joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4024b9
Capabilities:
Get session user name

Disassembly:
push rbp
push rbx
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd0], rcx
mov dword [rbp + 0xa8], 0x101
lea rdx, [rbp + 0xa8]
lea rax, [rbp - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
test eax, eax
setne al
test al, al
je 0x402538
lea rax, [rbp + 0xae]
mov rcx, rax
call fcn.00447740
lea rdx, [rbp + 0xae]
lea rax, [rbp - 0x60]
mov r8, rdx
mov rdx, rax
mov rcx, qword [rbp + 0xd0]
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0xae]
mov rcx, rax
call sym.std::allocator_char_::allocator__
jmp 0x4025af
lea rax, [rbp + 0xaf]
mov rcx, rax
call fcn.00447740
lea rax, [rbp + 0xaf]
mov r8, rax
lea rdx, [0x0048a0ff]
mov rcx, qword [rbp + 0xd0]
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0xaf]
mov rcx, rax
call sym.std::allocator_char_::allocator__
jmp 0x4025af
mov rax, qword [rbp + 0xd0]
add rsp, 0x138
pop rbx
pop rbp
ret

Function at 0x40ee50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x004aa064]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x40ef6a
mov rax, qword [0x004aa068]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x40ee9e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x40ef50
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x40ee82
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x40efa2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x004aa068]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x004aa068]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x40ef85
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40ef49
sub eax, 0x40
and eax, 0xffffffbf
je 0x40ef49
mov r9, rbp
add r9, qword [0x004aa068]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40ef71
add dword [0x004aa064], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x40eeab
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x004aa068]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x40fb80
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x40fb90
xor eax, eax
ret
jmp sym.unk_2308
Function at 0x40fba0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x40fbe1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x40fbd8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x40fbe3
add rax, 0x28
cmp rax, r9
jne 0x40fbc4
xor eax, eax
repz ret

Function at 0x40fc90
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x0048eba0]
cmp word [rbx], 0x5a4d
je 0x40fcb0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym.unk_2308
test eax, eax
je 0x40fca4
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection

Function at 0x40ff00
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004aa9c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004aa9a0]
test rbx, rbx
je 0x40ff54
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40ff4b
test rsi, rsi
je 0x40ff4b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40ff30
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004aa9c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x4106f0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov rdi, rcx
movsxd r12, edx
mov r13, r8
call sym.strlen
mov rsi, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x52]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.00410630
sub rsp, rax
movsxd r14, esi
movabs rax, 0x656d68732d636367
lea r15, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, r14
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
movsxd rbx, ebx
mov byte [rsp + 0x2e], 0x2d
call sym.memcpy
lea rax, [r15 + r14 + 0x10]
lea r14d, [rsi + 0x50]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, r15
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r14d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4107d9
int3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x410878
mov rcx, r12
call sym.malloc
lea r9d, [rsi + 0x10]
mov rbx, rax
mov r10d, 0x40
bt rbx, r10
jae 0x410814
mov r11d, r14d
sub r11d, r10d
movsxd r11, r11d
mov byte [r15 + r11], 0x41
sub r10d, 1
jne 0x410800
mov dword [rbp - 0x54], r9d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
mov r9d, dword [rbp - 0x54]
je 0x410875
lea r8d, [rsi + 0x51]
movzx ecx, ax
mov rdx, r15
call dbg.get_ptr_from_atom
cmp rax, rbx
mov rsi, rax
je 0x410890
mov rcx, rbx
call sym.free
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x48]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [rsi + 0x10]
lea r8d, [rsi + 0x51]
movzx ecx, ax
mov rdx, r15
call dbg.get_ptr_from_atom
mov rsi, rax
jmp 0x41084f
xor edx, edx
mov r8, r12
mov rcx, rbx
call sym.memset
test r13, r13
je 0x41084f
mov rcx, rbx
call r13
jmp 0x41084f
Function at 0x410ad0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x130
mov rbx, rcx
call sym._errno
test rbx, rbx
mov dword [rax], 0
je 0x410c9e
cmp byte [rbx], 0
je 0x410c60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x410c80
test al, 0x10
je 0x410c60
lea rdi, [rsp + 0x20]
mov rdx, rbx
mov r8d, 0x104
mov rcx, rdi
mov rbx, rdi
call sym.unk_2642
mov r8d, dword [rbx]
add rbx, 4
lea eax, [r8 - 0x1010101]
not r8d
and eax, r8d
and eax, 0x80808080
je 0x410b2d
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [rbx + 2]
cmove rbx, rdx
add al, al
sbb rbx, 3
sub rbx, rdi
lea rcx, [rbx + 0x24b]
call sym.malloc
test rax, rax
mov rsi, rax
je 0x410c8f
lea r9, [rax + 0x244]
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, r9
call sym.memcpy
cmp byte [rsi + 0x244], 0
mov r9, rax
je 0x410bc0
movzx eax, byte [rsi + rbx + 0x243]
cmp al, 0x2f
je 0x410bc0
cmp al, 0x5c
je 0x410bc0
mov r8d, 0x5c
mov word [r9 + rbx], r8w
nop dword [rax + rax]
mov rcx, r9
mov eax, dword [rcx]
add rcx, 4
lea edx, [rax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x410bc3
mov eax, edx
shr eax, 0x10
test edx, 0x8080
cmove edx, eax
lea rax, [rcx + 2]
cmove rcx, rax
add dl, dl
mov eax, 0x2a
sbb rcx, 3
xor edx, edx
mov word [rcx], ax
mov word [rsi + 0x12c], dx
lea rdx, [rsi + 0x130]
xor ecx, ecx
xor eax, eax
mov qword [rsi + 0x238], 0xffffffffffffffff
mov word [rsi + 0x12e], cx
mov rdi, rdx
mov ecx, 0x20
mov dword [rsi + 0x240], 0
mov dword [rsi + 0x128], 0
rep stosq qword [rdi], rax
mov rax, rsi
mov dword [rdi], 0
add rsp, 0x130
pop rbx
pop rsi
pop rdi
ret
call sym._errno
mov dword [rax], 0x14
xor eax, eax
add rsp, 0x130
pop rbx
pop rsi
pop rdi
ret
call sym._errno
mov dword [rax], 2
xor eax, eax
jmp 0x410c4d
call sym._errno
mov dword [rax], 0xc
xor eax, eax
jmp 0x410c4d
call sym._errno
mov dword [rax], 0xe
xor eax, eax
jmp 0x410c4d
Function at 0x417450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rax, rcx
movzx ecx, word [rcx + 0xa]
and cx, 0x7fff
cmp cx, 0x7fff
je 0x4174e3
movzx ecx, word [rdx + 0xa]
and cx, 0x7fff
cmp cx, 0x7fff
je 0x417512
lea rsi, [rsp + 0x20]
lea rdi, [rsp + 0x40]
mov rcx, rax
mov rbx, rdx
mov rdx, rsi
call dbg.__emovi
mov rdx, rdi
mov rcx, rbx
call dbg.__emovi
movzx r8d, word [rsp + 0x20]
xor eax, eax
lea rcx, [rsi + 2]
cmp r8w, word [rsp + 0x40]
lea rdx, [rdi + 2]
je 0x417530
cmp word [rcx + rax], 0
jne 0x417570
cmp word [rdx + rax], 0
jne 0x417570
add rax, 2
cmp rax, 0xe
jne 0x4174b9
xor al, al
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
lea r8, [rax + 0xa]
mov rcx, rax
add rcx, 2
cmp word [rcx - 2], 0
jne 0x417585
cmp rcx, r8
jne 0x4174ea
movzx ecx, word [rdx + 0xa]
and cx, 0x7fff
cmp cx, 0x7fff
jne 0x41747e
lea r8, [rdx + 0xa]
mov rcx, rdx
add rcx, 2
cmp word [rcx - 2], 0
jne 0x417585
cmp rcx, r8
jne 0x417519
jmp 0x41747e
cmp r8w, 1
sbb eax, eax
xor ecx, ecx
add rsi, 2
and eax, 2
sub eax, 1
movzx edx, word [rsi + rcx]
add rcx, 2
movzx r8d, word [rdi + rcx]
cmp dx, r8w
jne 0x417592
cmp rcx, 0xe
jne 0x417543
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
cmp r8w, 1
sbb eax, eax
and eax, 2
sub eax, 1
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov eax, 0xfffffffe
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
cmp r8w, dx
setae dl
movzx edx, dl
mov ecx, edx
neg ecx
xor eax, ecx
add eax, edx
jmp 0x4174db

Function at 0x41c270
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x004ab508]
test rbx, rbx
je 0x41c2a0
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [0x004ab508]
test rax, rax
je 0x41c2c4
cmp dword [rax], 0xffffffff
je 0x41c2e5
add rsp, 0x20
pop rbx
ret
lea r8, [sym.unk_2449]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call sym.unk_2594
mov rbx, rax
mov qword [0x004ab508], rax
jmp 0x41c281
lea r8, [sym.unk_2449]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call sym.unk_2594
mov qword [0x004ab508], rax
jmp 0x41c295
call sym.abort
nop
nop dword [rax + rax]
Function at 0x41c780
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rcx, qword [0x004ab510]
test rcx, rcx
je 0x41c8c0
call sym.unk_2461
mov rax, qword [0x004ab508]
test rax, rax
je 0x41c8e3
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x41c7c3
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.unk_2458
test rax, rax
mov rbx, rax
je 0x41c92b
cmp qword [sym.unk_2480], 0
je 0x41c92b
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rbx + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx + 0xb0], 0
mov qword [rbx + 0x28], 0
call rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rsi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbx + 0x28]
mov r8, rbp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x41c932
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xb8], eax
movzx eax, byte [rbx + 0x40]
mov dword [rbx + 0xb4], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [0x004ab508]
test rax, rax
je 0x41c907
mov rdx, rbx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x41c932
mov rax, rbx
jmp 0x41c7ba
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
call sym.unk_2594
mov rcx, rax
mov qword [0x004ab510], rax
jmp 0x41c798
lea r8, [sym.unk_2449]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call sym.unk_2594
mov qword [0x004ab508], rax
jmp 0x41c7ad
lea r8, [sym.unk_2449]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call sym.unk_2594
mov qword [0x004ab508], rax
jmp 0x41c8a8
xor eax, eax
jmp 0x41c7ba
call sym.abort
nop
nop dword [rax + rax]

Function at 0x41c940
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str._pthread_key_dest_shmem
xor r8d, r8d
mov edx, 8
jmp sym.unk_2594

Function at 0x41c960
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str._pthread_cancelling_shmem
xor r8d, r8d
mov edx, 4
jmp sym.unk_2594

Function at 0x41c980
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str._pthread_concur_shmem
xor r8d, r8d
mov edx, 4
jmp sym.unk_2594

Function at 0x41c9a0
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
jmp sym.unk_2594

Function at 0x41c9c0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.unk_2449]
lea rcx, str._pthread_tls_shmem
mov edx, 4
jmp sym.unk_2594

Function at 0x41c9e0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.unk_2450]
lea rcx, str._pthread_key_lock_shmem
mov edx, 8
jmp sym.unk_2594

Function at 0x41ca00
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str._pthread_key_max_shmem
xor r8d, r8d
mov edx, 4
jmp sym.unk_2594
Function at 0x41ca20
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str._pthread_key_sch_shmem
xor r8d, r8d
mov edx, 4
jmp sym.unk_2594

Function at 0x41ca40
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.pthr_root_shmem
xor r8d, r8d
mov edx, 8
jmp sym.unk_2594

Function at 0x41ca60
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.pthr_last_shmem
xor r8d, r8d
mov edx, 8
jmp sym.unk_2594

Function at 0x41ca80
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.unk_2451]
lea rcx, str.mtx_pthr_locked_shmem
mov edx, 8
jmp sym.unk_2594

Function at 0x41caa0
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.idList_shmem
xor r8d, r8d
mov edx, 8
jmp sym.unk_2594

Function at 0x41cac0
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.idListCnt_shmem
xor r8d, r8d
mov edx, 8
jmp sym.unk_2594

Function at 0x41cae0
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.idListMax_shmem
xor r8d, r8d
mov edx, 8
jmp sym.unk_2594

Function at 0x41cb00
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.idListNextId_shmem
xor r8d, r8d
mov edx, 8
jmp sym.unk_2594

Function at 0x41cda0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp edx, 3
je 0x41cdc0
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret
mov rax, qword [0x004ab508]
test rax, rax
je 0x41cf20
mov ecx, dword [rax]
cmp ecx, 0xffffffff
je 0x41cdab
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x41cdab
test byte [rax + 0x40], 0x30
je 0x41ce71
mov rcx, qword [rax + 0x1c8]
test rcx, rcx
jne 0x41cf10
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x41ce2c
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x41ce1c
call rsi
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x28], 0
lea rcx, [rbx + 0x38]
call sym.unk_2558
cmp qword [rbx + 0x1c0], 0
mov qword [rbx + 0x60], 0xffffffffffffffff
je 0x41cf65
mov rax, qword [0x004ab508]
test rax, rax
je 0x41cf41
mov ecx, dword [rax]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret
mov eax, dword [rax + 0xb4]
mov rcx, qword [rbx + 0x30]
test eax, eax
jne 0x41ced0
test rcx, rcx
je 0x41ce8a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x1c8]
mov qword [rbx + 0x30], 0
mov dword [rbx + 0xb4], 1
test rcx, rcx
jne 0x41cf00
test byte [rbx + 0x44], 4
je 0x41cee3
mov rcx, qword [rbx + 0x28]
mov dword [rbx], 0xdeadbeef
test rcx, rcx
je 0x41ce24
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41ce24
test rcx, rcx
je 0x41cedb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
call sym.unk_2558
mov qword [rbx + 0x60], 0xffffffffffffffff
jmp 0x41cdab
call sym.unk_2479
jmp 0x41cea8
call sym.unk_2479
jmp 0x41cdff
lea r8, [sym.unk_2449]
lea rcx, str._pthread_tls_shmem
mov dl, 4
call sym.unk_2594
mov qword [0x004ab508], rax
jmp 0x41cdd0
lea r8, [sym.unk_2449]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call sym.unk_2594
mov qword [0x004ab508], rax
jmp 0x41ce5b
mov rcx, rbx
call sym.unk_2460
jmp 0x41ce4b
Function at 0x41d370
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.once_obj_shmem
xor r8d, r8d
mov edx, 8
jmp sym.unk_2594

Function at 0x41d390
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.unk_2452]
lea rcx, str.once_global_shmem
mov edx, 8
jmp sym.unk_2594
Function at 0x41e560
Capabilities:
Hijack thread execution

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
mov rsi, rcx
call sym.unk_2478
test rax, rax
mov rbx, rax
je 0x41e589
mov rcx, qword [rax + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x41e5a0
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x41e589
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.unk_2554
call sym.unk_2462
test rax, rax
je 0x41e745
mov rax, qword [rax + 0x1c8]
cmp rsi, rax
je 0x41e643
mov eax, dword [rbx + 0x44]
and eax, 3
cmp eax, 3
movzx eax, byte [rbx + 0x40]
je 0x41e6a0
test al, 3
jne 0x41e62a
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
mov rax, qword [0x004ab520]
test rax, rax
je 0x41e74c
lock add dword [rax], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x41e61b
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.unk_2549
xor eax, eax
jmp 0x41e58e
mov rcx, rbp
call sym.unk_2549
test byte [rbx + 0x40], 0xc
jne 0x41e589
xor eax, eax
jmp 0x41e58e
movzx eax, byte [rbx + 0x40]
test al, 3
jne 0x41e62a
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
mov rax, qword [0x004ab520]
test rax, rax
je 0x41e76c
lock add dword [rax], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x41e677
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
and eax, 3
cmp eax, 3
jne 0x41e61b
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
mov rcx, rbp
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call sym.unk_2549
call sym.unk_2505
test al, 0xc
jne 0x41e62a
test al, 0xf
jne 0x41e589
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41e61b
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [sym.unk_2505]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
mov rax, qword [0x004ab520]
test rax, rax
je 0x41e78c
lock add dword [rax], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x41e72e
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.unk_2549
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x41e61b
xor eax, eax
jmp 0x41e5d3
lea rcx, str._pthread_cancelling_shmem
xor r8d, r8d
mov edx, 4
call sym.unk_2594
mov qword [0x004ab520], rax
jmp 0x41e608
lea rcx, str._pthread_cancelling_shmem
xor r8d, r8d
mov edx, 4
call sym.unk_2594
mov qword [0x004ab520], rax
jmp 0x41e664
lea rcx, str._pthread_cancelling_shmem
xor r8d, r8d
mov edx, 4
call sym.unk_2594
mov qword [0x004ab520], rax
jmp 0x41e71b
Function at 0x41e7b0
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [0x004ab4d8]
mov edi, edx
test rcx, rcx
je 0x41e890
call sym.unk_2554
mov rcx, rbx
call sym.unk_2453
test rax, rax
je 0x41e7ea
mov rsi, qword [rax + 0x1c8]
cmp rsi, rbx
je 0x41e810
mov rcx, qword [0x004ab4d8]
test rcx, rcx
je 0x41e860
mov ebx, 3
call sym.unk_2549
mov eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
test byte [rax + 0x40], 0xc
jne 0x41e7ea
mov ebx, dword [rax + 0xb4]
test ebx, ebx
jne 0x41e7ea
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x41e7ea
mov rcx, qword [0x004ab4d8]
test rcx, rcx
je 0x41e8b7
call sym.unk_2549
test edi, edi
je 0x41e800
sub edi, 2
mov ebx, 0x16
cmp edi, 0x15
ja 0x41e800
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.unk_2510
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.unk_2451]
mov edx, 8
call sym.unk_2594
mov rcx, rax
mov qword [0x004ab4d8], rax
jmp 0x41e7f6
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.unk_2451]
mov edx, 8
call sym.unk_2594
mov rcx, rax
mov qword [0x004ab4d8], rax
jmp 0x41e7cc
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.unk_2451]
mov edx, 8
call sym.unk_2594
mov rcx, rax
mov qword [0x004ab4d8], rax
jmp 0x41e83a