joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4246a1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop ds
mov eax, edi
test bx, bx
je 0x4246bb
mov esi, ebx
cmp si, dx
je 0x4246bb
add eax, 2
movzx esi, word [eax]
test si, si
jne 0x4246ab
xor edx, edx
cmp word [eax], dx
je 0x4246cd
add ecx, 2
movzx edx, word [ecx]
test dx, dx
jne 0x4246a2
xor edi, dword [eax + 0x3966f18b]
add dword [esi + edi + 0xf], esi
mov bh, 0x1f
xor edx, edx
mov eax, edi
test bx, bx
je 0x4246fd
movzx edx, word [ecx]
mov dword [ebp + 8], edx
mov edx, ebx
cmp dx, word [ebp + 8]
je 0x4246fb
add eax, 2
movzx edx, word [eax]
test dx, dx
jne 0x4246ea
xor edx, edx
cmp word [eax], dx
jne 0x42470c
add ecx, 2
cmp word [ecx], dx
jne 0x4246db
jmp 0x424714
xor eax, eax
mov word [ecx], ax
add ecx, 2
mov eax, dword [ebp - 4]
pop edi
mov dword [eax + 0x1c], ecx
mov eax, esi
sub eax, ecx
neg eax
sbb eax, eax
and eax, esi
add byte [eax], al
add byte [ebx], dh
leave
ret
Function at 0x468aaa
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [0x4c4190]
jne 0x468abc
call 0x4d468b4c
mov eax, dword [0x4c7ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c7ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xc1ffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x468aff
fadd qword [0x4bbac8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4bbaa0]
mov esp, ebp
pop ebp
ret
Function at 0x4036c0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, eax
mov ebx, edx
sub esp, 0x7c
mov dword [esp], 0x2000
call fcn.00444470
mov dword [esp], esi
mov dword [esp + 4], 0
mov edi, eax
call sub.msvcrt.dll__open
mov dword [esp + 4], 0
mov esi, eax
mov dword [esp], ebx
call sub.msvcrt.dll__open
mov ebp, eax
mov eax, esi
shr eax, 0x1f
test al, al
jne 0x403741
mov eax, ebp
shr eax, 0x1f
test al, al
jne 0x403741
lea eax, [esp + 0x28]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll__fstat
test eax, eax
js 0x403741
lea eax, [esp + 0x4c]
mov dword [esp], ebp
mov dword [esp + 4], eax
call sub.msvcrt.dll__fstat
test eax, eax
js 0x403741
mov ebx, dword [esp + 0x3c]
cmp ebx, dword [esp + 0x60]
je 0x403763
mov dword [esp], edi
call sub.msvcrt.dll_free
mov dword [esp], esi
call sub.msvcrt.dll__close
mov dword [esp], ebp
call sub.msvcrt.dll__close
xor eax, eax
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
test ebx, ebx
je 0x4037ee
lea eax, [edi + 0x1000]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
lea esi, [esi]
cmp ebx, 0x1000
mov ecx, 0x1000
mov dword [esp + 4], edi
cmovle ecx, ebx
mov dword [esp], esi
mov dword [esp + 8], ecx
mov dword [esp + 0x14], ecx
call sub.msvcrt.dll__read
mov ecx, dword [esp + 0x14]
mov ebp, eax
cmp eax, ecx
je 0x4037b2
mov ebp, dword [esp + 0x18]
jmp 0x403741
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll__read
cmp ebp, eax
jne 0x4037ac
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], ebp
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4037ac
sub ebx, ebp
jne 0x403780
mov ebp, dword [esp + 0x18]
mov dword [esp], edi
call sub.msvcrt.dll_free
mov dword [esp], esi
call sub.msvcrt.dll__close
mov dword [esp], ebp
call sub.msvcrt.dll__close
mov eax, 1
jmp 0x40375b

Function at 0x403810
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, edx
mov esi, 1
sub esp, 0x11c
mov dword [esp + 4], 0x47a31f
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp], ebx
mov dword [esp + 4], 0x47a322
mov ebp, eax
lea ebx, [esp + 0x10]
call sub.msvcrt.dll_fopen
mov edi, eax
jmp 0x403873
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.msvcrt.dll_fputs
mov dword [esp + 4], 0xa
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
setne al
mov esi, eax
mov dword [esp + 8], ebp
mov dword [esp + 4], 0x100
mov dword [esp], ebx
call sub.msvcrt.dll_fgets
test eax, eax
je 0x4038b3
mov eax, esi
test al, al
je 0x403850
mov dword [esp + 0xc], edi
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], 0x47a325
call sub.msvcrt.dll_fwrite
jmp 0x403850
mov dword [esp], ebp
call sub.msvcrt.dll_fclose
mov dword [esp], edi
call sub.msvcrt.dll_fclose
add esp, 0x11c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4197e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [ebp - 0x24], eax
movzx eax, byte [eax]
cmp al, 0x24
mov byte [ebp - 0x1d], al
je 0x419800
cmp al, 0x40
jne 0x41994b
nop
mov eax, dword [ebp - 0x24]
lea edx, [eax + 1]
mov dword [ebp - 0x1c], edx
mov edx, eax
movzx eax, byte [eax + 1]
test al, al
je 0x4198e0
cmp al, 0x2f
je 0x4198e0
cmp al, 0x5c
lea edx, [edx + 2]
setne cl
xor eax, eax
test cl, cl
je 0x4198e0
movzx ecx, byte [edx]
lea edi, [eax + 1]
mov ebx, edx
mov esi, edi
test cl, cl
je 0x419860
add edx, 1
cmp cl, 0x2f
je 0x419860
cmp cl, 0x5c
je 0x419860
movzx ecx, byte [edx]
mov eax, edi
mov ebx, edx
lea edi, [eax + 1]
mov esi, edi
test cl, cl
jne 0x41983f
lea esi, [esi]
add eax, 2
add eax, 0x1e
shr eax, 4
shl eax, 4
call fcn.0046a050
sub esp, eax
mov eax, dword [ebp - 0x1c]
lea edi, [esp + 0x1b]
mov dword [esp + 8], esi
and edi, 0xfffffff0
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_strncpy
cmp byte [ebp - 0x1d], 0x40
mov byte [edi + esi], 0
je 0x4198f0
mov dword [esp], edi
call sub.msvcrt.dll_getenv
test eax, eax
je 0x419941
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov dword [esp], eax
call fcn.00444640
mov ebx, eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
movzx eax, byte [ebx]
cmp al, 0x40
mov byte [ebp - 0x1d], al
je 0x4198d6
cmp al, 0x24
jne 0x41994e
mov dword [ebp - 0x24], ebx
jmp 0x419800
mov ebx, dword [ebp - 0x1c]
mov eax, 1
xor esi, esi
jmp 0x419863
mov dword [esp + 8], 0
mov dword [esp + 4], str._ROOT
mov dword [esp], edi
call fcn.00444640
mov dword [esp], eax
mov esi, eax
call sub.msvcrt.dll_getenv
test eax, eax
je 0x419926
mov dword [esp], esi
mov dword [ebp - 0x1c], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x1c]
jmp 0x4198a7
mov eax, dword [str.C:_mingw32tdm]
mov dword [esp], esi
mov dword [ebp - 0x1c], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x4198a7
mov eax, str.C:_mingw32tdm
jmp 0x4198a7
mov ebx, dword [ebp - 0x24]
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41f9b0
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [eax + 0x14]
test edx, edx
je 0x41f9c4
cmp edx, dword [eax + 0x10]
je 0x41f9c4
lea ecx, [edx - 1]
cmp dword [eax + 0x18], ecx
jb 0x41fa11
mov ecx, dword [eax + 8]
test byte [ecx + 0xc], 0x30
jne 0x41fa11
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov esi, dword [eax + 0x10]
cmp edx, esi
je 0x41fa20
mov eax, dword [eax + 0xc]
sub esi, edx
add eax, edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov edx, dword [ebx + 8]
test byte [edx + 0xc], 0x20
jne 0x41fa14
add dword [ebx + 0x14], eax
test eax, eax
setne al
add esp, 0x14
pop ebx
pop esi
ret
xor eax, eax
ret
xor eax, eax
jmp 0x41fa0b
test edx, edx
jne 0x41fa50
mov eax, 0x1001
mov esi, 0x1000
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call fcn.004444f0
mov dword [ebx + 0x10], esi
mov dword [ebx + 0xc], eax
mov edx, dword [ebx + 0x14]
mov ecx, dword [ebx + 8]
jmp 0x41f9de
lea esi, [edx + edx]
lea eax, [esi + 1]
jmp 0x41fa2e

Function at 0x420d80
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x1c
mov dword [esp], str.COLUMNS
call sub.msvcrt.dll_getenv
test eax, eax
je 0x420da3
mov dword [esp], eax
call fcn.004708a8
test eax, eax
jle 0x420da3
add esp, 0x1c
ret
mov eax, 0x7fffffff
add esp, 0x1c
ret
Function at 0x44b100
Capabilities:
Get file attributes

Disassembly:
push esi
push ebx
mov edx, eax
mov ebx, eax
sub esp, 0x14
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x44b109
mov ecx, eax
mov dword [esp + 4], 0x4be9e0
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
add al, al
sbb edx, 3
lea esi, [edx - 4]
cmp ebx, esi
cmovae esi, ebx
mov dword [esp], esi
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x44b170
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
test eax, 0x80000010
sete al
movzx eax, al
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp + 4], 0x4be9e5
mov dword [esp], esi
call sub.msvcrt.dll__stricmp
test eax, eax
je 0x44b153
mov dword [esp + 4], 0x4be9ea
mov dword [esp], esi
call sub.msvcrt.dll__stricmp
test eax, eax
je 0x44b153
xor eax, eax
jmp 0x44b169

Function at 0x44b6e0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x4c7f20]
test eax, eax
je 0x44b6f0
ret
push ebx
sub esp, 0x18
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_GetTempPathA
sub esp, 8
test eax, eax
mov ebx, eax
jne 0x44b720
mov eax, dword [0x4c7f20]
test eax, eax
je 0x44b757
add esp, 0x18
pop ebx
ret
mov dword [esp], eax
call fcn.00444470
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [0x4c7f20], eax
call sub.KERNEL32.dll_GetTempPathA
sub esp, 8
test eax, eax
jne 0x44b711
mov eax, dword [0x4c7f20]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [0x4c7f20], 0
mov dword [esp], 0x4be9f4
call fcn.00444790
mov dword [0x4c7f20], eax
jmp 0x44b71a
Function at 0x44d950
Capabilities:
Delete file

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
test eax, eax
jle 0x44d96d
mov edx, dword [ebx + 0x44]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [edx + 0xc]
mov eax, dword [ebx + 0x18]
test eax, eax
jle 0x44d981
mov edx, dword [ebx + 0x44]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [edx + 0xc]
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x44d990
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x44d99f
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x44da40
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x44da30
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x3c]
test eax, eax
jle 0x44da0f
xor esi, esi
nop
lea esi, [esi]
mov eax, dword [ebx + 0x40]
mov eax, dword [eax + esi*4]
mov dword [esp], eax
call sub.msvcrt.dll_remove
mov eax, dword [ebx + 0x40]
mov eax, dword [eax + esi*4]
add esi, 1
mov dword [esp], eax
call sub.msvcrt.dll_free
cmp dword [ebx + 0x3c], esi
jg 0x44d9e0
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x44]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x44da1e
mov dword [esp], ebx
call eax
mov dword [esp + 0x30], ebx
add esp, 0x24
pop ebx
pop esi
jmp sub.msvcrt.dll_free
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x44d9b1
and dword [ebx], 0xfffffffe
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x18]
mov edx, 1
mov dword [esp], eax
mov eax, ebx
call fcn.0044cd00
jmp 0x44d9aa

Function at 0x469e30
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x4c8038
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x4c8050]
sub esp, 4
test ebx, ebx
je 0x469e7b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x469e74
test esi, esi
je 0x469e74
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x469e50
mov dword [esp], 0x4c8038
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x46b3d0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov ebx, eax
add eax, 0x31
mov dword [ebp - 0x1c], eax
lea eax, [ebx + 0x41]
shr eax, 4
shl eax, 4
call fcn.0046a050
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sub.msvcrt.dll_memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
test eax, eax
je 0x46b4c0
int3
mov dword [esp], esi
call sub.KERNEL32.dll_FindAtomA
sub esp, 4
test ax, ax
jne 0x46b560
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x46b4f8
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x46b4f0
mov dword [esp], esi
call sub.KERNEL32.dll_AddAtomA
sub esp, 4
test ax, ax
je 0x46b554
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0046b360
cmp ebx, eax
mov esi, eax
je 0x46b577
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call sub.KERNEL32.dll_ReleaseMutex
sub esp, 4
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0046b360
mov esi, eax
jmp 0x46b531
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], esi
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x46b531
mov dword [esp], esi
call dword [ebp + 0x10]
jmp 0x46b531
Function at 0x472510
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x4c8a64]
test ebx, ebx
je 0x472540
call sub.KERNEL32.dll_TlsAlloc
mov dword [ebx], eax
mov eax, dword [0x4c8a64]
test eax, eax
je 0x472565
cmp dword [eax], 0xffffffff
je 0x472588
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], 0x4719b0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00475cc0
mov ebx, eax
mov dword [0x4c8a64], eax
jmp 0x47251e
mov dword [esp + 8], 0x4719b0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00475cc0
mov dword [0x4c8a64], eax
jmp 0x47252e
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x472a10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [0x4c8a68]
test eax, eax
je 0x472b60
cmp dword [eax], 1
je 0x472a2d
call fcn.004729a0
mov eax, dword [0x4c8a64]
test eax, eax
je 0x472b90
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
test eax, eax
je 0x472a52
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call fcn.00472360
mov ebx, eax
mov eax, dword [entry3]
test eax, eax
je 0x472bdc
test ebx, ebx
je 0x472bdc
mov dword [ebx + 0x24], 1
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [ebx + 0x38], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
mov dword [ebx + 0x1c], 0xffffffff
sub esp, 0x10
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x34], 0xffffffff
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x14], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov edi, eax
call sub.KERNEL32.dll_GetCurrentThread
mov esi, eax
call sub.KERNEL32.dll_GetCurrentProcess
lea edx, [ebx + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.KERNEL32.dll_DuplicateHandle
sub esp, 0x1c
test eax, eax
je 0x472be3
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_GetThreadPriority
mov dword [ebx + 0x68], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
mov dword [ebx + 0x64], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x4c8a64]
test eax, eax
je 0x472bb6
mov dword [esp + 4], ebx
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
je 0x472be3
mov eax, ebx
jmp 0x472a4b
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_once_shmem
call fcn.00475cc0
mov dword [0x4c8a68], eax
jmp 0x472a23
mov dword [esp + 8], 0x4719b0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00475cc0
mov dword [0x4c8a64], eax
jmp 0x472a3a
mov dword [esp + 8], 0x4719b0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00475cc0
mov dword [0x4c8a64], eax
jmp 0x472b3e
xor eax, eax
jmp 0x472a4b
call sub.msvcrt.dll_abort
nop
lea esi, [esi]
mov eax, dword [esp + 4]
mov dword [eax], 0xffffffff
ret
Function at 0x473160
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
cmp dword [esp + 0x24], 3
je 0x473180
add esp, 0x18
mov eax, 1
pop ebx
ret 0xc
mov eax, dword [0x4c8a64]
test eax, eax
je 0x4732f0
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x47316b
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
test eax, eax
mov ebx, eax
je 0x47316b
test byte [eax + 0x20], 0x30
je 0x473240
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x4732e0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4731ef
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x4731e1
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.00471760
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x34], 0xffffffff
test edx, edx
je 0x473346
mov eax, dword [0x4c8a64]
test eax, eax
je 0x473320
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
mov eax, 1
add esp, 0x18
pop ebx
ret 0xc
mov eax, dword [eax + 0x64]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x4732a0
test eax, eax
je 0x473259
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x64], 1
test eax, eax
jne 0x4732d0
test byte [ebx + 0x24], 4
je 0x4732b6
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x4731e8
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x4731e8
test eax, eax
je 0x4732af
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.00471760
mov dword [ebx + 0x34], 0xffffffff
jmp 0x47316b
call fcn.00472f70
jmp 0x473271
call fcn.00472f70
jmp 0x4731bd
mov dword [esp + 8], 0x4719b0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00475cc0
mov dword [0x4c8a64], eax
jmp 0x47318d
mov dword [esp + 8], 0x4719b0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00475cc0
mov dword [0x4c8a64], eax
jmp 0x47321c
mov eax, ebx
call fcn.00472590
jmp 0x47320f
Function at 0x4744c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.00472a10
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x474550
test byte [ebx + 0x20], 0x30
je 0x474646
mov eax, dword [0x4c8a64]
test eax, eax
je 0x4745f0
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
test eax, eax
mov ebx, eax
je 0x47453b
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4745b5
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x47452e
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x474560
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp sub.msvcrt.dll__endthreadex
call fcn.00472f70
jmp 0x4744dd
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebx + 0xac]
sub esp, 4
mov dword [ebx + 0x14], 0
test eax, eax
je 0x4745e1
mov eax, dword [0x4c8a64]
test eax, eax
je 0x474620
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp sub.msvcrt.dll__endthreadex
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4745cd
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
test edx, edx
jne 0x474585
mov eax, ebx
call fcn.00472590
jmp 0x474585
mov dword [esp + 8], 0x4719b0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00475cc0
mov dword [0x4c8a64], eax
jmp 0x4744f4
mov dword [esp + 8], 0x4719b0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00475cc0
mov dword [0x4c8a64], eax
jmp 0x474592
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_longjmp
lea esi, [esi]