joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003f66d
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x10046113
aad 1
sar ah, cl
not ah
push ebp
aad 0xa0
mov ebp, esp
cwde
sub esp, 0x10
stc
bt ebp, ebx
push esi
or ah, dh
push edi
sar al, cl
sbb al, 0xa9
cmc
bsf ax, si
push ebx
adc al, 0xdc
push edx
and ah, 0x7f
sub ax, 0x57f7
sal al, 1
stc
mov eax, dword [ebp + 8]
test cx, 0xf65f
pushfd
test eax, eax
lea esp, [esp + 4]
jns 0x1003f3bf
push ecx
lea esp, [esp + 4]
ja 0x1006264b
call fcn.10065eb1
je fcn.100648d6
shrd dx, cx, 0xa
btc dx, cx
btr dx, 8
mov esi, dword [eax + 0x3c]
inc dl
cmc
add esi, eax
btr dx, sp
inc dh
pushal
ror dx, cl
mov edx, dword [esi + 0x78]
cmc
stc
test edx, edx
mov byte [esp], 0xf1
mov byte [esp], dl
lea esp, [esp + 0x20]
je fcn.100648d6
rcr ch, cl
shr cl, cl
add edx, eax
bsf cx, ax
mov ecx, dword [esi + 0x7c]
stc
cmp cx, bx
clc
add ecx, edx
call fcn.10060ec1
push 0xab2ed9b7
pushal
pushal
lea esp, [esp + 0x44]
je fcn.100648d6
neg esi
mov esi, dword [eax + 0x3c]
adc dx, 0x4bbe
bswap dx
mov dl, 0x95
add esi, eax
adc edx, 0x37dbc3a3
dec edx
inc dl
bt ecx, eax
mov edx, dword [esi + 0x78]
stc
jmp 0x100650ee
bt bp, 0xd
pushfd
test edx, edx
push 0x8cc3c20d
pushfd
mov byte [esp], bh
lea esp, [esp + 0xc]
je fcn.100648d6
rol cl, 4
cmc
add edx, eax
sar cx, 0xa
bsf cx, cx
rol ch, 6
mov ecx, dword [esi + 0x7c]
push edi
bt bx, dx
pushfd
add ecx, edx
cmc
mov dword [ebp - 0x10], ecx
ror cl, 2
mov cl, ch
mov ecx, dword [ebp + 0xc]
call fcn.10066dce

Function at 0x10045af8
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
js 0x1006446a
lea edi, [edi + 1]
call fcn.10063464
push edi
cmp eax, 0xf8002fbf
xor al, al
add al, 0xf8
sbb al, 0xcc
xor al, 0xe0
or al, 0xe4
add al, 0xd8
add bh, al
das
push edx
mov dword [ebp - 0x36fe366f], esp
add al, byte [esi]
jle 0x10045b6b
rep outsb dx, byte [esi]
sbb al, 0x6e
xor eax, 0x2cdb1717
push cs
push cs
inc esi
fmul qword fs:[esi + 0x22]
pop esi
mov edi, 0xb0675b41
fldenv [ecx + 0x61]
mov bl, 0xa8
invalid
xor eax, 0xc424c2f7
psrad mm3, qword [edi]
rol byte [edi], cl
cli
adc esp, esp
sahf
pushal
mov bh, 0x6a
test edx, edx
adc eax, 0x29aa14e3
or al, 0x5d
sbb eax, 0x58b79357
stosb byte es:[edi], al
sub dword [ebx*2 - 0x486ca8e3], ecx
pop eax
mov eax, dword [0xa1b3b970]
jo 0x10045b55
jnp 0x10045bba
sbb dl, al
xor eax, 0xd0398ed4
cmp eax, edx
pushal
push 0xf126d556
push ebp
lea esp, [esp + 0x4c]
jb 0x100648e5
push 0x1e4e95a3
pushfd
lea esp, [esp + 8]
jmp fcn.10068283
push ecx
bswap ax
push 0x1084c725
mov word [esp], 0x5b56
lea edi, [edi + 1]
mov al, ah
mov eax, dword [esp + 8]
mov word [esp], dx

Function at 0x1006238b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp ebx, 2
jmp 0x1006af0b
push esi
lea esp, [esp + 0xc]
je 0x10066d36
test sp, bx
push 0xd7700cc2
cmp ebx, 3
call fcn.10060a38

Function at 0x10063921
Capabilities:
Encode data using xor

Disassembly:
pushfd
lea esp, [esp + 8]
jno 0x10065c96
push edi
mov dword [ebp - 8], ecx
pushal
push 0xa7549a26
mov word [esp + 4], si
lea esp, [esp + 0x28]
jmp 0x100635ec
add ecx, 1
jmp 0x1004876e
Function at 0x10065297
Capabilities:
Encode data using xor

Disassembly:
sbb esi, dword [esi + 0x95b5381]
out dx, eax
mov ecx, 0xfa3234fa
xor eax, 0x21164ab6
sbb edx, dword [edi]
push esi
div byte [ecx - 2]
lahf
push edi
mov ch, 0xfc
sub dword [eax + ecx*4], 0x28
nop
xor dl, byte [ebx + edi]
clc
retf 0x39ef
invalid
popal
cmp byte [ecx + 0x78], 0x91
dec eax
mov ecx, 0x2a3e4e44
sar ah, 0x5e
mov eax, 0x9c3dae67
pushfd
pushfd
mov dword [esp + 0xc], ebx
pop eax
lea eax, sym.imp.KERNEL32.dll_LocalFree
call fcn.10062682
insd dword es:[edi], dx
mov bl, 0xb5
xor dword [eax], eax
outsb dx, byte [esi]
mov fs, word [edx - 0x66]
inc esi
scasb al, byte es:[edi]
push 0xffffffffffffffad
push 0xe6d9d107
cwde
push ecx
jb 0x10065285
xor bh, dh
xlatb
rol ch, 1
jno 0x10065250
pop edi
push 0xffffffffffffffb8
dec eax
cwde
insb byte es:[edi], dx
movsb byte es:[edi], byte [esi]
jo 0x10065264
push 0xf536bf68
outsd dx, dword [esi]
loop 0x100652e8
loop 0x100652e8
lds edx, [edi + 0xdc0ccc0]
pop es
cmp eax, 0x1ebb9d64
loopne 0x10065267
pushal
inc eax
pushfd
jg 0x10065346
test byte [edi + eax*4 + 0x7e], bl
or esi, ecx
jmp 0x100652d7
fmul st(4), st(0)
push ebp
nop
xchg edx, eax
adc al, 0x31
xor edi, esp
sbb dword [edx - 0x49135b54], ecx
xor dword [eax], eax
test eax, 0x854dad45
test dword [ecx - 0x73], esp
inc ecx
mov ecx, 0x8555a17d
insb byte es:[edi], dx
mov dword [esi - 0x6d], esi
sub ebp, ebx
pop es
invalid

Function at 0x100668a7
Capabilities:
Check for software breakpoints

Disassembly:
bt esp, 0x12
add al, 0xb8
jmp 0x1004618f
bt edi, esp
rol al, 6
cmc
mov byte [esp + 4], bl
test bh, al
bt bx, bx
neg al
jmp 0x10046784

Function at 0x10066f09
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp + 0x30]
call fcn.10063c25
call fcn.10068273
add byte [eax], al
dec esp
outsd dx, dword [esi]
popal
dec esp
imul esp, dword [edx + 0x72], 0x41797261
add byte [ebp + 0x6abf005], cl
lea eax, sym.imp.KERNEL32.dll_LocalAlloc
push 0x77bce866
mov dword [esp + 0x24], 0x1004881b
call 0x10069505
cmc
cmp eax, 4
mov byte [esp + 0xc], dh
call fcn.10060c69

Function at 0x1006a973
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1006a9a4
lea esp, [esp + 0x28]
ja 0x1006896a
push 0xfb0f52e7
push 0xa1561b12
lea esp, [esp + 8]
jb 0x1003f5ff
cmp cl, bl
cmp ah, cl
push ecx
cmp byte [edi - 1], 0
call fcn.10064c36
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x17ce116e
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x57101436
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4015cf
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov ebx, dword [sym.imp.MSVCRT.dll_wcsncpy]
push edi
mov edi, dword [esp + 0x18]
push 0x100
mov esi, 0x4030e4
push dword [edi]
push esi
call ebx
push 0x4030c0
push esi
call dword [sym.imp.MSVCRT.dll__wstat]
add esp, 0x14
jmp loc.00408000

Function at 0x40170f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402088
push 0x401850
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x403cf8], 0xffffffff
or dword [0x403cfc], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x403cf4]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x403cf0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x403d00], eax
call fcn.00401841
cmp dword [0x4030b0], 0
jne 0x401792
push 0x40183e
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0040182c
push 0x40300c
push 0x403008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x403cec]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x403ce8]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___wgetmainargs]
push 0x403004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___winitenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.004015cf
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4022d2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [str.WeaponsDat]
mov dword [ebp - 0x78], eax
mov eax, dword [0x44307d]
mov dword [ebp - 0x74], eax
movzx eax, word [0x443081]
mov word [ebp - 0x70], ax
movzx eax, byte [0x443083]
mov byte [ebp - 0x6e], al
mov dword [esp], 0xc0c0c0
call sub.GDI32.dll_CreateSolidBrush
sub esp, 4
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], sym.__Z7WndProcP6HWND__jjl_16
lea eax, [ebp - 0x78]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x48], 0
lea eax, [ebp - 0x48]
mov dword [esp], eax
call sub.USER32.dll_RegisterClassA
sub esp, 4
mov dword [esp + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x2d5
mov dword [esp + 0x18], 0x406
mov dword [esp + 0x14], 0xa
mov dword [esp + 0x10], 0x64
mov dword [esp + 0xc], 0xcf0000
mov dword [esp + 8], str.Desperados___Weapons.dat___Editor
lea eax, [ebp - 0x78]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.USER32.dll_CreateWindowExA
sub esp, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.USER32.dll_UpdateWindow
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sub.USER32.dll_GetMessageA
sub esp, 0x10
test eax, eax
je 0x402449
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sub.USER32.dll_TranslateMessage
sub esp, 4
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sub.USER32.dll_DispatchMessageA
sub esp, 4
jmp 0x402401
mov eax, dword [ebp - 0x60]
leave
ret 0x10

Function at 0x4069a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4069d6
mov dword [0x44ac00], eax
mov edx, sym.get_globals_dtor_void_
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [0x442010], eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x442010], eax
leave
ret
Function at 0x406ac0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], sym.___gxx_personality_sj0
mov dword [ebp - 0x24], 0x440af8
mov dword [ebp - 0x1c], 0x406b80
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call sym.__Unwind_SjLj_Register
cmp dword [0x442010], 0
mov dword [ebp - 0x44], 0x44ac10
je 0x406b60
jl 0x406ba0
mov dword [ebp - 0x3c], 1
mov eax, dword [0x44ac00]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x406c43
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x44b700]
mov eax, 0xffffffff
test edx, edx
je 0x406bba
mov eax, dword [0x442014]
test eax, eax
je 0x406bfa
xor eax, eax
test eax, eax
jne 0x406bf0
mov edi, dword [0x442010]
test edi, edi
js 0x406bf0
mov dword [ebp - 0x44], 0x44ac10
mov ebx, dword [0x442010]
test ebx, ebx
je 0x406b60
jmp 0x406b0e
xor esi, esi
mov dword [0x442010], esi
jmp 0x406bc8
mov dword [esp], 0x442018
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.dll_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x406c81
mov eax, dword [0x442014]
test eax, eax
jne 0x406bb8
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x442014]
test eax, eax
je 0x406c1d
jmp 0x406bb8
mov dword [esp], 8
call sym._malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x406c75
mov dword [esp + 4], eax
mov eax, dword [0x44ac00]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x406caa
test edx, edx
je 0x406c95
mov dword [ebp - 0x3c], 1
call method.std.terminate__
call sym.get_globals_init__
mov eax, 1
mov dword [0x442014], eax
jmp 0x406bb8
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x406b56
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
jmp 0x406c71
Function at 0x40c3b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call method.std::__basic_file_char_.fd__
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sym._read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x40c3fc
call sym.__errno
cmp dword [eax], 4
je 0x40c3d0
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40f2f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00410410
call sym.___main
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40f328
jmp 0x40f3c6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x40f327
cmp cl, 0x22
je 0x40f380
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x40f3a0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x40f3a0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x40f360
jmp 0x40f3a0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x40f380
cmp cl, 0x22
je 0x40f402
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x40f3c0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x40f3b0
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x40f3e4
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x40f3a0

Function at 0x40f8b0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x44b760]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40f8f0
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x40fca0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x44b760]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40fd7c
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x40fd91
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x40fd50
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x40fce8
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x40fcf8
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x40fd43
test edx, edx
jne 0x40fd36
test ecx, ecx
je 0x40fce0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x40fda0
cmp eax, 8
je 0x40fce0
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40fcd2
call sym.___w32_sharedptr_initialize
mov eax, dword [0x44b760]
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x40fcc4
call sym._fc_key_init_once
mov eax, dword [0x44b760]
jmp 0x40fcc4
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x40fd3b
mov eax, dword [0x44b760]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40fdf3
mov edi, dword [eax + 0x30]
test edi, edi
js 0x40fe1e
mov esi, dword [eax + 0x30]
test esi, esi
jne 0x40fdff
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call sym.___w32_sharedptr_initialize
mov eax, dword [0x44b760]
jmp 0x40fdd1
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40fde2
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40fde2
call sym._fc_key_init_once
mov eax, dword [0x44b760]
jmp 0x40fdd8
Function at 0x40ff20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov eax, dword [0x44b760]
test eax, eax
je 0x40ff80
mov esi, dword [eax + 0x30]
test esi, esi
js 0x40ffa0
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x40ffc0
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x410010
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sym.___w32_sharedptr_initialize
mov eax, dword [0x44b760]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x40ff42
jmp 0x40ffa0
call sym._fc_key_init_once
mov eax, dword [0x44b760]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x40ff49
jmp 0x40ffc0
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
sub esp, 4
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x40ff71
lea esi, [esi]
mov eax, dword [0x44b760]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x41005d
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x410069
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x41003e
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x41002d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41002d
call sym.___w32_sharedptr_initialize
mov eax, dword [0x44b760]
jmp 0x41001c
call sym._fc_key_init_once
mov eax, dword [0x44b760]
jmp 0x410023
Function at 0x410080
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x44b760]
mov edi, dword [ebp + 8]
test eax, eax
je 0x410114
mov esi, dword [eax + 0x30]
test esi, esi
js 0x410130
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x410150
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x410108
lea edx, [ebp - 0x14]
mov eax, edi
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x4101cf
mov eax, dword [0x44b760]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x4101a6
mov edx, dword [eax + 0x30]
test edx, edx
js 0x4101c0
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x410180
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
jmp 0x4100c5
call sym.___w32_sharedptr_initialize
mov eax, dword [0x44b760]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x4100a0
lea esi, [esi]
call sym._fc_key_init_once
mov eax, dword [0x44b760]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x4100ab
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x4100ae
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4100f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4100f7
call sym.___w32_sharedptr_initialize
mov eax, dword [0x44b760]
mov edx, dword [eax + 0x30]
test edx, edx
jns 0x4100e9
nop
lea esi, [esi]
call sym._fc_key_init_once
mov eax, dword [0x44b760]
jmp 0x4100e9
call sym._abort
lea esi, [esi]
lea edi, [edi]