joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4416c0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x4b9170]
xorpd xmm0, xmm0
xor eax, ebp
mov dword [esp + 0x30], eax
movsd xmm1, qword [0x4bd650]
ucomisd xmm1, xmm0
jne 0x441844
jp 0x441844
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [0x4bd5f0]
mov edx, dword fs:[0x2c]
mov eax, dword [0x4bd660]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x441869
mov ecx, dword [0x4bd5f0]
mov edx, dword fs:[0x2c]
mov eax, dword [0x4bd670]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4418a2
rdtsc
lea esi, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 8], eax
mov dword [esp + 4], edx
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub edi, dword [0x4bd668]
movsd xmm2, qword [0x4a4350]
sbb ebx, dword [0x4bd66c]
movd xmm1, edi
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movd xmm0, ebx
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x4a4330]
subpd xmm1, xmmword [0x4a4340]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
xorpd xmm1, xmm1
divsd xmm0, qword [esp + 0x20]
ucomisd xmm2, xmm0
ja 0x441844
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub eax, dword [0x4bd658]
sbb ecx, dword [0x4bd65c]
movd xmm2, eax
movd xmm1, ecx
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x4a4330]
subpd xmm2, xmmword [0x4a4340]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x4bd650], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.004771d1
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4bd660
call fcn.00477217
add esp, 4
cmp dword [0x4bd660], 0xffffffff
jne 0x441732
rdtsc
mov dword [0x4bd658], eax
mov dword [0x4bd65c], edx
push 0x4bd660
call fcn.0047728d
add esp, 4
jmp 0x441732
push 0x4bd670
call fcn.00477217
add esp, 4
cmp dword [0x4bd670], 0xffffffff
jne 0x441753
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [0x4bd66c], ecx
mov dword [0x4bd668], eax
push 0x4bd670
call fcn.0047728d
add esp, 4
jmp 0x441753
Function at 0x4464b0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
movzx edx, byte [esi + 0xb]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ebp - 0x10], ecx
test dl, dl
mov dword [ebp - 0x20], edx
lea edx, [esi + edx]
lea ecx, [eax + ecx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
jb 0x44651d
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
imul eax, eax, 0x5bd1e995
add edx, 0xfffffffc
add ecx, 4
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
xor eax, edi
cmp edx, 3
ja 0x4464f0
cmp edx, 1
jne 0x446526
jmp 0x446542
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x446542
cmp edx, 2
je 0x446539
cmp edx, 3
jne 0x44654d
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ecx + 4]
xor ecx, ecx
test ebx, ebx
je 0x4466a8
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edx, ebx
mov edi, eax
shr edi, 0xf
xor edi, eax
mov eax, ebx
shr eax, 1
and eax, 0x55555555
sub edx, eax
mov eax, edx
shr edx, 2
and eax, 0x33333333
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
cmp eax, 1
mov dword [ebp - 0x24], eax
jbe 0x4465bb
cmp edi, ebx
mov edx, edi
jb 0x4465c0
mov eax, edi
xor edx, edx
div ebx
jmp 0x4465c0
lea edx, [ebx - 1]
and edx, edi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], edx
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4466a8
mov dword [ebp - 0x18], ebx
mov ebx, dword [eax]
test ebx, ebx
je 0x4466a8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
test cl, cl
lea eax, [eax - 1]
cmovns edx, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], edx
jmp 0x446616
and eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jne 0x4466a6
mov ebx, dword [ebx]
test ebx, ebx
je 0x4466a6
mov eax, dword [ebx + 4]
cmp eax, edi
jne 0x446670
movzx eax, byte [ebx + 0x13]
test al, al
mov ecx, eax
jns 0x44662a
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x44660c
lea ecx, [ebx + 8]
test al, al
mov edx, dword [ecx]
cmovs ecx, edx
js 0x446688
cmp dword [ebp - 0x10], 0
je 0x4466a2
cmp byte [esi], dl
jne 0x44660c
dec eax
xor ecx, ecx
nop dword [eax + eax]
cmp eax, ecx
je 0x4466a2
movzx edx, byte [ebx + ecx + 9]
cmp dl, byte [esi + ecx + 1]
lea ecx, [ecx + 1]
je 0x446650
jmp 0x44660c
cmp dword [ebp - 0x24], 1
jbe 0x446600
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x446603
xor edx, edx
div ecx
mov eax, edx
jmp 0x446603
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4466a2
push eax
push esi
push ecx
call fcn.0047996d
add esp, 0xc
test eax, eax
jne 0x44660c
mov ecx, ebx
jmp 0x4466a8
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x449b40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x4b9170]
mov ebx, ecx
lea esi, [ebp - 0x1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], edx
push edx
push ecx
push esi
call fcn.0043cae0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x449b6f
mov esi, dword [ebp - 0x1c]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
mov edi, eax
js 0x449bfd
test edi, edi
je 0x449c10
cmp dword [ebp + 8], 0
mov dword [ebp - 0x20], ebx
mov bl, 1
je 0x449c74
mov eax, edi
mov ecx, 0xffffffff
add eax, edi
cmovae ecx, eax
push ecx
call fcn.004771c3
add esp, 4
mov esi, eax
lea ebx, [ebp - 0x1c]
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push ebx
call fcn.0043cae0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x449bcb
mov ebx, dword [ebp - 0x1c]
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x449be5
push dword [ebp - 0x1c]
call fcn.00477190
add esp, 4
cmp word [esi], 0
mov bl, 1
je 0x449c14
xor eax, eax
nop
cmp word [esi + eax*2 + 2], 0
lea eax, [eax + 1]
jne 0x449bf0
jmp 0x449c16
push dword [ebp - 0x1c]
call fcn.00477190
add esp, 4
test edi, edi
jne 0x449b8a
xor ebx, ebx
jmp 0x449c74
xor eax, eax
lea ecx, [ebp - 0x1c]
push eax
push esi
push ecx
call fcn.0043cb40
add esp, 0xc
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
js 0x449c36
mov byte [ecx], 0
mov byte [ecx + 0xb], 0
jmp 0x449c5c
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
cmp byte [ecx + 0xb], 0
jns 0x449c5c
push dword [ecx]
call fcn.00477190
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [ecx + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [ecx + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ecx], xmm0
push esi
call fcn.004771cc
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004771d1
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44ee00
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov eax, dword [0x4b9170]
xor eax, ebp
mov dword [esp + 0x158], eax
mov ecx, dword [0x4bd5f0]
mov edx, dword fs:[0x2c]
mov eax, dword [0x4bdbdc]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x44ee55
mov ecx, dword [esp + 0x158]
xor ecx, ebp
call fcn.004771d1
mov eax, 0x4bdbd8
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4bdbdc
call fcn.00477217
add esp, 4
cmp dword [0x4bdbdc], 0xffffffff
jne 0x44ee3a
lea eax, [esp + 0x40]
push 0x118
push 0
push eax
call fcn.0047b380
add esp, 0xc
lea edi, [esp + 0x3c]
mov dword [esp + 0x3c], 0x11c
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 0
push 0
push dword [esp + 0x50]
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x50
call fcn.00477160
add esp, 4
mov ecx, dword [0x4bd5f0]
mov edx, dword fs:[0x2c]
mov esi, eax
mov eax, dword [0x4bdc04]
mov ebx, dword [esp + 0xc]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x44ef04
mov ecx, esi
push ebx
push 0x4bdbe0
push edi
call fcn.0044efa0
mov dword [0x4bdbd8], esi
push 0x4bdbdc
call fcn.0047728d
add esp, 4
jmp 0x44ee3a
push 0x4bdc04
call fcn.00477217
add esp, 4
cmp dword [0x4bdc04], 0xffffffff
jne 0x44eede
xorps xmm0, xmm0
lea eax, [esp + 0x10]
mov dword [esp + 0x30], 0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movsd xmm1, qword [esp + 0x20]
mov eax, dword [esp + 0x30]
movsd xmm0, qword [esp + 0x28]
movsd xmm2, qword [esp + 0x10]
movsd qword [0x4bdbf0], xmm1
movsd xmm1, qword [esp + 0x18]
mov dword [0x4bdc00], eax
movsd qword [0x4bdbf8], xmm0
movsd qword [0x4bdbe0], xmm2
movsd qword [0x4bdbe8], xmm1
push 0x4bdc04
call fcn.0047728d
add esp, 4
jmp 0x44eede

Function at 0x44f450
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov edx, dword [0x4b9170]
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x10]
xor edx, ebp
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 0
push edx
push esi
push edi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x44f4b8
mov eax, dword [ebp - 0x10]
mov esi, 0x3f4
add eax, 0xfffffffd
cmp eax, 1
ja 0x44f4b8
cmp dword [ebp - 0x14], 4
jne 0x44f4b8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
xor esi, esi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004771d1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret 8
Function at 0x44f4d0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.00477520
mov eax, dword [0x4b9170]
mov edi, dword [ebp + 8]
lea ebx, [ebp - 0x810]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x800
push 0xff
push ebx
call fcn.0047b380
add esp, 0xc
lea eax, [ebp - 0x1018]
mov dword [ebp - 0x1014], 1
mov dword [ebp - 0x1018], 0x800
lea ecx, [ebp - 0x1014]
push eax
push ebx
push ecx
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x44f5a2
mov eax, dword [ebp - 0x1014]
mov esi, dword [ebp + 0xc]
cmp eax, 2
je 0x44f559
mov edi, 0x3f4
cmp eax, 1
jne 0x44f5a2
mov ecx, esi
push ebx
jmp 0x44f59b
lea edi, [ebp - 0x1010]
push 0x800
push 0xff
push edi
call fcn.0047b380
add esp, 0xc
push 0x400
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
dec eax
mov edi, 0xea
cmp eax, 0x3ff
ja 0x44f5a2
mov ecx, esi
lea eax, [ebp - 0x1010]
push eax
call fcn.00426f98
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004771d1
mov eax, edi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x451820
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.00477520
mov eax, dword [0x4b9170]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4b9fc0]
cmp eax, 0xffffffff
je 0x45197f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x45197f
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.0047a880
add esp, 0xc
mov ecx, dword [0x4b9fc0]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.0045e390
add esp, 8
test ebx, ebx
je 0x45189b
push ebx
call fcn.004771cc
add esp, 4
lea edi, [ebp - 0x1410]
push 0xc00
push 0xff
push edi
call fcn.0047b380
add esp, 0xc
mov ecx, dword [0x4bd5f0]
mov edx, dword fs:[0x2c]
mov eax, dword [0x4be864]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x451994
mov esi, dword [0x4be860]
mov ecx, esi
call fcn.0043b300
push 0xc00
push 0x4bdc60
push edi
call fcn.0047a880
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov esi, 0x100
jmp 0x451918
cmp esi, 2
lea esi, [esi - 1]
jb 0x45196f
test al, 1
je 0x45196f
mov ebx, 0xfffff400
xor eax, eax
lea edi, [ebp - 0x810]
jmp 0x451938
add edi, 8
add ebx, 0xc
je 0x451910
mov ecx, dword [edi]
test ecx, ecx
je 0x451930
cmp dword [ebp + ebx - 0x810], 0
je 0x451930
mov edx, dword [edi + 4]
cmp edx, dword [ebp + ebx - 0x808]
jne 0x451930
mov edx, dword [ebp + ebx - 0x80c]
test edx, edx
je 0x451930
mov dword [edi], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x451930
push 2
push dword [ebp - 0x1414]
call fcn.0045e390
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004771d1
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4be864
call fcn.00477217
add esp, 4
cmp dword [0x4be864], 0xffffffff
jne 0x4518d5
push 4
call fcn.00477160
add esp, 4
mov ecx, eax
mov esi, eax
call fcn.0043b2f0
mov dword [0x4be860], esi
push 0x4be864
call fcn.0047728d
add esp, 4
jmp 0x4518d5

Function at 0x4519e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4b9fc0]
cmp eax, 0xffffffff
je 0x451a00
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x451a10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x4b9170]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4b9fc0]
cmp eax, 0xffffffff
je 0x451a3a
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x451a3f
call fcn.00451c00
mov ecx, dword [0x4bd5f0]
mov edx, dword fs:[0x2c]
mov eax, dword [0x4be864]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x451bb8
mov edi, dword [0x4be860]
mov ecx, edi
call fcn.0043b300
mov eax, dword [0x4bdc5c]
mov ecx, 0x100
inc eax
nop dword [eax + eax]
movzx edx, al
lea ebx, [edx + edx*2]
cmp dword [ebx*4 + 0x4bdc60], 0
je 0x451a96
inc eax
dec ecx
jne 0x451a80
jmp 0x451ac6
mov ecx, dword [ebp + 8]
lea eax, [ebx*4 + 0x4bdc60]
mov dword [0x4bdc5c], edx
mov dword [eax], 1
lea eax, [edx*4]
mov dword [eax + eax*2 + 0x4bdc64], ecx
mov dword [esi], edx
mov eax, dword [eax + eax*2 + 0x4bdc68]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov dword [ebp - 0x14], 0xffffffff
mov ebx, dword [esi]
cmp ebx, 0xffffffff
je 0x451ae4
mov dword [ebp - 0x14], 0
jmp 0x451b38
push 0xffffffffffffffff
call fcn.0043b490
add esp, 4
mov ebx, eax
push 0xffffffffffffffff
call fcn.0043b490
add esp, 4
lea edi, [ebp - 0x14]
mov ecx, edi
push ebx
push eax
push str.slot____kInvalidSlotValue
call fcn.0043b850
cmp dword [ebp - 0x14], 0
je 0x451b36
lea ebx, [ebp - 0x18]
push edi
push 0x197
push str..._.._base_threading_thread_local_storage.cc
push ebx
call fcn.0043bb50
add esp, 0x10
mov ecx, ebx
call fcn.0043bb20
mov ecx, ebx
call fcn.0043bb30
mov ebx, dword [esi]
cmp ebx, 0xff
mov dword [ebp - 0x14], 0xffffffff
jg 0x451b50
mov dword [ebp - 0x14], 0
jmp 0x451ba4
push 0x100
call fcn.0043b490
add esp, 4
mov edi, eax
push ebx
call fcn.0043b490
add esp, 4
lea esi, [ebp - 0x14]
mov ecx, esi
push edi
push eax
push str.slot____kThreadLocalStorageSize
call fcn.0043b850
cmp dword [ebp - 0x14], 0
je 0x451ba4
lea edi, [ebp - 0x18]
push esi
push 0x198
push str..._.._base_threading_thread_local_storage.cc
push edi
call fcn.0043bb50
add esp, 0x10
mov ecx, edi
call fcn.0043bb20
mov ecx, edi
call fcn.0043bb30
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004771d1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x4be864
call fcn.00477217
add esp, 4
cmp dword [0x4be864], 0xffffffff
jne 0x451a60
push 4
call fcn.00477160
add esp, 4
mov ecx, eax
mov edi, eax
call fcn.0043b2f0
mov dword [0x4be860], edi
push 0x4be864
call fcn.0047728d
add esp, 4
jmp 0x451a60
Function at 0x451c00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x80c
mov eax, dword [0x4b9170]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x810], 0xffffffff
mov eax, dword [0x4b9fc0]
cmp eax, 0xffffffff
mov dword [ebp - 0x810], eax
jne 0x451cf8
lea edi, [ebp - 0x810]
push edi
call fcn.0045e360
add esp, 4
test al, al
jne 0x451c72
lea esi, [ebp - 0x80c]
push str.PlatformThreadLocalStorage::AllocTLS_key_
push 0xd1
push str..._.._base_threading_thread_local_storage.cc
push esi
call fcn.0043bab0
add esp, 0x10
mov ecx, esi
call fcn.0043bb20
mov ecx, esi
call fcn.0043bb30
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x451ccf
push edi
call fcn.0045e360
add esp, 4
test al, al
je 0x451c93
cmp dword [ebp - 0x810], 0xffffffff
jne 0x451cbf
lea esi, [ebp - 0x80c]
push str.PlatformThreadLocalStorage::AllocTLS_key___key___PlatformThreadLocalStorage::TLS_KEY_OUT_OF_INDEXES
push 0xdb
push str..._.._base_threading_thread_local_storage.cc
push esi
call fcn.0043bab0
add esp, 0x10
mov ecx, esi
call fcn.0043bb20
mov ecx, esi
call fcn.0043bb30
push 0xffffffffffffffff
call fcn.0045e380
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x4b9fc0], ecx
mov eax, dword [ebp - 0x810]
je 0x451cf8
push eax
call fcn.0045e380
add esp, 4
mov eax, dword [0x4b9fc0]
mov dword [ebp - 0x810], eax
mov dword [ebp - 0x80c], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
and esi, 3
je 0x451d6c
push 0
call fcn.0043b490
add esp, 4
mov edi, eax
push esi
call fcn.0043b490
add esp, 4
lea esi, [ebp - 0x80c]
mov ecx, esi
push edi
push eax
push str.GetTlsVectorStateAndValue_key___TlsVectorState::kUninitialized
call fcn.0043b850
cmp dword [ebp - 0x80c], 0
je 0x451d76
lea edi, [ebp - 0x814]
push esi
push 0xed
push str..._.._base_threading_thread_local_storage.cc
push edi
call fcn.0043bb50
add esp, 0x10
mov ecx, edi
call fcn.0043bb20
mov ecx, edi
call fcn.0043bb30
jmp 0x451d76
mov dword [ebp - 0x80c], 0
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.0047b380
add esp, 0xc
lea eax, [ebp - 0x809]
push eax
push dword [ebp - 0x810]
call fcn.0045e390
add esp, 8
push 0x800
call fcn.004771c3
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.0047a880
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x810]
call fcn.0045e390
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004771d1
mov eax, esi
add esp, 0x80c
pop esi
pop edi
pop ebp
ret
Function at 0x457370
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
movzx edx, byte [esi + 0xb]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ebp - 0x10], ecx
test dl, dl
mov dword [ebp - 0x20], edx
lea edx, [esi + edx]
lea ecx, [eax + ecx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
jb 0x4573dd
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
imul eax, eax, 0x5bd1e995
add edx, 0xfffffffc
add ecx, 4
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
xor eax, edi
cmp edx, 3
ja 0x4573b0
cmp edx, 1
jne 0x4573e6
jmp 0x457402
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x457402
cmp edx, 2
je 0x4573f9
cmp edx, 3
jne 0x45740d
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ecx + 4]
xor ecx, ecx
test ebx, ebx
je 0x457568
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edx, ebx
mov edi, eax
shr edi, 0xf
xor edi, eax
mov eax, ebx
shr eax, 1
and eax, 0x55555555
sub edx, eax
mov eax, edx
shr edx, 2
and eax, 0x33333333
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
cmp eax, 1
mov dword [ebp - 0x24], eax
jbe 0x45747b
cmp edi, ebx
mov edx, edi
jb 0x457480
mov eax, edi
xor edx, edx
div ebx
jmp 0x457480
lea edx, [ebx - 1]
and edx, edi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], edx
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x457568
mov dword [ebp - 0x18], ebx
mov ebx, dword [eax]
test ebx, ebx
je 0x457568
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
test cl, cl
lea eax, [eax - 1]
cmovns edx, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], edx
jmp 0x4574d6
and eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jne 0x457566
mov ebx, dword [ebx]
test ebx, ebx
je 0x457566
mov eax, dword [ebx + 4]
cmp edi, eax
jne 0x457530
movzx eax, byte [ebx + 0x13]
test al, al
mov ecx, eax
jns 0x4574ea
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x4574cc
lea ecx, [ebx + 8]
test al, al
mov edx, dword [ecx]
cmovs ecx, edx
js 0x457548
cmp dword [ebp - 0x10], 0
je 0x457562
cmp byte [esi], dl
jne 0x4574cc
dec eax
xor ecx, ecx
nop dword [eax + eax]
cmp eax, ecx
je 0x457562
movzx edx, byte [ebx + ecx + 9]
cmp dl, byte [esi + ecx + 1]
lea ecx, [ecx + 1]
je 0x457510
jmp 0x4574cc
cmp dword [ebp - 0x24], 1
jbe 0x4574c0
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x4574c3
xor edx, edx
div ecx
mov eax, edx
jmp 0x4574c3
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x457562
push eax
push esi
push ecx
call fcn.0047996d
add esp, 0xc
test eax, eax
jne 0x4574cc
mov ecx, ebx
jmp 0x457568
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8