joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413b28
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x47a040]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x413b98
test edx, edx
jne 0x413b74
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x10], eax
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x413ba7
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edi
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push ecx
mov eax, dword [ebp - 0x2c]
jmp 0x413b47
call dbg.fc_key_init_once
mov eax, dword [0x47a040]
mov edx, dword [eax + 0x28]
jmp 0x413b40
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
lea esi, [esi]

Function at 0x413c8c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov eax, dword [0x47a040]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x413d71
test edx, edx
jne 0x413d10
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
test eax, eax
je 0x413d03
lea esi, [ebp - 0x20]
jmp 0x413cc3
mov dword [ebp - 0x20], eax
mov eax, dword [eax + 0x18]
test eax, eax
je 0x413cfa
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 1
mov dword [esp], 1
call eax
cmp eax, 6
je 0x413d38
cmp eax, 8
jne 0x413d64
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
test eax, eax
jne 0x413cc0
mov eax, 5
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edi
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push ecx
mov eax, dword [ebp - 0x2c]
jmp 0x413caf
mov dword [ebx + 0xc], 0
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, esi
mov eax, ebx
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x413d08
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
call dbg.fc_key_init_once
mov eax, dword [0x47a040]
mov edx, dword [eax + 0x28]
jmp 0x413ca8
Function at 0x413d84
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x413da8
mov dword [esp], ebx
call dbg._Unwind_SjLj_RaiseException
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [0x47a040]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x413dfc
test edx, edx
jne 0x413dd8
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x413e0c
call sym._abort
nop
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x413dbb
call dbg.fc_key_init_once
mov eax, dword [0x47a040]
mov edx, dword [eax + 0x28]
jmp 0x413db4
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop

Function at 0x413ea8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x47a040]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x413f2c
test edx, edx
jne 0x413f08
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov edi, dword [ebx + 0xc]
test edi, edi
jne 0x413eec
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
je 0x413efd
call sym._abort
nop
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x413ee5
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x413ec7
call dbg.fc_key_init_once
mov eax, dword [0x47a040]
mov edx, dword [eax + 0x28]
jmp 0x413ec0
Function at 0x41dbd8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call sym._fread
test eax, eax
jle 0x41dc18
movzx edx, byte [esi + eax - 1]
mov dword [ebx + 0x24], edx
add esp, 0x10
pop ebx
pop esi
leave
ret
mov dword [ebx + 0x24], 0xffffffff
add esp, 0x10
pop ebx
pop esi
leave
ret

Function at 0x41dc28
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fwrite
leave
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x5dd67249
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x6c4d5616
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4062b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x406300
cmp esi, edi
ja 0x406368
cmp edi, dword [esp + 0x1c]
ja 0x406376
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x406302
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x4062f0
jmp 0x40635f
ja 0x406308
cmp eax, edx
mov esi, edi
jne 0x4062c3
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x406340
mov ebp, esi
sub ecx, edx
jns 0x406357
jmp 0x406361
cmp esi, edi
je 0x406386
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x406361
xor al, 1
cmp ebp, edi
jne 0x406320
jmp 0x406361
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x443bac
call fcn.00441e00
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x443bac
call fcn.00441c10
mov ecx, 0x443b9c
call fcn.00441f30
Function at 0x40dc37
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, edx
mov esi, ecx
xor eax, eax
mov edx, dword [ebx]
lea ecx, [edx - 0x7fffffff]
cmp edx, 0x80000003
cmovge ecx, eax
lea edx, [ecx - 2]
cmp edx, 2
jae 0x40dc62
mov ebx, dword [ebx + 4]
jmp 0x40dc44
test ecx, ecx
jne 0x40dc98
lea edi, [esp + 4]
lea edx, [ebx + 0xc]
mov ecx, edi
call fcn.00416dde
cmp dword [edi], 0
jne 0x40dd7f
mov edi, dword [esp + 8]
mov al, byte [esp + 0xc]
cmp dword [edi + 8], 2
jne 0x40dcd7
movzx edx, al
mov ecx, edi
mov byte [esi], 4
jmp 0x40dd72
mov ebx, dword [ebx + 4]
lea edi, [esp + 0x14]
mov ecx, edi
mov edx, ebx
call fcn.0040dc37
add ebx, 0x48
lea ebp, [esp + 4]
mov ecx, ebp
mov edx, ebx
call fcn.0040dc37
cmp byte [edi], 4
mov eax, edi
cmove eax, ebp
cmove ebp, edi
movsd xmm0, qword [eax]
mov ecx, ebp
movsd qword [esi], xmm0
call fcn.004095ba
jmp 0x40dd77
add ebx, 0x1c
lea ebp, [esp + 4]
mov byte [esp + 3], al
mov ecx, ebp
mov edx, ebx
call fcn.00416dde
cmp dword [ebp], 0
jne 0x40dda4
mov ebx, dword [esp + 8]
mov al, byte [esp + 0xc]
mov ebp, dword [ebx + 0x20]
mov byte [esp + 2], al
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x40dd16
mov byte [esi], 4
jmp 0x40dd5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40dd59
mov dword [esp + 0x10], eax
push 0
push ebp
call sub.KERNEL32.dll_WaitForSingleObject
test eax, eax
je 0x40dd3a
cmp eax, 0x102
je 0x40dd11
jmp 0x40dd4f
and dword [esp + 4], 0
lea eax, [esp + 4]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x40dd11
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x10]
mov byte [esi], 0
mov dword [esi + 4], eax
movzx edx, byte [esp + 3]
mov ecx, edi
call fcn.004095c8
movzx edx, byte [esp + 2]
mov ecx, ebx
call fcn.004095c8
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 8]
mov cl, byte [esp + 0xc]
lea esi, [esp + 0x14]
mov dword [esi], eax
mov byte [esi + 4], cl
push 0x2b
pop edx
mov ecx, str.called__Result::unwrap____on_an__Err__value
push 0x4457bc
push 0x4456f0
jmp 0x40ddc7
mov eax, dword [esp + 8]
mov cl, byte [esp + 0xc]
lea esi, [esp + 0x14]
mov dword [esi], eax
mov byte [esi + 4], cl
push 0x2b
pop edx
mov ecx, str.called__Result::unwrap____on_an__Err__value
push 0x4457cc
push 0x4456e0
push esi
call fcn.00441eb0
Function at 0x40e306
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x34
mov edi, edx
lea edx, [esp + 4]
mov eax, dword [esp + 0x44]
mov esi, ecx
mov ecx, dword [esp + 0x48]
mov ebx, 0x103
and dword [edx + 4], 0
mov dword [edx], ebx
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, ebx
jne 0x40e34b
push 0xffffffffffffffff
push edi
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, 0xc0000011
je 0x40e363
cmp eax, 0x103
je 0x40e392
test eax, eax
js 0x40e370
mov ecx, dword [esp + 8]
mov dword [esi + 4], ecx
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
pop ebx
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
mov edi, eax
call fcn.0041a160
cmp al, 0xb
jne 0x40e38a
and dword [esi + 4], 0
jmp 0x40e366
and dword [esi], 0
mov dword [esi + 4], edi
jmp 0x40e369
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
mov edx, esp
lea esi, [esp + 0x14]
and dword [eax], 0
mov dword [ecx], 0x447704
mov dword [ecx + 4], 1
and dword [ecx + 0x10], 0
mov dword [ecx + 8], edx
and dword [ecx + 0xc], 0
mov byte [eax + 4], 0
push ecx
push eax
push esi
call fcn.00417470
add esp, 0xc
mov ecx, dword [esi]
mov edx, dword [esi + 4]
call fcn.004175a0
push 7
pop ecx
int 0x29
ud2

Function at 0x40e3db
Capabilities:
Create pipe

Disassembly:
push esi
sub esp, 8
mov esi, ecx
mov eax, esp
lea ecx, [esp + 4]
or dword [eax], 0xffffffff
or dword [ecx], 0xffffffff
push 0
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x40e40e
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], ecx
jmp 0x40e41e
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [esi + 4], 0
mov dword [esi + 8], eax
xor eax, eax
inc eax
mov dword [esi], eax
add esp, 8
pop esi
ret

Function at 0x4107b9
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], ecx
push 0x20
pop ebp
xor ebx, ebx
mov edi, dword [esp]
test bl, 1
jne 0x410820
mov esi, ebp
lea eax, [edi + ebp]
mov dword [esp], eax
push 2
push ebp
push edi
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
xor ebp, ebp
mov bl, 1
cmp eax, 0xc0000000
mov dword [esp + 4], eax
jb 0x4107c8
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x4107c8
mov esi, dword [esp + 4]
xor esi, 0x80000000
je 0x410820
mov al, byte [0x451ab8]
push 4
pop ecx
call fcn.0042cd80
test eax, eax
je 0x41082a
mov dword [eax], esi
jmp 0x410822
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 4
pop ecx
mov edx, ecx
call fcn.00441a80
push 0x28
pop edx
mov eax, str.description___is_deprecated__use_Display
ret
Function at 0x416ea0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x432fb0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x451a70]
test al, al
je 0x417071
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x416eec
cmp eax, 3
jne 0x41706a
mov ebx, dword [0x451a74]
test ebx, ebx
je 0x41706a
mov dword [ebp - 0x20], 0
jmp 0x416f17
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x416f48
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4170bb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x416f10
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x416f10
test byte [ebp - 0x20], 1
je 0x41706a
mov ebx, dword [0x451a74]
test ebx, ebx
je 0x41706a
mov dword [ebp - 0x20], 0
jmp 0x416f77
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x416fa8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4170bb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x416f70
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x416f70
test byte [ebp - 0x20], 1
je 0x41706a
mov ebx, dword [0x451a74]
test ebx, ebx
je 0x41706a
mov dword [ebp - 0x20], 0
jmp 0x416fd7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x417008
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4170bb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x416fd0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x416fd0
test byte [ebp - 0x20], 1
je 0x41706a
mov ebx, dword [0x451a74]
test ebx, ebx
je 0x41706a
mov dword [ebp - 0x20], 0
jmp 0x417037
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x417064
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4170bb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x417030
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x417030
test byte [ebp - 0x20], 1
jne 0x417084
movzx eax, byte [0x44d780]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x451a74]
jmp 0x41708f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41706a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4170bb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41708c
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x41708c
mov ecx, 0x447e88
mov dword [ebp - 0x10], 0
call fcn.00441f30
ud2
Function at 0x417db0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x451058]
test eax, eax
je 0x417e63
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x417ddc
cmp dword [eax + 4], 0
mov edi, eax
je 0x417ddc
add edi, 8
jmp 0x417e5e
mov eax, dword [0x451058]
test eax, eax
je 0x417e72
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x417e5c
mov esi, eax
test eax, eax
jne 0x417e32
movzx eax, byte [0x451ab8]
mov ecx, 0xc
call fcn.0042cd80
test eax, eax
je 0x417e8d
mov dword [eax], 0x451058
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x451058]
test eax, eax
je 0x417e81
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x417e5e
test ecx, ecx
je 0x417e5e
lock dec dword [ecx]
jne 0x417e5e
call fcn.00417930
jmp 0x417e5e
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x451058
call fcn.004428c0
jmp 0x417dc0
mov ecx, 0x451058
call fcn.004428c0
jmp 0x417dea
mov ecx, 0x451058
call fcn.004428c0
jmp 0x417e2a
mov ecx, 4
mov edx, 0xc
call fcn.00441a80
int3

Function at 0x418370
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x451068]
test eax, eax
je 0x4183ef
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x41838f
cmp byte [eax + 4], 0
mov esi, eax
jne 0x4183e4
mov eax, dword [0x451068]
test eax, eax
je 0x4183fb
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4183e9
mov esi, eax
test eax, eax
jne 0x4183de
movzx eax, byte [0x451ab8]
mov ecx, 8
call fcn.0042cd80
test eax, eax
je 0x418413
mov dword [eax], 0x451068
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x451068]
test eax, eax
je 0x418407
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x4183eb
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x451068
call fcn.004428c0
jmp 0x41837b
mov ecx, 0x451068
call fcn.004428c0
jmp 0x418399
mov ecx, 0x451068
call fcn.004428c0
jmp 0x4183d6
mov ecx, 4
mov edx, 8
call fcn.00441a80
int3
Function at 0x418ae0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x418b33
push 0xffffffffffffffff
push edi
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x418b56
test eax, eax
js 0x418b42
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x418b4e
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x447704
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.00417470
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.004175a0
mov ecx, 7
int 0x29
ud2
Function at 0x4191b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x451048]
test eax, eax
je 0x419243
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x4191d6
cmp dword [eax + 4], 0
je 0x4191d6
add eax, 8
pop esi
ret
mov eax, dword [0x451048]
test eax, eax
je 0x419252
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41923f
mov esi, eax
test eax, eax
jne 0x419228
movzx eax, byte [0x451ab8]
mov ecx, 0x10
call fcn.0042cd80
test eax, eax
je 0x41926a
mov dword [eax], 0x451048
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x451048]
test eax, eax
je 0x41925e
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x451048
call fcn.004428c0
jmp 0x4191bf
mov ecx, 0x451048
call fcn.004428c0
jmp 0x4191e0
mov ecx, 0x451048
call fcn.004428c0
jmp 0x419220
mov ecx, 4
mov edx, 0x10
call fcn.00441a80
int3
Function at 0x41e490
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4331b0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
je 0x41e4db
mov ecx, dword [ebp - 0x18]
mov edx, eax
mov dword fs:[0], ecx
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x44], 0x447890
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x44]
mov edx, 0x447898
mov dword [ebp - 0x28], fcn.0041e570
mov dword [ebp - 0x38], 1
call fcn.00441b20
ud2
Function at 0x422010
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x451078]
test eax, eax
je 0x4220c3
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x42203c
cmp dword [eax + 4], 0
mov edi, eax
je 0x42203c
add edi, 8
jmp 0x4220be
mov eax, dword [0x451078]
test eax, eax
je 0x4220d2
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4220bc
mov esi, eax
test eax, eax
jne 0x422092
movzx eax, byte [0x451ab8]
mov ecx, 0xc
call fcn.0042cd80
test eax, eax
je 0x4220ed
mov dword [eax], 0x451078
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x451078]
test eax, eax
je 0x4220e1
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x4220be
test ecx, ecx
je 0x4220be
lock dec dword [ecx]
jne 0x4220be
call fcn.00422100
jmp 0x4220be
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x451078
call fcn.004428c0
jmp 0x422020
mov ecx, 0x451078
call fcn.004428c0
jmp 0x42204a
mov ecx, 0x451078
call fcn.004428c0
jmp 0x42208a
mov ecx, 4
mov edx, 0xc
call fcn.00441a80
int3
Function at 0x429150
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.00419860
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp edx, 0x80000000
jne 0x42918e
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], 0x80000000
jmp 0x4291b0
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.00429080
mov ebx, dword [esp]
cmp ebx, 0x80000000
jne 0x4291c5
mov ecx, esp
call fcn.00419a10
mov dword [esi], 0x80000000
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [esp + 4]
mov ebp, dword [esp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4291e3
mov dword [esi], ebx
mov dword [esi + 4], edi
mov dword [esi + 8], ebp
jmp 0x4291bd
test ebx, ebx
mov dword [esi], 0x80000000
je 0x4291bd
mov ecx, edi
mov edx, 2
call fcn.00403100
jmp 0x4291bd