joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a80
Capabilities:
Create thread
Print debug messages
Resolve dns

Disassembly:
mov eax, dword [0x40e74c]
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
push esi
push edi
push 0x40e4a8
mov esi, ecx
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.SocketFuncPtr
mov edi, eax
call ebp
push 6
push 1
push 2
call edi
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x401ac7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
push str.HtonsFuncPtr
call ebp
mov ecx, dword [0x40e74c]
push str.htons
push ecx
call ebx
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
mov eax, dword [esp + 0x28]
push eax
mov word [esp + 0x14], 2
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
mov ecx, dword [edi + 0xc]
push 0x40e460
mov edx, dword [ecx]
mov ecx, dword [0x40e74c]
push ecx
mov eax, dword [edx]
mov dword [esp + 0x1c], eax
call ebx
mov ecx, dword [esi + 8]
lea edx, [esp + 0x10]
push 0x10
push edx
push ecx
call eax
cmp eax, 0xffffffff
jne 0x401b5a
push str.connectFunc
call ebp
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 0x1c]
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x401ac7
push 0
push 0
push esi
push 0x401b80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret 8
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x29233f1e
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x55895036
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x407d10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc6f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x527d34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x407e62
cmp byte [ebx + 0x3d], 0
je 0x407e62
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x407d64
xor al, al
jmp 0x407e64
mov ecx, 0xf
mov dword [ebp - 0x18], 8
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x28]
movq qword [ebp - 0x28], xmm0
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14]
nop
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmp edx, 0x10
lea esi, [ebp - 0x28]
cmovae esi, eax
cmovae edi, eax
mov edx, dword [ecx]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x407dcf
sub eax, 1
je 0x407dd3
mov edx, dword [ebp - 0x14]
sub eax, 2
mov eax, dword [ebp - 0x28]
je 0x407e29
xor bl, bl
jmp 0x407e2b
mov byte [ebx + 0x3d], 0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp edx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae ecx, eax
sub esi, ecx
je 0x407e0b
push dword [ebx + 0x4c]
cmp edx, 0x10
lea ecx, [ebp - 0x28]
push esi
cmovae ecx, eax
push 1
push ecx
call fcn.004c0114
mov edx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
mov eax, dword [ebp - 0x28]
jne 0x407dcb
cmp byte [ebx + 0x3d], 0
je 0x407e29
test esi, esi
jne 0x407d90
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00407ae0
jmp 0x407d89
mov bl, 1
cmp edx, 0x10
jb 0x407e5e
lea ecx, [edx + 1]
mov edx, eax
cmp ecx, 0x1000
jb 0x407e55
test dl, 0x1f
jne 0x407e80
mov eax, dword [eax - 4]
cmp eax, edx
jae 0x407e85
sub edx, eax
cmp edx, 4
jb 0x407e8a
cmp edx, 0x23
ja 0x407e8f
push eax
call fcn.004943b0
add esp, 4
mov al, bl
jmp 0x407e64
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049425b
mov esp, ebp
pop ebp
ret
call fcn.004af5bc
call fcn.004af5bc
call fcn.004af5bc
call fcn.004af5bc
int3
Function at 0x409250
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc3b0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x527d34]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00493f75
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00480a65
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40c9d0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcb33
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push 0x4c
mov dword [ebp - 0x10], 0
call fcn.00493f75
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 0x40]
mov dword [esi + 0x14], 0x4ffa14
call fcn.00410530
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [ebp - 0x10], 2
call fcn.00418b50
mov dword [ebp - 4], 2
lea ecx, [esi + 0x18]
mov eax, dword [esi + 0x14]
mov dword [esi], vtable.log4cplus::spi::LoggerImpl.1.0
push 0xffffffffffffffff
mov eax, dword [eax + 4]
mov dword [eax + esi + 0x14], vtable.log4cplus::spi::LoggerImpl.0
xor eax, eax
push eax
push dword [ebp + 0xc]
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov word [ecx], ax
call fcn.00412bb0
mov eax, dword [ebp + 0x10]
lea edx, [esi + 0x1c]
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 8]
mov byte [esi + 0x38], 1
mov ecx, dword [esi + 0x14]
mov dword [eax], vtable.log4cplus::Logger.0
mov dword [eax + 4], esi
mov ecx, dword [ecx + 4]
add edx, ecx
mov ecx, 1
lock xadd dword [edx], ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40dc20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcc47
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
push 0x18
mov dword [ebp - 0x18], edi
call fcn.00493f75
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.0041c9e0
test al, al
je 0x40ddb2
mov dword [edi], esi
mov dword [ebp - 4], 1
lea esi, [edi + 4]
mov dword [ebp - 0x10], esi
push 0x18
mov dword [esi], vtable.log4cplus::helpers::LogLog.0
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], 0xffffffff
call fcn.00493f75
mov ebx, eax
add esp, 4
mov dword [ebp - 0x10], ebx
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0041c9e0
test al, al
je 0x40ddb2
mov dword [esi + 0xc], ebx
lea ecx, [edi + 0x14]
mov dword [ebp - 0x1c], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
lea esi, [ecx + 0xc]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 5
push eax
mov dword [ebp - 0x14], 0x41f6d0
mov byte [ebp - 0x10], 0
call fcn.0041fdb0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x41f770
push eax
mov ecx, esi
call fcn.0041fcc0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x40], vtable.log4cplus::NDC.0
mov dword [edi + 0x44], vtable.log4cplus::MDC.0
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 8
call fcn.0041cee0
lea esi, [edi + 0x74]
mov byte [ebp - 4], 9
mov ecx, esi
mov dword [ebp - 0x1c], esi
call fcn.004207f0
mov dword [esi], vtable.log4cplus::spi::FactoryRegistry_class_log4cplus::spi::AppenderFactory_.0
lea esi, [edi + 0x84]
mov byte [ebp - 4], 0xa
mov ecx, esi
mov dword [ebp - 0x1c], esi
call fcn.004207f0
mov dword [esi], vtable.log4cplus::spi::FactoryRegistry_class_log4cplus::spi::LayoutFactory_.0
lea esi, [edi + 0x94]
mov byte [ebp - 4], 0xb
mov ecx, esi
mov dword [ebp - 0x1c], esi
call fcn.004207f0
mov dword [esi], vtable.log4cplus::spi::FactoryRegistry_class_log4cplus::spi::FilterFactory_.0
lea esi, [edi + 0xa4]
mov byte [ebp - 4], 0xc
mov ecx, esi
mov dword [ebp - 0x1c], esi
call fcn.004207f0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword [esi], vtable.log4cplus::spi::FactoryRegistry_class_log4cplus::spi::LocaleFactory_.0
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push str.InitializeCriticalSection:_STATUS_NO_MEMORY
lea ecx, [ebp - 0x28]
call fcn.004038d0
push 0x5164b4
lea eax, [ebp - 0x28]
push eax
call fcn.004ab0d8
int3
Function at 0x40e670
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4dcd82
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x14
cmp byte [0x535a14], 0
push esi
jne 0x40e763
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push eax
mov dword [0x5357c0], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x40e6f5
push 0x400
call fcn.00493f75
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0040e220
push eax
mov dword [ebp - 4], 0xffffffff
push dword [0x5357c0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.0040df90
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.0041b2c0
movups xmm0, xmmword [eax]
lea eax, [ebp - 0x18]
push eax
movups xmmword [esi + 0x30], xmm0
call fcn.0040cae0
mov ecx, dword [ebp - 0x14]
add esp, 4
mov dword [ebp - 0x18], vtable.log4cplus::Logger.0
test ecx, ecx
je 0x40e750
mov eax, dword [ecx + 0x14]
lea edx, [ecx + 0x14]
or ecx, 0xffffffff
mov eax, dword [eax + 4]
add edx, eax
lea eax, [edx + 8]
lock xadd dword [eax], ecx
cmp ecx, 1
sete al
test al, al
je 0x40e750
test edx, edx
je 0x40e750
mov eax, dword [edx]
mov ecx, edx
push 1
call dword [eax]
mov dword [ebp - 0x18], vtable.log4cplus::spi::AppenderAttachable.0
call fcn.00419820
mov byte [0x535a14], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x40e880
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcddf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
push esi
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 0
push edi
je 0x40e8cb
mov dword [ebx], 0x4ff388
mov dword [ebx + 0x50], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ebx]
lea edi, [ebx + 4]
push 0
push edi
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
add ecx, ebx
call fcn.0040fd40
mov dword [ebp - 4], 2
mov eax, dword [ebx]
push 8
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebp + 0xc], edi
lea eax, [ecx - 0x50]
mov dword [ecx + ebx - 4], eax
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00493f75
add esp, 4
mov esi, eax
push 1
mov byte [ebp - 4], 3
call fcn.00480a65
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 4
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov ecx, eax
not ecx
mov dword [edi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
and ecx, 1
mov dword [edi + 0x38], 0
shl ecx, 2
mov edx, ecx
or edx, 8
and al, 8
cmove edx, ecx
mov ecx, dword [ebp + 8]
mov eax, edx
or eax, 0x10
and cl, 4
mov ecx, dword [ebp - 0xc]
cmove eax, edx
mov dword [edi + 0x3c], eax
mov eax, ebx
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40f920
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcdf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00493f75
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00480a65
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov ebx, dword [ebp + 8]
mov ecx, ebx
not ecx
mov dword [edi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
and ecx, 1
mov dword [edi + 0x38], 0
shl ecx, 2
mov eax, ebx
mov edx, ecx
or edx, 2
and al, 2
mov eax, ebx
cmovne edx, ecx
mov ecx, edx
or ecx, 8
and al, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
and bl, 4
cmove eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x3c], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x40fc90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4dcd90
push eax
mov dword fs:[0], esp
push esi
push edi
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00493f75
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00480a65
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x417780
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd5a2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push dword [0x5357c0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x4177dc
push 0x400
call fcn.00493f75
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, eax
mov dword [ebp - 4], esi
call fcn.0040e220
mov esi, eax
mov dword [ebp - 4], 0xffffffff
push esi
push dword [0x5357c0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call fcn.004174e0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x417800
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4dd5a2
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
push dword [0x5357c0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x41785f
push 0x400
call fcn.00493f75
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.0040e220
mov edi, eax
mov dword [ebp - 4], 0xffffffff
push edi
push dword [0x5357c0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [ebp + 0x18]
mov esi, dword [ebp + 8]
add edi, 0x318
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
mov eax, dword [esi + 4]
push dword [ebp + 0xc]
add eax, 0x18
push eax
call fcn.004206e0
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0x28]
test eax, eax
mov edx, 0x4feee5
cmovne edx, eax
call fcn.00428d80
push eax
lea ecx, [edi + 0xb8]
call fcn.00414b50
lea ecx, [ebp - 0x28]
call fcn.0040ce40
mov ecx, dword [esi + 4]
push edi
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418a90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd5a2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
push dword [0x5357c0]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x418aef
push 0x400
call fcn.00493f75
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, eax
mov dword [ebp - 4], esi
call fcn.0040e220
mov esi, eax
mov dword [ebp - 4], 0xffffffff
push esi
push dword [0x5357c0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [ebp + 0x14]
lea eax, [edi + 0x18]
add esi, 0x318
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.004206e0
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x420120
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4dd5a2
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
push edi
cmp byte [esi + 0xd6], 0
jne 0x420204
call fcn.0040df90
push dword [0x5357c0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x420193
push 0x400
call fcn.00493f75
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.0040e220
mov edi, eax
mov dword [ebp - 4], 0xffffffff
push edi
push dword [0x5357c0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [edi + 0x140], 0
lea ecx, [edi + 0x130]
je 0x4201d3
push ecx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041cec0
mov ecx, eax
call fcn.0041ce80
mov edx, eax
mov eax, dword [edx]
test eax, eax
je 0x4201c1
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, dword [edx + 8]
mov eax, dword [eax + ecx*4]
add eax, 0x18
jmp 0x4201d8
mov eax, 0x5289b0
lea edi, [esi + 0x3c]
cmp edi, eax
je 0x4201eb
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.00412bb0
mov byte [esi + 0xd6], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0x3c]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x420220
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de222
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
cmp byte [edi + 0xd7], 0
jne 0x4202f3
push ebx
push esi
call fcn.0040df90
push dword [0x5357c0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x420292
push 0x400
call fcn.00493f75
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, eax
mov dword [ebp - 4], esi
call fcn.0040e220
mov esi, eax
mov dword [ebp - 4], 0xffffffff
push esi
push dword [0x5357c0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ebx, [esi + 0x144]
lea esi, [edi + 0x54]
cmp esi, ebx
je 0x4202d9
mov dword [ebp - 4], 1
mov ecx, esi
mov eax, dword [esi]
push dword [eax + 4]
call fcn.0040fe00
mov eax, dword [esi]
mov ecx, esi
mov dword [eax + 4], eax
mov eax, dword [esi]
mov dword [eax], eax
mov eax, dword [esi]
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
mov dword [eax + 8], eax
push ebx
mov dword [esi + 4], 0
call fcn.00416170
mov eax, esi
mov byte [edi + 0xd7], 1
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
lea eax, [edi + 0x54]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret