42b0f0
mov eax, dword [edx + 0x20]
test eax, eax
je 0x42b0f0
mov ecx, dword [edx + 0x24]
test ecx, ecx
jne 0x42b100
lea esi, [esi]
lea edi, [edi]
add esp, 0x14
mov eax, 0xfffffffe
pop ebx
pop ebp
ret
mov dword [edx + 0x2c], 2
mov eax, dword [ebx + 8]
cmp dword [ebx + 0x18], 0
mov dword [edx + 0x14], 0
mov dword [edx + 8], 0
mov dword [edx + 0x18], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x10], eax
jl 0x42b1fc
jne 0x42b1f2
mov eax, 0x2a
mov dword [ebx + 4], eax
mov dword [edx + 0x30], 1
mov dword [ebx + 0x20], 0
mov dword [esp], ebx
call fcn.0042caa0
mov edx, dword [ebx + 0x24]
mov ecx, dword [ebx + 0x44]
add edx, edx
mov dword [ebx + 0x34], edx
mov edx, dword [ebx + 0x3c]
lea eax, [ecx + ecx - 2]
mov word [edx + ecx*2 - 2], 0
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov dword [ebx + 0x64], 0
mov eax, dword [ebx + 0x7c]
mov dword [ebx + 0x54], 0
mov dword [ebx + 0x6c], 0
lea ecx, [eax + eax*2]
shl ecx, 2
movzx edx, word [ecx + 0x557b6a]
mov dword [ebx + 0x70], 2
xor eax, eax
mov dword [ebx + 0x58], 2
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x78], edx
movzx edx, word [ecx + 0x557b68]
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x84], edx
movzx edx, word [ecx + 0x557b6c]
mov dword [ebx + 0x88], edx
movzx edx, word [ecx + 0x557b6e]
mov dword [ebx + 0x74], edx
add esp, 0x14
pop ebx
pop ebp
ret
mov eax, 0x71
jmp 0x42b13e
mov dword [ebx + 0x18], 0
jmp 0x42b139
Function at 0x434170
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x4341a4
mov dword [esp], eax
mov edx, 0x434150
mov dword [esp + 4], edx
mov dword [0x642c00], eax
call fcn.004351e0
test eax, eax
sete al
movzx eax, al
mov dword [0x5518a0], eax
add esp, 0xc
ret
call sub.KERNEL32.dll_GetLastError
test eax, eax
sete al
movzx eax, al
mov dword [0x5518a0], eax
add esp, 0xc
ret

Function at 0x4341c0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x6c
mov eax, 0x433410
mov dword [esp + 0x40], eax
mov eax, 0x437974
mov dword [esp + 0x44], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x48], eax
mov eax, 0x434287
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x64], edi
mov dword [esp], eax
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], esi
mov dword [esp + 0x68], ebp
mov dword [esp + 0x50], esp
call fcn.00435a20
mov edi, dword [0x5518a0]
mov eax, 0x642c10
mov dword [esp + 0x24], eax
test edi, edi
jne 0x434240
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.00435b00
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x5c]
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x64]
mov ebp, dword [esp + 0x68]
add esp, 0x6c
ret
mov eax, dword [0x642c00]
mov esi, 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], eax
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_SetLastError
sub esp, 4
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
jmp 0x434219
Function at 0x4342c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x6c
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], ebx
mov ebx, 0x4343a4
mov dword [esp + 0x60], esi
mov esi, 0x437984
mov dword [esp + 0x64], edi
mov edi, 0x433410
mov dword [esp + 0x48], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x68], ebp
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], esi
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], esp
mov dword [esp], eax
call fcn.00435a20
cmp dword [0x5518a0], 0
mov ecx, 0x642c10
mov dword [esp + 0x24], ecx
je 0x434380
jl 0x4343c0
mov eax, dword [0x642c00]
mov ecx, 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_SetLastError
sub esp, 4
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x20], eax
je 0x434466
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
lea esi, [esi]
lea edi, [edi]
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.00435b00
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x5c]
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x64]
mov ebp, dword [esp + 0x68]
add esp, 0x6c
ret
mov edx, dword [0x553700]
mov eax, 0xffffffff
test edx, edx
je 0x4343da
mov eax, dword [0x5518a4]
test eax, eax
je 0x43441b
xor eax, eax
test eax, eax
jne 0x434411
mov eax, dword [0x5518a0]
test eax, eax
js 0x434411
mov ebx, dword [0x5518a0]
mov esi, 0x642c10
mov dword [esp + 0x24], esi
test ebx, ebx
je 0x434380
jmp 0x43431e
xor edi, edi
mov dword [0x5518a0], edi
jmp 0x4343e7
mov dword [esp], 0x5518a8
mov eax, 1
mov dword [esp + 0x2c], eax
call sub.KERNEL32.dll_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x4344a6
mov eax, dword [0x5518a4]
test eax, eax
jne 0x4343d8
mov dword [esp], 0
mov eax, 1
mov dword [esp + 0x2c], eax
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov eax, dword [0x5518a4]
test eax, eax
je 0x434440
jmp 0x4343d8
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [esp + 0x20], eax
test eax, eax
je 0x434498
mov dword [esp + 4], eax
mov eax, dword [0x642c00]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
xor edx, edx
test eax, eax
je 0x4344d0
test edx, edx
je 0x4344ba
mov edx, 1
mov dword [esp + 0x2c], edx
call fcn.00434020
call fcn.00434170
mov eax, 1
mov dword [0x5518a4], eax
jmp 0x4343d8
mov eax, dword [esp + 0x20]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x43436b
call sub.KERNEL32.dll_GetLastError
mov edx, eax
jmp 0x434494
Function at 0x435080
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.004366b0
call fcn.004352e0
call sub.KERNEL32.dll_GetCommandLineA
lea edx, [ebp - 0x58]
mov ebx, eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
je 0x4350ea
movzx eax, byte [ebx]
cmp al, 0x20
je 0x435152
cmp al, 9
je 0x435152
cmp al, 0x22
je 0x43513e
cmp al, 0x20
je 0x435130
cmp al, 9
je 0x4350e2
test al, al
je 0x4350e2
inc ebx
movzx eax, byte [ebx]
cmp al, 0x20
je 0x435130
cmp al, 9
je 0x4350e2
test al, al
jne 0x4350d2
cmp al, 0x20
je 0x435130
cmp al, 9
je 0x435130
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
je 0x435123
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004012d0
mov ebx, dword [ebp - 4]
sub esp, 0x10
leave
ret
mov edx, 0xa
jmp 0x435103
inc ebx
movzx eax, byte [ebx]
cmp al, 0x20
je 0x435130
cmp al, 9
je 0x435130
jmp 0x4350ea
inc ebx
movzx eax, byte [ebx]
cmp al, 0x22
je 0x43514c
test al, al
jne 0x43513e
jmp 0x4350e2
inc ebx
movzx eax, byte [ebx]
jmp 0x4350e2
inc ebx
movzx eax, byte [ebx]
cmp al, 0x20
je 0x435152
cmp al, 9
je 0x435152
jmp 0x4350c2

Function at 0x435910
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x642c50]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x435950
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.004351e0
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret