joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418f10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, ecx
mov ecx, 0xe3
push esi
push edi
lea edi, [ebx + 0x9c4]
mov edx, dword [edi + 4]
lea edi, [edi + 4]
xor edx, dword [edi - 4]
and edx, 0x7fffffff
xor edx, dword [edi - 4]
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, edx
mov dword [edi - 0x9c4], eax
sub ecx, 1
jne 0x418f20
lea esi, [ebx + 0xd50]
mov edi, 0x18c
mov ecx, dword [esi + 4]
lea esi, [esi + 4]
xor ecx, dword [esi - 4]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
xor eax, ecx
mov dword [esi - 0x9c4], eax
sub edi, 1
jne 0x418f62
mov ecx, dword [ebx + 0x1380]
xor ecx, dword [ebx + 4]
and ecx, 0x7fffffff
xor ecx, dword [ebx + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx + 0x9c0], eax
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret

Function at 0x419cc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x40
lea eax, [ebp - 0x54]
xorps xmm0, xmm0
push 0
push eax
mov ebx, edx
mov esi, ecx
movups xmmword [ebp - 0x14], xmm0
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x28], ax
xor ecx, ecx
mov eax, dword [esi + 0x10]
mov edx, 2
inc eax
mov dword [ebp - 0x2c], 1
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049b111
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x419d21
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
inc eax
push eax
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x419d39
mov esi, dword [esi]
push esi
push 0x4c2a74
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 8]
add esp, 0xc
mov byte [ebp - 1], 1
cmp dword [ecx + 0x10], 0
ja 0x419d5a
xor edx, edx
jmp 0x419d61
call fcn.004056d0
mov edx, eax
cmp dword [ebx + 0x10], 0
ja 0x419d6b
xor eax, eax
jmp 0x419d72
mov ecx, ebx
call fcn.004056d0
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x58]
push ecx
push edx
push 0
push 0x20
push 1
push 0
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
mov eax, dword [ebp - 0x14]
neg ebx
sbb bl, bl
and bl, byte [ebp - 1]
cmp eax, 0xffffffff
je 0x419da7
push eax
call esi
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
je 0x419db2
push eax
call esi
push 2
push edi
call fcn.0049b0e0
add esp, 8
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a540
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49de19
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4d506c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x41a598
mov eax, dword [esi]
jmp 0x41a59a
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x10], 1
cmp ecx, 0x104
jb 0x41a5db
mov dword [esi + 0x10], 0x104
cmp dword [esi + 0x14], 8
jb 0x41a5ce
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x208], cx
jmp 0x41a5ec
mov eax, esi
xor ecx, ecx
mov word [eax + 0x208], cx
jmp 0x41a5ec
mov eax, 0x104
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00419080
cmp dword [esi + 0x14], 8
jb 0x41a5f6
mov eax, dword [esi]
jmp 0x41a5f8
mov eax, esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esi + 0x10]
cmp eax, ecx
ja 0x41a648
mov dword [esi + 0x10], eax
cmp dword [esi + 0x14], 8
jb 0x41a62e
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, esi
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00419080
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a670
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49de62
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4d506c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x220], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x224], esi
mov dword [esi + 0x10], 0
jb 0x41a6db
mov eax, dword [esi]
jmp 0x41a6dd
mov eax, esi
xor ecx, ecx
mov word [eax], cx
push 0x110
push ecx
lea eax, [ebp - 0x120]
mov dword [ebp - 4], ecx
push eax
mov dword [ebp - 0x220], 1
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x124], 0x114
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x120], 6
jb 0x41a78e
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x41a7de
push str.SHGetKnownFolderPath
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41a785
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
push ecx
push 0
push 0x8000
push 0x4a6c20
call eax
test eax, eax
jne 0x41a785
push dword [ebp - 0x21c]
mov ecx, esi
call fcn.00405ba0
push dword [ebp - 0x21c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x41a7de
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x801c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x41a7de
cmp word [ebp - 0x218], ax
jne 0x41a7b7
xor ecx, ecx
jmp 0x41a7cf
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a7c0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00405bf0
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x41a802
cmp dword [esi + 0x14], 8
jb 0x41a7ef
mov eax, dword [esi]
jmp 0x41a7f1
mov eax, esi
cmp word [eax + ecx*2 - 2], 0x5c
je 0x41a802
push 0x5c
mov ecx, esi
call fcn.004194b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049abdf
mov esp, ebp
pop ebp
ret
Function at 0x41aae0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49df28
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4d506c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
test edi, edi
jns 0x41ab25
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0041bd20
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x41ab0f
call fcn.0041a9d0
mov esi, eax
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [ebx]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
call fcn.0041a9d0
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.0041b3c0
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.0041b3f0
cmp byte [ebp - 0x14], 0
jne 0x41ab91
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x14]
cmp eax, dword [ebx]
je 0x41ab91
xor bl, bl
jmp 0x41ab9c
mov eax, dword [ebp + 8]
inc dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov bl, 1
test esi, esi
je 0x41aba7
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41abc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49df58
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4d506c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0041bd20
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x41ac80
mov ecx, dword [edi + 8]
cmp ecx, 1
jl 0x41ac80
add ecx, 0xffffffff
mov dword [edi + 8], ecx
jne 0x41ac6d
call fcn.0041a9d0
mov esi, eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add edi, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.0041a9d0
lea ecx, [eax + 0x18]
call fcn.0041aea0
call fcn.0041a9d0
lea ecx, [eax + 0x18]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ecx]
je 0x41ac5c
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041a9d0
lea ecx, [eax + 0x18]
call fcn.0041aef0
mov dword [edi], 0xffffffff
test esi, esi
je 0x41ac6d
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41b6f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e00e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4d506c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x10]
mov dword [esi], vtable.nbase::FrameworkThread.1.0
mov eax, dword [eax + 4]
mov dword [eax + esi + 0x10], vtable.nbase::FrameworkThread.0
mov word [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x2c], eax
mov edx, dword [ebp + 8]
mov byte [ebp - 4], 3
mov dword [esi + 0x44], 0xf
mov dword [esi + 0x40], 0
mov byte [esi + 0x30], 0
cmp byte [edx], 0
jne 0x41b7a9
xor ecx, ecx
jmp 0x41b7b9
mov ecx, edx
lea ebx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b7b0
sub ecx, ebx
push ecx
push edx
lea ecx, [esi + 0x30]
call fcn.00406080
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41b870
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e037
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4d506c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], vtable.nbase::FrameworkThread.1.0
mov eax, dword [eax + 4]
mov dword [eax + esi + 0x10], vtable.nbase::FrameworkThread.0
mov al, byte [esi + 0x14]
test al, al
je 0x41b8fb
call fcn.0041b9c0
mov eax, dword [esi + 8]
test eax, eax
je 0x41b8f5
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41b8e2
mov eax, dword [esi + 8]
test eax, eax
je 0x41b8f5
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call ebx
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov word [esi + 0x14], 0
mov edx, dword [esi + 0x44]
lea edi, [esi + 0x30]
cmp edx, 0x10
jb 0x41b913
mov ecx, dword [edi]
inc edx
push 1
call fcn.004044e0
add esp, 4
mov dword [edi + 0x14], 0xf
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], 0
jb 0x41b929
mov edi, dword [edi]
mov byte [edi], 0
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x41b936
push eax
call ebx
mov dword [ebp - 4], 0
mov edi, dword [esi + 0x24]
test edi, edi
je 0x41b965
or eax, 0xffffffff
lock xadd dword [edi + 4], eax
jne 0x41b965
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
jne 0x41b965
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, dword [esi + 8]
mov dword [esi], vtable.nbase::Thread.0
test eax, eax
je 0x41b9a2
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41b98f
mov eax, dword [esi + 8]
test eax, eax
je 0x41b9a2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call ebx
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bd20
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4d96dc]
sub esp, 0x18
push esi
cmp eax, 2
je 0x41bdf0
push 0
push 1
push 0x4d96dc
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x41bdcd
push 4
call fcn.0049ae45
mov esi, eax
add esp, 4
mov dword [ebp - 8], esi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
sub esp, 0x28
mov eax, esp
mov dword [0x4d96e0], esi
mov dword [ebp - 8], 0x4d96dc
mov dword [ebp - 0xc], 0x41be00
mov dword [ebp - 0x18], 0x41be00
mov dword [eax], vtable.std::_Func_base_void___.0
mov dword [eax], vtable.std::_Func_impl_class_std::_Binder_struct_std::_Unforced__void____cdecl___void_____void_____class_std::allocator_int___void___.0
mov dword [eax + 4], 0x41be00
mov dword [eax + 8], 0x4d96dc
mov byte [ebp - 1], 0
mov dword [ebp - 0x14], 0x4d96dc
mov dword [eax + 0x24], eax
call fcn.0041f140
mov eax, dword [0x4d96e0]
add esp, 0x28
mov dword [0x4d96dc], 2
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 2
je 0x41bdf0
mov eax, dword [0x4d96dc]
cmp eax, 2
je 0x41bdf0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call esi
mov eax, dword [0x4d96dc]
cmp eax, 2
jne 0x41bde2
mov eax, dword [0x4d96e0]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41d8a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4d96e4]
sub esp, 0x18
push esi
cmp eax, 2
je 0x41d970
push 0
push 1
push 0x4d96e4
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x41d94d
push 4
call fcn.0049ae45
mov esi, eax
add esp, 4
mov dword [ebp - 8], esi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
sub esp, 0x28
mov eax, esp
mov dword [0x4d96e8], esi
mov dword [ebp - 8], 0x4d96e4
mov dword [ebp - 0xc], 0x41be00
mov dword [ebp - 0x18], 0x41be00
mov dword [eax], vtable.std::_Func_base_void___.0
mov dword [eax], vtable.std::_Func_impl_class_std::_Binder_struct_std::_Unforced__void____cdecl___void_____void_____class_std::allocator_int___void___.0
mov dword [eax + 4], 0x41be00
mov dword [eax + 8], 0x4d96e4
mov byte [ebp - 1], 0
mov dword [ebp - 0x14], 0x4d96e4
mov dword [eax + 0x24], eax
call fcn.0041f140
mov eax, dword [0x4d96e8]
add esp, 0x28
mov dword [0x4d96e4], 2
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 2
je 0x41d970
mov eax, dword [0x4d96e4]
cmp eax, 2
je 0x41d970
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call esi
mov eax, dword [0x4d96e4]
cmp eax, 2
jne 0x41d962
mov eax, dword [0x4d96e8]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41f420
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov dword [esi], vtable.nbase::Thread.0
test eax, eax
je 0x41f467
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41f450
mov eax, dword [esi + 8]
test eax, eax
je 0x41f467
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
test byte [ebp + 8], 1
je 0x41f478
push 0x10
push esi
call fcn.0049b0e0
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x41f4d0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov esi, ecx
lea edi, [esi + 4]
push edi
push 0
push esi
push 0x41f590
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 8], eax
cmp eax, 2
jae 0x41f502
mov dword [esi + 8], 0
mov dword [edi], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
jle 0x41f579
or eax, 0xffffffff
cmp ecx, 1
jne 0x41f52a
mov eax, 0xfffffffe
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp dword [esi + 8], 1
pop edi
seta al
pop esi
ret
cmp ecx, 2
jne 0x41f546
or eax, 0xffffffff
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp dword [esi + 8], 1
pop edi
seta al
pop esi
ret
cmp ecx, 3
jne 0x41f564
mov eax, 2
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp dword [esi + 8], 1
pop edi
seta al
pop esi
ret
cmp ecx, 4
mov edx, 0xf
cmove eax, edx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp dword [esi + 8], 1
pop edi
seta al
pop esi
ret
Function at 0x41fce0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
mov edi, ecx
call fcn.0041d8a0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 1
cmp byte [eax + 0x14], 0
lea eax, [ebp - 0x1c]
je 0x41fd36
push 0xf
push 0xf
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x41fd32
push 1
push 0x113
push 0x113
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x41fd32
xor bl, bl
jmp 0x41fd48
mov bl, 1
jmp 0x41fd48
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
setne bl
push 0
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test bl, bl
jne 0x41fd60
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.0041fc30
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ff70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e873
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4d506c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.nbase::WinIOMessagePump.0
mov dword [edi + 0x18], 0xffffffff
lea esi, [edi + 0x1c]
mov byte [ebp - 4], 1
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00420420
push 1
mov dword [esi], eax
push 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x24], vtable.ObserverList_class_nbase::WinIOMessagePump::IOObserver_.0
push 0
push 0xffffffffffffffff
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov esi, eax
mov eax, dword [edi + 0x18]
cmp eax, 0xffffffff
je 0x420030
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov dword [edi + 0x18], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x420770
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e8f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4d506c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0xc]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [edi + 0x24], 0
je 0x4207c8
call fcn.0041d8a0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, dword [edi + 0x24]
jne 0x4207c8
mov bl, 1
jmp 0x4207ca
xor bl, bl
test esi, esi
je 0x4207d5
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420820
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e93e
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4d506c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0xc]
xor bl, bl
push esi
mov dword [ebp - 0x50], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [edi + 0x24], 0
je 0x4208ef
call fcn.0041d8a0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, dword [edi + 0x24]
je 0x4208ef
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
push eax
lea ecx, [ebp - 0x4c]
call fcn.00420950
mov eax, dword [ebp - 0x4c]
add esp, 4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], vtable.._AV___Func_impl_V__WeakCallback_V___Binder_U_Unforced_std__AAP8MessageLoopProxy_nbase__BEXXZABQBV34__std___nbase__V__allocator_H_std__X__V_std__.0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
mov ecx, dword [edi + 0x24]
push eax
call fcn.0041cbb0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4208ed
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov bl, 1
test esi, esi
je 0x4208fa
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
jne 0x420906
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049abdf
mov esp, ebp
pop ebp
ret