joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40280c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x174
mov dword [ebp - 0x134], 0x40a7c4
mov dword [ebp - 0x130], 0x4759bc
lea eax, [ebp - 8]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], 0x402a7d
mov dword [ebp - 0x124], esp
lea eax, [ebp - 0x14c]
mov dword [esp], eax
call fcn.0041cc28
lea edi, [ebp - 0x114]
mov ecx, 0x104
xor eax, eax
rep stosb byte es:[edi], al
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x15c], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp], edx
mov dword [ebp - 0x148], 0xffffffff
call sub.SHELL32.DLL_DragQueryFileA
sub esp, 0x10
mov dword [ebp - 0x158], eax
test eax, eax
je 0x402a54
mov dword [ebp - 0x150], 0
jmp 0x40298b
lea edx, [ebp - 9]
mov dword [esp + 8], edx
lea ecx, [ebp - 0x114]
mov dword [esp + 4], ecx
lea eax, [ebp - 0x10]
mov dword [esp], eax
mov dword [ebp - 0x148], 3
call fcn.00454180
lea edx, [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], 0x47f040
mov dword [ebp - 0x148], 2
call fcn.004051a0
mov eax, dword [ebp - 0x10]
lea ecx, [eax - 0xc]
mov dword [ebp - 0x154], ecx
mov edi, dword [0x485130]
test edi, edi
jne 0x402a14
mov edx, dword [ebp - 0x154]
mov eax, dword [edx + 8]
lea edx, [eax - 1]
mov ecx, dword [ebp - 0x154]
mov dword [ecx + 8], edx
test eax, eax
jle 0x402a39
mov dword [esp + 4], 0xfa9
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov dword [ebp - 0x148], 0xffffffff
call sub.USER32.dll_GetDlgItem
sub esp, 8
lea ecx, [ebp - 0x114]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x180
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
inc dword [ebp - 0x150]
mov edx, dword [ebp - 0x150]
cmp dword [ebp - 0x158], edx
jbe 0x402a54
mov dword [esp + 0xc], 0x104
lea eax, [ebp - 0x114]
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x150]
mov dword [esp + 4], edx
mov ecx, dword [ebp - 0x15c]
mov dword [esp], ecx
mov dword [ebp - 0x148], 0xffffffff
call sub.SHELL32.DLL_DragQueryFileA
sub esp, 0x10
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
push edx
cmp eax, 0x10
jne 0x4028b4
mov dword [esp + 4], 0xfaa
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov dword [ebp - 0x148], 0xffffffff
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], str.no_support_dir
mov dword [esp], eax
call sub.USER32.dll_SetWindowTextA
sub esp, 8
jmp 0x402973
mov dword [esp + 4], 0xffffffff
sub eax, 4
mov dword [esp], eax
mov dword [ebp - 0x148], 1
call fcn.0040ce64
test eax, eax
jg 0x40292e
lea eax, [ebp - 0xa]
mov dword [esp + 4], eax
mov edx, dword [ebp - 0x154]
mov dword [esp], edx
call fcn.004528f0
jmp 0x40292e
mov ecx, dword [ebp + 0xc]
mov dword [esp], ecx
mov dword [ebp - 0x148], 0xffffffff
call sub.SHELL32.DLL_DragFinish
push ecx
lea eax, [ebp - 0x14c]
mov dword [esp], eax
call fcn.0041cbd4
mov edi, dword [ebp - 4]
leave
ret
Function at 0x4038bc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
cmp ax, 0x7d2
je 0x403930
jbe 0x40390c
cmp ax, 0x7d5
je 0x40391c
cmp ax, 0x7d6
jne 0x403912
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [ebp + 0xc], 0x406
mov dword [ebp + 8], ebx
lea esp, [ebp - 8]
pop ebx
pop esi
leave
jmp fcn.00402200
cmp ax, 0x7d1
je 0x40394c
lea esp, [ebp - 8]
pop ebx
pop esi
leave
ret
mov dword [ebp + 0x10], edx
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ebx
lea esp, [ebp - 8]
pop ebx
pop esi
leave
jmp fcn.00402d88
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.USER32.dll_EndDialog
sub esp, 8
lea esp, [ebp - 8]
pop ebx
pop esi
leave
ret
mov dword [esp], ebx
call fcn.00402ac4
test al, al
jne 0x4039f8
mov dword [esp + 4], 0x405
mov dword [esp], ebx
call fcn.00402200
mov dword [esp + 4], 0x7d1
mov dword [esp], ebx
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.USER32.dll_EnableWindow
sub esp, 8
mov dword [esp + 4], 0x7d3
mov dword [esp], ebx
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.USER32.dll_EnableWindow
sub esp, 8
mov dword [esp + 4], 0x7d4
mov dword [esp], ebx
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.USER32.dll_EnableWindow
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.USER32.dll_ShowWindow
sub esp, 8
lea esp, [ebp - 8]
pop ebx
pop esi
leave
ret
mov dword [esp], 0x47f040
call fcn.00405160
mov esi, eax
mov dword [esp + 4], 0xfab
mov dword [esp], ebx
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.USER32.dll_SetWindowTextA
sub esp, 8
mov dword [esp + 4], 0x7d3
mov dword [esp], ebx
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], 0x4790c0
mov dword [esp], eax
call sub.USER32.dll_SetWindowTextA
sub esp, 8
mov dword [esp + 4], 0x7d4
mov dword [esp], ebx
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], 0x4790c0
mov dword [esp], eax
call sub.USER32.dll_SetWindowTextA
sub esp, 8
lea esp, [ebp - 8]
pop ebx
pop esi
leave
ret

Function at 0x403d78
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x403d9b
mov dword [esp], eax
call sub.WS2_32.DLL_closesocket
push edx
inc eax
je 0x403da0
mov dword [ebx], 0xffffffff
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 8], 0x99
mov dword [esp + 4], str.G:MyMailEnginePop3Engine.cpp
mov dword [esp], 0x479150
call sub.msvcrt.dll__assert
Function at 0x403dbc
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x403def
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.DLL_recv
sub esp, 0x10
leave
ret
mov dword [esp + 8], 0x92
mov dword [esp + 4], str.G:MyMailEnginePop3Engine.cpp
mov dword [esp], 0x479177
call sub.msvcrt.dll__assert
nop

Function at 0x403e0c
Capabilities:
Connect socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x403e43
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.DLL_send
sub esp, 0x10
inc eax
setne al
leave
ret
mov dword [esp + 8], 0x8d
mov dword [esp + 4], str.G:MyMailEnginePop3Engine.cpp
mov dword [esp], 0x479177
call sub.msvcrt.dll__assert
nop

Function at 0x403e60
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call sub.WS2_32.DLL_connect
sub esp, 0xc
inc eax
setne al
leave
ret

Function at 0x403e8c
Capabilities:
Create tcp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
cmp dword [esi], 0xffffffff
je 0x403f21
lea ebx, [ebp - 0x28]
mov ecx, 0x10
xor eax, eax
mov edi, ebx
rep stosb byte es:[edi], al
mov word [ebp - 0x28], 2
movzx eax, word [ebp + 0x10]
mov dword [esp], eax
call sub.WS2_32.DLL_htons
push ecx
mov word [ebp - 0x26], ax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.WS2_32.DLL_inet_addr
push edx
mov dword [ebp - 0x24], eax
inc eax
je 0x403ef4
mov dword [esp + 8], 0x10
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00403e60
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.WS2_32.DLL_gethostbyname
push edi
test eax, eax
je 0x403f10
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
jmp 0x403ed8
mov dword [esp], 0x2726
call sub.WS2_32.DLL_WSASetLastError
push ecx
xor eax, eax
jmp 0x403eec
mov dword [esp + 8], 0x72
mov dword [esp + 4], str.G:MyMailEnginePop3Engine.cpp
mov dword [esp], 0x479177
call sub.msvcrt.dll__assert
nop
nop

Function at 0x403f40
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.WS2_32.DLL_socket
sub esp, 0xc
mov edx, dword [ebp + 8]
mov dword [edx], eax
inc eax
setne al
leave
ret
Function at 0x405f74
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x405f97
mov dword [esp], eax
call sub.WS2_32.DLL_closesocket
push edx
inc eax
je 0x405f9c
mov dword [ebx], 0xffffffff
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 8], 0x3c
mov dword [esp + 4], str.G:MyMailEngineSmtpEngine.cpp
mov dword [esp], str.SOCKET_ERROR___closesocket_m_hSocket_
call sub.msvcrt.dll__assert

Function at 0x405fb8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call sub.WS2_32.DLL_recv
sub esp, 0x10
leave
ret

Function at 0x406044
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call sub.WS2_32.DLL_send
sub esp, 0x10
inc eax
setne al
leave
ret

Function at 0x4060e4
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call sub.WS2_32.DLL_connect
sub esp, 0xc
inc eax
setne al
leave
ret

Function at 0x406110
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
cmp dword [esi], 0xffffffff
je 0x4061a5
lea ebx, [ebp - 0x28]
mov ecx, 0x10
xor eax, eax
mov edi, ebx
rep stosb byte es:[edi], al
mov word [ebp - 0x28], 2
movzx eax, word [ebp + 0x10]
mov dword [esp], eax
call sub.WS2_32.DLL_htons
push ecx
mov word [ebp - 0x26], ax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.WS2_32.DLL_inet_addr
push edx
mov dword [ebp - 0x24], eax
inc eax
je 0x406178
mov dword [esp + 8], 0x10
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.004060e4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.WS2_32.DLL_gethostbyname
push edi
test eax, eax
je 0x406194
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
jmp 0x40615c
mov dword [esp], 0x2726
call sub.WS2_32.DLL_WSASetLastError
push ecx
xor eax, eax
jmp 0x406170
mov dword [esp + 8], 0x17
mov dword [esp + 4], str.G:MyMailEngineSmtpEngine.cpp
mov dword [esp], str.m_hSocket___INVALID_SOCKET
call sub.msvcrt.dll__assert
nop
nop

Function at 0x4061c4
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.WS2_32.DLL_socket
sub esp, 0xc
mov edx, dword [ebp + 8]
mov dword [edx], eax
inc eax
setne al
leave
ret
Function at 0x40ff48
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebx, eax
cmp eax, 0xffffffff
je 0x40ff80
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x40ff57
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret

Function at 0x41c160
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x41c186
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x41c21a
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x41c1d5
cmp eax, 0x40
je 0x41c1d5
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x41c179
cmp eax, 0x40
je 0x41c179
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x41c179
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sub.msvcrt.dll__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x41c490
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.0041c470
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
je 0x41c530
movzx edx, byte [ebx]
cmp dl, 9
je 0x41c574
cmp dl, 0x20
je 0x41c574
cmp dl, 0x22
je 0x41c514
cmp dl, 9
mov eax, edx
je 0x41c528
cmp dl, 0x20
je 0x41c580
test dl, dl
lea esi, [esi]
jne 0x41c502
jmp 0x41c530
cmp al, 0x20
je 0x41c580
test al, al
nop
je 0x41c530
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x41c4f4
jmp 0x41c528
cmp al, 0x22
je 0x41c51e
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x41c510
cmp al, 0x22
jne 0x41c528
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x41c580
cmp al, 9
je 0x41c580
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x41c53f
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004098b4
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 1
jmp 0x41c4c1
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x41c580
cmp al, 0x20
jne 0x41c530
nop
jmp 0x41c580

Function at 0x41c858
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x485138]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x41c894
mov dword [ebx + 0x24], eax
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00425cb0
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x28], eax
add esp, 0x14
pop ebx
leave
ret
call fcn.00425c04
jmp 0x41c882
Function at 0x41c9b8
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
mov edx, dword [ebx + 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [esi]
jmp 0x41c9e1
mov dword [eax + 0x20], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
test eax, eax
je 0x41caa8
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x2c], eax
xor edi, edi
mov eax, 0xa
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 1
call dword [ebp - 0x20]
test eax, eax
jne 0x41cacc
cmp edi, 5
je 0x41cad1
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x41ca6b
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
call dword [ebp - 0x2c]
mov edi, eax
cmp eax, 7
je 0x41cad1
cmp eax, 8
jne 0x41cacc
mov eax, dword [esi]
mov edi, dword [eax]
mov eax, dword [0x485138]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x41cabc
test edx, edx
je 0x41c9d8
mov dword [esp + 4], edi
mov eax, dword [eax + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
jne 0x41c9db
call fcn.00425c04
jmp 0x41c9db
mov dword [ebp - 0x2c], 0
mov edi, 5
mov al, 0x1a
jmp 0x41c9f6
call fcn.0041c89c
mov eax, dword [0x485138]
mov edx, dword [eax + 0x28]
jmp 0x41ca7b
mov edi, 2
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x41ccac
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov eax, dword [0x485138]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x41cd91
test edx, edx
jne 0x41cd30
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
test eax, eax
je 0x41cd23
lea esi, [ebp - 0x20]
jmp 0x41cce3
mov dword [ebp - 0x20], eax
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41cd1a
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 1
mov dword [esp], 1
call eax
cmp eax, 6
je 0x41cd58
cmp eax, 8
jne 0x41cd84
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
test eax, eax
jne 0x41cce0
mov eax, 5
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, dword [eax + 0x24]
call fcn.00425c04
mov esi, eax
mov dword [esp], edi
call sub.KERNEL32.dll_TlsGetValue
push edi
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sub.KERNEL32.dll_SetLastError
push ecx
mov eax, dword [ebp - 0x2c]
jmp 0x41cccf
mov dword [ebx + 0xc], 0
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, esi
mov eax, ebx
call fcn.0041c914
cmp eax, 7
jne 0x41cd28
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.0041cadc
nop
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
call fcn.0041c89c
mov eax, dword [0x485138]
mov edx, dword [eax + 0x28]
jmp 0x41ccc8
Function at 0x41cda4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x41cdc8
mov dword [esp], ebx
call fcn.0041ccac
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [0x485138]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x41ce1c
test edx, edx
jne 0x41cdf8
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call fcn.0041c9b8
cmp eax, 7
je 0x41ce2c
call sub.msvcrt.dll_abort
nop
mov edi, dword [eax + 0x24]
call fcn.00425c04
mov esi, eax
mov dword [esp], edi
call sub.KERNEL32.dll_TlsGetValue
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sub.KERNEL32.dll_SetLastError
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x41cddb
call fcn.0041c89c
mov eax, dword [0x485138]
mov edx, dword [eax + 0x28]
jmp 0x41cdd4
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.0041cadc
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov eax, dword [0x485138]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x41ceb8
test edx, edx
jne 0x41ce94
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
lea esi, [ebp - 0x1c]
jmp 0x41ce6d
cmp ebx, 5
je 0x41ce8a
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
cmp eax, 1
sbb ebx, ebx
and ebx, 5
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], esi
call edi
test eax, eax
je 0x41ce60
mov ebx, 3
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov esi, dword [eax + 0x24]
call fcn.00425c04
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.dll_TlsGetValue
push esi
mov dword [esp], ebx
mov dword [ebp - 0x2c], eax
call sub.KERNEL32.dll_SetLastError
push ebx
mov eax, dword [ebp - 0x2c]
jmp 0x41ce57
call fcn.0041c89c
mov eax, dword [0x485138]
mov edx, dword [eax + 0x28]
jmp 0x41ce50

Function at 0x41cec8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x485138]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x41cf4c
test edx, edx
jne 0x41cf28
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov edi, dword [ebx + 0xc]
test edi, edi
jne 0x41cf0c
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call fcn.0041c914
cmp eax, 7
je 0x41cf1d
call sub.msvcrt.dll_abort
nop
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call fcn.0041c9b8
cmp eax, 7
jne 0x41cf05
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.0041cadc
nop
mov edi, dword [eax + 0x24]
call fcn.00425c04
mov esi, eax
mov dword [esp], edi
call sub.KERNEL32.dll_TlsGetValue
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sub.KERNEL32.dll_SetLastError
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x41cee7
call fcn.0041c89c
mov eax, dword [0x485138]
mov edx, dword [eax + 0x28]
jmp 0x41cee0