joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408ce0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], esp
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0x40aa40
mov edx, dword [ebp + 8]
lea eax, [esi + 0x38]
mov ecx, dword fs:[0]
mov dword [esi + 0x38], ecx
mov dword fs:[0], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 8]
mov byte [esi + 3], 1
mov dword [esi + 0x40], 0
lea edx, [esi + 0x20]
push ecx
push eax
push edx
call fcn.004334a0
add esp, 0xc
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x20]
mov edi, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], ecx
mov ecx, dword [ebp + 8]
mov dword [esi + 0x1c], eax
cmp dword [ecx + 0x10], 1
lea edi, [ecx + 0x10]
jne 0x408da0
mov eax, dword [ecx + 0x18]
or eax, dword [ecx + 0x1c]
je 0x408da0
mov eax, dword [ecx + 0x20]
test eax, eax
je 0x408da0
mov ecx, dword [ecx + 0x24]
mov dword [esi + 0xc], edi
mov dword [esi + 0x40], 1
mov dword [esi + 8], eax
push eax
mov dword [esi + 4], ecx
call dword [ecx]
add esp, 4
mov edx, dword [esi + 4]
mov edi, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov eax, dword [edx + 4]
test eax, eax
je 0x408da0
push dword [edx + 8]
push eax
push ecx
call fcn.00421c20
add esp, 0xc
mov eax, dword [ebp + 0xc]
movsd xmm0, qword [eax + 0x18]
movsd qword [edi + 0x18], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [edi + 0x10], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
lea eax, [esi + 0x10]
movsd qword [edi + 8], xmm1
movsd qword [edi], xmm0
mov byte [esi + 3], 0
mov dword [esi + 0x40], 0
push eax
call fcn.00433500
add esp, 4
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40c000
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x40c930
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov dword [ebp - 0x10], 6
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
add eax, 0x30
mov dword [ebp - 0x24], eax
push eax
call fcn.0040e4e0
add esp, 4
mov esi, dword [ebp - 0x20]
mov eax, dword [esi + 0x34]
test eax, eax
je 0x40c069
shl eax, 3
push 4
push eax
mov eax, dword [ebp - 0x24]
push dword [eax]
call fcn.00421c20
add esp, 0xc
mov eax, dword [esi + 0x64]
test eax, eax
je 0x40c087
lock dec dword [eax]
jne 0x40c087
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 5
lea ecx, [eax + 0x64]
call fcn.0040b680
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x40c0e2
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
lea ecx, [eax + 0x68]
mov eax, dword [eax + 0x70]
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x28], ecx
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
lock dec dword [eax]
jne 0x40c0c1
push dword [ebp - 0x28]
call fcn.0040bfc0
add esp, 4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x6c]
lock dec dword [eax]
jne 0x40c0e2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 3
add eax, 0x6c
push eax
call fcn.0040c300
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 2
add eax, 0x40
push eax
call fcn.00417dc0
add esp, 4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x20]
lock dec dword [eax]
jne 0x40c119
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 1
add eax, 0x20
push eax
call fcn.0040b770
add esp, 4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x80]
test eax, eax
je 0x40c143
lock dec dword [eax]
jne 0x40c143
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0
add eax, 0x80
push eax
call fcn.0040b770
add esp, 4
mov esi, dword [ebp - 0x20]
mov eax, dword [esi + 0x88]
test eax, eax
je 0x40c16b
lock dec dword [eax]
jne 0x40c16b
lea eax, [esi + 0x88]
mov dword [ebp - 0x10], 0xffffffff
push eax
call fcn.0040b770
add esp, 4
cmp esi, 0xffffffff
je 0x40c186
lock dec dword [esi + 4]
jne 0x40c186
push 8
push 0xa8
push esi
call fcn.00421c20
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x419130
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], esp
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0x41abc0
lea eax, [esi + 0x38]
mov ecx, dword fs:[0]
mov dword [esi + 0x38], ecx
mov dword fs:[0], eax
call fcn.00426820
mov dword [esi + 8], eax
lea eax, [esi + 8]
mov dword [esi + 0xc], edx
push eax
call fcn.00426850
add esp, 4
mov eax, dword [0x596058]
push 0
push eax
call fcn.0040f920
add esp, 8
test eax, eax
je 0x4191fb
mov edx, dword [eax]
cmp edx, 0x7ffffffe
ja 0x419202
lea ecx, [edx + 1]
mov dword [eax], ecx
mov edi, dword [eax + 4]
cmp edi, 2
je 0x419211
mov ecx, eax
mov ebx, dword [ebp + 8]
mov edx, dword [esi + 8]
mov dword [esi + 4], eax
add ecx, 8
test edi, edi
mov edi, dword [esi + 0xc]
je 0x4191d1
mov dword [esi + 0x40], 0
push edi
push edx
push ebx
push ecx
call fcn.00419f80
add esp, 0x10
jmp 0x4191e4
mov dword [esi + 0x40], 0
push edi
push edx
push ebx
push ecx
call fcn.0041c920
add esp, 0x10
mov ecx, dword [esi + 4]
dec dword [ecx]
mov ecx, dword [esi + 0x38]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00426960
jmp 0x419218
push 0x55c2e4
call fcn.0051ecb0
add esp, 4
ud2
mov dword [eax], edx
call fcn.00417c10
mov ecx, dword [ebp + 0xc]
mov byte [esi + 3], al
lea eax, [esi + 3]
mov dword [esi + 0x18], 0x55c22c
mov dword [esi + 0x1c], 1
mov dword [esi + 0x28], 0
mov dword [esi + 0x10], eax
lea eax, [esi + 0x10]
mov dword [esi + 0x14], 0x426970
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 1
lea eax, [esi + 0x18]
push ecx
push eax
call fcn.0051ed60
add esp, 8
ud2
Function at 0x41e020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, esp
mov dword [esi + 0x38], ebp
mov dword [esi + 0x3c], esp
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x44], 0x41ebb0
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x40]
mov edx, dword fs:[0]
mov dword [esi + 0x40], edx
mov dword fs:[0], ecx
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], eax
movzx eax, byte [edi + 0x34]
and al, 6
cmp al, 4
je 0x41e0da
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 8]
mov dword [esi + 0x48], 0
lea edx, [esi + 0x28]
push ecx
push eax
push edx
call fcn.004334a0
add esp, 0xc
mov ecx, dword [esi + 0x30]
mov edx, dword [esi + 0x28]
mov edi, dword [esi + 0x2c]
mov eax, dword [esi + 0x34]
mov dword [esi + 0x48], 1
mov dword [esi + 8], edx
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], ecx
mov ecx, dword [ebp + 8]
lea edx, [esi + 0x24]
mov dword [esi + 0x14], eax
add ecx, 0x10
call fcn.00409d50
lea eax, [esi + 8]
mov dword [esi + 0x48], 0
push eax
call fcn.00433500
add esp, 4
mov eax, dword [esi + 0x40]
mov dword fs:[0], eax
mov al, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + 4]
mov dword [esi + 8], 0x520b60
mov dword [esi + 0xc], 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0
lea eax, [esi + 8]
push 0x520bd0
push eax
call fcn.0051ed60
add esp, 8
ud2
Function at 0x425c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [esp + 0x74]
mov ebp, dword [esp + 0x7c]
xor ebx, ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
mov ecx, dword [eax + 8]
mov esi, dword [eax]
mov edx, dword [eax + 4]
movzx eax, byte [eax + 0xc]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], edx
mov byte [esp + 2], al
jmp 0x425cf0
mov byte [esp + 2], 1
push 4
push str.____:
push dword [esp + 0xc]
call fcn.0047f440
add esp, 0xc
test al, al
je 0x425ea7
jmp 0x425ec7
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 8]
test al, al
mov byte [esp + 3], al
jne 0x425ec7
mov al, 1
mov dword [esp + 8], eax
nop word [eax + eax]
cmp ebx, ebp
ja 0x425db0
mov eax, dword [esp + 0x78]
mov ecx, ebp
sub ecx, ebx
cmp ecx, 8
lea eax, [eax + ebx]
jae 0x425d50
xor edx, edx
test ecx, ecx
je 0x425d66
nop
cmp byte [eax + edx], 0xa
je 0x425d72
inc edx
cmp ecx, edx
jne 0x425d30
xor eax, eax
mov edx, ecx
cmp eax, 1
je 0x425d80
jmp 0x425e00
push ecx
push eax
push 0xa
call fcn.0047ff90
add esp, 0xc
cmp eax, 1
je 0x425d80
jmp 0x425e00
xor eax, eax
cmp eax, 1
je 0x425d80
jmp 0x425e00
mov eax, 1
cmp eax, 1
jne 0x425e00
lea esi, [ebx + edx]
lea ebx, [ebx + edx + 1]
cmp esi, ebp
jae 0x425d10
mov eax, dword [esp + 0x78]
cmp byte [eax + esi], 0xa
jne 0x425d10
mov ecx, ebx
mov dword [esp + 8], 0
cmp byte [esp + 2], 0
mov dword [esp + 0x14], ecx
jne 0x425dbf
jmp 0x425e11
mov ecx, edi
mov esi, ebp
cmp byte [esp + 2], 0
mov dword [esp + 0x14], ecx
je 0x425e11
cmp dword [esp + 0x10], 0
je 0x425ea7
push 0xa
push dword [esp + 8]
call fcn.0047f900
add esp, 8
test al, al
jne 0x425ec7
cmp dword [esp + 0xc], 0
je 0x425ccc
push 7
push 0x5652e0
jmp 0x425cd3
mov ecx, edi
mov ebx, ebp
mov esi, ebp
cmp byte [esp + 2], 0
mov dword [esp + 0x14], ecx
jne 0x425dbf
cmp dword [esp + 0xc], 0
mov eax, dword [esp + 0x74]
mov byte [eax + 0xc], 1
je 0x425cc7
mov eax, dword [esp + 0x18]
movaps xmm0, xmmword [0x5652a0]
mov dword [esp + 0x28], 0x5652d0
mov dword [esp + 0x2c], 2
mov dword [esp + 0x40], 2
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x58], 0
mov byte [esp + 0x5c], 1
mov dword [esp + 0x20], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x24], fcn.00483650
mov dword [esp + 0x38], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x3c], 1
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x34], 1
push eax
push dword [esp + 8]
call fcn.0047f460
add esp, 8
mov byte [esp + 2], 1
test al, al
jne 0x425ec7
sub esi, edi
add edi, dword [esp + 0x78]
inc dword [esp + 0x10]
push esi
push edi
push dword [esp + 0xc]
call fcn.0047f440
add esp, 0xc
test al, al
je 0x425cf0
cmp byte [esp + 3], 0
sete al
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4276e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x429c80
mov dword [ebp - 0x20], ecx
add ecx, 0x30
lea eax, [ebp - 0x18]
mov edx, dword fs:[0]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ebp - 0x10], 7
push ecx
call fcn.00434800
add esp, 4
mov esi, dword [ebp - 0x20]
mov eax, dword [esi + 0x34]
test eax, eax
je 0x427743
shl eax, 3
push 4
push eax
mov eax, dword [ebp - 0x24]
push dword [eax]
call fcn.00421c20
add esp, 0xc
mov eax, dword [esi + 0x64]
test eax, eax
je 0x427765
lock dec dword [eax]
jne 0x427765
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 6
add eax, 0x64
push eax
call fcn.00431610
add esp, 4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x4277c7
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 5
lea ecx, [eax + 0x68]
mov eax, dword [eax + 0x70]
mov dword [ebp - 0x28], ecx
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
lock dec dword [eax]
jne 0x4277a6
mov dword [ebp - 0x10], 4
push dword [ebp - 0x28]
call fcn.0040bfc0
add esp, 4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x6c]
lock dec dword [eax]
jne 0x4277c7
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 3
add eax, 0x6c
push eax
call fcn.00430e00
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 2
add eax, 0x40
push eax
call fcn.00444500
add esp, 4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x20]
lock dec dword [eax]
jne 0x4277fe
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 1
add eax, 0x20
push eax
call fcn.0040b770
add esp, 4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x80]
test eax, eax
je 0x427828
lock dec dword [eax]
jne 0x427828
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0
add eax, 0x80
push eax
call fcn.0040b770
add esp, 4
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 0x88]
test eax, eax
je 0x427850
lock dec dword [eax]
jne 0x427850
add ecx, 0x88
mov dword [ebp - 0x10], 0xffffffff
push ecx
call fcn.0040b770
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x427c70
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
nop word cs:[eax + eax]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x427c80
test al, 1
je 0x427c97
test al, 2
jne 0x427cad
xor eax, 3
ret
push 0x5658c8
push 0x23
push str.assertion_failed:_prev.is_running__
call fcn.0051ee20
add esp, 0xc
ud2
push 0x565900
push 0x25
push 0x5658d8
call fcn.0051ee20
add esp, 0xc
ud2
Function at 0x42ab80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x42b080
lea eax, [ebp - 0x18]
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ecx]
nop word cs:[eax + eax]
nop dword [eax]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x42abc0
test al, 1
je 0x42ac6a
test al, 2
mov dword [ebp - 0x10], 0xffffffff
jne 0x42ac87
xor eax, 3
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x20]
push eax
push ecx
call fcn.00438a80
add esp, 8
test eax, eax
je 0x42ac29
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x28], eax
push eax
mov dword [ebp - 0x24], edx
call dword [edx]
add esp, 4
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov eax, dword [edx + 4]
test eax, eax
je 0x42ac29
push dword [edx + 8]
push eax
push ecx
call fcn.00421c20
add esp, 0xc
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], 1
mov eax, 0xffffffc0
lock xadd dword [ecx], eax
shr eax, 6
cmp eax, dword [ebp - 0x2c]
jb 0x42ac9d
jne 0x42ac59
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0xffffffff
push eax
call fcn.0042a640
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0xffffffff
push 0x5658c8
push 0x23
push str.assertion_failed:_prev.is_running__
call fcn.0051ee20
add esp, 0xc
ud2
push 0x565900
push 0x25
push 0x5658d8
call fcn.0051ee20
add esp, 0xc
ud2
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x5c], 0x565920
mov dword [ebp - 0x58], 2
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x40], fcn.00483650
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x38], fcn.00483650
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 2
lea eax, [ebp - 0x5c]
push 0x565930
push eax
call fcn.0051ed60
add esp, 8
ud2
Function at 0x431320
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4327a0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov dword [ebp - 0x10], 6
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
add eax, 0x30
mov dword [ebp - 0x24], eax
push eax
call fcn.00434800
add esp, 4
mov esi, dword [ebp - 0x20]
mov eax, dword [esi + 0x34]
test eax, eax
je 0x431389
shl eax, 3
push 4
push eax
mov eax, dword [ebp - 0x24]
push dword [eax]
call fcn.00421c20
add esp, 0xc
mov eax, dword [esi + 0x64]
test eax, eax
je 0x4313ab
lock dec dword [eax]
jne 0x4313ab
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 5
add eax, 0x64
push eax
call fcn.00431610
add esp, 4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x431406
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
lea ecx, [eax + 0x68]
mov eax, dword [eax + 0x70]
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x28], ecx
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
lock dec dword [eax]
jne 0x4313e5
push dword [ebp - 0x28]
call fcn.0040bfc0
add esp, 4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x6c]
lock dec dword [eax]
jne 0x431406
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 3
add eax, 0x6c
push eax
call fcn.00430e00
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 2
add eax, 0x40
push eax
call fcn.00444500
add esp, 4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x20]
lock dec dword [eax]
jne 0x43143d
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 1
add eax, 0x20
push eax
call fcn.0040b770
add esp, 4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x80]
test eax, eax
je 0x431467
lock dec dword [eax]
jne 0x431467
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0
add eax, 0x80
push eax
call fcn.0040b770
add esp, 4
mov esi, dword [ebp - 0x20]
mov eax, dword [esi + 0x88]
test eax, eax
je 0x43148f
lock dec dword [eax]
jne 0x43148f
lea eax, [esi + 0x88]
mov dword [ebp - 0x10], 0xffffffff
push eax
call fcn.0040b770
add esp, 4
cmp esi, 0xffffffff
je 0x4314aa
lock dec dword [esi + 4]
jne 0x4314aa
push 8
push 0xa8
push esi
call fcn.00421c20
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x432d80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x434150
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [edi]
test eax, eax
je 0x432dd3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x432de8
cmp dword [eax + 4], 0
mov esi, eax
je 0x432de8
add esi, 4
jmp 0x432ed1
push edi
call fcn.0051e5f0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x432dc3
mov eax, dword [edi]
test eax, eax
je 0x432eb6
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x432ecf
mov esi, eax
test eax, eax
jne 0x432e4c
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], 0
movzx eax, byte [0x599449]
push 4
push 8
call fcn.00421c10
add esp, 8
test eax, eax
je 0x432f00
mov dword [eax], edi
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x432ee4
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x432e5f
mov eax, dword [ecx]
mov dword [ecx], 0
test eax, eax
jne 0x432e95
movzx eax, byte [0x599449]
push 4
push 0x14
call fcn.00421c10
add esp, 8
test eax, eax
je 0x432ef2
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov byte [eax + 0x10], 0
add esi, 4
mov ecx, dword [esi]
test ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [esi], eax
je 0x432ed1
lock dec dword [ecx]
jne 0x432ed1
lea eax, [ebp - 0x24]
push eax
call fcn.0040bb80
add esp, 4
jmp 0x432ed1
push edi
call fcn.0051e5f0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x432e03
xor esi, esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.0051e5f0
add esp, 4
jmp 0x432e44
push 0x14
push 4
call fcn.0051ec40
add esp, 8
ud2
mov dword [ebp - 0x10], 0
push 8
push 4
call fcn.0051ec40
add esp, 8
ud2
Function at 0x438c20
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x439a70
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov ecx, dword [eax + 0x48]
mov eax, dword [ecx]
mov dword [ebp - 0x28], ecx
test eax, eax
je 0x438c65
dec eax
jmp 0x438c79
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 1
push ecx
call fcn.0051e5f0
add esp, 4
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 1
push 1
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx]
mov dword [ebp - 0x24], ecx
or eax, dword [ecx + 4]
je 0x438cdf
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0xc]
cmp ecx, 2
je 0x438cdf
mov eax, dword [ebp - 0x24]
test ecx, ecx
lea eax, [eax + 0x10]
je 0x438cc8
mov ecx, dword [eax]
lock dec dword [ecx]
jne 0x438cdf
mov dword [ebp - 0x10], 2
push eax
call fcn.004309b0
add esp, 4
jmp 0x438cdf
mov ecx, dword [eax]
lock dec dword [ecx]
jne 0x438cdf
mov dword [ebp - 0x10], 2
push eax
call fcn.00430f50
add esp, 4
push 8
push 0x50
push dword [ebp - 0x24]
call fcn.00421c20
add esp, 0xc
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx]
test eax, eax
je 0x438d01
dec eax
mov dword [ebp - 0x10], 1
jmp 0x438d15
mov byte [ebp - 0x1d], 0
mov dword [ebp - 0x10], 1
push ecx
call fcn.0051e5f0
add esp, 4
mov byte [ebp - 0x1d], 0
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x438e30
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x439a80
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov ecx, dword [eax]
mov eax, dword [ecx]
mov dword [ebp - 0x28], ecx
test eax, eax
je 0x438e74
dec eax
jmp 0x438e88
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 1
push ecx
call fcn.0051e5f0
add esp, 4
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 1
push 1
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [eax + 4]
test eax, eax
je 0x438ec4
lock dec dword [eax]
jne 0x438ec4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], 2
add eax, 4
push eax
call fcn.0040bb80
add esp, 4
push 4
push 8
push dword [ebp - 0x24]
call fcn.00421c20
add esp, 0xc
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx]
test eax, eax
je 0x438ee6
dec eax
mov dword [ebp - 0x10], 1
jmp 0x438efa
mov byte [ebp - 0x1d], 0
mov dword [ebp - 0x10], 1
push ecx
call fcn.0051e5f0
add esp, 4
mov byte [ebp - 0x1d], 0
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret