joyce8/EMBER2024-capa huggingface dataset:
Function at 0x507a90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x526e40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004a5b30
mov eax, dword [0x9c0c0c]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004df5e0
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.00508530
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x507b37
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x507b2e
cmp al, 0xff
je 0x507b2e
dec al
mov byte [ecx], al
jmp 0x507b37
push ecx
call fcn.00512123
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x507b68
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x507b5f
cmp al, 0xff
je 0x507b5f
dec al
mov byte [ecx], al
jmp 0x507b68
push ecx
call fcn.00512123
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x514897
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5148cf
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00512860
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00512838
jmp 0x5148db
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x515f88
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x515fca
call fcn.0051c463
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x515fca
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x515fc1
xor eax, eax
jmp 0x515fd2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00515fd8
pop edi
pop esi
pop ebx
ret 4
Function at 0x40258e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
xor esi, esi
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], esi
je 0x4025fc
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x1c]
add ecx, edi
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x20]
add ecx, edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov ebx, esi
cmp dword [eax + 0x14], esi
jbe 0x4025fb
mov eax, dword [ecx + ebx*4]
add eax, edi
push 0x4015a8
push eax
call dword [0x406014]
pop ecx
test eax, eax
mov eax, dword [ebp - 4]
pop ecx
je 0x4025e9
mov ecx, dword [ebp - 8]
inc ebx
cmp ebx, dword [eax + 0x14]
jb 0x4025c4
jmp 0x4025fb
mov eax, dword [eax + 0x24]
mov esi, dword [ebp - 0xc]
lea eax, [eax + ebx*2]
movzx eax, word [eax + edi]
mov esi, dword [esi + eax*4]
add esi, edi
pop ebx
call fcn.00403526
sub eax, dword [0x406040]
xor ecx, ecx
cmp eax, 0x7fff
cmova esi, ecx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x4031d7
Capabilities:
Accept command line arguments
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x401234
mov dword [ebp - 8], ecx
call edi
push eax
call dword [0x406008]
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x403202
xor al, al
jmp 0x403269
add esi, 0x2a
push 0x20
push esi
call dword [0x406004]
pop ecx
pop ecx
test eax, eax
jne 0x403221
push ecx
push 0x401260
call fcn.0040249a
jmp 0x4031fe
sub eax, esi
sar eax, 1
cmp eax, 2
jae 0x40323b
push ecx
push 0x401274
call fcn.0040249a
push ecx
call edi
push eax
jmp 0x40321a
lea edi, [eax + eax]
push ebx
lea eax, [edi + 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
jne 0x40326d
push ecx
push 0x401288
call fcn.0040249a
xor al, al
pop ebx
pop edi
pop esi
leave
ret
push edi
push esi
push ebx
call dword [0x406020]
add esp, 0xc
xor eax, eax
push ebx
mov word [edi + ebx], ax
xor ebx, ebx
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4032b2
push ecx
push 0x40129c
call fcn.0040249a
push 0xa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, 0x406048
call fcn.00402433
jmp 0x403266
mov esi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebx
push ebx
push ebx
push 4
push eax
call esi
mov ebx, eax
test ebx, ebx
jne 0x4032ce
push ecx
push 0x4012b0
jmp 0x403298
push 0x20
push ebx
push dword [ebp - 8]
call dword [0x406020]
add esp, 0xc
call fcn.0040341e
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x403266
mov eax, dword [ebx + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
add eax, 0x18
mov edx, eax
mov ecx, edi
mov dword [ebp - 8], eax
call fcn.004033c5
test al, al
je 0x403266
lea edx, [ebp - 4]
mov ecx, edi
call fcn.004033c5
test al, al
je 0x403266
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ebp - 8]
push 2
push dword [eax]
call esi
mov ecx, eax
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x403343
push ecx
push 0x4012c4
jmp 0x403298
mov eax, dword [ebx + 0x24]
lea esi, [ebx + 0x28]
lea eax, [esi + eax*4]
mov dword [ebp - 0xc], eax
cmp esi, eax
je 0x403371
mov edx, dword [esi]
add edx, ecx
mov ecx, edi
call fcn.004033c5
test al, al
je 0x403266
mov ecx, dword [ebp - 8]
add esi, 4
cmp esi, dword [ebp - 0xc]
jne 0x403353
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x403389
push ecx
push 0x4012d8
jmp 0x403298
push dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call edi
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
push ebx
call edi
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x18]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
jmp 0x403268
Function at 0x403330
Capabilities:
Hash data with md5

Disassembly:
movzx eax, word [0x434f6c]
mov edx, ecx
and eax, 0xa2672e3d
mov word [0x434f6c], ax
and dword [edx], 0
xor dword [0x43c2cc], 0x38d57135
and dword [edx + 4], 0
mov eax, dword [0x438e0c]
xor eax, 0xbab7be49
add dword [0x43a3a0], eax
inc dword [0x438e0c]
mov dword [edx + 8], 0x67452301
imul eax, dword [0x43ada0], 0x7521e0f9
mov dword [0x43ada0], eax
mov dword [edx + 0xc], 0xefcdab89
add dword [0x43b9b4], 0x7c1d3904
mov dword [edx + 0x10], 0x98badcfe
dec word [0x4332ec]
mov ax, word [0x4332ec]
cwde
cmp eax, 0xe14f20de
jne 0x4033cb
mov ecx, dword [0x43d3dc]
movzx eax, word [0x4356bc]
xor ecx, 0xe938ef4
or eax, ecx
mov word [0x4356bc], ax
jmp 0x4033d5
xor dword [0x437098], 0x9a1fcccd
mov dword [edx + 0x14], 0x10325476
movsx eax, word [0x4342b4]
mov ecx, dword [0x4370ec]
add eax, 0x4a883ebe
and ecx, eax
and ecx, 0xdbf3cdf0
mov dword [0x4370ec], ecx
ret

Function at 0x409f98
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [0x436228]
sub eax, 0x4e9bddff
mov word [0x436228], ax
movsx ecx, word [0x4335a2]
movzx eax, word [0x4345b4]
add ecx, 0x25c5ba3a
push ebx
or ecx, 0x945a5b53
push edi
push dword [ebp + 8]
and eax, ecx
mov word [0x4345b4], ax
call fcn.0040102b
movsx edx, word [0x434b1c]
mov edi, eax
mov ebx, dword [ebp + 0x10]
shl edx, 5
add edx, 0x4457e2ac
pop ecx
movzx ecx, word [0x4364e2]
and edx, 0xdcc274bc
xor ecx, edx
mov word [0x4364e2], cx
cmp ebx, edi
jge 0x40a00e
push 0xfffffffffffffff8
pop eax
jmp 0x40a080
movzx eax, word [0x4337e8]
push esi
push ebx
xor esi, esi
add eax, 0x5441043a
push esi
push dword [ebp + 0xc]
mov word [0x4337e8], ax
call fcn.00416be2
add dword [0x436d08], 0x2bcad60f
add esp, 0xc
test edi, edi
jle 0x40a073
dec ebx
add ebx, dword [ebp + 0xc]
mov eax, esi
mov ecx, esi
cdq
and edx, 3
add edx, eax
mov eax, dword [ebp + 8]
sar edx, 2
mov eax, dword [eax + 8]
and ecx, 0x80000003
jns 0x40a062
dec ecx
or ecx, 0xfffffffc
inc ecx
mov eax, dword [eax + edx*4]
shl ecx, 3
shr eax, cl
inc esi
dec edi
mov byte [ebx], al
dec ebx
test edi, edi
jg 0x40a042
add dword [0x4388f4], 0xabaa851d
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
xor dword [0x43d1e0], 0xf597f3f3
add dword [0x43be80], 0x96c5b174
xor dword [0x43ce0c], 0xdffd8eed
cmp dword [ebp + 8], 0
je 0x40d941
lea edx, [ebp + 8]
movzx eax, word [0x435d58]
sub eax, 0x6ea74c50
mov word [0x435d58], ax
mov eax, dword [ebp + 8]
mov dword [eax], 1
mov ecx, dword [0x43df68]
movzx eax, word [0x435e3c]
xor ecx, 0x19caca8
sub eax, ecx
mov word [0x435e3c], ax
mov eax, dword [ebp + 8]
and dword [eax + 4], 0
dec dword [0x439c48]
mov eax, dword [0x439c48]
cmp eax, 0xb2c2fa82
jl 0x40d90f
mov ax, word [0x4365e0]
mov ecx, dword [0x43d978]
cwde
add ecx, eax
movzx eax, word [0x435338]
and ecx, 0xf932372a
imul eax, ecx
mov word [0x435338], ax
dec word [0x4365e0]
dec dword [0x43d978]
mov eax, dword [ebp + 8]
add edx, 4
and dword [eax + 8], 0
or dword [0x439a24], 0xe5c1d83a
mov eax, dword [edx]
mov dword [ebp + 8], eax
imul eax, dword [0x437608], 0x2d380006
cmp dword [ebp + 8], 0
mov dword [0x437608], eax
jne 0x40d88e
movzx eax, word [0x43584a]
sub eax, 0xe832a2f
mov word [0x43584a], ax
mov ax, word [0x4339c6]
movzx ecx, word [0x433e66]
cwde
and ecx, eax
mov word [0x4339c6], cx
pop ebp
ret
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x201237fa
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
mov ecx, 0x18f00077
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401580
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
sub esp, 4
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileW
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x4015bf
mov dword [ebp - 8], 0
jmp 0x401651
sub esp, 8
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp + 0xc]
push dword [eax]
call sub.KERNEL32.dll_CreateFileMappingW
add esp, 8
mov edx, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jne 0x401601
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push dword [eax]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
mov dword [ebp - 8], 0
jmp 0x401651
sub esp, 0xc
push 0
push 0
push 0
push 4
mov eax, dword [ebp + 0x10]
push dword [eax]
call sub.KERNEL32.dll_MapViewOfFile
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40164b
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push dword [eax]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push dword [eax]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
mov dword [ebp - 8], 0
jmp 0x401651
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
leave
ret
Function at 0x401960
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
sub esp, 8
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004018a2
add esp, 0x10
test eax, eax
jne 0x401984
mov dword [ebp - 8], 0
jmp 0x40199f
push 0x40
push 0x3000
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
leave
ret

Function at 0x4019a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
cmp dword [ebp + 0xc], 0
je 0x4019b8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [edx], eax
cmp dword [ebp + 0x10], 0
je 0x401a0f
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp dword [eax], 0x4550
jne 0x4019e5
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
jne 0x4019e5
jmp 0x4019ee
mov dword [ebp - 4], 0
jmp 0x401a16
cmp dword [ebp + 0x14], 0
je 0x401a0f
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ax, word [eax + 0x14]
and eax, 0xffff
add eax, dword [edx]
add eax, 0x18
mov dword [ecx], eax
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
leave
ret

Function at 0x401b1c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret

Function at 0x40247e
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
sub esp, 4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c78
add esp, 0x10
mov dword [ebp - 4], eax
sub esp, 0xc
push 0x8007
call sub.KERNEL32.dll_SetErrorMode
add esp, 0xc
cmp dword [ebp - 4], 0
jns 0x4024b9
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x4024dc
sub esp, 8
sub esp, 8
mov eax, dword [ebp - 4]
call eax
add esp, 8
push eax
sub esp, 4
call sub.KERNEL32.dll_GetCurrentThread
add esp, 4
push eax
call sub.KERNEL32.dll_TerminateThread
add esp, 8
mov eax, dword [ebp - 8]
leave
ret
Function at 0x404960
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x54
and esp, 0xfffffff0
call fcn.00405a60
call fcn.00404b20
call sub.KERNEL32.dll_GetCommandLineA
sub esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x58]
push eax
call sub.KERNEL32.dll_GetStartupInfoA
add esp, 0xc
test ebx, ebx
jne 0x404999
jmp 0x404a23
inc ebx
mov cl, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x404998
cmp cl, 0x22
je 0x4049e5
cmp cl, 0x20
setne dl
cmp cl, 9
setne al
and eax, 0xff
test edx, eax
je 0x404a01
test cl, cl
je 0x404a01
inc ebx
mov cl, byte [ebx]
cmp cl, 0x20
setne dl
cmp cl, 9
setne al
and eax, 0xff
test edx, eax
jne 0x4049c7
jmp 0x404a01
inc ebx
mov cl, byte [ebx]
cmp cl, 0x22
setne dl
test cl, cl
setne al
and eax, 0xff
test edx, eax
jne 0x4049e5
cmp cl, 0x22
je 0x404a4c
cmp cl, 0x20
sete dl
cmp cl, 9
jmp 0x404a1a
inc ebx
mov al, byte [ebx]
cmp al, 0x20
sete dl
cmp al, 9
sete al
or eax, edx
test al, 1
jne 0x404a10
mov eax, 0xa
test byte [ebp - 0x2c], 1
je 0x404a36
mov eax, dword [ebp - 0x28]
and eax, 0xffff
push eax
push ebx
push 0
push 0
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call fcn.004024f6
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
mov cl, byte [ebx]
jmp 0x404a01

Function at 0x404e50
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
mov ebx, dword [0x4110e0]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x404e90
mov dword [ebx + 0x30], eax
push edx
push edx
push 0
mov eax, dword [ebx + 0x30]
push eax
call fcn.00405df0
add esp, 0x10
test eax, eax
sete al
and eax, 0xff
mov dword [ebx + 0x2c], eax
mov ebx, dword [ebp - 4]
leave
ret
call fcn.00405d60
test eax, eax
sete al
and eax, 0xff
mov dword [ebx + 0x2c], eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4051a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [0x4110e0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x405262
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x405277
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x40523d
mov eax, dword [eax + 0x28]
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
jmp 0x4051e8
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov edx, 5
test eax, eax
je 0x4051f8
mov ecx, dword [eax + 0x18]
xor dl, dl
cmp edx, 5
je 0x405230
test edx, edx
jne 0x405223
test ecx, ecx
je 0x4051e0
push eax
push eax
push ebx
push edi
mov eax, dword [edi + 4]
push eax
mov esi, dword [edi]
push esi
push 1
push 1
call ecx
add esp, 0x20
cmp eax, 6
je 0x405286
cmp eax, 8
je 0x4051e0
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x30]
call fcn.00405d60
sub esp, 0xc
mov esi, eax
push ebx
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
push esi
call sub.KERNEL32.dll_SetLastError
mov eax, ebx
add esp, 0xc
jmp 0x4051ce
call fcn.00404bd0
mov eax, dword [0x4110e0]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jns 0x4051c4
call fcn.00404eb0
mov eax, dword [0x4110e0]
jmp 0x4051c4
mov eax, dword [ebp - 0x14]
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov edx, ebx
mov eax, edi
call fcn.00405120
cmp eax, 7
jne 0x405228
mov eax, dword [0x4110e0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x4052d5
mov edx, dword [eax + 0x2c]
test edx, edx
js 0x4052fa
mov edi, dword [eax + 0x2c]
test edi, edi
jne 0x4052e1
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.00404bd0
mov eax, dword [0x4110e0]
jmp 0x4052b3
push esi
push esi
push ebx
mov ebx, dword [eax + 0x30]
push ebx
call sub.KERNEL32.dll_TlsSetValue
pop edx
test eax, eax
pop ecx
jne 0x4052c4
call fcn.00405d60
jmp 0x4052c4
call fcn.00404eb0
mov eax, dword [0x4110e0]
jmp 0x4052ba
Function at 0x405500
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [0x4110e0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x405590
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x4055a5
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x4055c0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x405584
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00405120
cmp eax, 7
jne 0x40562f
mov eax, dword [0x4110e0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x405605
mov esi, dword [eax + 0x2c]
test esi, esi
js 0x405620
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jne 0x4055e5
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00405310
jmp 0x405545
call fcn.00404bd0
mov eax, dword [0x4110e0]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jns 0x405520
call fcn.00404eb0
mov eax, dword [0x4110e0]
mov edx, dword [eax + 0x2c]
test edx, edx
je 0x40552b
lea esi, [esi]
mov ebx, dword [eax + 0x30]
call fcn.00405d60
sub esp, 0xc
mov esi, eax
push ebx
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
push esi
call sub.KERNEL32.dll_SetLastError
mov eax, ebx
add esp, 0xc
jmp 0x40552e
push edx
push edx
push ebx
mov edi, dword [eax + 0x30]
push edi
call sub.KERNEL32.dll_TlsSetValue
pop ebx
test eax, eax
pop esi
jne 0x405573
call fcn.00405d60
jmp 0x405573
call fcn.00404bd0
mov eax, dword [0x4110e0]
mov esi, dword [eax + 0x2c]
test esi, esi
jns 0x405569
lea esi, [esi]
call fcn.00404eb0
mov eax, dword [0x4110e0]
jmp 0x405569
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x405640
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0xc]
test ebx, ebx
je 0x4056d0
mov eax, dword [0x4110e0]
test eax, eax
je 0x4056c0
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x40572f
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x4056e1
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00405310
cmp eax, 7
jne 0x40574d
mov eax, dword [0x4110e0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x405720
mov esi, dword [eax + 0x2c]
test esi, esi
js 0x40573e
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jne 0x405706
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.00404bd0
mov eax, dword [0x4110e0]
jmp 0x40565c
sub esp, 0xc
push edi
call fcn.004051a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x30]
call fcn.00405d60
sub esp, 0xc
mov esi, eax
push ebx
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
push esi
call sub.KERNEL32.dll_SetLastError
mov eax, ebx
add esp, 0xc
jmp 0x405671
push edx
push edx
push ebx
mov edi, dword [eax + 0x30]
push edi
call sub.KERNEL32.dll_TlsSetValue
pop ebx
test eax, eax
pop esi
jne 0x4056af
call fcn.00405d60
jmp 0x4056af
call fcn.00404bd0
mov eax, dword [0x4110e0]
jmp 0x40569a
call fcn.00404eb0
mov eax, dword [0x4110e0]
jmp 0x405667
call fcn.00404eb0
mov eax, dword [0x4110e0]
jmp 0x4056a5
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x4058e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push eax
push eax
call sub.KERNEL32.dll_TlsAlloc
mov edx, eax
cmp eax, 0xffffffff
je 0x405907
mov eax, dword [ebp + 8]
mov dword [eax], edx
push eax
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push edx
call fcn.00405df0
add esp, 0x10
leave
ret
call fcn.00405d60
leave
ret