joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b580
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x4db02c]
mov edi, ecx
test esi, esi
je 0x48b622
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x48b61a
je 0x48b5c2
test edi, edi
je 0x48b5c6
mov ebx, dword [edi]
mov dword [edi], 0
mov eax, dword [edi + 8]
test ebx, ebx
cmove eax, ebx
cmovne ebx, dword [edi + 4]
mov dword [ebp - 0x10], eax
jmp 0x48b5cf
xor eax, eax
jmp 0x48b61a
mov dword [ebp - 0x10], 0
xor ebx, ebx
mov eax, dword [0x4fcc54]
movzx eax, byte [eax]
push 4
push 0xc
call fcn.004016e0
add esp, 8
test eax, eax
je 0x48b642
mov ecx, dword [ebp - 0x10]
mov dword [eax], ebx
mov byte [eax + 4], cl
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x48b617
push 4
push 0xc
push edi
call fcn.004016f0
add esp, 0xc
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4db02c
call fcn.00485490
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x48b5a3
jmp 0x48b61a
push 0xc
push 4
call fcn.004a8170
nop dword [eax + eax]

Function at 0x48b650
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [0x4db03c]
mov edi, ecx
test esi, esi
je 0x48b679
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x48b693
add eax, 4
jmp 0x48b703
push 0x4db03c
call fcn.00485490
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x48b671
je 0x48b6ad
xor ecx, ecx
test edi, edi
je 0x48b6b1
cmp byte [edi], 0
mov byte [edi], 0
movzx eax, byte [edi + 1]
cmove eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x48b6b8
xor eax, eax
jmp 0x48b703
mov dword [ebp - 0x14], 0
mov eax, dword [0x4fcc54]
movzx eax, byte [eax]
push 4
push 8
call fcn.004016e0
add esp, 8
test eax, eax
je 0x48b70b
mov ebx, eax
mov dword [eax], esi
add eax, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov byte [ebx + 4], al
push esi
call sub.kernel32.dll_TlsGetValue
mov edi, eax
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x48b700
push 4
push 8
push edi
call fcn.004016f0
add esp, 0xc
mov eax, dword [ebp - 0x10]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 8
push 4
call fcn.004a8170
nop word cs:[eax + eax]
nop
Function at 0x48b720
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [0x4db05c]
mov edi, ecx
test esi, esi
je 0x48b7c7
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x48b7bf
je 0x48b75c
test edi, edi
je 0x48b760
mov ebx, dword [edi]
mov dword [edi], 0
test ebx, ebx
je 0x48b762
mov ebx, dword [edi + 4]
jmp 0x48b762
xor eax, eax
jmp 0x48b7bf
xor ebx, ebx
mov eax, dword [0x4fcc54]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
movzx eax, byte [eax]
push 4
push 8
call fcn.004016e0
add esp, 8
test eax, eax
je 0x48b7e7
mov dword [eax], ebx
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x48b7bc
mov eax, dword [edi]
test eax, eax
je 0x48b7af
lock dec dword [eax]
jne 0x48b7af
mov ecx, edi
call fcn.00446c10
push 4
push 8
push edi
call fcn.004016f0
add esp, 0xc
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4db05c
call fcn.00485490
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x48b745
jmp 0x48b7bf
push 8
push 4
call fcn.004a8170
add esp, 8
ud2

Function at 0x48b810
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x4db07c]
mov edi, ecx
test esi, esi
je 0x48b8b6
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x48b8ae
je 0x48b85e
test edi, edi
je 0x48b862
mov eax, dword [edi]
xor ecx, ecx
mov ebx, 0
mov dword [edi], 0
or eax, dword [edi + 4]
mov dword [edi + 4], 0
je 0x48b85a
mov ecx, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov edi, ecx
jmp 0x48b866
xor eax, eax
jmp 0x48b8ae
xor ebx, ebx
xor edi, edi
mov eax, dword [0x4fcc54]
movzx eax, byte [eax]
push 8
push 0x10
call fcn.004016e0
add esp, 8
test eax, eax
je 0x48b8d6
mov dword [eax], ebx
mov dword [eax + 4], edi
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x48b8ab
push 8
push 0x10
push edi
call fcn.004016f0
add esp, 0xc
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4db07c
call fcn.00485490
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x48b833
jmp 0x48b8ae
push 0x10
push 8
call fcn.004a8170
nop
Function at 0x48b8e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [0x4db08c]
mov edi, ecx
test esi, esi
je 0x48b987
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x48b97f
je 0x48b91c
test edi, edi
je 0x48b920
mov ebx, dword [edi]
mov dword [edi], 0
test ebx, ebx
je 0x48b922
mov ebx, dword [edi + 4]
jmp 0x48b922
xor eax, eax
jmp 0x48b97f
xor ebx, ebx
mov eax, dword [0x4fcc54]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
movzx eax, byte [eax]
push 4
push 8
call fcn.004016e0
add esp, 8
test eax, eax
je 0x48b9a7
mov dword [eax], ebx
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x48b97c
mov eax, dword [edi]
test eax, eax
je 0x48b96f
lock dec dword [eax]
jne 0x48b96f
mov ecx, edi
call fcn.00446d20
push 4
push 8
push edi
call fcn.004016f0
add esp, 0xc
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4db08c
call fcn.00485490
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x48b905
jmp 0x48b97f
push 8
push 4
call fcn.004a8170
add esp, 8
ud2
Function at 0x4bbbf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x4bbc48
lea edi, [edx + eax*2]
xor ebx, ebx
movzx esi, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea eax, [ebx + esi]
jne 0x4bbc40
cmp eax, ebx
jb 0x4bbcb6
cmp eax, dword [ebp + 0x10]
ja 0x4bbcc2
add ebx, dword [ebp + 0xc]
nop word cs:[eax + eax]
nop
test esi, esi
je 0x4bbc42
dec esi
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x4bbc30
jmp 0x4bbc9f
ja 0x4bbc48
cmp edx, edi
mov ebx, eax
jne 0x4bbc02
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x4bbca3
mov esi, dword [ebp + 0x14]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x4bbc80
mov esi, edi
sub ecx, ebx
jns 0x4bbc97
jmp 0x4bbca5
cmp edi, edx
je 0x4bbcac
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x4bbca5
xor al, 1
cmp esi, edx
jne 0x4bbc60
jmp 0x4bbca5
xor eax, eax
jmp 0x4bbca5
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4f1734
call fcn.004b3870
push 0x4f1744
push eax
push ebx
call fcn.004b9490
push 0x4f1744
push dword [ebp + 0x10]
push eax
call fcn.004b9430
Function at 0x4cf7f0
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push edi
xor eax, eax
mov ecx, 0x10
sub esp, 0x88
lea edi, [esp + 0x40]
mov dword [esp + 0x15], 0x6f727245
mov dword [esp + 0x19], 0x6c632072
mov dword [esp + 0x1d], 0x696e6165
mov dword [esp + 0x21], 0x7520676e
mov dword [esp + 0x25], 0x70732070
mov dword [esp + 0x29], 0x6b5f6e69
mov dword [esp + 0x2d], 0x20737965
mov dword [esp + 0x31], 0x20726f66
mov dword [esp + 0x35], 0x65726874
mov dword [esp + 0x39], 0x206461
mov dword [esp + 0x3d], 0
mov dword [esp + 0x7c], 0
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
je 0x4cf8cb
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x4cf89d
cmp eax, 0x6a
je 0x4cf8ba
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0x4cf898
cmp eax, 0x6a
je 0x4cf8ba
add ecx, 2
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + ecx + 0x15], 0
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sub.msvcrt.dll_abort
mov ecx, 0x28
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x4cf8b0

Function at 0x4cfc50
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x51e1bc], 1
je 0x4cfd08
push edi
mov eax, 0x51e1bc
push esi
push ebx
sub esp, 0x10
call fcn.004cf5d0
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call fcn.004ceed0
mov edi, dword [0x51e1bc]
test edi, edi
jne 0x4cfcc0
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov dword [0x4db0d4], eax
cmp eax, 0xffffffff
je 0x4d58f1
mov dword [0x51e1bc], 1
mov dword [esp], esi
call fcn.004cf210
test ebx, ebx
je 0x4cfcfa
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
jmp fcn.004cf8e0
cmp edi, 1
je 0x4cfca2
mov dword [esp], 2
call dword [0x4db0e4]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x51e1bc
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], esi
call fcn.004cf210
test ebx, ebx
jne 0x4cfcae
add esp, 0x10
pop ebx
pop esi
pop edi
ret
ret
call sub.msvcrt.dll_abort
Function at 0x4cfd10
Capabilities:
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call fcn.004cf9d0
mov edx, dword [entry4]
test edx, edx
je 0x4cfe40
mov ebx, eax
test eax, eax
je 0x4cfe40
mov dword [eax + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x18], eax
sub esp, 0x10
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.004d31a0
cmp eax, 1
je 0x4cfe4c
mov ebp, dword [sym.imp.kernel32.dll_GetCurrentProcess]
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call ebp
mov edi, eax
call dword [sym.imp.kernel32.dll_GetCurrentThread]
mov esi, eax
call ebp
lea edx, [ebx + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je fcn.004d58f6
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x4db0d4]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x4cfe51
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2c
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004cf7f0
jmp fcn.004d58f6

Function at 0x4cfe60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.004cfc50
mov eax, dword [0x4db0d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4cfe88
add esp, 0x1c
ret
add esp, 0x1c
jmp fcn.004cfd10
Function at 0x4d0150
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x4d0180
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x4d0250
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
cmp eax, 1
je 0x4d0280
cmp eax, 3
jne 0x4d016b
mov eax, dword [0x4db0d4]
cmp eax, 0xffffffff
je 0x4d016b
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4d016b
lea esi, [eax + 0x1c]
lea edi, [eax + 0x38]
test byte [eax + 0x20], 0x30
je 0x4d02b0
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x4d01c9
call fcn.004cfe90
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4d01fb
mov dword [esp], eax
mov ebp, dword [sym.imp.kernel32.dll_CloseHandle]
call ebp
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x4d01ed
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
mov dword [esp], esi
call fcn.004cf390
mov dword [esp], edi
call fcn.004d31a0
cmp eax, 1
je 0x4d0376
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x4d036a
mov eax, dword [0x4db0d4]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
jmp 0x4d016b
mov eax, dword [0x51e198]
test eax, eax
je 0x4d016b
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x51e198], 0
sub esp, 4
jmp 0x4d016b
mov dword [esp + 4], 0x4cf540
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x51e198], eax
mov eax, 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x4d0320
test eax, eax
je 0x4d02ca
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x4d02e7
call fcn.004cfe90
test byte [ebx + 0x24], 4
je 0x4d0360
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x4d01fb
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [ebx + 0x14], 0
sub esp, 4
mov dword [esp], esi
call fcn.004cf390
jmp 0x4d0203
test eax, eax
je 0x4d0360
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [ebx + 0x18], 0
sub esp, 4
mov dword [esp], esi
call fcn.004cf390
mov dword [esp], edi
call fcn.004d31a0
cmp eax, 1
je 0x4d0376
mov dword [ebx + 0x38], 0xffffffff
jmp 0x4d016b
mov dword [esp], esi
call fcn.004cf390
jmp 0x4d033f
mov eax, ebx
call fcn.004cfa90
jmp 0x4d0229
call fcn.004cf7f0
lea esi, [esi]
nop
Function at 0x4d0610
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov eax, dword [ebx]
test edx, edx
je 0x4d0730
cmp eax, 1
je 0x4d0664
mov eax, ebx
call fcn.004cf5d0
lea edi, [eax + 4]
mov esi, eax
mov dword [esp], edi
call fcn.004ceed0
mov ebp, dword [ebx]
test ebp, ebp
je 0x4d0670
cmp ebp, 1
jne 0x4d0700
mov dword [esp], edi
call fcn.004cf210
test esi, esi
je 0x4d0664
mov eax, esi
call fcn.004cf8e0
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x14], 0x4cf9a0
mov dword [esp + 0x18], esi
call fcn.004cfc50
mov eax, dword [0x4db0d4]
mov ebp, dword [sym.imp.kernel32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x4d0768
mov eax, dword [eax + 0xc]
mov dword [esp + 0x1c], eax
lock or dword [esp], 0
call fcn.004cfc50
mov eax, dword [0x4db0d4]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x4d0750
lea edx, [esp + 0x14]
mov dword [eax + 0xc], edx
lock or dword [esp], 0
call dword [esp + 0x44]
call fcn.004cfc50
mov eax, dword [0x4db0d4]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x4d0740
mov edx, dword [esp + 0x1c]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x4d0651
mov dword [esp], 2
call dword [0x4db0e4]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x4d0651
add esp, 0x2c
mov eax, 0x16
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004cfd10
test eax, eax
jne 0x4d06e8
jmp 0x4d5909
call fcn.004cfd10
test eax, eax
jne 0x4d06c2
jmp 0x4d591b
call fcn.004cfd10
test eax, eax
jne 0x4d069c
jmp 0x4d5914
mov eax, dword [esp + 0x1c]
mov dword [0], eax
ud2
mov eax, dword [pe_dos_header]
ud2
lea eax, [esp + 0x14]
mov dword [0], eax
ud2

Function at 0x4d0c00
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.004cfc50
mov eax, dword [0x4db0d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4d0c28
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.004cfd10
test eax, eax
jne 0x4d0c1d
add esp, 0x1c
ret
Function at 0x4d0cf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.004cfe60
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x4d0d12
call fcn.004cfe90
test byte [ebx + 0x20], 0x30
jne 0x4d0d2c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x4db0d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x4d0d6d
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x4d0dad
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x4d0d62
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x4d0d76
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.004cfc30
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x4db0d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push edx
push edx
jmp 0x4d0d6d
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x4d0dc1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x4d0d8e

Function at 0x4d0dd0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x51e1c4]
test eax, eax
jne 0x4d0de0
xor eax, eax
ret
sub esp, 0x1c
call fcn.004cfc50
mov eax, dword [0x4db0d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4d0e20
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x4d0e10
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x4d0e04
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x4d0e06
call fcn.004cfd10
test eax, eax
jne 0x4d0dfd
jmp 0x4d0e04

Function at 0x4d0e30
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.004cfc50
mov eax, dword [0x4db0d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4d0e70
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x4d0e60
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call fcn.004cfd10
test eax, eax
jne 0x4d0e4d
add esp, 0x1c
ret
Function at 0x4d0f70
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.004cfc50
mov eax, dword [0x4db0d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4d0fe0
test byte [ebx + 0x20], 0xc
jne 0x4d0fa0
mov eax, dword [0x51e1c4]
test eax, eax
jne 0x4d0fb0
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.004ceed0
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x4d0fd2
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x4d0fd2
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x4d0ff1
mov dword [esp], esi
call fcn.004cf210
add esp, 0x14
pop ebx
pop esi
ret
call fcn.004cfd10
mov ebx, eax
test eax, eax
jne 0x4d0f91
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4d1011
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.004cf210
call fcn.004d0e80
nop
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4d10a0
mov dword [esp], eax
call fcn.004d2280
mov edi, eax
mov eax, 0xfffffffe
cmp eax, edi
mov eax, 0
sbb eax, edx
jb 0x4d10e0
call fcn.004cfc50
mov eax, dword [0x4db0d4]
mov esi, edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4d1140
test edi, edi
je 0x4d10ba
call fcn.004d0f70
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4d1118
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.004d2390
call fcn.004d0f70
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.004cfc50
mov eax, dword [0x4db0d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4d1130
call fcn.004d0f70
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_Sleep]
sub esp, 4
call fcn.004d0f70
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.004cfc50
mov eax, dword [0x4db0d4]
mov esi, 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
jne 0x4d1072
call fcn.004cfd10
mov ebx, eax
jmp 0x4d1072
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_Sleep]
sub esp, 4
jmp 0x4d108e
call fcn.004cfd10
jmp 0x4d10ba
call fcn.004cfd10
mov ebx, eax
jmp 0x4d106e

Function at 0x4d4b40
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004d4810
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004d4810
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]