joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aa3ca
Capabilities:
Hash data with crc32

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4aa614
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ecx, eax
test esi, esi
not ecx
jmp 0x4aa402
test dl, 3
je 0x4aa404
mov al, byte [edx]
inc edx
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x661980]
dec esi
jne 0x4aa3ea
mov ebx, edx
cmp esi, 0x1f
jbe 0x4aa5b7
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x662180]
xor eax, dword [edx*4 + 0x662580]
movzx edx, cl
xor eax, dword [edx*4 + 0x661d80]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x661980]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x662180]
xor eax, dword [edx*4 + 0x662580]
movzx edx, cl
xor eax, dword [edx*4 + 0x661d80]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x661980]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x662180]
xor eax, dword [edx*4 + 0x662580]
movzx edx, cl
xor eax, dword [edx*4 + 0x661d80]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x661980]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x662180]
xor eax, dword [edx*4 + 0x662580]
movzx edx, cl
xor eax, dword [edx*4 + 0x661d80]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x661980]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x662180]
xor eax, dword [edx*4 + 0x662580]
movzx edx, cl
xor eax, dword [edx*4 + 0x661d80]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x661980]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x662180]
xor eax, dword [edx*4 + 0x662580]
movzx edx, cl
xor eax, dword [edx*4 + 0x661d80]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x661980]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x662180]
xor eax, dword [edx*4 + 0x662580]
movzx edx, cl
xor eax, dword [edx*4 + 0x661d80]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x661980]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
mov eax, dword [eax*4 + 0x662180]
xor eax, dword [edx*4 + 0x662580]
sub esi, 0x20
shr ecx, 0x10
movzx edx, cl
xor eax, dword [edx*4 + 0x661d80]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x661980]
jmp 0x4aa406
cmp esi, 3
jbe 0x4aa5f5
xor ecx, dword [ebx]
sub esi, 4
movzx eax, ch
movzx edx, cl
mov eax, dword [eax*4 + 0x662180]
add ebx, 4
shr ecx, 0x10
xor eax, dword [edx*4 + 0x662580]
movzx edx, cl
xor eax, dword [edx*4 + 0x661d80]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x661980]
jmp 0x4aa5b7
mov edx, ebx
test esi, esi
je 0x4aa610
mov al, byte [edx]
inc edx
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x661980]
dec esi
jmp 0x4aa5f9
mov eax, ecx
not eax
pop ebx
pop esi
pop ebp
ret
Function at 0x4ab37b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
mov edi, dword [ebp + 8]
test edi, edi
je 0x4ab39a
mov ebx, dword [edi + 0x1c]
test ebx, ebx
je 0x4ab39a
cmp dword [edi + 0x20], 0
je 0x4ab39a
cmp dword [edi + 0x24], 0
jne 0x4ab3a4
mov eax, 0xfffffffe
jmp 0x4ab4a4
mov dword [edi + 0x2c], 2
mov eax, dword [ebx + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x14], 0
mov dword [edi + 8], 0
mov dword [edi + 0x18], 0
mov dword [ebx + 0x14], 0
test eax, eax
jns 0x4ab3d9
neg eax
mov dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x18]
cmp edx, 1
sbb eax, eax
and eax, 0x47
add eax, 0x2a
cmp edx, 2
mov dword [ebx + 4], eax
jne 0x4ab3fc
push 0
push 0
push 0
call fcn.004aa3ca
jmp 0x4ab407
push 0
push 0
push 0
call fcn.004adbe0
add esp, 0xc
mov dword [edi + 0x30], eax
mov dword [ebx + 0x28], 0
push ebx
call fcn.004adf9f
pop edi
mov ecx, dword [ebx + 0x4c]
mov eax, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x44]
add eax, eax
cld
mov dword [ebx + 0x3c], eax
mov word [edi + ecx*2 - 2], 0
xor eax, eax
lea ecx, [ecx + ecx - 2]
rep stosb byte es:[edi], al
imul edx, dword [ebx + 0x84], 0xc
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x5c], 0
movzx eax, word [edx + 0x6639c2]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0
movzx eax, word [edx + 0x6639c0]
mov dword [ebx + 0x8c], eax
mov dword [ebx + 0x78], 2
movzx eax, word [edx + 0x6639c4]
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x60], 2
movzx eax, word [edx + 0x6639c6]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x48], 0
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x4abaa8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, eax
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x74]
mov edx, dword [esi + 0x3c]
sub edx, eax
mov eax, dword [ebp - 0x14]
add eax, dword [esi + 0x2c]
mov dword [ebp - 0x10], edx
sub eax, 0x106
mov edx, dword [esi + 0x6c]
sub dword [ebp - 0x10], edx
cmp edx, eax
jb 0x4abb44
push dword [ebp - 0x14]
mov edx, dword [esi + 0x38]
mov eax, dword [ebp - 0x14]
add eax, edx
push eax
push edx
call fcn.004bdd50
mov edx, dword [ebp - 0x14]
mov ecx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edx
add esp, 0xc
sub dword [esi + 0x6c], edx
lea eax, [eax + ecx*2]
sub dword [esi + 0x5c], edx
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x4abb16
mov ebx, edx
sub bx, word [ebp - 0x14]
dec ecx
mov word [eax], bx
jne 0x4abb03
mov ecx, dword [ebp - 0x14]
mov eax, dword [esi + 0x40]
lea eax, [eax + ecx*2]
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x4abb38
mov ebx, edx
sub bx, word [ebp - 0x14]
dec ecx
mov word [eax], bx
jne 0x4abb25
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov ebx, dword [esi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x4abbfc
mov edx, dword [esi + 0x6c]
mov edi, eax
mov dword [ebp - 0x18], edx
mov edx, dword [esi + 0x38]
add dword [ebp - 0x18], edx
mov edx, dword [esi + 0x74]
add dword [ebp - 0x18], edx
cmp eax, dword [ebp - 0x10]
jbe 0x4abb6d
mov edi, dword [ebp - 0x10]
xor edx, edx
test edi, edi
je 0x4abbbb
sub eax, edi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x4abb90
push edi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.004adbe0
jmp 0x4abba0
cmp eax, 2
jne 0x4abba6
push edi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.004aa3ca
add esp, 0xc
mov dword [ebx + 0x30], eax
push edi
push dword [ebx]
push dword [ebp - 0x18]
call fcn.004bdd50
add dword [ebx], edi
add dword [ebx + 8], edi
add esp, 0xc
mov edx, edi
mov eax, dword [esi + 0x74]
add eax, edx
mov dword [esi + 0x74], eax
cmp eax, 2
jbe 0x4abbe7
mov ebx, dword [esi + 0x6c]
mov edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [ebx + edx]
mov dword [esi + 0x48], eax
movzx edx, byte [edx + ebx + 1]
shl eax, cl
xor eax, edx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp dword [esi + 0x74], 0x105
ja 0x4abbfc
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x4abab9
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4ac4cf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
or eax, 0xffffffff
cmp dword [ebx + 0x3c], 0
jne 0x4ac539
cmp dword [ebx + 4], 0
jne 0x4ac52c
call sub.msvcrt.dll__errno
mov dword [eax], 0
push dword [ebx + 0x40]
push 0x4000
push 1
push dword [ebx + 0x44]
call sub.msvcrt.dll_fread
add esp, 0x10
test eax, eax
mov dword [ebx + 4], eax
jne 0x4ac527
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x3c], 1
test byte [eax + 0xc], 0x20
je 0x4ac522
mov dword [ebx + 0x38], 0xffffffff
or eax, 0xffffffff
jmp 0x4ac539
mov eax, dword [ebx + 0x44]
mov dword [ebx], eax
dec dword [ebx + 4]
mov eax, dword [ebx]
movzx edx, byte [eax]
inc eax
mov dword [ebx], eax
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4ac53e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, dword [eax + 4]
mov esi, eax
cmp ebx, 1
ja 0x4ac5b1
test ebx, ebx
je 0x4ac55b
mov edx, dword [esi]
mov eax, dword [eax + 0x44]
mov dl, byte [edx]
mov byte [eax], dl
call sub.msvcrt.dll__errno
mov cl, bl
add ebx, dword [esi + 0x44]
mov dword [eax], 0
mov eax, 0x4000
push dword [esi + 0x40]
sar eax, cl
push eax
push 1
push ebx
call sub.msvcrt.dll_fread
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x4ac597
mov eax, dword [esi + 0x40]
test byte [eax + 0xc], 0x20
je 0x4ac597
mov dword [esi + 0x38], 0xffffffff
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x44]
add edx, ebx
mov dword [esi], eax
mov dword [esi + 4], edx
cmp edx, 1
ja 0x4ac5b1
mov dword [esi + 0x58], edx
jmp 0x4ac682
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x4ac5be
cmp byte [eax + 1], 0x8b
je 0x4ac5ca
mov dword [esi + 0x58], 1
jmp 0x4ac682
sub dword [esi + 4], 2
add eax, 2
mov dword [esi], eax
mov eax, esi
call fcn.004ac4cf
mov ebx, eax
mov eax, esi
call fcn.004ac4cf
cmp ebx, 8
mov edi, eax
jne 0x4ac5f0
mov bl, 5
test al, 0xe0
je 0x4ac5fc
mov dword [esi + 0x38], 0xfffffffd
jmp 0x4ac682
mov eax, esi
call fcn.004ac4cf
dec ebx
jns 0x4ac5fc
test edi, 4
je 0x4ac633
mov eax, esi
call fcn.004ac4cf
mov ebx, eax
mov eax, esi
call fcn.004ac4cf
shl eax, 8
add ebx, eax
dec ebx
cmp ebx, 0xffffffff
je 0x4ac633
mov eax, esi
call fcn.004ac4cf
inc eax
jne 0x4ac623
test edi, 8
je 0x4ac649
mov eax, esi
call fcn.004ac4cf
test eax, eax
je 0x4ac649
inc eax
jmp 0x4ac639
test edi, 0x10
je 0x4ac65f
mov eax, esi
call fcn.004ac4cf
test eax, eax
je 0x4ac65f
inc eax
jmp 0x4ac64f
and edi, 2
je 0x4ac672
mov eax, esi
call fcn.004ac4cf
mov eax, esi
call fcn.004ac4cf
mov eax, dword [esi + 0x3c]
cmp eax, 1
sbb eax, eax
not eax
and eax, 0xfffffffd
mov dword [esi + 0x38], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4acd46
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
test ebx, ebx
je 0x4acd5f
cmp byte [ebx + 0x5c], 0x77
je 0x4acd72
mov eax, 0xfffffffe
jmp 0x4acdea
mov dword [ebx + 0x38], 0xffffffff
jmp 0x4acdd8
mov dword [ebx], edi
mov dword [ebx + 4], esi
test esi, esi
je 0x4acdd8
cmp dword [ebx + 0x10], 0
jne 0x4acda8
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0xc], eax
push dword [ebx + 0x40]
push 0x4000
push 1
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp eax, 0x4000
jne 0x4acd69
mov dword [ebx + 0x10], 0x4000
mov eax, dword [ebx + 4]
add dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x10]
add dword [ebx + 0x68], eax
push 0
push ebx
call fcn.004aaa70
mov edx, dword [ebx + 0x68]
mov ecx, dword [ebx + 4]
sub dword [ebx + 0x64], ecx
mov dword [ebx + 0x38], eax
sub edx, dword [ebx + 0x10]
test eax, eax
mov dword [ebx + 0x68], edx
pop edx
pop edx
jne 0x4acdd8
test ecx, ecx
jmp 0x4acd79
push esi
push edi
push dword [ebx + 0x4c]
call fcn.004aa3ca
mov dword [ebx + 0x4c], eax
mov eax, esi
sub eax, dword [ebx + 4]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4ace90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
test eax, eax
push ebx
push ebx
mov ebx, eax
mov dword [ebp - 0x10], edx
je 0x4acea8
cmp byte [eax + 0x5c], 0x77
je 0x4aceb2
mov eax, 0xfffffffe
jmp 0x4acf44
mov dword [eax + 4], 0
mov eax, 0x4000
mov esi, eax
sub esi, dword [ebx + 0x10]
je 0x4acee7
push dword [ebx + 0x40]
push esi
push 1
push dword [ebx + 0x48]
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp eax, esi
jne 0x4acf36
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0x10], 0x4000
mov dword [ebx + 0xc], eax
test edi, edi
jne 0x4acf2c
mov eax, dword [ebx + 0x10]
push dword [ebp - 0x10]
add dword [ebx + 0x68], eax
push ebx
call fcn.004aaa70
mov edx, dword [ebx + 0x10]
sub dword [ebx + 0x68], edx
pop edi
mov dword [ebx + 0x38], eax
pop ecx
test esi, esi
jne 0x4acf15
cmp eax, 0xfffffffb
jne 0x4acf15
mov dword [ebx + 0x38], 0
xor edi, edi
test edx, edx
jne 0x4acf21
cmp dword [ebx + 0x38], 1
jne 0x4acf26
mov edi, 1
cmp dword [ebx + 0x38], 1
jbe 0x4aceb9
mov eax, dword [ebx + 0x38]
cmp eax, 1
jne 0x4acf44
jmp 0x4acf42
or eax, 0xffffffff
mov dword [ebx + 0x38], 0xffffffff
jmp 0x4acf44
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4b43d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 0x78
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
cmp eax, dword [ebp - 4]
jbe 0x4b448a
sub esp, 8
push dword [ebp + 0xc]
mov eax, dword [ebp - 4]
lea ecx, [eax*4]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, dword [ecx + edx]
push eax
call sub.KERNEL32.DLL_lstrcmpA
add esp, 8
test eax, eax
jne 0x4b4483
mov eax, dword [ebp - 4]
lea edx, [eax + eax]
mov eax, dword [ebp - 0x18]
mov ax, word [edx + eax]
and eax, 0xffff
lea ecx, [eax*4]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
add eax, dword [ecx + edx]
mov dword [ebp - 0x24], eax
jmp 0x4b4491
lea eax, [ebp - 4]
inc dword [eax]
jmp 0x4b442b
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
leave
ret

Function at 0x4b6eb0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x4b6ee6
mov dword [0x676870], eax
mov edx, 0x4b6e90
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004bc750
test eax, eax
sete al
movzx eax, al
mov dword [0x4fdec0], eax
leave
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x4fdec0], eax
leave
ret
Function at 0x4b6fd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], 0x4b61a0
mov dword [ebp - 0x24], 0x4bee14
mov dword [ebp - 0x1c], 0x4b7090
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.004bcf00
cmp dword [0x4fdec0], 0
mov dword [ebp - 0x44], 0x676880
je 0x4b7070
jl 0x4b70b0
mov dword [ebp - 0x3c], 1
mov eax, dword [0x676870]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x4b7153
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.004bcfe0
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x677250]
mov eax, 0xffffffff
test edx, edx
je 0x4b70ca
mov eax, dword [0x4fdec4]
test eax, eax
je 0x4b710a
xor eax, eax
test eax, eax
jne 0x4b7100
mov edi, dword [0x4fdec0]
test edi, edi
js 0x4b7100
mov dword [ebp - 0x44], 0x676880
mov ebx, dword [0x4fdec0]
test ebx, ebx
je 0x4b7070
jmp 0x4b701e
xor esi, esi
mov dword [0x4fdec0], esi
jmp 0x4b70d8
mov dword [esp], 0x4fdec8
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.DLL_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x4b7191
mov eax, dword [0x4fdec4]
test eax, eax
jne 0x4b70c8
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x4fdec4]
test eax, eax
je 0x4b712d
jmp 0x4b70c8
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x4b7185
mov dword [esp + 4], eax
mov eax, dword [0x676870]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x4b71ba
test edx, edx
je 0x4b71a5
mov dword [ebp - 0x3c], 1
call fcn.004b5ce0
call fcn.004b6eb0
mov eax, 1
mov dword [0x4fdec4], eax
jmp 0x4b70c8
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x4b7066
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
jmp 0x4b7181
Function at 0x4bcdf0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x677460]
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x4bce30
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.004bc750
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x4bd1e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x677460]
mov edi, dword [ebp + 8]
test eax, eax
je 0x4bd2bc
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x4bd2d1
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x4bd290
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x4bd228
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x4bd238
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x4bd283
test edx, edx
jne 0x4bd276
test ecx, ecx
je 0x4bd220
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x4bd2e0
cmp eax, 8
je 0x4bd220
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x4bd212
call fcn.004bc820
mov eax, dword [0x677460]
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x4bd204
call fcn.004bce50
mov eax, dword [0x677460]
jmp 0x4bd204
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.004bd150
cmp eax, 7
jne 0x4bd27b
mov eax, dword [0x677460]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x4bd333
mov edi, dword [eax + 0x30]
test edi, edi
js 0x4bd35e
mov esi, dword [eax + 0x30]
test esi, esi
jne 0x4bd33f
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.004bc820
mov eax, dword [0x677460]
jmp 0x4bd311
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4bd322
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x4bd322
call fcn.004bce50
mov eax, dword [0x677460]
jmp 0x4bd318
Function at 0x4bd5c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x677460]
mov edi, dword [ebp + 8]
test eax, eax
je 0x4bd654
mov esi, dword [eax + 0x30]
test esi, esi
js 0x4bd670
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x4bd690
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x4bd648
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.004bd150
cmp eax, 7
jne 0x4bd70f
mov eax, dword [0x677460]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x4bd6e6
mov edx, dword [eax + 0x30]
test edx, edx
js 0x4bd700
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x4bd6c0
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.004bd370
jmp 0x4bd605
call fcn.004bc820
mov eax, dword [0x677460]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x4bd5e0
lea esi, [esi]
call fcn.004bce50
mov eax, dword [0x677460]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x4bd5eb
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x4bd5ee
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4bd637
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x4bd637
call fcn.004bc820
mov eax, dword [0x677460]
mov edx, dword [eax + 0x30]
test edx, edx
jns 0x4bd629
nop
lea esi, [esi]
call fcn.004bce50
mov eax, dword [0x677460]
jmp 0x4bd629
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x4bd720
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x4bd7b2
mov eax, dword [0x677460]
test eax, eax
je 0x4bd7a6
mov ebx, dword [eax + 0x30]
test ebx, ebx
js 0x4bd821
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x4bd7c7
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.004bd370
cmp eax, 7
jne 0x4bd83f
mov eax, dword [0x677460]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x4bd812
mov edx, dword [eax + 0x30]
test edx, edx
js 0x4bd830
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x4bd7f3
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.004bc820
mov eax, dword [0x677460]
jmp 0x4bd742
mov dword [esp], edi
call fcn.004bd1e0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x4bd757
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4bd795
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x4bd795
call fcn.004bc820
mov eax, dword [0x677460]
jmp 0x4bd780
call fcn.004bce50
mov eax, dword [0x677460]
jmp 0x4bd74d
call fcn.004bce50
mov eax, dword [0x677460]
jmp 0x4bd78b
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]