joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a8f0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x42a959
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.0042a440
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x42b400
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x42b492
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x42b484
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x42b47c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x42b445
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x42bee0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x42befe
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x42bef3
pop esi
ret
Function at 0x42cf50
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x42cf5d
xor eax, eax
pop esi
ret
push esi
call fcn.0042da20
add esp, 4
test eax, eax
jne 0x42cf6c
pop esi
ret
cmp eax, 1
jne 0x42cf7a
cmp byte [esi], 0x5c
jne 0x42cf7a
xor eax, eax
pop esi
ret
push esi
call fcn.0042cd00
add esp, 4
test eax, eax
je 0x42cf8e
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x42d010
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret

Function at 0x42db00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x42db21
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x42db7b
inc edi
cmp edi, esi
jl 0x42db15
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x42dbb0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x42db6a
cmp byte [eax], bl
je 0x42db85
cmp byte [eax + 1], bl
je 0x42db8e
cmp byte [eax + 2], bl
je 0x42db98
cmp byte [eax + 3], bl
je 0x42dba4
add eax, 4
cmp eax, edi
jb 0x42db41
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
and esi, ebx
and edx, ecx
xchg esi, ecx
inc edx
add ecx, esi
dec edx
call sub.kernel32.dll_GetConsoleWindow
add esi, ecx
rol esi, 0xd
cmp eax, 0xfffffee7
jne 0x401089
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
ret
sub ecx, esi
rol ebx, 0x1d
add edx, esi
xor edx, 0x56595d40
ror edx, 0x1c
call sub.user32.dll_GetCursor
rol ebx, 0xd
or edx, 0x565b5e2f
mov ecx, edx
or edx, 0x565c96b9
xchg ecx, edx
inc esi
xor edx, 0x565e6ef4
or ebx, ecx
cmp eax, 0xffffff16
jne 0x40112a
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
ret
xor edx, esi
call sub.user32.dll_GetDoubleClickTime
and ebx, esi
bswap esi
inc ecx
xor ecx, esi
shr ebx, 9
sub edx, ebx
xchg ecx, ebx
or esi, ecx
cmp eax, 0xfffffef0
jne 0x4011a7
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
ret
and esi, edx
and esi, ecx
ror esi, 0x19
call sub.user32.dll_GetDoubleClickTime
neg esi
shr esi, 0x17
xor esi, ebx
rol ecx, 0x12
xchg edx, ecx
sub edx, ebx
xor ebx, 0x56704112
cmp eax, 0xffffff01
jne 0x401264
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
call main
ret
jmp 0x4941fd
or ebx, esi
and ebx, esi
bswap esi
jmp 0x495231
push 0x581795c5
or esi, ecx
dec esi
dec edx
and ecx, ebx
xor ebx, ecx
or ebx, ecx
jmp 0x49738b
push 0x5816bcad
add edx, ebx
mov ecx, ebx
xor edx, ecx
sub edx, esi
xchg ecx, esi
shl edx, 0x1b
or esi, edx
shr ecx, 0x1b
or edx, 0x5dea2955
and esi, 0x5dea9602
add ebx, esi
jmp 0x4975b3
jmp loc.0049a000
push 0x5817ebe3
xor esi, ebx
sub esi, 0x63014a9f
xor ecx, edx
and ebx, esi
or ebx, edx
xchg ebx, esi
or ebx, 0x6303fb4d
shl edx, 0x1e
add ebx, esi
not esi
mov esi, ecx
add edx, 0x630653d3
jmp 0x497510
mov edi, 0x2774562b
not edx
add ebx, edx
and ecx, edx
jmp 0x495dd7
push 0x581736bd
nop
ror esi, 0x1c
bswap esi
nop
xchg esi, ecx
xchg edx, esi
shl edx, 0x1c
sub edx, 0x6353530e
jmp 0x495138
Function at 0xf3f8f0
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf3f8fa
pushal
call 0xf3f900
pop ebp
sub ebp, 0x10
sub ebp, 0xb3f8f0
jmp 0xf3f916
mov eax, 0xb3f8f0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a9
mov edx, 0x1c927718
xor byte [eax], dl
inc eax
dec ecx
jne 0xf3f92d
jmp 0xf3f940
xchg ebx, eax
aad 0x93
xchg ecx, eax
and al, 0x18
sbb byte [eax], bl
cdq
fchs
sbb byte [eax], bl
sbb byte [ebx], bl
aad 0xa0
pop ds
sbb byte [eax], bl
sbb byte [edx + 0x18181830], ah
out dx, eax
cli
sbb edx, eax
xchg ebx, eax
cdq
adc al, 0x18
sbb byte [eax], bl
sbb ebx, ebp
xchg ebp, eax
jl 0xf3f9a5
in al, 0x91
sbb al, 0x3c
dec eax
jo 0xf3f988
pop ebp
cmp dword [eax], ebx
jo 0xf3f96b
stosd dword es:[edi], eax
mov bl, byte [eax]
sbb dword [esp + edi], esi
jo 0xf3f9b2
ret 0x8925
sbb byte [eax], bl
xchg ebp, eax
jl 0xf3f9c9
in al, 0x91
xor al, 0x3c
dec esp
inc ebp
xchg ebx, eax
popfd
adc byte [eax], bl
sbb byte [eax], bl
xchg ebx, eax
lea edx, [eax + ebx]
sbb byte [eax], bl
xchg ebx, eax
xchg ebp, eax
or byte [eax], bl
sbb byte [eax], bl
fyl2x
sbb ch, byte [ecx]
sbb bl, byte [ebx + 0x17511cda]
popfd
in al, dx
out 0xe7, eax
out 0x45, eax
out 0xe7, eax
inc ebp
ficom dword [eax + ebx]
xchg ebx, eax
xchg esp, eax
cmp al, 0x1c
sbb byte [eax], bl
sbb byte [eax + 0x18], dh
pop ebp
cmp dword [eax], ebx
jo 0xf3f9bc
stosd dword es:[edi], eax
mov bl, byte [eax]
sbb dword [esp + edi], esi
dec ecx
invalid
Function at 0x4030e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
mov eax, dword [ebp + 8]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov edx, dword [ebp + 0xc]
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x403480
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov byte [ebp - 0x4d], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
xor eax, eax
lea eax, [ebp - 0x84]
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call sub.SHELL32.dll_SHGetKnownFolderPath
sub esp, 0x10
mov dword [ebp - 0x4c], eax
cmp eax, 0
je 0x4031b4
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call sub.ole32.dll_CoTaskMemFree
sub esp, 4
mov eax, dword [ebp - 0x8c]
mov dword [eax], 0x80000000
jmp 0x403216
mov ecx, dword [ebp - 0x84]
mov eax, esp
mov dword [eax], ecx
call sub.KERNEL32.dll_lstrlenW
sub esp, 4
mov edx, eax
mov dword [ebp - 0x48], edx
mov ecx, dword [ebp - 0x84]
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.00402e80
mov ecx, eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], edx
mov byte [ebp - 0x4d], 1
mov eax, esp
mov dword [eax + 8], edx
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x80]
mov dword [eax], ecx
call fcn.00406ee0
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x10], 0
mov eax, esp
mov dword [eax], ecx
call sub.ole32.dll_CoTaskMemFree
sub esp, 4
jmp 0x403231
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [ebp - 0x4d], 0
movsd xmm0, qword [ebp - 0x80]
movsd xmm1, qword [ebp - 0x78]
movsd qword [ebp - 0x58], xmm1
movsd qword [ebp - 0x60], xmm0
mov eax, esp
lea ecx, [ebp - 0x60]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x70]
mov dword [eax], ecx
call fcn.004030b0
jmp 0x40325d
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x70]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x6c]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x68]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x64]
mov dword [eax + 0xc], ecx
mov byte [ebp - 0x4d], 0
jmp 0x403216
Function at 0x405860
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x40f050
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x2c], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x30], 0
cmp esi, 0x201
jae 0x4058f0
jmp 0x4058de
jbe 0x405984
cmp esi, 0x201
jae 0x4058f0
mov dword [ebp - 0x28], 0x200
lea ebx, [ebp - 0x448]
mov edi, esi
jmp 0x40592b
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x40591c
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x38]
mov edx, edi
push esi
call fcn.0041b140
add esp, 4
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x40594f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4059e7
cmp esi, edi
jne 0x4058d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x405a06
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x4058de
jmp 0x4058f0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0
cmp esi, eax
ja 0x405a23
lea eax, [ebp - 0x48]
push esi
push ebx
push eax
call fcn.00406ee0
add esp, 0xc
movsd xmm0, qword [ebp - 0x48]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x40]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4059d1
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00402090
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x43c
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi], 0x80000000
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4059c1
jmp 0x4059d1
mov dword [ebp - 0x10], 0
push 0x41da34
push 0x28
push str.internal_error:_entered_unreachable_code_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_src_vecmod.rs
call fcn.0041bae0
add esp, 0xc
jmp 0x405a32
push 0x41da24
push eax
push esi
call fcn.0041be60
add esp, 0xc
ud2
Function at 0x40c4e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x40c524
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x40c52a
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x40c566
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x40c58b
test eax, eax
js 0x40c575
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov al, 4
jmp 0x40c581
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x41d5cc
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.00406c20
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.00403d10
mov ecx, 7
int 0x29
ud2
Function at 0x40d580
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x40f280
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x4221d4]
test al, al
je 0x40d751
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40d5cc
cmp eax, 3
jne 0x40d74a
mov ebx, dword [0x4221d8]
test ebx, ebx
je 0x40d74a
mov dword [ebp - 0x20], 0
jmp 0x40d5f7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40d628
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40d79b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40d5f0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x40d5f0
test byte [ebp - 0x20], 1
je 0x40d74a
mov ebx, dword [0x4221d8]
test ebx, ebx
je 0x40d74a
mov dword [ebp - 0x20], 0
jmp 0x40d657
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40d688
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40d79b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40d650
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x40d650
test byte [ebp - 0x20], 1
je 0x40d74a
mov ebx, dword [0x4221d8]
test ebx, ebx
je 0x40d74a
mov dword [ebp - 0x20], 0
jmp 0x40d6b7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40d6e8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40d79b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40d6b0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x40d6b0
test byte [ebp - 0x20], 1
je 0x40d74a
mov ebx, dword [0x4221d8]
test ebx, ebx
je 0x40d74a
mov dword [ebp - 0x20], 0
jmp 0x40d717
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40d744
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40d79b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40d710
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x40d710
test byte [ebp - 0x20], 1
jne 0x40d764
movzx eax, byte [0x41fb40]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x4221d8]
jmp 0x40d76f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40d74a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40d79b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40d76c
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x40d76c
mov dword [ebp - 0x10], 0
push 0x41d978
push 0x2b
push 0x41c450
call fcn.0041bae0
add esp, 0xc
ud2
Function at 0x40eb30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x422038]
mov esi, ecx
test eax, eax
je 0x40eb56
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x40eb6f
cmp dword [eax + 4], 0
je 0x40eb6f
add eax, 8
pop esi
pop edi
ret
push 0x422038
call fcn.0041b410
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x40eb4a
mov eax, dword [0x422038]
test eax, eax
je 0x40ec06
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x40ec23
mov edi, eax
test eax, eax
jne 0x40ebcf
movzx eax, byte [0x422161]
push 4
push 0x10
call fcn.00402080
add esp, 8
test eax, eax
je 0x40ec37
mov dword [eax], 0x422038
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x422038]
test eax, eax
je 0x40ec28
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x40ebef
mov eax, dword [esi]
xor ecx, ecx
mov edx, 0
mov dword [esi], 0
cmp eax, 1
jne 0x40ebf3
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x40ebf3
xor ecx, ecx
xor edx, edx
lea eax, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
mov byte [edi + 0xc], dl
pop esi
pop edi
ret
push 0x422038
call fcn.0041b410
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x40eb8d
xor eax, eax
pop esi
pop edi
ret
push 0x422038
call fcn.0041b410
add esp, 4
jmp 0x40ebc7
push 0x10
push 4
call fcn.0041b940

Function at 0x40ec40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x422048]
mov esi, ecx
test eax, eax
je 0x40ed1a
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x40ec6d
cmp dword [eax + 4], 0
mov edi, eax
jne 0x40ed15
mov eax, dword [0x422048]
test eax, eax
je 0x40ed3c
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x40ed59
mov edi, eax
test eax, eax
jne 0x40ecd1
movzx eax, byte [0x422161]
push 4
push 0xc
call fcn.00402080
add esp, 8
test eax, eax
je 0x40ed75
mov dword [eax], 0x422048
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x422048]
test eax, eax
je 0x40ed63
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x40ece6
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x40ece8
mov eax, dword [esi + 4]
jmp 0x40ece8
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
test edx, edx
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x40ed15
test ecx, ecx
je 0x40ed15
lock dec dword [ecx]
jne 0x40ed15
lea ecx, [esp + 4]
call fcn.00404950
add edi, 8
jmp 0x40ed5b
push 0x422048
call fcn.0041b410
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x40ec61
jmp 0x40ec6d
push 0x422048
call fcn.0041b410
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x40ec8b
xor edi, edi
mov eax, edi
add esp, 8
pop esi
pop edi
ret
push 0x422048
call fcn.0041b410
add esp, 4
jmp 0x40ecc9
push 0xc
push 4
call fcn.0041b940
int3
Function at 0x40ed80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x422058]
mov esi, ecx
test eax, eax
je 0x40eda6
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x40edbf
cmp byte [eax + 4], 0
je 0x40edbf
add eax, 5
pop esi
pop edi
ret
push 0x422058
call fcn.0041b410
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x40ed9a
mov eax, dword [0x422058]
test eax, eax
je 0x40ee32
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x40ee4b
mov edi, eax
test eax, eax
jne 0x40ee10
movzx eax, byte [0x422161]
push 4
push 8
call fcn.00402080
add esp, 8
test eax, eax
je 0x40ee5f
mov dword [eax], 0x422058
mov byte [eax + 4], 0
mov edi, eax
mov eax, dword [0x422058]
test eax, eax
je 0x40ee50
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test esi, esi
je 0x40ee25
cmp byte [esi], 0
mov byte [esi], 0
movzx eax, byte [esi + 1]
cmove eax, ecx
mov ecx, eax
lea eax, [edi + 5]
mov byte [edi + 4], 1
mov byte [edi + 5], cl
pop esi
pop edi
ret
push 0x422058
call fcn.0041b410
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x40edd5
xor eax, eax
pop esi
pop edi
ret
push 0x422058
call fcn.0041b410
add esp, 4
jmp 0x40ee08
push 8
push 4
call fcn.0041b940
int3

Function at 0x40ee70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x422068]
mov esi, ecx
test eax, eax
je 0x40ef4a
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x40ee9d
cmp dword [eax + 4], 0
mov edi, eax
jne 0x40ef45
mov eax, dword [0x422068]
test eax, eax
je 0x40ef6c
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x40ef89
mov edi, eax
test eax, eax
jne 0x40ef01
movzx eax, byte [0x422161]
push 4
push 0xc
call fcn.00402080
add esp, 8
test eax, eax
je 0x40efa5
mov dword [eax], 0x422068
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x422068]
test eax, eax
je 0x40ef93
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x40ef16
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x40ef18
mov eax, dword [esi + 4]
jmp 0x40ef18
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
test edx, edx
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x40ef45
test ecx, ecx
je 0x40ef45
lock dec dword [ecx]
jne 0x40ef45
lea ecx, [esp + 4]
call fcn.004048f0
add edi, 8
jmp 0x40ef8b
push 0x422068
call fcn.0041b410
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x40ee91
jmp 0x40ee9d
push 0x422068
call fcn.0041b410
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x40eebb
xor edi, edi
mov eax, edi
add esp, 8
pop esi
pop edi
ret
push 0x422068
call fcn.0041b410
add esp, 4
jmp 0x40eef9
push 0xc
push 4
call fcn.0041b940
int3