joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432700
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x432771
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x432771
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x4327b5
cmp esi, eax
jne 0x432765
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x43279e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x4327e3
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x432805
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.0045a086
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
pop ebp
ret 0xc
cmp eax, esi
jne 0x4327eb
mov dword [ecx], edi
jmp 0x432805
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x432805
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.004321a0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
pop ebp
ret 0xc

Function at 0x435ca0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x495e2c]
push esi
mov esi, ecx
test eax, 0xfffffffe
jne 0x435cdf
push 0x495e2c
call fcn.004168e0
add esp, 4
test al, al
je 0x435cdf
mov ecx, 0x495e30
call fcn.004212c0
push 0
push 0x495e2c
push eax
push 0x495e2c
call fcn.00416930
add esp, 0x10
mov eax, dword [0x495e2c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x435d08
mov eax, dword [eax]
mov dword [esi], eax
test eax, eax
je 0x435d0e
mov ecx, 1
add eax, 4
lock xadd dword [eax], ecx
mov eax, esi
pop esi
ret
mov dword [esi], 0
mov eax, esi
pop esi
ret
Function at 0x435d20
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb8
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, dword [eax]
mov dword [esp + 0xc], ebx
mov dword [esi], eax
test eax, eax
je 0x435d4d
mov ecx, 1
add eax, 4
lock xadd dword [eax], ecx
mov eax, dword [0x495e2c]
test eax, 0xfffffffe
jne 0x435d89
push 0x495e2c
call fcn.004168e0
add esp, 4
test al, al
je 0x435d89
mov ecx, 0x495e30
call fcn.004212c0
push 0
push 0x495e2c
push eax
push 0x495e2c
call fcn.00416930
add esp, 0x10
mov eax, dword [0x495e2c]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x435dd8
cmp dword [0x494e44], 3
jg 0x435dca
push 3
push 0x23
push str.d:webapps_b_build_slave_repo_build_src_base_threading_thread_local_win.cc
lea ecx, [esp + 0x1c]
lea ebx, [eax + 4]
call fcn.00413f50
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.0040b370
add esp, 8
test bl, 4
je 0x435dd8
lea ecx, [esp + 0x10]
call fcn.00414010
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x435df0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb8
mov eax, dword [0x495e2c]
push ebx
xor ebx, ebx
mov dword [esp + 8], ebx
push esi
mov esi, ecx
test eax, 0xfffffffe
jne 0x435e41
push 0x495e2c
call fcn.004168e0
add esp, 4
test al, al
je 0x435e41
mov ecx, 0x495e30
call fcn.004212c0
push ebx
push 0x495e2c
push eax
push 0x495e2c
call fcn.00416930
add esp, 0x10
mov eax, dword [0x495e2c]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x435e91
cmp dword [0x494e44], 3
jg 0x435e83
push 3
push 0x23
push str.d:webapps_b_build_slave_repo_build_src_base_threading_thread_local_win.cc
lea ecx, [esp + 0x1c]
lea ebx, [eax + 2]
call fcn.00413f50
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.0040b370
add esp, 8
test bl, 2
je 0x435e91
lea ecx, [esp + 0x10]
call fcn.00414010
mov ecx, dword [esi]
test ecx, ecx
je 0x435ecd
add ecx, 4
or eax, 0xffffffff
lock xadd dword [ecx], eax
sub eax, 1
setne al
test al, al
jne 0x435ecd
test ecx, ecx
je 0x435eb4
add ecx, 0xfffffffc
jmp 0x435eb6
xor ecx, ecx
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, 0x48c550
jne 0x435ed3
push 1
call dword [eax + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call edx
jmp 0x435ecd
Function at 0x437010
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x494ed4]
mov dword [esp], 0
push ebx
push esi
push edi
mov edi, ecx
test eax, 0xfffffffe
jne 0x437061
push 0x494ed4
call fcn.004168e0
add esp, 4
test al, al
je 0x437061
mov ecx, 0x494ed8
call fcn.004212c0
push 0
push 0x494ed4
push eax
push 0x494ed4
call fcn.00416930
add esp, 0x10
mov eax, dword [0x494ed4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 1
cmp byte [eax + 0x6d], 0
lea eax, [esp + 0x28]
je 0x4370ad
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
push 0xf
push 0xf
push 0
push eax
call esi
test eax, eax
jne 0x4370a9
push 1
push 0x113
push 0x113
push eax
lea eax, [esp + 0x34]
push eax
call esi
test eax, eax
jne 0x4370a9
xor bl, bl
jmp 0x4370bf
mov bl, 1
jmp 0x4370bf
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
setne bl
mov esi, dword [0x495e48]
test esi, esi
jne 0x4370ed
call fcn.00431050
test eax, eax
jne 0x4370d9
mov esi, 0x495db1
jmp 0x4370e7
push 0x48cb94
mov ecx, eax
call fcn.0042f410
mov esi, eax
mov dword [0x495e48], esi
mov dword [esp + 0x10], 0
test byte [esi], 0xd
je 0x437132
lea eax, [esp + 0x28]
mov edx, esi
push eax
push 0x48cb90
sub esp, 0x18
push str.origin_base::MessagePumpForUI::ProcessPumpReplacementMessage
call fcn.004379c0
mov dword [esp + 0x40], eax
add esp, 0x24
lea eax, [esp + 0x14]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], str.origin_base::MessagePumpForUI::ProcessPumpReplacementMessage
mov dword [esp + 0x20], edx
mov dword [esp + 0x10], eax
xor ecx, ecx
lea eax, [edi + 0x28]
xchg dword [eax], ecx
test bl, bl
je 0x437152
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
lea eax, [esp + 0x24]
mov ecx, edi
push eax
call fcn.00436d00
mov bl, al
cmp dword [esp + 0x10], 0
je 0x43717e
mov ecx, dword [esp + 0x14]
cmp byte [ecx], 0
je 0x43717e
call fcn.00431050
push dword [esp + 0x20]
mov ecx, eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.004305c0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x437b80
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x494ed4]
push esi
mov esi, ecx
test eax, 0xfffffffe
jne 0x437bbf
push 0x494ed4
call fcn.004168e0
add esp, 4
test al, al
je 0x437bbf
mov ecx, 0x494ed8
call fcn.004212c0
push 0
push 0x494ed4
push eax
push 0x494ed4
call fcn.00416930
add esp, 0x10
mov eax, dword [0x494ed4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi], eax
mov eax, esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], esi
pop esi
ret
Function at 0x439a60
Capabilities:
Get thread local storage value

Disassembly:
push edi
mov edi, ecx
call fcn.00439db0
mov eax, dword [0x492df8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
test edx, edx
jne 0x439a81
call fcn.00441dc0
mov edx, eax
mov eax, dword [0x495e98]
cmp dword [edx + eax*4], 0
jne 0x439ac2
push 0x70
call fcn.0045a053
add esp, 4
mov ecx, eax
push edi
call fcn.004397e0
mov ecx, dword [0x492df8]
mov edi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
test ecx, ecx
jne 0x439aba
call fcn.00441dc0
mov ecx, eax
mov eax, dword [0x495e98]
mov dword [ecx + eax*4], edi
pop edi
ret

Function at 0x439ad0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x495e94]
push ebx
push esi
push edi
test eax, eax
jne 0x439ae0
pop edi
pop esi
pop ebx
ret
mov eax, dword [0x492df8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
test ecx, ecx
jne 0x439af9
call fcn.00441dc0
mov ecx, eax
mov eax, dword [0x495e98]
mov eax, dword [ecx + eax*4]
test eax, eax
jne 0x439b89
mov ecx, 0x495e5c
xor edi, edi
xor ebx, ebx
call fcn.00415780
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x495e78]
test ecx, ecx
je 0x439b39
mov eax, dword [ecx + 4]
mov edi, ecx
mov dword [0x495e78], eax
mov dword [ecx + 4], ebx
jmp 0x439b46
mov ebx, dword [0x495e9c]
inc ebx
mov dword [0x495e9c], ebx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x439b65
push 0x70
call fcn.0045a053
add esp, 4
mov ecx, eax
push ebx
call fcn.004398b0
mov edi, eax
mov ecx, dword [0x492df8]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
test ecx, ecx
jne 0x439b7f
call fcn.00441dc0
mov ecx, eax
mov eax, dword [0x495e98]
mov dword [ecx + eax*4], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x43a840
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x492250]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x68]
mov dword [ebp - 0x68], eax
lea ecx, [ebp - 0x60]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x64], eax
call fcn.004161b0
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x70]
call fcn.004162d0
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
call fcn.0043a7a0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
call fcn.0045a313
mov esp, ebp
pop ebp
ret
Function at 0x43a8c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ecx]
mov ecx, dword [ecx + 4]
sub ecx, edi
sar ecx, 2
test ecx, ecx
je 0x43a930
push ebx
push esi
mov ebx, ecx
mov eax, dword [edi]
lea edi, [edi + 4]
movzx esi, cl
movzx edx, al
xor esi, edx
shr ecx, 8
mov dword [ebp - 4], eax
movzx eax, ah
xor ecx, dword [esi*4 + 0x48ce30]
movzx edx, cl
xor edx, eax
shr ecx, 8
movzx eax, byte [ebp - 2]
xor ecx, dword [edx*4 + 0x48ce30]
movzx edx, cl
xor edx, eax
shr ecx, 8
movzx eax, byte [ebp - 1]
xor ecx, dword [edx*4 + 0x48ce30]
movzx edx, cl
xor edx, eax
shr ecx, 8
xor ecx, dword [edx*4 + 0x48ce30]
sub ebx, 1
jne 0x43a8d7
pop esi
pop ebx
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x43c850
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x492df8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
test ecx, ecx
jne 0x43c86a
call fcn.00441dc0
mov ecx, eax
mov eax, dword [0x495ed0]
mov eax, dword [ecx + eax*4]
test eax, eax
jne 0x43c8b6
push 0xc
call fcn.0045a053
mov esi, eax
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov eax, dword [0x492df8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x43c8ab
call fcn.00441dc0
mov ecx, dword [0x495ed0]
mov dword [eax + ecx*4], esi
mov eax, esi
pop esi
ret
Function at 0x43dc30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
mov esi, dword [ebx + 4]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
shl ecx, 3
mov dword [ebp - 4], ecx
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
cmp esi, eax
je 0x43dcb3
mov esi, dword [ecx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x43dcb3
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x43dca1
cmp esi, eax
jne 0x43dc93
jmp 0x43dcb6
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
push edx
push dword [eax]
call fcn.0043dd50
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x43dcf0
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 4]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x43dd0a
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x43dd2c
cmp eax, esi
jne 0x43dd12
mov dword [ecx], edi
jmp 0x43dd2c
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x43dd2c
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.004321a0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x441620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
aam 0x88
pop ebp
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00441207
push eax
push esi
push dword [ebp + 8]
call fcn.004411bc
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004411f7
invalid
Function at 0x441dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.00441207
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004411bc
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.004411f7
aam 0x2d
and byte ss:[ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.00441207
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004411bc
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.004411f7
xor ebx, ecx
mov byte [0x104681e], al
add byte [eax], al
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x441eeb
cmp dword [ebp - 0x398], 0
je 0x4420b5
cmp dword [ebp + 0xc], 1
je 0x4420b5
cmp dword [ebp + 0xc], 8
invalid
Function at 0x4445a0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2d4
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], ebx
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [edi + 0x40], ebx
mov eax, dword [0x495f08]
test eax, 0xfffffffe
jne 0x444606
push 0x495f08
call fcn.004168e0
add esp, 4
test al, al
je 0x444606
mov ecx, 0x495f0c
call fcn.004212c0
push 0x444ab0
push 0x495f08
push eax
push 0x495f08
call fcn.00416930
add esp, 0x10
mov eax, dword [0x495f08]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x444659
cmp dword [0x494e44], 3
jg 0x444648
push 3
push 0x23
push str.d:webapps_b_build_slave_repo_build_src_base_threading_thread_local_win.cc
lea ecx, [esp + 0x2c]
lea ebx, [eax + 0x10]
call fcn.00413f50
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.0040b370
add esp, 8
test bl, 0x10
je 0x444659
lea ecx, [esp + 0x20]
and ebx, 0xffffffef
call fcn.00414010
mov edx, dword [ebp + 8]
mov eax, 2
cmp dword [edx + 8], 0
mov esi, dword [edx]
cmovne esi, eax
mov eax, dword [edx + 4]
mov dword [edi + 0x4c], eax
sub esp, 0x20
mov ecx, dword [edx + 8]
mov eax, esp
mov dword [esp + 0x34], eax
mov dword [eax], ecx
test ecx, ecx
je 0x44468b
mov eax, 1
lock xadd dword [ecx], eax
mov eax, dword [edx + 0xc]
mov ecx, dword [esp + 0x34]
push 0xffffffffffffffff
push 0
mov dword [ecx + 4], eax
add ecx, 8
lea eax, [edx + 0x10]
push eax
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.0040a0c0
mov edx, esi
lea ecx, [esp + 0x38]
call fcn.0041f950
mov esi, dword [esp + 0x38]
add esp, 0x20
mov dword [edi + 0x48], esi
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
add edi, 0x28
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x2c]
mov ecx, dword [ecx + 0x28]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
lea edx, [eax + 0x24]
mov dword [esp + 0x18], edx
test bl, 0x20
je 0x44471a
lea ecx, [esp + 0xd0]
and ebx, 0xffffffdf
call fcn.00414010
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push dword [esp + 0x1c]
push edx
mov edx, eax
call fcn.00425890
add esp, 8
test al, al
jne 0x444754
test bl, 4
je 0x44473e
lea ecx, [esp + 0x180]
call fcn.00414010
mov eax, dword [esp + 0x10]
push edi
mov dword [eax + 0x48], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor bl, bl
jmp 0x444770
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
test bl, 8
je 0x44476e
lea ecx, [esp + 0x230]
call fcn.00414010
mov bl, 1
test esi, esi
je 0x44477c
mov edx, dword [esi]
mov ecx, esi
push 1
call dword [edx]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x445d90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov dword [esp + 0xc], 0
mov esi, edx
cmp dword [ecx + 0x14], 8
push edi
jb 0x445dae
mov ecx, dword [ecx]
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x445e39
mov edi, dword [esp + 0x10]
test edi, edi
je 0x445e39
mov edx, dword [ebp + 8]
cmp dword [edx + 0x14], 8
jb 0x445df0
mov edx, dword [edx]
cmp dword [esi + 0x14], 8
jb 0x445df8
mov esi, dword [esi]
mov ecx, edx
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x445e00
sub ecx, ebx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
push edi
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x445e50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov dword [esp + 0xc], 0
mov esi, edx
cmp dword [ecx + 0x14], 8
push edi
jb 0x445e6e
mov ecx, dword [ecx]
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x445ef9
mov edi, dword [esp + 0x10]
test edi, edi
je 0x445ef9
mov edx, dword [ebp + 8]
cmp dword [edx + 0x14], 8
jb 0x445eb0
mov edx, dword [edx]
cmp dword [esi + 0x14], 8
jb 0x445eb8
mov esi, dword [esi]
mov ecx, edx
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x445ec0
sub ecx, ebx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
push edi
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446b50
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x492250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
mov eax, 0x1400
cmp ax, di
je 0x446bff
push 9
lea eax, [ebp - 0x18]
mov ebx, edi
push eax
push 0x59
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jle 0x446bff
mov ecx, dword [ebp - 0x1c]
dec eax
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00409bb0
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x446bb7
mov eax, dword [esi]
jmp 0x446bb9
mov eax, esi
xor ecx, ecx
and edi, 0xfc00
mov word [eax], cx
xor eax, eax
cmp ax, di
je 0x446bec
push 9
lea eax, [ebp - 0x18]
push eax
push 0x5a
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jle 0x446bec
dec eax
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00409bb0
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045a313
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045a313
mov esp, ebp
pop ebp
ret

Function at 0x448033
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.004479a1
pop ecx
pop ecx
test al, al
je 0x4480c8
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004488ad
add esp, 0x14
test al, al
je 0x4480c8
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call fcn.00448806
pop ecx
pop ecx
test al, al
je 0x4480c8
push esi
push edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x14]
call fcn.004486b1
pop ecx
pop ecx
test al, al
jne 0x4480ba
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x4480a2
push dword [ebp - 0x10]
call edi
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x4480c6
push 0xc000013a
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call edi
jmp 0x4480c6
mov edi, dword [ebp + 0x1c]
lea esi, [ebp - 0x14]
mov bl, 1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea ecx, [ebp - 4]
call fcn.0040f500
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret