joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, ecx
xor edx, edx
mov esi, 0x21
mov edi, 0x21
shl eax, 0xb
nop word [eax + eax]
shr esi, 1
add esi, edx
mov ebx, dword [esi*4 + 0x4a09cc]
shl ebx, 0xb
cmp ebx, eax
je 0x404855
cmp ebx, eax
cmova edi, esi
lea esi, [esi + 1]
cmovb edx, esi
mov esi, edi
sub esi, edx
ja 0x404830
jmp 0x404858
inc esi
mov edx, esi
cmp edx, 0x20
ja 0x4048ec
mov eax, dword [edx*4 + 0x4a09cc]
mov esi, 0x2d7
shr eax, 0x15
cmp edx, 0x20
je 0x404883
mov esi, dword [edx*4 + 0x4a09d0]
shr esi, 0x15
test edx, edx
je 0x4048cf
mov edi, 0x1fffff
and edi, dword [edx*4 + 0x4a09c8]
mov edx, eax
not edx
add edx, esi
je 0x4048c8
sub ecx, edi
cmp eax, 0x2d8
mov edx, 0x2d7
cmovae edx, eax
dec esi
xor edi, edi
nop dword [eax]
cmp edx, eax
je 0x4048db
movzx ebx, byte [eax + 0x4a0a50]
add edi, ebx
cmp edi, ecx
ja 0x4048c8
inc eax
cmp esi, eax
jne 0x4048b0
mov eax, esi
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
mov edx, eax
not edx
add edx, esi
jne 0x404897
jmp 0x4048c8
mov ecx, edx
mov edx, 0x2d7
push 0x4a0954
call sym.core::panicking::panic_bounds_check::haf27547f44996d48
mov ecx, 0x21
mov edx, 0x21
push 0x4a0944
call sym.core::panicking::panic_bounds_check::haf27547f44996d48

Function at 0x404900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
xor esi, esi
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea edi, [esi + eax]
jne 0x404950
cmp edi, esi
jb 0x4049bb
cmp edi, dword [ebp + 0x10]
ja 0x4049c9
add esi, dword [ebp + 0xc]
nop word [eax + eax]
test eax, eax
je 0x404952
dec eax
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x404940
jmp 0x4049af
ja 0x404959
cmp edx, dword [ebp - 0x10]
mov esi, edi
jne 0x404915
mov edi, dword [ebp + 0x18]
movzx ecx, cx
mov al, 1
add edi, ebx
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebx]
lea esi, [ebx + 1]
test dl, dl
js 0x404990
mov ebx, esi
sub ecx, edx
jns 0x4049a7
jmp 0x4049b1
cmp esi, edi
je 0x4049d8
movzx esi, byte [ebx + 1]
and edx, 0x7f
add ebx, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x4049b1
xor al, 1
cmp ebx, edi
jne 0x404970
jmp 0x4049b1
xor eax, eax
and al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x4a0390
call sym.core::slice::index::slice_index_order_fail::h40cd09a6386d1bdc
mov edx, dword [ebp + 0x10]
mov ecx, edi
push 0x4a0390
call sym.core::slice::index::slice_end_index_len_fail::hb7bcdcb5c84f7e98
mov ecx, 0x4a0380
call sym.core::option::unwrap_failed::h400a3d34e496ce4a
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x40fe40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x442034]
mov edi, ecx
test esi, esi
je 0x40fee4
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x40fedc
je 0x40fe8e
test edi, edi
je 0x40fe92
mov eax, dword [edi]
xor ecx, ecx
mov ebx, 0
mov dword [edi], 0
or eax, dword [edi + 4]
mov dword [edi + 4], 0
je 0x40fe8a
mov ecx, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov edi, ecx
jmp 0x40fe96
xor eax, eax
jmp 0x40fedc
xor ebx, ebx
xor edi, edi
movzx eax, byte [0x4ac0d4]
mov ecx, 0x10
call sym.std::sys::pal::windows::alloc::process_heap_alloc::hf16b591a17783102
test eax, eax
je 0x40ff01
mov dword [eax], ebx
mov dword [eax + 4], edi
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.KERNEL32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.KERNEL32.dll_TlsSetValue
test edi, edi
je 0x40fed9
push edi
push 0
push dword [0x4ac0a0]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x442034
call sym.std::sys::thread_local::key::windows::LazyKey::init::h8219056d8c3ded71
mov esi, eax
push esi
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x40fe63
jmp 0x40fedc
mov ecx, 8
mov edx, 0x10
call sym.alloc::alloc::handle_alloc_error::h9a0385ddba01e206

Function at 0x40ff10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x442044]
test esi, esi
je 0x40ff94
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x40ff8c
je 0x40ff8a
movzx eax, byte [0x4ac0d4]
mov ecx, 8
call sym.std::sys::pal::windows::alloc::process_heap_alloc::hf16b591a17783102
test eax, eax
je 0x40ffad
mov dword [eax], 0
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.KERNEL32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.KERNEL32.dll_TlsSetValue
test edi, edi
je 0x40ff85
mov eax, dword [edi]
test eax, eax
je 0x40ff77
lock dec dword [eax]
jne 0x40ff77
mov ecx, dword [edi]
call sym.alloc::sync::Arc_LT_T_C_A_GT_::drop_slow::hc39c94033ce122a6
push edi
push 0
push dword [0x4ac0a0]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [ebp - 0x10]
jmp 0x40ff8c
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x442044
call sym.std::sys::thread_local::key::windows::LazyKey::init::h8219056d8c3ded71
mov esi, eax
push esi
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x40ff2d
jmp 0x40ff8c
mov ecx, 4
mov edx, 8
call sym.alloc::alloc::handle_alloc_error::h9a0385ddba01e206
nop dword [eax]
Function at 0x4100b0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x41011e
lea ebx, [esi + 0xc]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push 0
push ebx
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
mov dword [ebp - 0x30], eax
jne 0x410154
cmp dword [ebp - 0x14], 0
je 0x41013b
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x410166
mov edi, eax
mov eax, dword [entry1]
mov eax, dword [0x4ac0a4]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x4ac0a4], esi
jne 0x410100
mov eax, edi
inc eax
mov dword [esi], eax
push 0
push 0
push ebx
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x41014a
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x4101a0
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x41013f
mov edi, dword [ebp - 0x10]
jmp 0x41014a
mov edi, dword [esi]
jmp 0x410149
mov edi, eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
call sym.core::panicking::assert_failed::hb8c648543f8d8a15
push 0
push 4
push ebx
call sub.KERNEL32.dll_InitOnceComplete
lea ecx, [ebp - 0x2c]
mov edx, 0x4a2e48
mov dword [ebp - 0x2c], 0x4a2e10
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 0
call sym.core::panicking::panic_fmt::h653fda680bf9012e
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x4a2e10
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call sym.core::panicking::assert_failed::h62a725424a957060
nop

Function at 0x4101d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0x4a28c4
lea esi, [ebp - 0xc]
lea edx, [ebp - 8]
xor ecx, ecx
push 0x4a2e58
push eax
push 0x4a1aa0
push esi
push 0x4a1aa0
call sym.core::panicking::assert_failed_inner::h6755833cbf283ce8
nop word cs:[eax + eax]
nop dword [eax + eax]

Function at 0x410210
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0x4a2e68
lea esi, [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, 1
push 0x4a2e6c
push eax
push 0x4a1a90
push esi
push 0x4a1a90
call sym.core::panicking::assert_failed_inner::h6755833cbf283ce8
nop word cs:[eax + eax]
nop
Function at 0x410480
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x410497
test eax, eax
jne 0x4105fe
mov al, 1
mov dword [ebp - 0x10], eax
mov esi, dword [0x4ac0a4]
nop word cs:[eax + eax]
nop dword [eax]
test esi, esi
je 0x4104ec
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x410641
mov esi, dword [esi + 8]
test ebx, ebx
je 0x4104b0
dec ebx
push ebx
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x4104b0
push 0
push ebx
mov ebx, eax
call sub.KERNEL32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x4104b0
test byte [ebp - 0x10], 1
jne 0x4105fe
mov al, 1
mov dword [ebp - 0x10], eax
mov esi, dword [0x4ac0a4]
nop word cs:[eax + eax]
nop dword [eax + eax]
test esi, esi
je 0x41054c
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x410641
mov esi, dword [esi + 8]
test ebx, ebx
je 0x410510
dec ebx
push ebx
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x410510
push 0
push ebx
mov ebx, eax
call sub.KERNEL32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x410510
test byte [ebp - 0x10], 1
jne 0x4105fe
mov al, 1
mov dword [ebp - 0x10], eax
mov esi, dword [0x4ac0a4]
nop word cs:[eax + eax]
nop dword [eax + eax]
test esi, esi
je 0x4105ac
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x410641
mov esi, dword [esi + 8]
test ebx, ebx
je 0x410570
dec ebx
push ebx
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x410570
push 0
push ebx
mov ebx, eax
call sub.KERNEL32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x410570
test byte [ebp - 0x10], 1
jne 0x4105fe
mov al, 1
mov dword [ebp - 0x10], eax
mov esi, dword [0x4ac0a4]
nop dword [eax]
test esi, esi
je 0x4105f8
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x410641
mov esi, dword [esi + 8]
test ebx, ebx
je 0x4105c0
dec ebx
push ebx
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x4105c0
push 0
push ebx
mov ebx, eax
call sub.KERNEL32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x4105c0
test byte [ebp - 0x10], 1
je 0x410608
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov edi, dword [0x4ac0a4]
nop
test edi, edi
je 0x4105fe
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x410641
mov edi, dword [edi + 8]
test esi, esi
je 0x410610
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x410610
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
jmp 0x410610
mov ecx, 0x4a2e7c
call sym.core::option::unwrap_failed::h400a3d34e496ce4a
ud2
Function at 0x410ae0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x442024]
test esi, esi
je 0x410b56
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x410b4e
je 0x410b4c
movzx eax, byte [0x4ac0d4]
mov ecx, 0xc
call sym.std::sys::pal::windows::alloc::process_heap_alloc::hf16b591a17783102
test eax, eax
je 0x410b6f
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.KERNEL32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.KERNEL32.dll_TlsSetValue
test edi, edi
je 0x410b47
push edi
push 0
push dword [0x4ac0a0]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [ebp - 0x10]
jmp 0x410b4e
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x442024
call sym.std::sys::thread_local::key::windows::LazyKey::init::h8219056d8c3ded71
mov esi, eax
push esi
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x410afd
jmp 0x410b4e
mov ecx, 4
mov edx, 0xc
call sym.alloc::alloc::handle_alloc_error::h9a0385ddba01e206
nop
Function at 0x43aa30
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x442060], eax
cmp eax, 0xffffffff
je sym._pthread_tls_init.cold.12
add esp, 0xc
ret

Function at 0x43af40
Capabilities:
Print debug messages

Disassembly:
test eax, eax
je 0x43af70
push edi
push esi
push ebx
mov ebx, eax
add esp, 0xffffff80
mov dword [esp], eax
call sym._pthread_spin_destroy
cmp eax, 1
je 0x43af71
mov dword [ebx], 0xffffffff
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
ret
ret
lea ebx, [esp + 0x15]
xor eax, eax
mov esi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x3d]
mov ecx, 0x43
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
mov eax, 0x27
jne 0x43afc5
jmp 0x43afd3
cmp eax, 0x6a
je 0x43afdd
add eax, 1
cmp byte [ebx + eax], 0
jne 0x43afc0
cmp eax, 0x6a
je 0x43afdd
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + eax + 0x16], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sym._abort
lea esi, [esi]
Function at 0x43b080
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [0x4ac138], 1
je 0x43b095
call sym.__pthread_once_raw.part.5.constprop.11
mov eax, dword [0x442060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x43b0c0
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._pop_pthread_mem
mov ebx, eax
mov eax, dword [entry4]
test eax, eax
je 0x43b0ac
test ebx, ebx
je 0x43b0ac
mov dword [ebx + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x18], eax
sub esp, 0x10
lea eax, [ebx + 0x38]
call sym._replace_spin_keys.constprop.10
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call esi
lea edx, [ebx + 0x14]
mov dword [esp + 8], ebp
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je sym.___pthread_self_lite.cold.13
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x442060]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je sym.___pthread_self_lite.cold.13
add esp, 0x2c
mov esi, ebx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x43b300
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x43b330
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x43b3e0
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x43b410
cmp eax, 3
jne 0x43b31a
mov eax, dword [0x442060]
cmp eax, 0xffffffff
je 0x43b31a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x43b31a
test byte [eax + 0x20], 0x30
je 0x43b440
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x43b373
call sym.__pthread_cleanup_dest.part.8
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x43b3a5
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x43b397
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
lea eax, [ebx + 0x38]
call sym._replace_spin_keys.constprop.10
mov eax, ebx
call sym._push_pthread_mem
mov eax, dword [0x442060]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x43b31a
mov eax, dword [0x4ac114]
test eax, eax
je 0x43b31a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x4ac114], 0
sub esp, 4
jmp 0x43b31a
mov dword [esp + 4], sym._SetThreadName_VEH_4
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x4ac114], eax
mov eax, 1
add esp, 0x10
pop ebx
pop esi
pop edi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x43b4b2
test eax, eax
je 0x43b45a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x43b477
call sym.__pthread_cleanup_dest.part.8
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
test byte [ebx + 0x24], 4
je 0x43b4e1
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x43b49c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call sym._pthread_mutex_destroy
mov eax, esi
jmp 0x43b3b3
test eax, eax
je 0x43b4c2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call sym._pthread_mutex_destroy
lea eax, [ebx + 0x38]
call sym._replace_spin_keys.constprop.10
jmp 0x43b31a
mov dword [esp], edi
call sym._pthread_mutex_destroy
mov eax, esi
call sym._replace_spin_keys.constprop.10
jmp 0x43b31a
Function at 0x43b500
Capabilities:
Set thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov eax, dword [ecx]
mov esi, eax
mov dword [ebp - 0x1c], eax
call sym.__fpreset
mov dword [esp], 0x442058
lea ebx, [esi + 0x1c]
call sym._pthread_mutex_lock
mov dword [esp], ebx
call sym._pthread_mutex_lock
cmp dword [0x4ac138], 1
je 0x43b545
call sym.__pthread_once_raw.part.5.constprop.11
mov esi, dword [ebp - 0x1c]
mov eax, dword [0x442060]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp], ebx
call sym._pthread_mutex_unlock
lea eax, [esi + 0x70]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym.__setjmp3
test eax, eax
je 0x43b613
mov dword [esp], 0x442058
call sym._pthread_mutex_lock
mov esi, dword [ebp - 0x1c]
lea ebx, [esi + 0x1c]
mov dword [esp], ebx
call sym._pthread_mutex_lock
mov eax, esi
mov esi, dword [esi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x43b5b8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
je 0x43b65d
mov dword [esp], ebx
call sym._pthread_mutex_unlock
mov dword [esp], ebx
call sym._pthread_mutex_destroy
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x1c], 0xffffffff
mov dword [eax + 0x68], 1
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp], 0x442058
call sym._pthread_mutex_unlock
test eax, eax
jne 0x43b6a1
mov dword [esp], 0
call ebx
push eax
jmp 0x43b5f3
mov dword [esp], 0x442058
call sym._pthread_mutex_unlock
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
test eax, eax
je 0x43b69a
mov edx, dword [edx + 4]
mov dword [esp], edx
call eax
mov ebx, eax
mov dword [esp], 0x442058
call sym._pthread_mutex_lock
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], ebx
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x43b594
call sym.__pthread_cleanup_dest.part.8
jmp 0x43b594
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0xdeadbeef
mov dword [esp], ebx
call sym._pthread_mutex_unlock
mov dword [esp], ebx
call sym._pthread_mutex_destroy
mov eax, edi
call sym._push_pthread_mem
mov eax, dword [0x442060]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x43b5ed
mov ebx, pe_nt_image_headers32
jmp 0x43b633
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
lea esi, [esi]
Function at 0x43be70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x43be92
call sym.__pthread_cleanup_dest.part.8
test byte [ebx + 0x20], 0x30
jne 0x43beab
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
mov eax, dword [0x442060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x43beee
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x43bf32
mov esi, dword [ebx + 4]
mov dword [ebx + 0x68], 1
test eax, eax
je 0x43bee1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [ebx + 0x18], 0
test byte [ebx + 0x24], 4
jne 0x43bef7
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
mov dword [ebx + 0x14], 0
mov eax, ebx
call sym._push_pthread_mem
mov eax, dword [0x442060]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x43beee
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x43bf46
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jmp 0x43bf11

Function at 0x43fa20
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]