joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4284a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a1bc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x4da0cc]
push ebx
push esi
push edi
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4284df
mov dword [esp + 0x10], 0x4d79e4
mov ecx, dword [0x4da0cc]
push 0x4d79e4
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0
push 0x4da058
mov dword [esp + 0x1c], 0x4da058
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, 1
mov byte [esp + 0x1c], bl
mov eax, esi
mov byte [esp + 0x2c], bl
call fcn.00429410
cmp dword [0x4d7c34], 0
jne 0x42852b
or eax, 0xffffffff
jmp 0x428546
xor edx, edx
div dword [0x4d7c44]
mov eax, dword [0x4d7c38]
test byte [eax + edx*4], bl
je 0x428544
mov eax, dword [eax + edx*4]
shr eax, 1
jmp 0x428546
mov eax, edx
mov ebx, esi
mov edi, 0x4d7c34
call fcn.00441440
mov esi, eax
cmp esi, 0xffffffff
jne 0x428579
push 0
push 0xa1
push str.d:_build10_fineobjects_src_tempfile.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
mov ecx, 1
test byte [0x4d77bc], cl
jne 0x42858f
mov ecx, esi
call fcn.00428c00
jmp 0x4285d4
mov eax, dword [0x4d7c38]
mov ebx, dword [eax + esi*4]
mov dword [eax + esi*4], 0
sub dword [0x4d7c40], ecx
mov edi, dword [ebx]
push edi
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4285c6
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov ebx, dword [esp + 0x14]
mov edx, dword [0x4d7c50]
mov dword [ebx], edx
mov dword [0x4d7c50], ebx
push 0x4da058
mov byte [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x10]
mov ecx, dword [0x4da0cc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b010
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a0560
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.0042ae30
add esp, 8
mov dword [esp + 0x24], 0
mov eax, dword [esp + 0xc]
mov esi, dword [eax + 4]
test esi, esi
jne 0x42b08b
push eax
mov dword [esp + 0x28], 0xffffffff
mov edi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x42b077
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea ecx, [esp + 0x10]
call fcn.00419ec0
lea edx, [esi + 1]
push edx
push eax
call fcn.00446afe
mov eax, dword [esp + 0x14]
mov dword [eax + 4], esi
mov edx, dword [esp + 0x14]
xor ecx, ecx
mov word [edx + esi*2 + 0xc], cx
mov eax, dword [0x4da0cc]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test eax, eax
jne 0x42b0cb
mov edi, 0x4d79e4
mov ecx, dword [0x4da0cc]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x4d79e4
push ecx
mov dword [esp + 0x18], edi
call esi
mov eax, 0x4da0f8
mov byte [esp + 0x24], 1
call fcn.00434680
mov bl, byte [eax + 1]
mov eax, dword [esp + 0xc]
push 8
add eax, 0xc
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [esp + 0x14], eax
mov eax, 0x4da0f8
call fcn.00434680
mov byte [eax + 1], bl
mov byte [esp + 0x24], 0
mov edx, dword [0x4da0cc]
push edi
push edx
call esi
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0xc]
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x42b14d
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b170
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a1270
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
call fcn.0042b010
mov edi, eax
xor ebx, ebx
add esp, 4
mov dword [esp + 0x10], edi
cmp edi, ebx
jne 0x42b1bd
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4da070
mov dword [esp + 0x18], 0x4da070
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x18], 1
mov dword [esp + 0x3c], ebx
mov ecx, dword [0x4da76c]
xor esi, esi
cmp ecx, ebx
jle 0x42b1fc
mov eax, dword [0x4da770]
lea ebx, [ebx]
cmp dword [eax], edi
je 0x42b1fc
inc esi
add eax, 0x14
cmp esi, ecx
jl 0x42b1f0
cmp esi, ecx
jne 0x42b222
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], bl
mov dword [esp + 0x20], edi
call fcn.0042cdb0
mov eax, dword [0x4da770]
lea edx, [esi + esi*4]
inc dword [eax + edx*4 + 4]
cmp dword [0x4d9e80], 2
lea eax, [eax + edx*4 + 4]
jne 0x42b286
mov ecx, dword [0x4da0cc]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
cmp eax, ebx
jne 0x42b253
mov edi, 0x4d79e4
mov edx, dword [0x4da0cc]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x4d79e4
push edx
mov dword [esp + 0x14], edi
call esi
mov byte [esp + 0x3c], 1
call fcn.0042c310
mov byte [esp + 0x3c], bl
mov eax, dword [0x4da0cc]
push edi
push eax
call esi
mov edi, dword [esp + 0x10]
push 0x4da070
mov dword [esp + 0x40], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x34]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42c7f0
Capabilities:
Check os version

Disassembly:
push ecx
mov eax, dword [0x4d9d34]
test eax, eax
jne 0x42c83e
push 0x4d9d38
mov dword [0x4d9d38], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x42c831
push eax
push 0x413
push str.d:_build10_fineobjects_src_fineobjects.cpp
push 0x4b84f0
push 0x4b84f0
push eax
call fcn.0041d410
add esp, 0x18
push 1
push 0x4d9d34
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x4d9d48], 2
jne 0x42c873
mov eax, dword [0x4d9d3c]
cmp eax, 5
ja 0x42c86c
jne 0x42c873
mov eax, dword [0x4d9d40]
cmp eax, 2
ja 0x42c86c
jne 0x42c873
mov al, byte [0x4d9e52]
cmp al, 3
je 0x42c86c
cmp al, 2
jne 0x42c873
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x42c890
Capabilities:
Check os version

Disassembly:
push ecx
mov eax, dword [0x4d9d34]
test eax, eax
jne 0x42c8de
push 0x4d9d38
mov dword [0x4d9d38], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x42c8d1
push eax
push 0x413
push str.d:_build10_fineobjects_src_fineobjects.cpp
push 0x4b84f0
push 0x4b84f0
push eax
call fcn.0041d410
add esp, 0x18
push 1
push 0x4d9d34
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp byte [0x4d9e52], 1
mov eax, dword [0x4d9d3c]
je 0x42c8fa
cmp eax, 6
ja 0x42c8f3
jne 0x42c90a
mov eax, 1
pop ecx
ret
cmp eax, 6
ja 0x42c8f3
jne 0x42c90a
cmp dword [0x4d9d40], 1
jae 0x42c8f3
xor eax, eax
pop ecx
ret

Function at 0x42c910
Capabilities:
Check os version

Disassembly:
push ecx
mov eax, dword [0x4d9d34]
test eax, eax
jne 0x42c95e
push 0x4d9d38
mov dword [0x4d9d38], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x42c951
push eax
push 0x413
push str.d:_build10_fineobjects_src_fineobjects.cpp
push 0x4b84f0
push 0x4b84f0
push eax
call fcn.0041d410
add esp, 0x18
push 1
push 0x4d9d34
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp byte [0x4d9e52], 1
mov eax, dword [0x4d9d3c]
je 0x42c97c
cmp eax, 6
ja 0x42c990
jne 0x42c98c
cmp dword [0x4d9d40], 1
jmp 0x42c98a
cmp eax, 6
ja 0x42c990
jne 0x42c98c
cmp dword [0x4d9d40], 2
jae 0x42c990
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret

Function at 0x42c9a0
Capabilities:
Check os version

Disassembly:
push ecx
mov eax, dword [0x4d9d34]
test eax, eax
jne 0x42c9ee
push 0x4d9d38
mov dword [0x4d9d38], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x42c9e1
push eax
push 0x413
push str.d:_build10_fineobjects_src_fineobjects.cpp
push 0x4b84f0
push 0x4b84f0
push eax
call fcn.0041d410
add esp, 0x18
push 1
push 0x4d9d34
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x4d9d48], 2
jne 0x42ca1f
mov eax, dword [0x4d9d3c]
cmp eax, 5
ja 0x42ca18
jne 0x42ca1f
mov eax, dword [0x4d9d40]
cmp eax, 2
ja 0x42ca18
jne 0x42ca1f
cmp byte [0x4d9e52], 1
jne 0x42ca1f
call fcn.0042c700
pop ecx
ret
xor al, al
pop ecx
ret
Function at 0x42f840
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x49f2e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax]
push edi
mov ebx, ecx
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0x24]
xor eax, eax
push ecx
lea ebp, [edi + 0xc]
mov dword [esp + 0x20], eax
push ebp
mov dword [esp + 0x2c], eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jbe 0x42f8cf
push esi
mov ecx, ebx
mov byte [ebx + 0xc], 1
call fcn.00402040
cmp dword [ebx], 0
jne 0x42f8a0
xor ebx, ebx
jmp 0x42f8a3
mov ebx, dword [ebx + 4]
mov edx, dword [esp + 0x24]
push ebx
push esi
push edx
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x42f8cf
push eax
push 0x50
push str.d:_build10_fineobjects_src_versioninfo.cpp
push 0x4b84f0
push 0x4b84f0
push eax
call fcn.0041d410
add esp, 0x18
push edi
mov dword [esp + 0x20], 0xffffffff
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x42f8ef
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x42fdc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a1b1d
push eax
mov dword fs:[0], esp
xor eax, eax
push esi
mov esi, dword [esp + 0x14]
mov dword [esi], vtable.FObj::CMapping.0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0x1f
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 0x80
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
push edx
push 0xffffffffffffffff
mov eax, esi
call fcn.0042fed0
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0xc
Function at 0x4302e0
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x48
cmp dword [eax + 0xc], 0
push ebx
push ebp
push esi
push edi
jne 0x430311
push 0
push 0x99
push str.d:_build10_fineobjects_src_filemapping.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
cmp dword [esp + 0x68], 0
mov ebx, dword [esp + 0x64]
jl 0x430329
jg 0x430322
test ebx, ebx
jb 0x430329
cmp dword [esp + 0x6c], 0
jge 0x430349
push 0
push 0x9a
push str.d:_build10_fineobjects_src_filemapping.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
mov esi, dword [0x4da908]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
test esi, esi
jne 0x430392
lea ecx, [esp + 0x10]
push ecx
call edi
mov esi, dword [esp + 0x2c]
mov dword [0x4da908], esi
test esi, esi
jne 0x430392
push esi
push 0x34c
push 0x4c2af0
push 0x4b84f0
push 0x4b84f0
push esi
call fcn.0041d410
mov esi, dword [0x4da908]
add esp, 0x18
mov ebp, esi
test esi, esi
jne 0x4303d1
lea edx, [esp + 0x34]
push edx
call edi
mov esi, dword [esp + 0x50]
mov dword [0x4da908], esi
test esi, esi
jne 0x4303d1
push esi
push 0x34c
push 0x4c2af0
push 0x4b84f0
push 0x4b84f0
push esi
call fcn.0041d410
mov esi, dword [0x4da908]
add esp, 0x18
mov eax, ebp
cdq
push edx
push eax
mov eax, dword [esp + 0x70]
push eax
push ebx
call fcn.0044e9e0
mov ecx, eax
mov edi, edx
mov eax, esi
cdq
push edx
push eax
push edi
push ecx
call fcn.00455f70
mov ecx, dword [esp + 0x6c]
sub ebx, eax
mov esi, ebx
test ecx, ecx
je 0x4303ff
add ecx, esi
mov edi, dword [esp + 0x5c]
push ecx
push eax
mov eax, dword [edi + 0xc]
push edx
mov edx, dword [esp + 0x6c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
setne cl
movzx edx, cl
push edx
call fcn.00401790
add esp, 4
lea ebp, [ebx + esi]
add edi, 0x10
push ebp
call fcn.00430850
lea esi, [edi + 0x18]
mov dword [esp + 0x6c], eax
call fcn.0042ef10
test eax, eax
je 0x43044b
mov dword [eax], ebp
mov dword [eax + 4], ebx
jmp 0x43044d
xor eax, eax
inc dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esp + 0x6c]
pop edi
pop esi
mov dword [ecx + edx*4], eax
mov eax, ebp
pop ebp
pop ebx
add esp, 0x48
ret 0x14
Function at 0x431050
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a27a2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
xor ebx, ebx
push 0x4d9f40
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 2
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [esp + 0x1c], 0x4d9f40
mov edi, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
mov ecx, edi
mov dword [esp + 0x30], ebx
call fcn.00430d50
mov esi, eax
mov byte [esp + 0x2c], 1
mov eax, dword [edi + 0x10]
sub eax, ebx
je 0x4310e4
sub eax, 1
je 0x4311b5
sub eax, 1
je 0x4311ab
push ebx
push 0x7c
push str.d:_build10_fineobjects_src_setup.cpp
push 0x4b84f0
push 0x4b84f0
push ebx
call fcn.0041d410
add esp, 0x18
xor ecx, ecx
mov eax, dword [esi]
push ecx
add eax, 0xc
push 1
push eax
push ecx
mov eax, edi
call fcn.00430ce0
add esp, 4
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.0041f780
mov byte [esp + 0x2c], bl
mov eax, dword [esp + 0xc]
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x43112e
mov ebx, dword [esi + 8]
mov edi, esi
mov esi, 0x4da170
call fcn.00432310
mov edi, dword [ebp + 8]
xor ebx, ebx
mov edx, dword [ebp + 0xc]
mov esi, dword [edx]
mov edi, dword [edi + 0xc]
add esi, 0xc
add edi, 0xc
je 0x431142
cmp esi, ebx
jne 0x431160
push ebx
push 0x176
push str.d:_build10_fineobjects_src_registrykey.cpp
push 0x4b84f0
push 0x4b84f0
push ebx
call fcn.0041d410
add esp, 0x18
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x431165
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push esi
mov ecx, edi
lea edx, [esp + 0x18]
call fcn.0041fe40
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x30], 0xffffffff
call fcn.0041f6f0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 2
jmp 0x4310e6
mov ecx, 1
jmp 0x4310e6
Function at 0x431460
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x49eadb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40c
push esi
push edi
mov edi, 0x200
mov ecx, edi
lea eax, [esp + 8]
mov dword [esp + 0x40c], 0
mov dword [esp + 0x410], ecx
mov dword [esp + 0x408], eax
mov dword [esp + 0x41c], 0
jmp 0x4314b7
mov ecx, dword [esp + 0x410]
cmp edi, ecx
jle 0x4314e6
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x200
mov edx, eax
jg 0x4314d0
mov edx, 0x200
mov eax, edi
sub eax, ecx
cmp eax, edx
jg 0x4314da
mov eax, edx
add ecx, eax
push ecx
lea esi, [esp + 0xc]
call fcn.00431c60
mov edx, dword [esp + 0x424]
lea ecx, [esp + 0x428]
push ecx
mov eax, edi
neg eax
push edx
lea ecx, [edi - 1]
sbb eax, eax
and eax, dword [esp + 0x410]
push ecx
push edi
push eax
mov dword [esp + 0x420], edi
call fcn.0044764f
add esp, 0x14
add edi, edi
test eax, eax
jl 0x4314b0
test dword [0x4d77bc], 0x200
mov eax, dword [esp + 0x40c]
pop edi
pop esi
je 0x431556
neg eax
push 0x11
sbb eax, eax
and eax, dword [esp + 0x404]
push str.Fine_Objects
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x431568
int3
neg eax
sbb eax, eax
and eax, dword [esp + 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [esp + 0x414], 0xffffffff
mov eax, dword [esp + 0x400]
lea edx, [esp]
cmp eax, edx
je 0x431593
test eax, eax
je 0x431593
mov ecx, dword [eax - 8]
mov edx, dword [ecx]
add eax, 0xfffffff8
push eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 0x40c]
mov dword fs:[0], ecx
add esp, 0x418
ret
Function at 0x431940
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a2250
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 4], ebx
jne 0x431981
push ebx
push 0x20c
push 0x4c2af0
push 0x4b84f0
push 0x4b84f0
push ebx
call fcn.0041d410
add esp, 0x18
mov eax, dword [esi + 0xc]
test eax, eax
je 0x431b1e
mov ecx, dword [0x4da0cc]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 8], eax
cmp eax, ebx
jne 0x4319a9
mov dword [esp + 8], 0x4d79e4
mov edx, dword [0x4da0cc]
push ebp
push edi
push 0x4d79e4
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x44], ebx
test byte [0x4d77bc], 4
je 0x431a60
mov ebp, dword [esi + 4]
push ebp
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_HeapLock]
test eax, eax
jne 0x431a09
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x201
push 0x4c2af0
push 0x4b84f0
push 0x4b84f0
push 1
call fcn.0041d410
add esp, 0x18
mov byte [esp + 0x44], 1
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_HeapWalk]
lea eax, [esp + 0x20]
push eax
push ecx
call edi
test eax, eax
je 0x431a55
mov dl, byte [esp + 0x2a]
shr dl, 2
test dl, 1
je 0x431a46
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
push str.Undeleted_memory_block_in_heap_manager._Address:_0x_p._Size:__u_bytes_n
call fcn.00431460
add esp, 0xc
mov eax, dword [esi + 4]
lea edx, [esp + 0x20]
push edx
push eax
call edi
test eax, eax
jne 0x431a23
push ebp
mov byte [esp + 0x48], bl
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
test byte [0x4d77bc], 0x10
je 0x431b02
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.0041b670
mov byte [esp + 0x48], 2
mov eax, dword [eax]
mov esi, dword [esi + 4]
add eax, 0xc
push eax
push esi
lea edx, [esp + 0x20]
push str.Internal_error:_memory_leak._n_nHeap_0x_p___CHeapManager_object_at__s___is_not_empty.
push edx
call fcn.0041b640
add esp, 0x14
push 0x11
mov byte [esp + 0x48], 3
mov eax, dword [eax]
push str.Fine_Objects
add eax, 0xc
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [esp + 0x44], 2
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x431ade
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
xor ebx, ebx
mov byte [esp + 0x44], bl
mov edi, dword [esp + 0x18]
push edi
call ebp
test eax, eax
jg 0x431afa
mov ebx, dword [edi + 8]
mov esi, 0x4da170
call fcn.00432310
cmp dword [esp + 0x1c], 2
jne 0x431b02
int3
mov dword [esp + 0x44], 0xffffffff
mov eax, dword [esp + 0x10]
mov ecx, dword [0x4da0cc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop ebp
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x431bf0
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [0x4da908]
sub esp, 0x24
test eax, eax
jne 0x431c36
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x1c]
mov dword [0x4da908], eax
test eax, eax
jne 0x431c36
push eax
push 0x34c
push 0x4c2af0
push 0x4b84f0
push 0x4b84f0
push eax
call fcn.0041d410
mov eax, dword [0x4da908]
add esp, 0x18
add esp, 0x24
ret

Function at 0x431c60
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x200
jle 0x431cf9
push ebx
push ebp
mov ebp, dword [esi + 0x400]
push edi
lea edi, [eax + eax + 8]
mov eax, dword [0x4da0cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test eax, eax
jne 0x431c93
mov ebx, 0x4d79e4
mov edx, dword [ebx]
mov eax, dword [edx + 4]
push edi
mov ecx, ebx
call eax
mov edi, eax
test edi, edi
jne 0x431ca8
call fcn.0041cdf0
add edi, 8
mov dword [edi - 8], ebx
jne 0x431cb5
call fcn.0041cdf0
mov eax, dword [esi + 0x404]
mov dword [esi + 0x400], edi
test eax, eax
jle 0x431cd3
lea ecx, [eax + eax]
push ecx
push ebp
push edi
call fcn.0044c0d0
add esp, 0xc
cmp ebp, esi
je 0x431ce9
test ebp, ebp
je 0x431ce9
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
lea eax, [ebp - 8]
push eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 0x10]
pop edi
pop ebp
mov dword [esi + 0x408], ecx
pop ebx
ret 4
mov ecx, dword [esi + 0x400]
cmp ecx, esi
je 0x431d43
mov eax, dword [esi + 0x404]
test eax, eax
jle 0x431d1b
lea edx, [eax + eax]
push edx
push ecx
push esi
call fcn.0044c0d0
add esp, 0xc
mov eax, dword [esi + 0x400]
test eax, eax
je 0x431d33
mov ecx, dword [eax - 8]
mov edx, dword [ecx]
add eax, 0xfffffff8
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esi + 0x400], esi
mov dword [esi + 0x408], 0x200
ret 4

Function at 0x432930
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x49ef19
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
xor ebx, ebx
mov dword [esp + 0x18], ebx
push 0x4d9f30
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [esi], 0x4d9f30
push 0xa
push 0x29
mov dword [esp + 0x20], ebx
push 0x28
mov ecx, esi
mov dword [esp + 0x18], 1
call fcn.00432820
push eax
mov eax, dword [esp + 0x30]
push eax
call fcn.004497fd
mov ecx, dword [esi]
lea eax, [ecx + 0xc]
add esp, 0x10
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x432997
sub eax, edi
mov dword [ecx + 4], eax
mov ecx, dword [esi]
mov byte [ecx + eax + 0xc], bl
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret