joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413c70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
mov eax, dword [section..data]
test eax, eax
je 0x413d3d
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x413c9d
mov ecx, dword [eax]
xor esi, esi
or ecx, dword [eax + 4]
cmovne esi, eax
jne 0x413d78
mov eax, dword [section..data]
test eax, eax
je 0x413d5c
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x413d76
mov esi, eax
test eax, eax
jne 0x413d1f
movzx eax, byte [0x463514]
mov eax, dword [0x4634c8]
test eax, eax
jne 0x413ce4
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x413d8a
mov dword [0x4634c8], eax
push 0x10
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x413d8a
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x463000
mov esi, eax
mov eax, dword [section..data]
test eax, eax
je 0x413d7e
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
call fcn.00440bd0
mov edi, dword [eax + 8]
mov ebx, dword [eax + 0xc]
lock dec dword [eax]
jne 0x413d36
mov ecx, eax
call fcn.00413da0
mov dword [esi], edi
mov dword [esi + 4], ebx
jmp 0x413d78
mov ecx, section..data
call fcn.004558c0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x413c8d
jmp 0x413c9d
mov ecx, section..data
call fcn.004558c0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x413cbb
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
ret
mov ecx, section..data
call fcn.004558c0
jmp 0x413d17
mov ecx, 8
mov edx, 0x10
call fcn.004537a0
ud2
Function at 0x413e20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x463010]
test eax, eax
je 0x413e4c
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x413e62
mov edi, eax
mov eax, dword [eax + 4]
add edi, 8
test eax, eax
cmove edi, eax
je 0x413e62
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x463010
call fcn.004558c0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x413e38
mov eax, dword [0x463010]
test eax, eax
je 0x413ed6
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor edi, edi
cmp eax, 1
je 0x413e47
mov esi, eax
test eax, eax
jne 0x413eeb
movzx eax, byte [0x463514]
mov eax, dword [0x4634c8]
test eax, eax
jne 0x413ea3
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x413f25
mov dword [0x4634c8], eax
push 0xc
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x413f25
mov dword [eax], 0x463010
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x463010]
test eax, eax
jne 0x413ee2
mov ecx, 0x463010
call fcn.004558c0
jmp 0x413ee3
mov ecx, 0x463010
call fcn.004558c0
jmp 0x413e6c
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
call fcn.00453ec0
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x413e47
test ecx, ecx
je 0x413e47
lock dec dword [ecx]
jne 0x413e47
call fcn.00432510
mov eax, edi
pop esi
pop edi
ret
mov ecx, 4
mov edx, 0xc
call fcn.004537a0
ud2
Function at 0x424a50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [edx + 0x1008]
mov al, 4
test ebx, ebx
je 0x424b56
mov eax, dword [edx + 4]
mov dword [esp + 0xc], ebx
mov esi, dword [edx]
mov edi, edx
mov dword [esp + 8], ecx
lea ecx, [esp + 0xc]
mov ebp, dword [eax + 0x1c]
mov eax, esp
push 4
push ecx
push esi
push eax
call ebp
add esp, 0x10
movzx eax, byte [esp]
cmp al, 4
jne 0x424b44
mov eax, ebx
not eax
mov dword [esp + 0xc], eax
push 4
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x1c], esi
push esi
lea eax, [esp + 0xc]
push eax
call ebp
add esp, 0x10
movzx eax, byte [esp]
cmp al, 4
jne 0x424b44
cmp ebx, 0x1001
mov dword [esp + 0x10], ebp
jae 0x424b60
lea ebp, [edi + 8]
xor ecx, ecx
mov eax, 0xffffffff
lea esi, [esp + 0xc]
nop dword [eax]
movzx edx, byte [ebp + ecx]
inc ecx
xor dl, al
shr eax, 8
movzx edx, dl
xor eax, dword [edx*4 + 0x45a98c]
cmp ebx, ecx
jne 0x424ae0
not eax
mov dword [esp + 0xc], eax
push 4
push esi
mov esi, dword [esp + 0x1c]
push esi
lea eax, [esp + 0xc]
push eax
call dword [esp + 0x20]
add esp, 0x10
movzx eax, byte [esp]
cmp al, 4
jne 0x424b44
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push eax
call dword [esp + 0x20]
add esp, 0x10
movzx eax, byte [esp]
cmp al, 4
jne 0x424b44
mov ecx, dword [esp + 8]
mov dword [edi + 0x1008], 0
mov al, 4
jmp 0x424b56
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
mov esi, dword [esp + 1]
mov dword [ecx + 4], edx
mov dword [ecx + 1], esi
mov byte [ecx], al
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, ebx
mov edx, 0x1000
push 0x45adac
call fcn.004539d0
add esp, 4
ud2
Function at 0x43d0e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4524d0
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
cmp eax, 3
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
je 0x43d11e
test eax, eax
jne 0x43d29a
mov ebx, dword [0x4634cc]
test ebx, ebx
je 0x43d29a
mov dword [ebp - 0x20], 0
jmp 0x43d147
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x43d178
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x43d2eb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x43d140
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x43d140
test byte [ebp - 0x20], 1
je 0x43d29a
mov ebx, dword [0x4634cc]
test ebx, ebx
je 0x43d29a
mov dword [ebp - 0x20], 0
jmp 0x43d1a7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x43d1d8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x43d2eb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x43d1a0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x43d1a0
test byte [ebp - 0x20], 1
je 0x43d29a
mov ebx, dword [0x4634cc]
test ebx, ebx
je 0x43d29a
mov dword [ebp - 0x20], 0
jmp 0x43d207
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x43d238
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x43d2eb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x43d200
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x43d200
test byte [ebp - 0x20], 1
je 0x43d29a
mov ebx, dword [0x4634cc]
test ebx, ebx
je 0x43d29a
mov dword [ebp - 0x20], 0
jmp 0x43d267
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x43d294
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x43d2eb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x43d260
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x43d260
test byte [ebp - 0x20], 1
jne 0x43d2b4
movzx eax, byte [0x45f480]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x4634cc]
jmp 0x43d2bf
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x43d29a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x43d2eb
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x43d2bc
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x43d2bc
mov dword [ebp - 0x10], 0
mov ecx, str.called__Option::unwrap____on_a__None__value
mov edx, 0x2b
push 0x45e420
call fcn.00453a40
add esp, 4
ud2
Function at 0x43dab0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x463074]
test eax, eax
je 0x43dad8
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x43daee
cmp dword [eax + 4], 0
mov edi, eax
je 0x43daee
add edi, 8
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x463074
call fcn.004558c0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x43dac8
mov eax, dword [0x463074]
test eax, eax
je 0x43dba9
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x43dbc3
mov esi, eax
test eax, eax
jne 0x43db69
movzx eax, byte [0x463514]
mov eax, dword [0x4634c8]
test eax, eax
jne 0x43db35
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x43dbd6
mov dword [0x4634c8], eax
push 0x10
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x43dbd6
mov dword [eax], 0x463074
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x463074]
test eax, eax
je 0x43dbca
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 0xc]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
je 0x43dad3
test ecx, ecx
je 0x43dad3
lock dec dword [ecx]
jne 0x43dad3
call fcn.00413da0
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x463074
call fcn.004558c0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x43db0c
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x463074
call fcn.004558c0
jmp 0x43db61
mov ecx, 4
mov edx, 0x10
call fcn.004537a0
ud2

Function at 0x43e950
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x463084]
test eax, eax
je 0x43e9f4
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x43e973
cmp byte [eax + 4], 0
mov esi, eax
jne 0x43e9ed
mov eax, dword [0x463084]
test eax, eax
je 0x43ea13
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x43ea2d
mov esi, eax
test eax, eax
jne 0x43e9e7
movzx eax, byte [0x463514]
mov eax, dword [0x4634c8]
test eax, eax
jne 0x43e9ba
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x43ea3f
mov dword [0x4634c8], eax
push 8
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x43ea3f
mov dword [eax], 0x463084
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x463084]
test eax, eax
je 0x43ea33
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
mov eax, esi
pop esi
ret
mov ecx, 0x463084
call fcn.004558c0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x43e96b
jmp 0x43e973
mov ecx, 0x463084
call fcn.004558c0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x43e991
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x463084
call fcn.004558c0
jmp 0x43e9df
mov ecx, 4
mov edx, 8
call fcn.004537a0
ud2
Function at 0x43f820
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x43f874
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x43f897
test eax, eax
js 0x43f883
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x43f88f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x45ded4
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0043d680
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0043d7e0
mov ecx, 7
int 0x29
ud2
Function at 0x43fda0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x463064]
test eax, eax
je 0x43fdc2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x43fdd8
cmp dword [eax + 4], 0
je 0x43fdd8
add eax, 8
pop esi
ret
mov ecx, 0x463064
call fcn.004558c0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x43fdb7
mov eax, dword [0x463064]
test eax, eax
je 0x43fe5e
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x43fe78
mov esi, eax
test eax, eax
jne 0x43fe47
movzx eax, byte [0x463514]
mov eax, dword [0x4634c8]
test eax, eax
jne 0x43fe17
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x43fe88
mov dword [0x4634c8], eax
push 0x10
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x43fe88
mov dword [eax], 0x463064
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x463064]
test eax, eax
je 0x43fe7c
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
mov ecx, 0x463064
call fcn.004558c0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x43fdf2
xor eax, eax
pop esi
ret
mov ecx, 0x463064
call fcn.004558c0
jmp 0x43fe3f
mov ecx, 4
mov edx, 0x10
call fcn.004537a0
ud2
Function at 0x4464d0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x44651d
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x44652d
mov dword [esi + 4], 0
jmp 0x44653f
cmp eax, 0x103
je 0x44655b
test eax, eax
js 0x446548
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x45ded4
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0043d680
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0043d7e0
mov ecx, 7
int 0x29
ud2
Function at 0x44a2d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x4630b4]
test eax, eax
je 0x44a2f8
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x44a30e
cmp dword [eax + 4], 0
mov edi, eax
je 0x44a30e
add edi, 8
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x4630b4
call fcn.004558c0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x44a2e8
mov eax, dword [0x4630b4]
test eax, eax
je 0x44a3c2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x44a3dc
mov esi, eax
test eax, eax
jne 0x44a389
movzx eax, byte [0x463514]
mov eax, dword [0x4634c8]
test eax, eax
jne 0x44a355
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x44a3ef
mov dword [0x4634c8], eax
push 0xc
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x44a3ef
mov dword [eax], 0x4630b4
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4630b4]
test eax, eax
je 0x44a3e3
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x44a2f3
test ecx, ecx
je 0x44a2f3
lock dec dword [ecx]
jne 0x44a2f3
call fcn.0044a400
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x4630b4
call fcn.004558c0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x44a32c
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x4630b4
call fcn.004558c0
jmp 0x44a381
mov ecx, 4
mov edx, 0xc
call fcn.004537a0
ud2
Function at 0x44b4f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x452820
mov esi, edx
mov edi, ecx
mov eax, dword fs:[0]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword fs:[0], eax
movzx eax, byte [0x463514]
mov eax, dword [0x4634c8]
test eax, eax
jne 0x44b543
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x44b5fe
mov dword [0x4634c8], eax
push 8
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x44b5fe
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
push 0
push 0x10000
push ebx
push 0x44b670
push esi
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x44b585
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x44b5ed
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], eax
push eax
mov dword [ebp - 0x24], ecx
call dword [ecx]
add esp, 4
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
cmp dword [eax + 4], 0
je 0x44b5d2
cmp dword [eax + 8], 9
jae 0x44b5bd
mov eax, dword [ebp - 0x20]
jmp 0x44b5c3
mov eax, dword [ebp - 0x20]
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x4634c8]
call dword [sym.imp.kernel32.dll_HeapFree]
push edi
push 0
push dword [0x4634c8]
call dword [sym.imp.kernel32.dll_HeapFree]
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 8
mov dword [ebp - 0x10], 0
call fcn.004537a0
ud2
Function at 0x44b7c0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x452840
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x44b83e
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
lea edx, [esi + 8]
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], 0x45e070
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x30]
mov edx, 0x45e09c
mov dword [esi + 0x2c], fcn.00444570
mov dword [esi + 0x3c], 1
call fcn.004538c0
ud2

Function at 0x44b920
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x463094]
test eax, eax
je 0x44b9c4
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x44b943
cmp byte [eax + 4], 0
mov esi, eax
jne 0x44b9bd
mov eax, dword [0x463094]
test eax, eax
je 0x44b9e3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x44b9fd
mov esi, eax
test eax, eax
jne 0x44b9b7
movzx eax, byte [0x463514]
mov eax, dword [0x4634c8]
test eax, eax
jne 0x44b98a
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x44ba0f
mov dword [0x4634c8], eax
push 8
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x44ba0f
mov dword [eax], 0x463094
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x463094]
test eax, eax
je 0x44ba03
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
mov eax, esi
pop esi
ret
mov ecx, 0x463094
call fcn.004558c0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x44b93b
jmp 0x44b943
mov ecx, 0x463094
call fcn.004558c0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x44b961
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x463094
call fcn.004558c0
jmp 0x44b9af
mov ecx, 4
mov edx, 8
call fcn.004537a0
ud2
Function at 0x450c60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x4630a4]
test eax, eax
je 0x450c88
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x450c9e
cmp dword [eax + 4], 0
mov edi, eax
je 0x450c9e
add edi, 8
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x4630a4
call fcn.004558c0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x450c78
mov eax, dword [0x4630a4]
test eax, eax
je 0x450d12
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor edi, edi
cmp eax, 1
je 0x450c83
mov esi, eax
test eax, eax
jne 0x450d27
movzx eax, byte [0x463514]
mov eax, dword [0x4634c8]
test eax, eax
jne 0x450cdf
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x450d61
mov dword [0x4634c8], eax
push 0xc
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x450d61
mov dword [eax], 0x4630a4
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4630a4]
test eax, eax
jne 0x450d1e
mov ecx, 0x4630a4
call fcn.004558c0
jmp 0x450d1f
mov ecx, 0x4630a4
call fcn.004558c0
jmp 0x450ca8
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
call fcn.00455df0
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x450c83
test ecx, ecx
je 0x450c83
lock dec dword [ecx]
jne 0x450c83
call fcn.00450d80
mov eax, edi
pop esi
pop edi
ret
mov ecx, 4
mov edx, 0xc
call fcn.004537a0
ud2