joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435350
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, edx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
push eax
push 0x4a83e0
push 1
push 0
push 0x4a83fc
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x43538b
mov esi, dword [ebp - 0x14]
test esi, esi
jne 0x4353cc
xor edi, edi
jmp 0x4353bb
mov ebx, eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
call sub.oleaut32.dll_GetErrorInfo
mov esi, dword [ebp - 0x10]
test ebx, ebx
je 0x4353cc
xor edi, edi
cmp ebx, 0x535f4f4b
cmovne edi, ebx
test esi, esi
je 0x4353bb
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, dword [ebp - 0x18]
mov dword [eax], 0x80000000
mov dword [eax + 4], edi
jmp 0x4354c0
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.00434df0
mov dword [ebp - 0x14], 0
mov edi, eax
lea ecx, [ebp - 0x14]
mov eax, dword [esi]
push ecx
push 0
push 0
push pe_nt_image_headers32
push 0
push 0
push 0
push edi
push esi
call dword [eax + 0xc]
test eax, eax
js 0x435437
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x43546d
test edi, edi
je 0x43540e
push edi
call sub.oleaut32.dll_SysFreeString
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push ebx
call sub.ole32.dll_CoSetProxyBlanket
test eax, eax
js 0x435487
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], ebx
mov dword [eax], 0x80000011
jmp 0x4354ba
mov ebx, eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
call sub.oleaut32.dll_GetErrorInfo
mov eax, dword [ebp - 0x10]
test ebx, ebx
je 0x4354c8
xor ecx, ecx
cmp ebx, 0x535f4f4b
cmovne ecx, ebx
test eax, eax
mov ebx, ecx
je 0x43546f
mov ecx, eax
mov eax, dword [eax]
push ecx
call dword [eax + 8]
jmp 0x43546f
xor ebx, ebx
test edi, edi
je 0x435479
push edi
call sub.oleaut32.dll_SysFreeString
mov eax, dword [ebp - 0x18]
mov dword [eax], 0x80000000
mov dword [eax + 4], ebx
jmp 0x4354ba
mov edi, eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
call sub.oleaut32.dll_GetErrorInfo
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4354a8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
mov dword [eax], 0x80000000
mov dword [eax + 4], edi
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov eax, dword [esi]
push esi
call dword [eax + 8]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, eax
test edi, edi
jne 0x435408
jmp 0x43540e
Function at 0x44ec40
Capabilities:
Print debug messages

Disassembly:
push ebx
sub esp, 0x58
lea ebx, [esp + 0x1b]
mov dword [esp + 0x1b], 0
mov dword [esp + 0x1f], 0
mov dword [esp + 0x23], 0
mov dword [esp + 0x27], 0
mov dword [esp + 0x2b], 0
mov dword [esp + 0x2f], 0
mov dword [esp + 0x33], 0
mov dword [esp + 0x37], 0
mov dword [esp + 0x3b], 0
mov dword [esp + 0x3f], 0
mov dword [esp + 0x43], 0
mov dword [esp + 0x47], 0
mov dword [esp + 0x4b], 0
mov byte [esp + 0x4f], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x35
mov dword [esp], ebx
call fcn.00453d60
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
lea esi, cs:[esi]

Function at 0x44f060
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4af130], 1
je 0x44f100
push edi
mov eax, 0x4af130
push esi
push ebx
sub esp, 0x10
call fcn.0044ea30
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call fcn.0044e320
mov edi, dword [0x4af130]
test edi, edi
jne 0x44f0c8
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov dword [0x456088], eax
cmp eax, 0xffffffff
je 0x44f101
mov dword [0x4af130], 1
mov dword [esp], esi
call fcn.0044e650
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
jmp fcn.0044ecf0
cmp edi, 1
je 0x44f0ae
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x4af130
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call fcn.00453e00
jmp 0x44f0ae
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
lea esi, cs:[esi]
nop
mov ebp, dword [sym.imp.kernel32.dll_GetCurrentProcess]
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call ebp
mov edi, eax
call dword [sym.imp.kernel32.dll_GetCurrentThread]
mov esi, eax
call ebp
lea edx, [ebx + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x44f22a
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
sub esp, 4
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
mov dword [ebx + 0x68], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x456088]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x44f22a
Function at 0x44f110
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call fcn.0044ede0
mov ebx, eax
test eax, eax
je 0x44f21b
mov dword [eax + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
sub esp, 0x10
mov dword [ebx + 0x18], eax
lea eax, [ebx + 0x38]
mov dword [ebx + 0x1c], 0xffffffff
mov dword [esp], eax
call fcn.00452710
cmp eax, 1
je 0x44f225
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0044ec40
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x44f230
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0044f060
mov eax, dword [0x456088]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x44f258
add esp, 0x1c
ret
add esp, 0x1c
jmp fcn.0044f110
Function at 0x44f540
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x44f568
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x44f660
add esp, 0x14
pop ebx
pop esi
ret 0xc
cmp eax, 1
je 0x44f630
cmp eax, 3
jne 0x44f559
mov eax, dword [0x456088]
cmp eax, 0xffffffff
je 0x44f559
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x44f559
test byte [eax + 0x20], 0x30
je 0x44f690
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x44f5ab
call fcn.0044f260
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x44f5dd
mov dword [esp], eax
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x44f5cf
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0044e7f0
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.00452710
cmp eax, 1
je 0x44f749
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x44f73d
mov eax, dword [0x456088]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
jmp 0x44f559
mov eax, dword [0x4af108]
test eax, eax
je 0x44f67c
mov dword [esp + 4], 0x44e9a0
mov dword [esp], 1
call eax
mov dword [0x4af10c], eax
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [0x4af10c]
test eax, eax
je 0x44f559
mov edx, dword [0x4af104]
test edx, edx
je 0x44f67c
mov dword [esp], eax
call edx
mov dword [0x4af10c], 0
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x44f6ef
test eax, eax
je 0x44f6aa
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x44f6c7
call fcn.0044f260
test byte [ebx + 0x24], 4
je 0x44f72d
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x44f5dd
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
jmp 0x44f5d6
test eax, eax
je 0x44f72d
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.0044e7f0
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.00452710
cmp eax, 1
je 0x44f749
mov dword [ebx + 0x38], 0xffffffff
jmp 0x44f559
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0044e7f0
lea eax, [ebx + 0x38]
jmp 0x44f714
mov eax, ebx
call fcn.0044eea0
jmp 0x44f611
call fcn.0044ec40
nop
Function at 0x44f9e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov eax, dword [ebx]
test edx, edx
je 0x44fb20
cmp eax, 1
je 0x44fa30
mov eax, ebx
call fcn.0044ea30
lea edi, [eax + 4]
mov esi, eax
mov dword [esp], edi
call fcn.0044e320
mov ebp, dword [ebx]
test ebp, ebp
je 0x44fa40
cmp ebp, 1
jne 0x44fae0
mov dword [esp], edi
call fcn.0044e650
mov eax, esi
call fcn.0044ecf0
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x14], 0x44edb0
mov dword [esp + 0x18], esi
call fcn.0044f060
mov eax, dword [0x456088]
mov ebp, dword [sym.imp.kernel32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x44fb70
mov eax, dword [eax + 0xc]
mov dword [esp + 0x1c], eax
lock or dword [esp], 0
call fcn.0044f060
mov eax, dword [0x456088]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x44fb50
lea edx, [esp + 0x14]
mov dword [eax + 0xc], edx
lock or dword [esp], 0
call dword [esp + 0x44]
call fcn.0044f060
mov eax, dword [0x456088]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x44fb30
mov edx, dword [esp + 0x1c]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
mov dword [esp], edi
call fcn.0044e650
mov eax, esi
call fcn.0044ecf0
jmp 0x44fa30
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call fcn.00453e00
mov dword [esp], edi
call fcn.0044e650
mov eax, esi
call fcn.0044ecf0
jmp 0x44fa30
add esp, 0x2c
mov eax, 0x16
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0044f110
test eax, eax
jne 0x44fab8
mov eax, dword [esp + 0x1c]
mov dword [0], eax
ud2
call fcn.0044f110
test eax, eax
jne 0x44fa92
lea eax, [esp + 0x14]
mov dword [0], eax
ud2
call fcn.0044f110
test eax, eax
jne 0x44fa6c
mov eax, dword [pe_dos_header]
ud2
Function at 0x44fe70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp + 0x14], eax
call fcn.0044f060
mov eax, dword [0x456088]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x44ff88
lea edi, [ebx + 0x38]
mov dword [esp], edi
call fcn.00452720
mov edx, dword [ebx + 0x2c]
cmp esi, dword [ebx + 0x28]
jb 0x44ff54
lea ebp, [esi + 1]
mov dword [esp], edx
lea eax, [ebp*4]
mov dword [esp + 4], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
test eax, eax
je 0x44ff94
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x44ff94
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov eax, dword [ebx + 0x28]
mov edx, dword [esp + 0x18]
mov ecx, ebp
mov dword [esp + 4], 0
sub ecx, eax
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call fcn.00452760
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0044f110
mov ebx, eax
jmp 0x44fea5
mov dword [esp], edi
call fcn.00452760
mov eax, 0xc
jmp 0x44ff7c

Function at 0x450030
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0044f060
mov eax, dword [0x456088]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x450058
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.0044f110
test eax, eax
jne 0x45004d
add esp, 0x1c
ret

Function at 0x4500c0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0044f060
mov eax, dword [0x456088]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4500e8
add eax, 0xc
add esp, 0x1c
ret
call fcn.0044f110
test eax, eax
jne 0x4500dd
jmp 0x4500e0
Function at 0x450120
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.0044f230
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x450142
call fcn.0044f260
test byte [ebx + 0x20], 0x30
jne 0x45015c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
mov eax, dword [0x456088]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x45019d
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x4501dd
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x450192
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x4501a6
mov dword [esp], esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.0044f040
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x456088]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push edx
push edx
jmp 0x45019d
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x4501f1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x4501be

Function at 0x450200
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x4af138]
test eax, eax
jne 0x450210
xor eax, eax
ret
sub esp, 0x1c
call fcn.0044f060
mov eax, dword [0x456088]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x450250
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x450240
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x450234
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x450236
call fcn.0044f110
test eax, eax
je 0x450234
jmp 0x45022d

Function at 0x450260
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0044f060
mov eax, dword [0x456088]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4502a0
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x450290
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call fcn.0044f110
test eax, eax
jne 0x45027d
add esp, 0x1c
ret
Function at 0x4503b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.0044f060
mov eax, dword [0x456088]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x450420
test byte [ebx + 0x20], 0xc
jne 0x4503e0
mov eax, dword [0x4af138]
test eax, eax
jne 0x4503f0
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.0044e320
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x450412
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x450412
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x450431
mov dword [esp], esi
call fcn.0044e650
add esp, 0x14
pop ebx
pop esi
ret
call fcn.0044f110
mov ebx, eax
test eax, eax
jne 0x4503d1
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x450451
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.0044e650
call fcn.004502b0
nop
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4504d0
mov dword [esp], eax
call fcn.00451770
xor ecx, ecx
mov ebx, edx
mov edx, 0xffffffff
cmp edx, eax
sbb ecx, ebx
cmovae edx, eax
mov ebx, edx
call fcn.0044f060
mov eax, dword [0x456088]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x450520
test ebx, ebx
je 0x4504ea
call fcn.004503b0
mov eax, dword [esi + 0x18]
test eax, eax
je 0x450510
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004518b0
call fcn.004503b0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.0044f060
mov eax, dword [0x456088]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x450530
call fcn.004503b0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_Sleep]
sub esp, 4
call fcn.004503b0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_Sleep]
sub esp, 4
jmp 0x4504bf
call fcn.0044f110
mov esi, eax
jmp 0x4504a3
call fcn.0044f110
jmp 0x4504ea

Function at 0x451fe0
Capabilities:
Terminate process

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov eax, ebx
call fcn.00451e20
test eax, eax
je 0x452000
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebx]
lea edi, [esi + 0x14]
mov dword [esp], edi
call fcn.0044e320
test eax, eax
jne 0x452027
lock add dword [esi + 0xc], 1
cmp dword [esi + 0xc], 0x7fffffff
je 0x452040
mov dword [esp], edi
call fcn.0044e650
mov edx, eax
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00451af0
lea edx, [esi + 0x18]
mov dword [esp], edx
mov dword [esp + 0x1c], edx
call fcn.0044e320
mov edx, dword [esp + 0x1c]
test eax, eax
mov ebp, eax
je 0x452068
mov dword [esp], edi
call fcn.0044e650
mov edx, ebp
jmp 0x452029
mov eax, dword [esi + 0x10]
sub dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [esp], edx
call fcn.0044e650
mov dword [esp], edi
mov esi, eax
call fcn.0044e650
test esi, esi
mov edx, esi
cmove edx, eax
jmp 0x452029
Function at 0x452300
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov esi, dword [esp + 0x30]
mov eax, esi
call fcn.00451a90
test eax, eax
jne 0x452380
mov ebx, dword [esi]
mov edx, dword [ebx + 8]
test edx, edx
je 0x452350
lock sub dword [ebx + 8], 1
lea eax, [ebx + 0x18]
add ebx, 0x14
mov dword [esp], eax
call fcn.0044e650
mov dword [esp], ebx
mov edi, eax
call fcn.0044e650
test edi, edi
cmove edi, eax
mov edx, edi
add esp, 0x20
mov eax, esi
pop ebx
pop esi
pop edi
jmp fcn.00451af0
lea edi, [ebx + 0x18]
mov dword [esp], edi
call fcn.0044e320
mov edx, eax
test eax, eax
jne 0x452342
lock add dword [ebx + 0x10], 1
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x452390
mov dword [esp], edi
call fcn.0044e650
mov edx, eax
jmp 0x452342
add esp, 0x20
pop ebx
pop esi
pop edi
ret
add ebx, 0x1c
mov dword [esp], ebx
call fcn.00453180
mov dword [esp], edi
mov dword [esp + 0x1c], eax
call fcn.0044e650
mov edx, dword [esp + 0x1c]
test edx, edx
cmove edx, eax
jmp 0x452342

Function at 0x4523c0
Capabilities:
Terminate process

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x50]
mov eax, esi
call fcn.00451e20
test eax, eax
je 0x4523e0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [esi]
lea ebp, [edi + 0x14]
mov dword [esp], ebp
call fcn.0044e320
mov ebx, eax
test eax, eax
jne 0x452432
lea eax, [edi + 0x18]
mov dword [esp], eax
mov dword [esp + 0x1c], eax
call fcn.0044e320
mov ebx, eax
test eax, eax
jne 0x4524c0
mov edx, dword [edi + 8]
test edx, edx
jne 0x45242d
mov ecx, dword [edi + 0x10]
mov eax, dword [edi + 0xc]
test ecx, ecx
jle 0x452429
sub eax, ecx
mov dword [edi + 0x10], 0
mov dword [edi + 0xc], eax
test eax, eax
jg 0x452448
lock add dword [edi + 8], 1
add esp, 0x3c
mov edx, ebx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00451af0
neg eax
mov dword [esp + 0x24], 0x451b80
lea ebp, [edi + 0x1c]
mov dword [edi + 0x10], eax
mov dword [esp + 0x28], edi
call fcn.004500c0
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
lock or dword [esp], 0
call fcn.004500c0
lea ecx, [esp + 0x24]
mov dword [eax], ecx
lock or dword [esp], 0
jmp 0x452487
mov eax, dword [edi + 0x10]
test eax, eax
jns 0x4524d0
mov eax, dword [esp + 0x1c]
mov dword [esp], ebp
mov dword [esp + 4], eax
call fcn.004533f0
test eax, eax
je 0x452480
mov dword [esp + 0x1c], eax
call fcn.004500c0
mov edx, dword [esp + 0x2c]
mov dword [eax], edx
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
jmp 0x452432
mov dword [esp], ebp
call fcn.0044e650
jmp 0x452432
call fcn.004500c0
mov ecx, dword [esp + 0x2c]
mov dword [eax], ecx
mov dword [edi + 0xc], 0
jmp 0x45242d