joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x2c9c662a
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x362c7095
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x91c6ef
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0091c76e
jae 0x91c6fb
xor ecx, ecx
call fcn.0091c76e
jae 0x91c725
xor eax, eax
call fcn.0091c76e
jae 0x91c736
mov al, 0x10
call fcn.0091c76e
adc al, al
jae 0x91c717
jne 0x91c763
stosb byte es:[edi], al
jmp 0x91c6fc
call fcn.0091c77a
dec ecx
loop 0x91c742
mov eax, ebp
call fcn.0091c778
jmp 0x91c764
lodsb al, byte [esi]
shr eax, 1
je 0x91c78a
adc ecx, 2
mov ebp, eax
jmp 0x91c764
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0091c778
cmp eax, 0x7d00
jae 0x91c762
cmp eax, 0x500
jae 0x91c763
cmp eax, 0x7f
ja 0x91c764
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x91c6fc
pop ebp
ret 8
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x55f56bac
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x42e1d0
mov ecx, 0x436b3efc
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x240
mov esi, esp
mov dword [esi + 0x228], ebp
mov dword [esi + 0x140], ecx
mov dword [esi + 0x22c], esp
mov dword [esi + 0x238], 0xffffffff
lea eax, [esi + 0x230]
mov dword [esi + 0x234], 0x40a5f0
mov ecx, dword fs:[0]
mov dword [esi + 0x230], ecx
mov dword fs:[0], eax
mov ecx, dword [edx]
mov eax, dword [edx + 8]
mov dword [esi + 0xc], eax
mov edi, dword [eax + 4]
cmp ecx, edi
mov dword [esi + 0x10], edx
mov edx, dword [edx + 4]
mov eax, edx
sbb eax, 0
mov eax, edi
cmovb eax, ecx
call fcn.00401072
Function at 0x4236f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esi]
mov ebx, dword [ebp + 4]
movzx eax, byte [ebp + 0x15]
test al, al
je 0x423775
bswap ebx
mov ecx, ebx
and ecx, 0xf0f0f0f
shl ecx, 4
shr ebx, 4
and ebx, 0xf0f0f0f
or ebx, ecx
mov ecx, ebx
and ecx, 0x33333333
shr ebx, 2
and ebx, 0x33333333
lea ecx, [ebx + ecx*4]
mov edx, ecx
and edx, 0x55555555
shr ecx, 1
and ecx, 0x55555555
lea ebx, [ecx + edx*2]
mov edx, dword [esp + 0x24]
mov ah, byte [ebp + 0x14]
mov cl, ah
neg cl
shr ebx, cl
test edx, edx
je 0x423853
mov byte [esp + 2], ah
mov byte [esp + 3], al
cmp edx, 1
jne 0x42379e
xor ecx, ecx
jmp 0x4237d8
mov ah, byte [ebp + 0x14]
mov cl, ah
neg cl
shl ebx, cl
test edx, edx
je 0x423853
mov byte [esp + 2], ah
mov byte [esp + 3], al
mov dword [esp + 4], ebp
cmp edx, 1
jne 0x4237f2
xor ecx, ecx
jmp 0x42382c
and edx, 0xfffffffe
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [edi + ecx]
xor al, bl
movzx eax, al
shr ebx, 8
xor ebx, dword [esi + eax*4 + 4]
movzx eax, byte [edi + ecx + 1]
xor al, bl
movzx eax, al
shr ebx, 8
xor ebx, dword [esi + eax*4 + 4]
add ecx, 2
cmp edx, ecx
jne 0x4237b0
mov eax, dword [esp + 0x24]
test al, 1
je 0x42384a
movzx eax, byte [edi + ecx]
xor al, bl
movzx eax, al
shr ebx, 8
xor ebx, dword [esi + eax*4 + 4]
jmp 0x42384a
and edx, 0xfffffffe
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, ebx
shr ebp, 0x18
movzx eax, byte [edi + ecx]
xor eax, ebp
shl ebx, 8
xor ebx, dword [esi + eax*4 + 4]
mov eax, ebx
shr eax, 0x18
movzx ebp, byte [edi + ecx + 1]
xor ebp, eax
shl ebx, 8
xor ebx, dword [esi + ebp*4 + 4]
add ecx, 2
cmp edx, ecx
jne 0x423800
mov eax, dword [esp + 0x24]
test al, 1
je 0x423846
mov eax, ebx
shr eax, 0x18
movzx ecx, byte [edi + ecx]
xor ecx, eax
shl ebx, 8
xor ebx, dword [esi + ecx*4 + 4]
mov ebp, dword [esp + 4]
movzx eax, byte [esp + 3]
mov ah, byte [esp + 2]
test al, al
setne al
neg ah
and ah, 0x1f
xor edi, edi
cmp byte [ebp + 0x16], 0
setne dl
mov esi, ebx
bswap esi
movzx ecx, ah
cmovne ecx, edi
xor dl, al
mov eax, esi
and eax, 0xf0f0f0f
shl eax, 4
shr esi, 4
and esi, 0xf0f0f0f
or esi, eax
mov eax, esi
and eax, 0x33333333
shr esi, 2
and esi, 0x33333333
lea eax, [esi + eax*4]
mov esi, eax
and esi, 0x55555555
shr eax, 1
and eax, 0x55555555
lea eax, [eax + esi*2]
test dl, dl
cmove eax, ebx
shr eax, cl
xor eax, dword [ebp + 8]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x423930
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov edx, dword [ebp]
mov ecx, dword [ebp + 4]
mov edi, dword [edx]
cmp byte [edi + 0x15], 0
je 0x42395f
test ebx, ebx
je 0x423a1a
cmp ebx, 1
jne 0x423973
xor edi, edi
jmp 0x4239a8
test ebx, ebx
je 0x423a1a
cmp ebx, 1
jne 0x4239c2
xor edi, edi
jmp 0x4239fc
and ebx, 0xfffffffe
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esi + edi]
xor al, cl
movzx eax, al
shr ecx, 8
xor ecx, dword [edx + eax*4 + 4]
movzx eax, byte [esi + edi + 1]
xor al, cl
movzx eax, al
shr ecx, 8
xor ecx, dword [edx + eax*4 + 4]
add edi, 2
cmp ebx, edi
jne 0x423980
mov eax, dword [esp + 0x1c]
test al, 1
je 0x423a1a
movzx eax, byte [esi + edi]
xor al, cl
movzx eax, al
shr ecx, 8
xor ecx, dword [edx + eax*4 + 4]
jmp 0x423a1a
and ebx, 0xfffffffe
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, ecx
shr ebp, 0x18
movzx eax, byte [esi + edi]
xor eax, ebp
shl ecx, 8
xor ecx, dword [edx + eax*4 + 4]
mov eax, ecx
shr eax, 0x18
movzx ebp, byte [esi + edi + 1]
xor ebp, eax
shl ecx, 8
xor ecx, dword [edx + ebp*4 + 4]
add edi, 2
cmp ebx, edi
jne 0x4239d0
mov eax, dword [esp + 0x1c]
test al, 1
mov ebp, dword [esp + 0x14]
je 0x423a1a
mov eax, ecx
shr eax, 0x18
movzx esi, byte [esi + edi]
xor esi, eax
shl ecx, 8
xor ecx, dword [edx + esi*4 + 4]
mov dword [ebp + 4], ecx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42b990
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x438
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x43a210
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x2c], 0
cmp esi, 0x201
jae 0x42ba20
jmp 0x42ba0e
jbe 0x42baa6
cmp esi, 0x201
jae 0x42ba20
mov dword [ebp - 0x28], 0x200
lea ebx, [ebp - 0x444]
mov edi, esi
jmp 0x42ba51
mov edi, dword [ebp - 0x20]
sub esi, edi
je 0x42ba45
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
mov edx, edi
push esi
call fcn.004548a0
add esp, 4
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x42ba75
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x42bb09
cmp esi, edi
jne 0x42ba00
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42bb28
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x42ba0e
jmp 0x42ba20
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0
cmp esi, eax
ja 0x42bb45
lea eax, [ebp - 0x44]
push esi
push ebx
push eax
call fcn.0042eda0
add esp, 0xc
movsd xmm0, qword [ebp - 0x44]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x3c]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42baf3
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.0041f3d0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x438
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi], 0x80000000
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x42bae3
jmp 0x42baf3
mov dword [ebp - 0x10], 0
push 0x45baac
push 0x28
push str.internal_error:_entered_unreachable_code_rustc_25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04library_alloc_src_vecmod.rs_
call fcn.00455230
add esp, 0xc
jmp 0x42bb54
push 0x45ba9c
push eax
push esi
call fcn.004555b0
add esp, 0xc
ud2
Function at 0x435630
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x34]
call fcn.00438370
add esp, 4
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp ecx, 0x80000000
je 0x43568b
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
mov ecx, esp
lea edx, [esp + 0x18]
push 1
call fcn.00436c50
add esp, 4
mov ebx, dword [esp]
mov edi, dword [esp + 4]
cmp ebx, 0x80000000
jne 0x435697
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov dword [esi], edi
add esp, 0x24
pop esi
pop edi
pop ebx
ret
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x4356ad
mov byte [esi], 4
test ebx, ebx
jne 0x4356bd
jmp 0x435690
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x435690
add ebx, ebx
push 2
push ebx
push edi
call fcn.0041f3d0
add esp, 0x30
pop esi
pop edi
pop ebx
ret

Function at 0x435ea0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x435ee4
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x435eea
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x435f1f
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0xc0000011
jne 0x435f2f
mov dword [esi + 4], 0
jmp 0x435f41
cmp eax, 0x103
je 0x435f5b
test eax, eax
js 0x435f4c
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov byte [esi], 4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x435f44
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x45b4e8
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.0042e950
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.00429e20
mov ecx, 7
int 0x29
ud2
Function at 0x435fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x436004
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x43600a
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x436046
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x43606b
test eax, eax
js 0x436055
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov al, 4
jmp 0x436061
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x45b4e8
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.0042e950
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.00429e20
mov ecx, 7
int 0x29
ud2
Function at 0x437a50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x43a560
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x467a84]
test al, al
je 0x437c21
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x437a9c
cmp eax, 3
jne 0x437c1a
mov ebx, dword [0x467a88]
test ebx, ebx
je 0x437c1a
mov dword [ebp - 0x20], 0
jmp 0x437ac7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x437af8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x437c6b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x437ac0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x437ac0
test byte [ebp - 0x20], 1
je 0x437c1a
mov ebx, dword [0x467a88]
test ebx, ebx
je 0x437c1a
mov dword [ebp - 0x20], 0
jmp 0x437b27
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x437b58
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x437c6b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x437b20
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x437b20
test byte [ebp - 0x20], 1
je 0x437c1a
mov ebx, dword [0x467a88]
test ebx, ebx
je 0x437c1a
mov dword [ebp - 0x20], 0
jmp 0x437b87
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x437bb8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x437c6b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x437b80
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x437b80
test byte [ebp - 0x20], 1
je 0x437c1a
mov ebx, dword [0x467a88]
test ebx, ebx
je 0x437c1a
mov dword [ebp - 0x20], 0
jmp 0x437be7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x437c14
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x437c6b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x437be0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x437be0
test byte [ebp - 0x20], 1
jne 0x437c34
movzx eax, byte [0x462b40]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x467a88]
jmp 0x437c3f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x437c1a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x437c6b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x437c3c
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x437c3c
mov dword [ebp - 0x10], 0
push 0x45b9e8
call fcn.004550e0
add esp, 4
ud2
Function at 0x439cf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x46704c]
mov esi, ecx
test eax, eax
je 0x439d16
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x439d2f
cmp dword [eax + 4], 0
je 0x439d2f
add eax, 8
pop esi
pop edi
ret
push 0x46704c
call fcn.00454ac0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x439d0a
mov eax, dword [0x46704c]
test eax, eax
je 0x439dc6
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x439de3
mov edi, eax
test eax, eax
jne 0x439d8f
movzx eax, byte [0x4679f9]
push 4
push 0x10
call fcn.0041f3c0
add esp, 8
test eax, eax
je 0x439df7
mov dword [eax], 0x46704c
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x46704c]
test eax, eax
je 0x439de8
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x439daf
mov eax, dword [esi]
xor ecx, ecx
mov edx, 0
mov dword [esi], 0
cmp eax, 1
jne 0x439db3
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x439db3
xor ecx, ecx
xor edx, edx
lea eax, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
mov byte [edi + 0xc], dl
pop esi
pop edi
ret
push 0x46704c
call fcn.00454ac0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x439d4d
xor eax, eax
pop esi
pop edi
ret
push 0x46704c
call fcn.00454ac0
add esp, 4
jmp 0x439d87
push 0x10
push 4
call fcn.00455080

Function at 0x439e00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x46705c]
mov esi, ecx
test eax, eax
je 0x439eda
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x439e2d
cmp dword [eax + 4], 0
mov edi, eax
jne 0x439ed5
mov eax, dword [0x46705c]
test eax, eax
je 0x439efc
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x439f19
mov edi, eax
test eax, eax
jne 0x439e91
movzx eax, byte [0x4679f9]
push 4
push 0xc
call fcn.0041f3c0
add esp, 8
test eax, eax
je 0x439f35
mov dword [eax], 0x46705c
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x46705c]
test eax, eax
je 0x439f23
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x439ea6
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x439ea8
mov eax, dword [esi + 4]
jmp 0x439ea8
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
test edx, edx
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x439ed5
test ecx, ecx
je 0x439ed5
lock dec dword [ecx]
jne 0x439ed5
lea ecx, [esp + 4]
call fcn.0042a960
add edi, 8
jmp 0x439f1b
push 0x46705c
call fcn.00454ac0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x439e21
jmp 0x439e2d
push 0x46705c
call fcn.00454ac0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x439e4b
xor edi, edi
mov eax, edi
add esp, 8
pop esi
pop edi
ret
push 0x46705c
call fcn.00454ac0
add esp, 4
jmp 0x439e89
push 0xc
push 4
call fcn.00455080
int3