joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a4d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5c8a30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
movzx edx, byte [eax + 8]
mov edi, ecx
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
mov ebx, dword [ebp + 8]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x42a552
cmp ecx, eax
jne 0x42a54a
mov eax, dword [edi + 4]
mov dword [edx], eax
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 4]
mov dword [esi + ecx + 4], eax
jmp 0x42a55a
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
jmp 0x42a55a
cmp ecx, eax
jne 0x42a55d
mov ecx, dword [eax]
mov dword [edx], ecx
mov eax, dword [ebp + 0xc]
push eax
push ebx
lea ecx, [edi + 4]
call fcn.0042a750
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441ed9
mov esp, ebp
pop ebp
ret 8
Function at 0x42a580
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c8a30]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov edx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], edx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0xc], ecx
and eax, dword [edx + 0x18]
mov edx, dword [edx + 4]
lea ebx, [eax*8]
add eax, eax
mov esi, dword [ebx + ecx]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ecx + eax*4]
lea ecx, [ecx + eax*4]
mov dword [ebp - 0x18], ebx
cmp ebx, edx
jne 0x42a5f9
mov eax, edx
jmp 0x42a5fe
mov eax, dword [ecx + 4]
mov eax, dword [eax]
cmp esi, eax
je 0x42a646
mov ebx, dword [edi]
cmp dword [esi + 8], ebx
je 0x42a610
mov esi, dword [esi]
mov ebx, dword [ebp - 0x18]
jmp 0x42a5f1
mov ecx, esi
mov edi, esi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x18]
cmp edi, edx
jne 0x42a628
mov eax, edx
jmp 0x42a631
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + ecx + 4]
mov eax, dword [eax]
cmp esi, eax
je 0x42a63e
cmp ebx, dword [esi + 8]
jne 0x42a63e
mov esi, dword [esi]
jmp 0x42a620
mov edi, dword [ebp - 0x14]
cmp dword [ebp - 0x10], esi
jne 0x42a64a
mov edi, edx
mov esi, edx
mov eax, edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
cmp eax, esi
je 0x42a65f
mov eax, dword [eax]
inc ebx
cmp eax, esi
jne 0x42a655
mov dword [ebp - 0xc], ebx
cmp edi, dword [edx]
jne 0x42a684
cmp esi, edx
jne 0x42a684
mov ecx, dword [ebp - 8]
call fcn.0042a3a0
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441ed9
mov esp, ebp
pop ebp
ret 4
cmp edi, esi
je 0x42a66f
nop dword [eax + eax]
movzx ecx, byte [edi + 8]
mov ebx, edi
xor ecx, 0x811c9dc5
mov dword [ebp - 0x10], edi
imul edx, ecx, 0x1000193
mov eax, edi
mov dword [ebp - 0x14], edi
movzx ecx, byte [ebx + 9]
mov edi, dword [edi]
xor edx, ecx
mov ecx, eax
imul edx, edx, 0x1000193
movzx ecx, byte [ecx + 0xa]
xor edx, ecx
mov ecx, eax
imul edx, edx, 0x1000193
movzx ecx, byte [ecx + 0xb]
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [ebp - 8]
and ecx, dword [edx + 0x18]
mov edx, dword [edx + 0xc]
lea ebx, [ecx*8]
mov ecx, dword [edx + ebx]
add edx, ebx
cmp dword [edx + 4], eax
jne 0x42a711
cmp ecx, eax
jne 0x42a709
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 4]
mov dword [edx], ecx
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
mov ecx, dword [ecx + 4]
mov dword [ebx + edx + 4], ecx
jmp 0x42a717
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x42a717
cmp ecx, eax
jne 0x42a717
mov dword [edx], edi
mov ecx, dword [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ecx + 4]
call fcn.0042a750
cmp edi, esi
jne 0x42a690
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00441ed9
mov esp, ebp
pop ebp
ret 4
Function at 0x42b300
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57d65c
mov eax, dword fs:[0]
push eax
sub esp, 0x300
mov eax, dword [0x5c8a30]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x220], edi
push 0x208
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x224], edi
push 0
push eax
mov dword [ebp - 0x228], 0
call fcn.00546c00
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [ebp + 8]
test esi, esi
js 0x42b392
nop word [eax + eax]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
sub esi, 1
jns 0x42b380
push 0x58b1f4
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push eax
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, 1
push 0xfde9
lea eax, [ebp - 0x21c]
cmove esi, ecx
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.0043b800
add esp, 0xc
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 1
jb 0x42b3eb
mov eax, dword [eax]
push eax
mov ecx, edi
call fcn.0048a370
mov edx, dword [ebp - 0x260]
mov byte [ebp - 4], 0
cmp edx, 0x10
jb 0x42b431
mov ecx, dword [ebp - 0x274]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b427
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42b678
push edx
push ecx
call fcn.00441c23
add esp, 8
test esi, esi
je 0x42b449
push str.CREATE_TABLE_IF_NOT_EXISTS_BatteryHistoryInfo__id_INTEGER_PRIMARY_KEY__life_percent_INTEGER__utc_time_INTEGER__ac_status_INTEGER_
mov ecx, edi
call fcn.0042b7c0
test eax, eax
js 0x42b523
mov ecx, edi
call fcn.0042b060
push 0xfde9
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.0043b800
mov esi, dword [ebp - 0x220]
mov edi, eax
add esi, 0xc
add esp, 0xc
cmp esi, edi
je 0x42b4df
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x42b4ad
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x42b4a3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42b678
mov eax, edx
push ecx
push eax
call fcn.00441c23
add esp, 8
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
movups xmm0, xmmword [edi]
movups xmmword [esi], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov edx, dword [ebp - 0x260]
cmp edx, 0x10
jb 0x42b519
mov ecx, dword [ebp - 0x274]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b50f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42b67d
push edx
push ecx
call fcn.00441c23
add esp, 8
mov eax, 1
jmp 0x42b65a
xor eax, eax
jmp 0x42b65a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00441ed9
mov esp, ebp
pop ebp
ret 4
call fcn.0054a27c
call fcn.0054a27c
int3
Function at 0x42c630
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x74], 0
je 0x42c646
mov eax, 1
pop esi
pop ebp
ret 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x42c6b1
call fcn.0042c5c0
cmp dword [eax + 0x30], 0
jne 0x42c66a
call fcn.0042c5c0
mov dword [eax + 0x30], 0
call fcn.0042c5c0
push dword [ebp + 8]
lea ecx, [esi + 0x20]
push ecx
push eax
push 0x5c7028
push 0x5d31ac
call fcn.004218a0
add esp, 0x14
movzx eax, ax
mov ecx, esi
push 0
push eax
push 0
push 0
push 0x56000000
push 0
push 0
push dword [ebp + 8]
call fcn.0042c4c0
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
neg eax
sbb eax, eax
neg eax
mov dword [esi + 0x74], eax
pop esi
pop ebp
ret 4
Function at 0x43d710
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ed98
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5c8a30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00441bf3
mov edi, eax
add esp, 4
test edi, edi
je 0x43d7b4
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00435abc
add esp, 4
mov dword [edi + 4], eax
jmp 0x43d7b6
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.0041b540
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x43d817
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x43d817
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x43d83a
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x43d85d
cmp byte [ebp + 0xc], 0
je 0x43d849
push esi
call fcn.0043601d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x43d869
mov esi, str.ios_base::badbit_set
jmp 0x43d879
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.0040bd20
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.00405130
push 0x5b6018
lea eax, [ebp - 0x30]
push eax
call fcn.00545cdd
int3
Function at 0x43ec70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ef2f
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5c8a30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.00407a70
mov ecx, eax
test ecx, ecx
je 0x43ee24
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.00407a70
mov ecx, eax
test ecx, ecx
je 0x43ee2e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.00407a70
mov ecx, eax
test ecx, ecx
je 0x43ee38
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 4
mov dword [esi + 0x10], eax
test edx, edx
jne 0x43ed48
xor ecx, ecx
jmp 0x43ed60
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43ed50
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00409260
push edi
mov ecx, ebx
call fcn.0040f8c0
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x43ed7c
xor ecx, ecx
jmp 0x43ed94
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43ed84
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.00409260
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.0043fba0
push eax
mov ecx, ebx
mov byte [ebp - 4], 5
call fcn.0040f8c0
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43edd5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x43ee0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x43ee0e
cmp dword [esi + 0x10], 0
je 0x43ee05
push dword [edi]
call fcn.00559d6a
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.004068d0
push 0x80004005
call fcn.004068d0
push 0x80004005
call fcn.004068d0
int3
Function at 0x43f9a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f018
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5c8a30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
je 0x43fb01
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.__set_log_lev0
push edi
call ebx
test eax, eax
je 0x43f9f8
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 4]
jmp 0x43fb01
push str.__set_log_lev1
push edi
call ebx
test eax, eax
je 0x43fa12
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
jmp 0x43fb01
push str.__set_log_lev2
push edi
call ebx
test eax, eax
je 0x43fa2c
mov eax, dword [esi]
mov ecx, esi
push 2
call dword [eax + 4]
jmp 0x43fb01
push str.__set_log_lev3
push edi
call ebx
test eax, eax
je 0x43fa46
mov eax, dword [esi]
mov ecx, esi
push 3
call dword [eax + 4]
jmp 0x43fb01
push str.__reload_log_switch
push edi
call ebx
test eax, eax
je 0x43fb01
push 3
mov ecx, esi
call fcn.0043f960
lea eax, [esi + 0x14]
push eax
lea ecx, [ebp - 0x28]
call fcn.00404780
push 0x590a58
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00441400
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43fa9e
push 0
mov ecx, esi
call fcn.0043f960
lea eax, [esi + 0x2c]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x43faaf
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x44], 0
mov byte [ebp - 4], 1
je 0x43faf1
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x43faf1
mov eax, dword [ecx]
push 1
mov eax, dword [eax + 4]
call eax
test al, al
je 0x43faf1
push str._______log_reload_switch
lea ecx, [ebp - 0x44]
call fcn.0040ee50
mov ecx, dword [esi + 0x44]
lea edx, [ebp - 0x44]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x44]
call fcn.00405550
lea ecx, [ebp - 0x2c]
call fcn.0043ef70
lea ecx, [ebp - 0x28]
call fcn.00405550
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00441ed9
mov esp, ebp
pop ebp
ret 4
Function at 0x441880
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f35b
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x5c8a30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov edx, dword [edi]
mov eax, dword [ebp + 8]
push eax
call dword [edx]
cmp byte [edi + 0xc], 0
je 0x4419b6
mov ebx, dword [edi + 0x14]
lea esi, [edi + 0x20]
push 0x180
push 0x40
push 0x8109
push ebx
push esi
call fcn.0055a6c8
add esp, 0x14
mov dword [ebp - 0xac], eax
test eax, eax
je 0x441996
push 0x98
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.00546c00
add esp, 0xc
lea ecx, [ebp - 0xa8]
push 1
push 2
call fcn.0040eb40
push 0x5907cc
push dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
mov dword [ebp - 4], 0
push str._error.__
push ebx
push str.open
push eax
call fcn.00414630
add esp, 8
push eax
call fcn.00414630
add esp, 8
push eax
call fcn.00414630
add esp, 8
mov ecx, eax
call fcn.00405e30
push eax
call fcn.00414630
add esp, 8
lea eax, [ebp - 0xd8]
lea ecx, [ebp - 0xa8]
push eax
call fcn.004417c0
cmp dword [eax + 0x14], 8
jb 0x441979
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0xd8]
call fcn.00405550
lea ecx, [ebp - 0xa8]
call fcn.00406290
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4419ac
push 2
push 0
push eax
call fcn.0055acbb
add esp, 0xc
jmp 0x4419af
or eax, 0xffffffff
mov dword [edi + 8], eax
mov byte [edi + 0xc], 0
mov eax, dword [edi + 4]
mov dword [ebp - 0xc0], eax
test eax, eax
je 0x441ad4
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor bl, bl
push 0
push eax
call esi
test eax, eax
movzx edx, bl
mov ecx, 1
cmove edx, ecx
mov dword [ebp - 0xac], edx
test dl, dl
jne 0x441a09
cmp dword [ebp + 0xc], 0
je 0x441a01
push 0xffffffffffffffff
push dword [edi + 4]
call esi
mov byte [ebp - 0xac], 1
jmp 0x441a09
test dl, dl
je 0x441ad4
lea ecx, [edi + 0x24]
mov dword [ebp - 0xb8], 0
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 0
cmp eax, ecx
je 0x441aad
mov esi, dword [ecx]
mov dword [ecx], 0
mov edx, dword [ecx + 4]
mov dword [ecx + 4], 0
mov eax, dword [ecx + 8]
mov dword [ebp - 0xb8], esi
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0xb0], eax
mov dword [ecx + 8], 0
cmp esi, edx
je 0x441aad
nop dword [eax]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x441a7a
mov ecx, dword [esi]
mov eax, dword [edi + 0x20]
cmp eax, 0xffffffff
je 0x441a99
push dword [esi + 0x10]
push ecx
push eax
call fcn.0055b550
mov edx, dword [ebp - 0xbc]
add esp, 0xc
mov ecx, eax
jmp 0x441a9c
or ecx, 0xffffffff
mov ebx, dword [edi + 8]
add esi, 0x18
add ebx, ecx
mov dword [edi + 8], ebx
cmp esi, edx
jne 0x441a70
jmp 0x441ab0
mov ebx, dword [edi + 8]
lea ecx, [ebp - 0xb8]
call fcn.0043eed0
cmp byte [ebp - 0xac], 0
je 0x441ad0
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
jmp 0x441ad7
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00441ed9
mov esp, ebp
pop ebp
ret 8
Function at 0x443230
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x5c8a30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x443253
test eax, eax
jne 0x443308
mov eax, dword [0x5c8c44]
cmp eax, 0xffffffff
je 0x443308
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x443307
mov eax, dword [0x5c8c44]
mov ecx, 0x100
push esi
push edi
mov esi, ebx
mov dword [ebp - 0x408], eax
lea edi, [ebp - 0x404]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x404]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.00441f1e
add esp, 4
mov edi, 0x100
nop dword [eax + eax]
mov esi, dword [0x5d4540]
xor dl, dl
test esi, esi
jle 0x4432ee
nop dword [eax]
mov ecx, dword [ebp + esi*4 - 0x404]
test ecx, ecx
je 0x4432e9
mov eax, dword [esi*4 + 0x5d4548]
test eax, eax
je 0x4432e9
push ecx
mov dword [ebp + esi*4 - 0x404], 0
call eax
add esp, 4
mov dl, 1
dec esi
test esi, esi
jg 0x4432c0
dec edi
test edi, edi
jle 0x4432f7
test dl, dl
jne 0x4432b0
push 0
push dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441ed9
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44a070
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57fbea
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5c8a30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [edi], vtable.base::MessageLoop.0
mov dword [ebp + 8], 0
mov dword [ebp - 0x14], 0
mov dword [edi + 4], eax
lea esi, [edi + 0xc]
mov dword [edi + 8], 2
push 8
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.00441bf3
mov dword [esi], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
push 8
mov byte [ebp - 4], 4
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.00441bf3
mov dword [esi], eax
add esp, 8
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov word [edi + 0x64], 1
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0xf
mov byte [edi + 0x68], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa8], 0
mov dword [edi + 0xac], 0
mov ecx, edi
mov dword [ebp - 4], 0xb
call fcn.00457f70
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x44a244
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4