joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bbaa
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
sub eax, 0
push edi
je 0x40bcd2
dec eax
je 0x40bc91
dec eax
je 0x40bc56
dec eax
je 0x40bc1b
dec eax
jne 0x40bd23
push 1
lea eax, [ebp + 0xb]
sub esp, 0x10
mov ecx, esp
push eax
push 0x40dcc4
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov edi, str.Control_PanelDesktop
push str.WallpaperStyle
mov esi, closesocket
push edi
push esi
call fcn.00405f8d
add esp, 0x20
lea eax, [ebp - 1]
push 1
sub esp, 0x10
mov ecx, esp
push eax
push 0x40d620
jmp 0x40bd0e
push 1
lea eax, [ebp - 2]
sub esp, 0x10
mov ecx, esp
push eax
push 0x40dcf8
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov edi, str.Control_PanelDesktop
push str.WallpaperStyle
mov esi, closesocket
push edi
push esi
call fcn.00405f8d
add esp, 0x20
lea eax, [ebp - 3]
push 1
sub esp, 0x10
mov ecx, esp
jmp 0x40bcca
push 1
lea eax, [ebp - 4]
sub esp, 0x10
mov ecx, esp
push eax
push 0x40df7c
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov edi, str.Control_PanelDesktop
push str.WallpaperStyle
mov esi, closesocket
push edi
push esi
call fcn.00405f8d
add esp, 0x20
lea eax, [ebp - 5]
push 1
sub esp, 0x10
mov ecx, esp
jmp 0x40bcca
push 1
lea eax, [ebp - 6]
sub esp, 0x10
mov ecx, esp
push eax
push 0x40dc30
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov edi, str.Control_PanelDesktop
push str.WallpaperStyle
mov esi, closesocket
push edi
push esi
call fcn.00405f8d
add esp, 0x20
lea eax, [ebp - 7]
push 1
sub esp, 0x10
mov ecx, esp
push eax
push 0x40dcc4
jmp 0x40bd0e
push 1
lea eax, [ebp - 8]
sub esp, 0x10
mov ebx, 0x40dcc4
mov ecx, esp
push eax
push ebx
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov edi, str.Control_PanelDesktop
push str.WallpaperStyle
mov esi, closesocket
push edi
push esi
call fcn.00405f8d
add esp, 0x20
lea eax, [ebp - 9]
push 1
sub esp, 0x10
mov ecx, esp
push eax
push ebx
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push str.TileWallpaper
push edi
push esi
call fcn.00405f8d
add esp, 0x20
push 3
push dword [ebp + 0xc]
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..3ean
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x709501a2
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x431060
nop
nop
nop
mov eax, section..7LWLf
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x78d751f6
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x406ce7
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub esi, 0xc703
pop esi
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x406d1d
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x406ae8
mov dword [ebp - 0x2a8], 0
Function at 0x422ad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x444969
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f01c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x1c]
call dword [0x44a2a4]
mov ebx, dword [0x462f5c]
mov ecx, dword [0x44a1e0]
mov dword [esp + 0x30], 0
mov dword [esp + 0x14], ebx
call dword [0x44a29c]
mov ebp, dword [esp + 0x38]
mov edi, eax
mov eax, dword [ebp]
cmp edi, dword [eax + 0xc]
jae 0x422b3b
mov ecx, dword [eax + 8]
mov esi, dword [ecx + edi*4]
test esi, esi
jne 0x422bab
jmp 0x422b3d
xor esi, esi
cmp byte [eax + 0x14], 0
je 0x422b54
call dword [0x44a2a0]
cmp edi, dword [eax + 0xc]
jae 0x422b58
mov eax, dword [eax + 8]
mov esi, dword [eax + edi*4]
test esi, esi
jne 0x422bab
test ebx, ebx
je 0x422b60
mov esi, ebx
jmp 0x422bab
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.004252c0
add esp, 8
cmp eax, 0xffffffff
jne 0x422b91
push str.bad_cast
lea ecx, [esp + 0x20]
call dword [0x44a5b4]
push 0x457d5c
lea eax, [esp + 0x20]
push eax
call fcn.0040be44
mov esi, dword [esp + 0x14]
mov dword [0x462f5c], esi
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
push esi
call fcn.0040bcbd
add esp, 4
lea ecx, [esp + 0x18]
call dword [0x44a2ac]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x422bd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x444969
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f01c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x1c]
call dword [0x44a2a4]
mov ebx, dword [0x462f60]
mov ecx, dword [0x44a1d0]
mov dword [esp + 0x30], 0
mov dword [esp + 0x14], ebx
call dword [0x44a29c]
mov ebp, dword [esp + 0x38]
mov edi, eax
mov eax, dword [ebp]
cmp edi, dword [eax + 0xc]
jae 0x422c3b
mov ecx, dword [eax + 8]
mov esi, dword [ecx + edi*4]
test esi, esi
jne 0x422cab
jmp 0x422c3d
xor esi, esi
cmp byte [eax + 0x14], 0
je 0x422c54
call dword [0x44a2a0]
cmp edi, dword [eax + 0xc]
jae 0x422c58
mov eax, dword [eax + 8]
mov esi, dword [eax + edi*4]
test esi, esi
jne 0x422cab
test ebx, ebx
je 0x422c60
mov esi, ebx
jmp 0x422cab
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.00425390
add esp, 8
cmp eax, 0xffffffff
jne 0x422c91
push str.bad_cast
lea ecx, [esp + 0x20]
call dword [0x44a5b4]
push 0x457d5c
lea eax, [esp + 0x20]
push eax
call fcn.0040be44
mov esi, dword [esp + 0x14]
mov dword [0x462f60], esi
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
push esi
call fcn.0040bcbd
add esp, 4
lea ecx, [esp + 0x18]
call dword [0x44a2ac]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x422ed0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x444969
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f01c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x1c]
call dword [0x44a2a4]
mov ebx, dword [0x462f4c]
mov ecx, dword [0x44a1e8]
mov dword [esp + 0x30], 0
mov dword [esp + 0x14], ebx
call dword [0x44a29c]
mov ebp, dword [esp + 0x38]
mov edi, eax
mov eax, dword [ebp]
cmp edi, dword [eax + 0xc]
jae 0x422f3b
mov ecx, dword [eax + 8]
mov esi, dword [ecx + edi*4]
test esi, esi
jne 0x422fab
jmp 0x422f3d
xor esi, esi
cmp byte [eax + 0x14], 0
je 0x422f54
call dword [0x44a2a0]
cmp edi, dword [eax + 0xc]
jae 0x422f58
mov eax, dword [eax + 8]
mov esi, dword [eax + edi*4]
test esi, esi
jne 0x422fab
test ebx, ebx
je 0x422f60
mov esi, ebx
jmp 0x422fab
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.00425600
add esp, 8
cmp eax, 0xffffffff
jne 0x422f91
push str.bad_cast
lea ecx, [esp + 0x20]
call dword [0x44a5b4]
push 0x457d5c
lea eax, [esp + 0x20]
push eax
call fcn.0040be44
mov esi, dword [esp + 0x14]
mov dword [0x462f4c], esi
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
push esi
call fcn.0040bcbd
add esp, 4
lea ecx, [esp + 0x18]
call dword [0x44a2ac]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x422fe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x444969
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f01c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x1c]
call dword [0x44a2a4]
mov ebx, dword [0x462f50]
mov ecx, dword [0x44a1e4]
mov dword [esp + 0x30], 0
mov dword [esp + 0x14], ebx
call dword [0x44a29c]
mov ebp, dword [esp + 0x38]
mov edi, eax
mov eax, dword [ebp]
cmp edi, dword [eax + 0xc]
jae 0x42304b
mov ecx, dword [eax + 8]
mov esi, dword [ecx + edi*4]
test esi, esi
jne 0x4230bb
jmp 0x42304d
xor esi, esi
cmp byte [eax + 0x14], 0
je 0x423064
call dword [0x44a2a0]
cmp edi, dword [eax + 0xc]
jae 0x423068
mov eax, dword [eax + 8]
mov esi, dword [eax + edi*4]
test esi, esi
jne 0x4230bb
test ebx, ebx
je 0x423070
mov esi, ebx
jmp 0x4230bb
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.004256f0
add esp, 8
cmp eax, 0xffffffff
jne 0x4230a1
push str.bad_cast
lea ecx, [esp + 0x20]
call dword [0x44a5b4]
push 0x457d5c
lea eax, [esp + 0x20]
push eax
call fcn.0040be44
mov esi, dword [esp + 0x14]
mov dword [0x462f50], esi
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
push esi
call fcn.0040bcbd
add esp, 4
lea ecx, [esp + 0x18]
call dword [0x44a2ac]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x4230e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x444969
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f01c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x1c]
call dword [0x44a2a4]
mov ebx, dword [0x462f40]
mov ecx, dword [0x44a1d8]
mov dword [esp + 0x30], 0
mov dword [esp + 0x14], ebx
call dword [0x44a29c]
mov ebp, dword [esp + 0x38]
mov edi, eax
mov eax, dword [ebp]
cmp edi, dword [eax + 0xc]
jae 0x42314b
mov ecx, dword [eax + 8]
mov esi, dword [ecx + edi*4]
test esi, esi
jne 0x4231bb
jmp 0x42314d
xor esi, esi
cmp byte [eax + 0x14], 0
je 0x423164
call dword [0x44a2a0]
cmp edi, dword [eax + 0xc]
jae 0x423168
mov eax, dword [eax + 8]
mov esi, dword [eax + edi*4]
test esi, esi
jne 0x4231bb
test ebx, ebx
je 0x423170
mov esi, ebx
jmp 0x4231bb
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.004257e0
add esp, 8
cmp eax, 0xffffffff
jne 0x4231a1
push str.bad_cast
lea ecx, [esp + 0x20]
call dword [0x44a5b4]
push 0x457d5c
lea eax, [esp + 0x20]
push eax
call fcn.0040be44
mov esi, dword [esp + 0x14]
mov dword [0x462f40], esi
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
push esi
call fcn.0040bcbd
add esp, 4
lea ecx, [esp + 0x18]
call dword [0x44a2ac]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x4231e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x444969
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f01c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x1c]
call dword [0x44a2a4]
mov ebx, dword [0x462f44]
mov ecx, dword [0x44a1d4]
mov dword [esp + 0x30], 0
mov dword [esp + 0x14], ebx
call dword [0x44a29c]
mov ebp, dword [esp + 0x38]
mov edi, eax
mov eax, dword [ebp]
cmp edi, dword [eax + 0xc]
jae 0x42324b
mov ecx, dword [eax + 8]
mov esi, dword [ecx + edi*4]
test esi, esi
jne 0x4232bb
jmp 0x42324d
xor esi, esi
cmp byte [eax + 0x14], 0
je 0x423264
call dword [0x44a2a0]
cmp edi, dword [eax + 0xc]
jae 0x423268
mov eax, dword [eax + 8]
mov esi, dword [eax + edi*4]
test esi, esi
jne 0x4232bb
test ebx, ebx
je 0x423270
mov esi, ebx
jmp 0x4232bb
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.004258d0
add esp, 8
cmp eax, 0xffffffff
jne 0x4232a1
push str.bad_cast
lea ecx, [esp + 0x20]
call dword [0x44a5b4]
push 0x457d5c
lea eax, [esp + 0x20]
push eax
call fcn.0040be44
mov esi, dword [esp + 0x14]
mov dword [0x462f44], esi
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
push esi
call fcn.0040bcbd
add esp, 4
lea ecx, [esp + 0x18]
call dword [0x44a2ac]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x43f8f0
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x447a28
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x45f01c]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov eax, dword [0x4615d4]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x3c], 0
cmp eax, 0xffffffff
je 0x43f937
push eax
call esi
mov ebx, eax
test ebx, ebx
jne 0x43f94f
call fcn.00440910
mov eax, dword [0x4615d4]
cmp eax, 0xffffffff
jne 0x43f94a
xor ebx, ebx
jmp 0x43f94f
push eax
call esi
mov ebx, eax
mov esi, dword [esp + 0x4c]
mov edi, dword [esp + 0x48]
mov edx, 1
test esi, esi
je 0x43f969
lea eax, [esi + 4]
mov ecx, edx
lock xadd dword [eax], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], esi
test esi, esi
je 0x43f97d
lea eax, [esi + 4]
lock xadd dword [eax], edx
inc edx
mov eax, dword [esp + 0x50]
or edi, 0xffffffff
mov dword [esp + 0x20], eax
test esi, esi
je 0x43f9b0
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x43f9b0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x43f9b0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x48], 1
call fcn.0043e570
add esp, 0xc
push eax
lea ecx, [ebx + 0x10]
mov byte [esp + 0x40], 2
call fcn.0043da70
push eax
add eax, 0x10
push eax
push 0
lea eax, [esp + 0x1c]
push eax
lea ecx, [ebx + 0x10]
call fcn.0043ddb0
mov esi, dword [esp + 0x2c]
mov byte [esp + 0x3c], 1
test esi, esi
je 0x43fa1f
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x43fa1f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x43fa1f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov esi, dword [esp + 0x1c]
mov byte [esp + 0x3c], 0
test esi, esi
je 0x43fa50
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x43fa50
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x43fa50
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x3c], 0xffffffff
test esi, esi
je 0x43fa83
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x43fa83
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x43fa83
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x4401f0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x4615d4]
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 0xffffffff
je 0x44020b
push eax
call esi
test eax, eax
jne 0x440221
call fcn.00440910
mov eax, dword [0x4615d4]
cmp eax, 0xffffffff
jne 0x44021e
xor eax, eax
jmp 0x440221
push eax
call esi
lea esi, [eax + 0x10]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.0043f650
push dword [eax + 4]
mov ecx, esi
push dword [eax]
lea eax, [esp + 0xc]
push eax
call fcn.0043fec0
pop esi
add esp, 8
ret

Function at 0x4410a0
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x447bc8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x45f01c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [0x4615d4]
mov edi, dword [esp + 0x24]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edi
cmp eax, 0xffffffff
je 0x441151
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x441151
lea esi, [eax + 0x10]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00440250
mov eax, dword [esp + 0x10]
cmp eax, dword [esi]
je 0x441151
lea esi, [eax + 0x14]
test esi, esi
je 0x441151
cmp byte [esp + 0x34], 0
je 0x441126
mov ecx, dword [esi]
test ecx, ecx
je 0x441126
mov edx, dword [esi + 8]
test edx, edx
je 0x441126
mov eax, dword [ecx]
push edx
call dword [eax + 4]
cmp dword [esp + 0x28], 0
mov ebx, dword [esp + 0x30]
jne 0x441140
test ebx, ebx
jne 0x441140
push edi
call fcn.004401f0
add esp, 4
jmp 0x44118d
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call fcn.0043f2c0
mov dword [esi + 8], ebx
jmp 0x44118d
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
test edx, edx
jne 0x441161
test eax, eax
je 0x44118d
push eax
sub esp, 8
mov ecx, esp
mov dword [ecx], edx
mov eax, dword [esp + 0x38]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x38]
test eax, eax
je 0x441184
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
push edi
call fcn.0043f8f0
add esp, 0x10
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0xffffffff
test esi, esi
je 0x4411c3
or edi, 0xffffffff
lea ecx, [esi + 4]
mov eax, edi
lock xadd dword [ecx], eax
jne 0x4411c3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x4411c3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x441ad0
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x447d0b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f01c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x441bbc
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitializeSRWLock
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x441bbc
push str.AcquireSRWLockExclusive
push esi
call edi
mov ebp, eax
test ebp, ebp
je 0x441bbc
push str.ReleaseSRWLockExclusive
push esi
call edi
mov dword [esp + 0x1c], eax
test eax, eax
je 0x441bbc
push str.InitializeConditionVariable
push esi
call edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x441bbc
push str.SleepConditionVariableSRW
push esi
call edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x441bbc
push str.WakeAllConditionVariable
push esi
call edi
mov esi, eax
test esi, esi
je 0x441bbc
push 0x1c
call int.0040bd38
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], 0
test eax, eax
je 0x441c2a
push esi
push dword [esp + 0x18]
mov ecx, eax
push dword [esp + 0x20]
push dword [esp + 0x28]
push ebp
push ebx
call fcn.00441570
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0x2c
call int.0040bd38
add esp, 4
test eax, eax
je 0x441c2a
mov dword [eax], vtable.once_block_impl_nt5.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x442590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x447e58
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x45f01c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push 1
push 0
sub esp, 8
mov eax, esp
push esi
mov dword [eax], 0
mov dword [esp + 0x30], 0
mov dword [eax + 4], 0
call fcn.004410a0
mov esi, dword [esi + 4]
add esp, 0x14
mov dword [esp + 0x1c], 0xffffffff
test esi, esi
je 0x442617
or edi, 0xffffffff
lea ecx, [esi + 4]
mov eax, edi
lock xadd dword [ecx], eax
jne 0x442617
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x442617
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x4024e0
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x450348]
sub esp, 0x114
test eax, eax
jne 0x40262d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push edi
push 0x4500e0
mov dword [0x450348], 1
mov dword [0x4500e0], 0x114
call esi
mov edx, dword [0x4500f0]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x44d048], eax
je 0x402608
push ebx
push 0x4501f8
mov dword [0x4501f8], 0x11c
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.kernel32.dll
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x45033c], eax
call edi
mov dword [0x450340], eax
mov eax, dword [0x45033c]
test eax, eax
push 0x450318
je 0x402584
call eax
jmp 0x40258a
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x4501fc]
cmp eax, 6
jae 0x4025a2
cmp eax, 5
jne 0x4025b6
cmp dword [0x450200], 2
jb 0x4025b6
cmp word [0x450318], 9
jne 0x4025b6
mov dword [0x4500d4], 1
push str.Ntdll.dll
call ebx
test eax, eax
pop ebx
je 0x4025d4
push str.RtlGetVersion
push eax
call edi
mov edx, eax
mov dword [0x450344], edx
jmp 0x4025da
mov edx, dword [0x450344]
test edx, edx
je 0x402608
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x114
push eax
call edx
test eax, eax
jne 0x402608
mov ecx, dword [esp + 0x14]
mov dword [0x4500ec], ecx
push 0x4500e8
push 0x4500e4
call fcn.004029d0
add esp, 8
call fcn.00402640
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
mov eax, 1
add esp, 0x114
ret