joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417200
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x41720c
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x41729f
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], pe_nt_image_headers32
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x417269
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.004172b0
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x41723e
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret

Function at 0x4172d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x4173cd
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x417322
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x41734e
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.004172b0
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x41738f
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x417311
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x418390
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x44c6d4]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4183a3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4183e4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x44c77c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x418416
mov bl, byte [esp + ecx + 0x4c]
jmp 0x41841a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x41840b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x418438
mov bl, byte [esp + ecx + 0x4c]
jmp 0x41843c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x41842d
xor ecx, ecx
mov eax, 0x44c6e4
xor ebx, ebx
mov bl, byte [ecx + 0x44c78c]
cmp byte [esp + ebx + 0x14], 0
je 0x418467
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x44c7a4]
cmp byte [esp + ebx + 0x14], 0
je 0x41847e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x41844e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4183d7
lea edx, [esp + 0x84]
push edx
call fcn.004184c0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x12de1d2c
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x54434e53
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4016da
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
mov eax, dword [ebp + 8]
fld dword [eax]
fld xword [0x434090]
fdivp st(1)
fstp dword [ebp - 0x1ac]
fld dword [ebp - 0x1ac]
mov eax, dword [ebp + 8]
fstp dword [eax]
mov dword [esp], 0
call sub.msvcrt.dll_time
mov dword [esp], eax
call sub.msvcrt.dll_srand
mov eax, dword [ebp + 8]
fld dword [eax]
fld xword [0x434090]
fdivp st(1)
fstp dword [ebp - 0x1ac]
fld dword [ebp - 0x1ac]
mov eax, dword [ebp + 8]
fstp dword [eax]
mov word [ebp - 0xa], 0x202
mov eax, dword [ebp + 8]
fld dword [eax]
fld xword [0x4340a0]
fdivp st(1)
fstp dword [ebp - 0x1ac]
fld dword [ebp - 0x1ac]
mov eax, dword [ebp + 8]
fstp dword [eax]
movzx eax, word [ebp - 0xa]
lea edx, [ebp - 0x1a0]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
fld dword [eax]
fld xword [0x4340a0]
fdivp st(1)
fstp dword [ebp - 0x1ac]
fld dword [ebp - 0x1ac]
mov eax, dword [ebp + 8]
fstp dword [eax]
cmp dword [ebp - 0x10], 0
je 0x4017c1
mov eax, dword [ebp + 8]
fld dword [eax]
fld xword [0x4340a0]
fdivp st(1)
fstp dword [ebp - 0x1ac]
fld dword [ebp - 0x1ac]
mov eax, dword [ebp + 8]
fstp dword [eax]
mov eax, 0
jmp 0x40188b
mov eax, dword [ebp + 8]
fld dword [eax]
fld xword [0x4340a0]
fdivp st(1)
fstp dword [ebp - 0x1ac]
fld dword [ebp - 0x1ac]
mov eax, dword [ebp + 8]
fstp dword [eax]
movzx eax, word [ebp - 0x1a0]
cmp al, 2
jne 0x4017f9
movzx eax, word [ebp - 0x1a0]
shr ax, 8
cmp al, 2
je 0x401843
mov eax, dword [ebp + 8]
fld dword [eax]
fld xword [0x4340a0]
fdivp st(1)
fstp dword [ebp - 0x1ac]
fld dword [ebp - 0x1ac]
mov eax, dword [ebp + 8]
fstp dword [eax]
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov eax, dword [ebp + 8]
fld dword [eax]
fld xword [0x4340a0]
fdivp st(1)
fstp dword [ebp - 0x1ac]
fld dword [ebp - 0x1ac]
mov eax, dword [ebp + 8]
fstp dword [eax]
mov eax, 0
jmp 0x40188b
mov eax, dword [ebp + 8]
fld dword [eax]
fld xword [0x4340a0]
fdivp st(1)
fstp dword [ebp - 0x1ac]
fld dword [ebp - 0x1ac]
mov eax, dword [ebp + 8]
fstp dword [eax]
mov byte [0x44c044], 1
mov eax, dword [ebp + 8]
fld dword [eax]
fld xword [0x4340a0]
fdivp st(1)
fstp dword [ebp - 0x1ac]
fld dword [ebp - 0x1ac]
mov eax, dword [ebp + 8]
fstp dword [eax]
mov eax, 1
leave
ret
Function at 0x40dfb0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004195b0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004195b0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x40e010
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x44c07c]
test esi, esi
jle 0x40e130
mov eax, dword [0x44c080]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x40e044
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40e0c7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40e030
mov dword [esp], ebx
call fcn.0040ea10
mov edi, eax
test eax, eax
je 0x40e157
mov eax, dword [0x44c080]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0040eb50
mov edx, dword [0x44c080]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40e137
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40e0c0
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x40e0d0
add dword [0x44c07c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x44c080]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40e0c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040dfb0
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x40e04e
mov eax, dword [0x44c080]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040dfb0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040dfb0
lea esi, cs:[esi]
nop
Function at 0x40e680
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x44c098
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x44c090]
sub esp, 4
test ebx, ebx
je 0x40e6d5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x40e6ce
test eax, eax
jne 0x40e6ce
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40e6b0
mov dword [esp], 0x44c098
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40ea10
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x40ea35
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x40ea40
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x40ea35
push esi
push ebx
mov ebx, dword [esp + 0xc]
movzx eax, word [ecx + 0x400014]
movzx esi, word [ecx + 0x400006]
sub ebx, 0x400000
lea eax, [edx + eax + 0x18]
test si, si
je 0x40ea88
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40ea7e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40ea8a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x40ea70
xor eax, eax
pop ebx
pop esi
ret
Function at 0x413a60
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x2d
mov dword [esp + 4], str._buffer_overflow_detected_:_terminated_n
mov dword [esp], 2
call sub.msvcrt.dll__write
mov dword [esp], 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
sub esp, 4
test eax, eax
je 0x413a99
mov ecx, 8
int 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], 0xc0000409
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x413ac0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x2c
mov dword [esp + 4], str._stack_smashing_detected_:_terminated_n
mov dword [esp], 2
call sub.msvcrt.dll__write
mov dword [esp], 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
sub esp, 4
test eax, eax
je 0x413af9
mov ecx, 2
int 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], 0xc0000409
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x41a770
Capabilities:
Print debug messages

Disassembly:
push edi
pxor xmm0, xmm0
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push ebx
lea ebx, [ebp - 0x41]
sub esp, 0x50
movups xmmword [ebp - 0x21], xmm0
mov eax, dword [0x44c0fc]
mov dword [ebp - 0xc], eax
xor eax, eax
movups xmmword [ebp - 0x41], xmm0
movups xmmword [ebp - 0x31], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x35
mov dword [esp], ebx
call fcn.0041fce0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sub.msvcrt.dll_abort
lea esi, cs:[esi]
lea esi, [esi]

Function at 0x41ab60
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x44caf4], 1
je 0x41ac00
push edi
mov eax, 0x44caf4
push esi
push ebx
sub esp, 0x10
call fcn.0041a560
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call fcn.00419e50
mov edi, dword [0x44caf4]
test edi, edi
jne 0x41abd0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x433120], eax
cmp eax, 0xffffffff
je 0x431995
mov dword [0x44caf4], 1
mov dword [esp], esi
call fcn.0041a180
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
jmp fcn.0041a7f0
cmp edi, 1
je 0x41abb2
mov dword [esp], 2
call dword [0x433108]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x44caf4
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x41abb2
ret
call sub.msvcrt.dll_abort
call sub.msvcrt.dll_abort
mov eax, dword [0x14]
ud2

Function at 0x41ad40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041ab60
mov eax, dword [0x433120]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41ad68
add esp, 0x1c
ret
add esp, 0x1c
jmp fcn.0041ac10
Function at 0x41b040
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x41b068
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x41b160
add esp, 0x14
pop ebx
pop esi
ret 0xc
cmp eax, 1
je 0x41b130
cmp eax, 3
jne 0x41b059
mov eax, dword [0x433120]
cmp eax, 0xffffffff
je 0x41b059
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41b059
test byte [eax + 0x20], 0x30
je 0x41b190
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41b0ab
call fcn.0041ad70
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x41b0dd
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x41b0cf
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0041a320
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0041e380
cmp eax, 1
je 0x41b25e
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x41b252
mov eax, dword [0x433120]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x41b059
mov eax, dword [0x44cacc]
test eax, eax
je 0x41b17c
mov dword [esp + 4], 0x41a4d0
mov dword [esp], 1
call eax
mov dword [0x44cad0], eax
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [0x44cad0]
test eax, eax
je 0x41b059
mov edx, dword [0x44cac8]
test edx, edx
je 0x41b17c
mov dword [esp], eax
call edx
mov dword [0x44cad0], 0
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x41b204
test eax, eax
je 0x41b1aa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x41b1c7
call fcn.0041ad70
test byte [ebx + 0x24], 4
je 0x41b242
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41b0dd
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], eax
call fcn.0041a320
lea eax, [ebx + 0x38]
jmp 0x41b0eb
test eax, eax
je 0x41b242
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.0041a320
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0041e380
cmp eax, 1
je 0x41b25e
mov dword [ebx + 0x38], 0xffffffff
jmp 0x41b059
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0041a320
lea eax, [ebx + 0x38]
jmp 0x41b229
mov eax, ebx
call fcn.0041a9a0
jmp 0x41b111
call fcn.0041a770
lea esi, cs:[esi]
lea esi, cs:[esi]
Function at 0x41b530
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [0x44c0fc]
mov dword [esp + 0x2c], esi
mov esi, dword [esp + 0x54]
mov ebx, dword [esp + 0x50]
mov eax, dword [ebx]
test esi, esi
je 0x41b670
cmp eax, 1
je 0x41b58e
mov eax, ebx
call fcn.0041a560
lea edi, [eax + 4]
mov dword [esp + 0x1c], eax
mov dword [esp], edi
call fcn.00419e50
mov ebp, dword [ebx]
test ebp, ebp
je 0x41b5b0
cmp ebp, 1
jne 0x41b640
mov dword [esp], edi
call fcn.0041a180
mov eax, dword [esp + 0x1c]
call fcn.0041a7f0
xor eax, eax
mov edx, dword [esp + 0x2c]
sub edx, dword [0x44c0fc]
jne 0x41b6ba
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], 0x41a8b0
mov dword [esp + 0x24], eax
call fcn.0041ab60
mov eax, dword [0x433120]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41b6a8
mov eax, dword [eax + 0xc]
mov dword [esp + 0x28], eax
lock or dword [esp], 0
call fcn.0041ab60
mov eax, dword [0x433120]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41b690
lea ecx, [esp + 0x20]
mov dword [eax + 0xc], ecx
lock or dword [esp], 0
call esi
call fcn.0041ab60
mov eax, dword [0x433120]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41b680
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x41b57d
mov dword [esp], 2
call dword [0x433108]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x41b57d
mov eax, 0x16
jmp 0x41b590
call fcn.0041ac10
test eax, eax
jne 0x41b62a
jmp 0x4319bf
call fcn.0041ac10
test eax, eax
jne 0x41b606
jmp 0x4319b4
call fcn.0041ac10
test eax, eax
jne 0x41b5e0
jmp 0x4319ad
call fcn.00413ac0
nop
mov eax, dword [pe_dos_header]
ud2
lea eax, [esp + 0x20]
mov dword [0], eax
ud2
mov eax, dword [esp + 0x28]
mov dword [0], eax
ud2

Function at 0x41b900
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0041ab60
mov eax, dword [0x433120]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41b978
lea ebp, [ebx + 0x38]
xor edi, edi
mov dword [esp], ebp
call fcn.0041e390
mov eax, dword [ebx + 0x28]
cmp dword [esp + 0x30], eax
jae 0x41b954
mov eax, dword [ebx + 0x30]
mov edx, dword [esp + 0x30]
cmp byte [eax + edx], 0
je 0x41b954
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + edx*4]
mov dword [esp], ebp
call fcn.0041e3e0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041ac10
mov ebx, eax
jmp 0x41b92b
Function at 0x41b990
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call fcn.0041ab60
mov eax, dword [0x433120]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41baa8
lea edi, [ebx + 0x38]
mov dword [esp], edi
call fcn.0041e390
mov edx, dword [ebx + 0x2c]
cmp esi, dword [ebx + 0x28]
jb 0x41ba74
lea ebp, [esi + 1]
mov dword [esp], edx
lea eax, [ebp*4]
mov dword [esp + 4], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x41bab4
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x41bab4
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x28]
mov edx, dword [esp + 0x18]
mov ecx, ebp
mov dword [esp + 4], 0
sub ecx, eax
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call fcn.0041e3e0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041ac10
mov ebx, eax
jmp 0x41b9c5
mov dword [esp], edi
call fcn.0041e3e0
mov eax, 0xc
jmp 0x41ba9c

Function at 0x41bb50
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041ab60
mov eax, dword [0x433120]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41bb78
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.0041ac10
test eax, eax
jne 0x41bb6d
add esp, 0x1c
ret

Function at 0x41bbe0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041ab60
mov eax, dword [0x433120]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41bc08
add eax, 0xc
add esp, 0x1c
ret
call fcn.0041ac10
test eax, eax
jne 0x41bbfd
jmp 0x41bc00