joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402060
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
mov eax, dword [0x574a28]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x40
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
xor edx, edx
test ecx, ecx
jbe 0x4020e9
mov edi, dword [ebp + 8]
mov esi, eax
sub edi, eax
mov dword [esp + 0xc], ecx
inc edx
and edx, 0xff
mov al, byte [esp + edx + 0x10]
movzx ecx, al
add ecx, ebx
and ecx, 0xff
mov ebx, ecx
mov cl, byte [esp + ebx + 0x10]
mov byte [esp + edx + 0x10], cl
mov byte [esp + ebx + 0x10], al
movzx ecx, byte [esp + edx + 0x10]
movzx eax, al
add eax, ecx
and eax, 0xff
movzx eax, byte [esp + eax + 0x10]
xor al, byte [edi + esi]
inc esi
sub dword [esp + 0xc], 1
mov byte [esi - 1], al
jne 0x4020a3
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ca80c
mov esp, ebp
pop ebp
ret

Function at 0x402b10
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x574a28]
xor eax, esp
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor esi, esi
push 0x50
lea ecx, [esp + 0x24]
push esi
push ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], esi
call fcn.004cb660
mov edi, dword [ebx + 0x14]
push edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0x67452301
mov dword [esp + 0x34], 0xefcdab89
mov dword [esp + 0x38], 0x98badcfe
mov dword [esp + 0x3c], 0x10325476
call fcn.00485e90
add esp, 0x10
cmp dword [ebx + 0x18], 0x10
mov esi, eax
jb 0x402b89
mov ebx, dword [ebx + 4]
jmp 0x402b8c
add ebx, 4
push edi
push ebx
push esi
call fcn.004cb2f0
push edi
lea edx, [esp + 0x28]
push esi
push edx
call fcn.00402130
push esi
call fcn.00485e9b
xor eax, eax
mov dword [esp + 0x91], eax
mov dword [esp + 0x95], eax
mov dword [esp + 0x99], eax
mov word [esp + 0x9d], ax
mov byte [esp + 0x9f], al
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x38]
push ecx
mov byte [esp + 0x98], 0
call fcn.004021e0
mov esi, dword [esp + 0x34]
push 0x10
lea edx, [esp + 0x9c]
push edx
push esi
call fcn.00402a10
mov ecx, dword [esp + 0xb4]
add esp, 0x30
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.004ca80c
mov esp, ebp
pop ebp
ret
Function at 0x40bf80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c8
mov eax, dword [0x574a28]
xor eax, esp
mov dword [esp + 0x1c4], eax
push ebp
push esi
mov esi, dword [esp + 0x1d4]
push 0x3f
lea eax, [esp + 0x91]
push 0
push eax
mov ebp, ecx
mov dword [esp + 0x14], esi
mov byte [esp + 0x98], 0
call fcn.004cb660
push 0x3f
lea ecx, [esp + 0x5d]
push 0
push ecx
mov byte [esp + 0x64], 0
call fcn.004cb660
push 0x3f
lea edx, [esp + 0x29]
push 0
push edx
mov byte [esp + 0x30], 0
call fcn.004cb660
push 0xff
lea eax, [esp + 0xf5]
push 0
push eax
mov byte [esp + 0xfc], 0
call fcn.004cb660
add esp, 0x30
test esi, esi
jne 0x40c00c
xor al, al
jmp 0x40c135
push ebx
push edi
lea ecx, [esp + 0x94]
push ecx
mov ecx, ebp
call sym.ftl.bin_private:_void___thiscall_FileHeader::GetEncryptHeaderKey_char__
cmp byte [ebp + 0x24], 0
lea ebx, [ebp + 0x24]
jne 0x40c03f
lea edx, [esp + 0x54]
push edx
mov ecx, ebp
call sym.ftl.bin_private:_void___thiscall_FileHeader::GenerateFileContentKey_unsigned_char__
mov ecx, 8
lea esi, [esp + 0x54]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push 0x20
push str.5F50BF2EE6D0443d85455B4AE05749C
push 0x20
lea eax, [esp + 0x60]
push eax
mov ecx, ebp
call sym.ftl.bin_private:_bool___thiscall_FileHeader::GetSHA160CharsetValue_unsigned_char___int__unsigned_char_const___int_
mov ecx, 8
mov esi, ebx
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x54]
push ecx
mov ecx, 0x20
lea esi, [esp + 0xd8]
call fcn.00401f30
lea eax, [esp + 0x18]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c081
mov esi, dword [esp + 0x10]
sub eax, edx
add esi, 0x24
push esi
push eax
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0xe0]
call fcn.00402060
add esp, 0xc
cmp dword [ebp + 0x84], 1
jne 0x40c0c0
mov eax, esi
mov ecx, 0x20
xor byte [eax], 0x61
inc eax
sub ecx, 1
jne 0x40c0b7
push pe_nt_image_headers32
lea eax, [esp + 0xd8]
push 0
mov ecx, 8
mov edi, ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004cb660
lea eax, [esp + 0xa0]
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c0f0
lea ecx, [esp + 0x94]
sub eax, edx
push ecx
mov ecx, eax
lea esi, [esp + 0xd8]
call fcn.00401f30
mov edx, dword [esp + 0x14]
push edx
push 0x400
push ebp
mov ecx, esi
call fcn.00402060
mov edi, ebx
add esp, 0x10
mov ecx, 8
lea esi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
pop edi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x1cc]
pop esi
pop ebp
xor ecx, esp
call fcn.004ca80c
add esp, 0x1c8
ret 4
Function at 0x40c180
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c4
mov eax, dword [0x574a28]
xor eax, esp
mov dword [esp + 0x1c0], eax
push ebp
push edi
push 0x3f
lea eax, [esp + 0x8d]
push 0
push eax
mov ebp, ecx
mov byte [esp + 0x94], 0
call fcn.004cb660
push 0x3f
lea ecx, [esp + 0x19]
push 0
push ecx
mov byte [esp + 0x20], 0
call fcn.004cb660
push 0x3f
lea edx, [esp + 0x65]
push 0
push edx
mov byte [esp + 0x6c], 0
call fcn.004cb660
push 0xff
lea eax, [esp + 0xf1]
push 0
push eax
mov byte [esp + 0xf8], 0
call fcn.004cb660
mov edi, dword [esp + 0x200]
add esp, 0x30
test edi, edi
je 0x40c359
cmp byte [edi], 0
je 0x40c359
lea ecx, [esp + 0x88]
push ecx
mov ecx, ebp
call sym.ftl.bin_private:_void___thiscall_FileHeader::GetEncryptHeaderKey_char__
lea eax, [esp + 0x88]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c227
sub eax, edx
push esi
lea edx, [esp + 0x8c]
push edx
mov ecx, eax
lea esi, [esp + 0xd0]
call fcn.00401f30
push ebp
push 0x400
push edi
mov ecx, esi
call fcn.00402060
xor eax, eax
add esp, 0x10
cmp byte [ebp + 5], al
jne 0x40c26c
cmp byte [ebp + 6], al
jne 0x40c26c
cmp byte [ebp + 7], al
jne 0x40c26c
mov eax, dword [ebp + 4]
sub eax, 1
je 0x40c275
xor eax, eax
jmp 0x40c27a
mov eax, 1
sub eax, 0
je 0x40c324
sub eax, 1
jne 0x40c354
push 0x20
push str.5F50BF2EE6D0443d85455B4AE05749C
push 0x20
lea eax, [esp + 0x18]
push eax
mov ecx, ebp
call sym.ftl.bin_private:_bool___thiscall_FileHeader::GetSHA160CharsetValue_unsigned_char___int__unsigned_char_const___int_
cmp dword [ebp + 0x84], 1
jne 0x40c2bb
lea eax, [ebp + 0x24]
mov ecx, 0x20
xor byte [eax], 0x61
inc eax
sub ecx, 1
jne 0x40c2b2
add ebp, 0x24
mov ecx, 8
mov esi, ebp
lea edi, [esp + 0x4c]
push pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xd0]
push 0
push ecx
call fcn.004cb660
lea edx, [esp + 0x18]
push edx
mov ecx, 0x20
lea esi, [esp + 0xdc]
call fcn.00401f30
lea eax, [esp + 0x5c]
add esp, 0x10
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c300
sub eax, edx
push ebp
push eax
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0xd8]
call fcn.00402060
add esp, 0xc
mov al, 1
pop esi
jmp 0x40c35b
push ebx
push 0x40
lea ebx, [ebp + 4]
push 0
mov ecx, 0x10
mov esi, ebx
lea edi, [esp + 0x18]
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.004cb660
add esp, 0xc
lea edi, [ebp + 0x24]
mov ecx, 8
lea esi, [esp + 0x10]
mov byte [ebx], 1
rep movsd dword es:[edi], dword [esi]
pop ebx
mov al, 1
pop esi
jmp 0x40c35b
xor al, al
mov ecx, dword [esp + 0x1c8]
pop edi
pop ebp
xor ecx, esp
call fcn.004ca80c
add esp, 0x1c4
ret 4
Function at 0x40c380
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c4
mov eax, dword [0x574a28]
xor eax, esp
mov dword [esp + 0x1c0], eax
push ebx
mov ebx, dword [esp + 0x1d0]
push ebp
push edi
push 0x3f
lea eax, [esp + 0x91]
push 0
push eax
mov ebp, ecx
mov byte [esp + 0x98], 0
call fcn.004cb660
push 0x3f
lea ecx, [esp + 0x1d]
push 0
push ecx
mov byte [esp + 0x24], 0
call fcn.004cb660
push 0x3f
lea edx, [esp + 0x69]
push 0
push edx
mov byte [esp + 0x70], 0
call fcn.004cb660
push 0xff
lea eax, [esp + 0xf5]
push 0
push eax
mov byte [esp + 0xfc], 0
call fcn.004cb660
mov edi, dword [esp + 0x204]
add esp, 0x30
test edi, edi
je 0x40c56a
cmp byte [edi], 0
je 0x40c56a
lea ecx, [esp + 0x8c]
push ecx
mov ecx, ebp
call sym.ftl.bin_private:_void___thiscall_FileHeader::GetEncryptHeaderKey_char__
lea eax, [esp + 0x8c]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c430
sub eax, edx
push esi
lea edx, [esp + 0x90]
push edx
mov ecx, eax
lea esi, [esp + 0xd4]
call fcn.00401f30
push ebp
push 0x400
push edi
mov ecx, esi
call fcn.00402060
xor eax, eax
add esp, 0x10
cmp byte [ebp + 5], al
jne 0x40c475
cmp byte [ebp + 6], al
jne 0x40c475
cmp byte [ebp + 7], al
jne 0x40c475
mov eax, dword [ebp + 4]
sub eax, 1
je 0x40c47e
xor eax, eax
jmp 0x40c483
mov eax, 1
sub eax, 0
je 0x40c534
sub eax, 1
jne 0x40c565
push 0x20
push str.5F50BF2EE6D0443d85455B4AE05749C
push 0x20
lea eax, [esp + 0x1c]
push eax
mov ecx, ebp
call sym.ftl.bin_private:_bool___thiscall_FileHeader::GetSHA160CharsetValue_unsigned_char___int__unsigned_char_const___int_
cmp dword [ebp + 0x84], 1
jne 0x40c4c9
lea eax, [ebp + 0x24]
mov ecx, 0x20
jmp 0x40c4c0
xor byte [eax], 0x61
inc eax
sub ecx, 1
jne 0x40c4c0
add ebp, 0x24
mov ecx, 8
mov esi, ebp
lea edi, [esp + 0x50]
push pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xd4]
push 0
push ecx
call fcn.004cb660
lea edx, [esp + 0x1c]
push edx
mov ecx, 0x20
lea esi, [esp + 0xe0]
call fcn.00401f30
lea eax, [esp + 0x60]
add esp, 0x10
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c510
sub eax, edx
push ebp
push eax
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0xdc]
call fcn.00402060
add esp, 0xc
mov al, 1
pop esi
jmp 0x40c56c
mov byte [ebx], 1
push 0x40
lea ebx, [ebp + 4]
push 0
mov ecx, 0x10
mov esi, ebx
lea edi, [esp + 0x18]
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.004cb660
lea edi, [ebp + 0x24]
mov ecx, 8
lea esi, [esp + 0x1c]
mov byte [ebx], 1
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
mov al, 1
pop esi
jmp 0x40c56c
xor al, al
mov ecx, dword [esp + 0x1cc]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ca80c
add esp, 0x1c4
ret 8
Function at 0x40cac0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x51a3eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x574a28]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004f726d
push 4
mov dword [esp + 0x24], 0
call fcn.00485e56
mov edi, eax
add esp, 4
test edi, edi
je 0x40cb42
call fcn.004f7528
mov dword [edi], eax
call fcn.004f73d3
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004f71a9
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40cb37
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004f71d1
jmp 0x40cb44
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x411530
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x106], 0
jne 0x41158d
cmp dword [0x57bf58], 0
jne 0x41154a
call fcn.004236c0
mov eax, dword [0x57bf5c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x41155f
call fcn.004240c0
add eax, 0x100
cmp dword [eax + 0x1c], 0
je 0x411574
call fcn.004279e0
add eax, 0x1c
jmp 0x411579
mov eax, 0x576ddc
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esi + 0x44]
call fcn.004141f0
mov byte [esi + 0x106], 1
lea eax, [esi + 0x44]
pop esi
ret

Function at 0x4115a0
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x107], 0
jne 0x4115e5
cmp dword [0x57bf58], 0
jne 0x4115bc
call fcn.004236c0
mov eax, dword [0x57bf5c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4115d1
call fcn.004240c0
add eax, 0x120
lea esi, [edi + 0x60]
call fcn.004132e0
mov byte [edi + 0x107], 1
lea eax, [edi + 0x60]
pop edi
pop esi
pop ecx
ret

Function at 0x412cf0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x57bf5c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x412d06
call fcn.004240c0
mov esi, eax
push esi
call sym.ftl.bin_void___cdecl_log4cplus::detail::clear_tostringstream_class_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____
add esp, 4
mov eax, esi
pop esi
ret

Function at 0x412d20
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x57bf5c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x412d35
call fcn.004240c0
add eax, 0x43c
ret

Function at 0x412d40
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x57bf5c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x412d55
call fcn.004240c0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [edi + 4]
lea esi, [eax + 0x330]
mov eax, dword [esp + 0x1c]
push eax
push ecx
add edx, 0x24
push edx
mov ecx, esi
call sym.ftl.bin_public:_void___thiscall_log4cplus::spi::InternalLoggingEvent::setLoggingEvent_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x412d90
mov eax, 0x53ed38
push eax
mov ecx, esi
call sym.ftl.bin_public:_void___thiscall_log4cplus::spi::InternalLoggingEvent::setFunction_char_const__
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x38]
push esi
call edx
pop edi
pop esi
ret
Function at 0x414900
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x51a31b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x574a28]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004f726d
push 4
mov dword [esp + 0x24], 0
call fcn.00485e56
mov edi, eax
add esp, 4
test edi, edi
je 0x414982
call fcn.004f7528
mov dword [edi], eax
call fcn.004f73d3
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004f71a9
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x414977
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004f71d1
jmp 0x414984
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x417de0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5202fb
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x574a28]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.00417a10
lea eax, [esi + 0x18]
push eax
mov dword [esp + 0x1c], 0
call fcn.00417a10
lea eax, [esi + 0x30]
push eax
mov byte [esp + 0x20], 1
call fcn.00417a10
add esp, 0xc
push 0
push 1
push 1
mov byte [esp + 0x20], 2
mov edi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push 0
call edi
mov dword [esi + 0x48], eax
test eax, eax
jne 0x417e5b
push 0x72
push str.d:SVN_thirdpartycpplog4cplus1.1.2_rc2_srcincludelog4cplus_thread_impl_syncprims_win32.h
push 0x53f178
call sym.ftl.bin_void___cdecl_log4cplus::thread::impl::syncprims_throw_exception_char_const__const__char_const__const__int_
push 0
push 1
push 1
mov byte [esp + 0x20], 3
push 0
mov dword [esi + 0x4c], 0
call edi
mov dword [esi + 0x50], eax
test eax, eax
jne 0x417e89
push 0x72
push str.d:SVN_thirdpartycpplog4cplus1.1.2_rc2_srcincludelog4cplus_thread_impl_syncprims_win32.h
push 0x53f178
call sym.ftl.bin_void___cdecl_log4cplus::thread::impl::syncprims_throw_exception_char_const__const__char_const__const__int_
mov dword [esi + 0x54], 0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x421130
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x51d678
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x574a28]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.004141f0
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x421190
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00421d50
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.004141f0
cmp dword [esp + 0x28], 8
jb 0x4211dd
mov eax, dword [esp + 0x14]
push eax
call fcn.00485e85
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret

Function at 0x423ac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51e232
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x574a28]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, 7
xor ebx, ebx
xor ecx, ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ebx
mov word [esi + 4], cx
mov dword [esp + 0x14], ebx
xor edx, edx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ebx
mov word [esi + 0x20], dx
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], ebx
mov word [esi + 0x3c], cx
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ebx
mov word [esi + 0x58], dx
mov dword [esi + 0x88], eax
mov dword [esi + 0x84], ebx
mov word [esi + 0x74], cx
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa0], ebx
mov word [esi + 0x90], dx
lea eax, [esi + 0xa8]
push eax
mov byte [esp + 0x18], 5
call fcn.00424350
mov byte [esi + 0xc0], bl
mov byte [esi + 0xc1], bl
mov byte [esi + 0xc2], bl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x4240c0
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x52088b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x574a28]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
push 0x458
call fcn.00485e56
add esp, 4
mov dword [esp + 0xc], eax
xor esi, esi
mov dword [esp + 0x18], esi
cmp eax, esi
je 0x424107
push eax
call fcn.00423d60
mov esi, eax
mov eax, dword [0x57bf5c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x424210
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp byte [0x57c00c], 0
push esi
jne 0x424298
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push eax
mov dword [0x57bf5c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x42423e
call fcn.004240c0
cmp dword [0x57bf58], 0
jne 0x42424c
call fcn.004236c0
mov esi, dword [0x57bf58]
lea eax, [esp + 8]
push eax
call sym.ftl.bin_public:_static_class_log4cplus::helpers::Time___cdecl_log4cplus::helpers::Time::gettimeofday_void_
mov ecx, dword [eax]
mov dword [esi + 0x48], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x4c], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x50], ecx
mov edx, dword [eax + 0xc]
lea eax, [esp + 0xc]
add esp, 4
push eax
mov dword [esi + 0x54], edx
call sym.ftl.bin_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
add esp, 4
lea ecx, [esp + 8]
call sym.ftl.bin_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
call fcn.0042ec20
mov byte [0x57c00c], 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4242b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x57bf5c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x4242d2
push esi
call fcn.00423ed0
push esi
call fcn.00485e85
add esp, 4
mov ecx, dword [0x57bf5c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
ret

Function at 0x426830
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x521328
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x574a28]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x57bf5c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x42686c
call fcn.004240c0
lea esi, [eax + 0x23c]
push esi
call sym.ftl.bin_void___cdecl_log4cplus::detail::clear_tostringstream_class_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____
mov ecx, dword [edi + 8]
mov eax, dword [esp + 0x3c]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
add esp, 4
push eax
push esi
call edx
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0041c180
sub esi, 0xffffff80
push eax
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.004232c0
cmp dword [esp + 0x24], 8
jb 0x4268be
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00485e85
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 4