joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ec486e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6f48f014]
mov dword [ebp - 0xc], eax
jmp 0x6ec487c4
jmp 0x6ec4889a
jmp 0x6ec48970
jmp 0x6ec48a46
jmp 0x6ec48b1c
jmp 0x6ec48bf2
jmp 0x6ec48cc8
jmp 0x6ec48d9e
jmp 0x6ec48e74
jmp 0x6ec48f4a
jmp 0x6ec49020
jmp 0x6ec490f6
jmp 0x6ec491cc
jmp 0x6ec492a2
jmp 0x6ec49378
jmp 0x6ec4944e
jmp 0x6ec49524
cmp dword [ebp - 0xc], 0
je 0x6ec4ce58
mov eax, dword [0x6f48f014]
mov dword [0x6f48f00c], eax
jmp 0x6ec4960e
jmp 0x6ec496e4
jmp 0x6ec497ba
jmp 0x6ec49890
jmp 0x6ec49966
jmp 0x6ec49a3c
jmp 0x6ec49b12
jmp 0x6ec49be8
jmp 0x6ec49cbe
jmp 0x6ec49d94
jmp 0x6ec49e6a
jmp 0x6ec49f40
jmp 0x6ec4a016
jmp 0x6ec4a0ec
jmp 0x6ec4a1c2
jmp 0x6ec4a298
jmp 0x6ec4a36e
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [0x6f48f008], eax
jmp 0x6ec4a454
jmp 0x6ec4a52a
jmp 0x6ec4a600
jmp 0x6ec4a6d6
jmp 0x6ec4a7ac
jmp 0x6ec4a882
jmp 0x6ec4a958
jmp 0x6ec4aa2e
jmp 0x6ec4ab04
jmp 0x6ec4abda
jmp 0x6ec4acb0
jmp 0x6ec4ad86
jmp 0x6ec4ae5c
jmp 0x6ec4af32
jmp 0x6ec4b008
jmp 0x6ec4b0de
jmp 0x6ec4b1b4
mov eax, dword [0x6f48f008]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
jmp 0x6ec4b295
jmp 0x6ec4b36b
jmp 0x6ec4b441
jmp 0x6ec4b517
jmp 0x6ec4b5ed
jmp 0x6ec4b6c3
jmp 0x6ec4b799
jmp 0x6ec4b86f
jmp 0x6ec4b945
jmp 0x6ec4ba1b
jmp 0x6ec4baf1
jmp 0x6ec4bbc7
jmp 0x6ec4bc9d
jmp 0x6ec4bd73
jmp 0x6ec4be49
jmp 0x6ec4bf1f
jmp 0x6ec4bff5
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [0x6f48f004], eax
jmp 0x6ec4c0f8
jmp 0x6ec4c1ce
jmp 0x6ec4c2a4
jmp 0x6ec4c37a
jmp 0x6ec4c450
jmp 0x6ec4c526
jmp 0x6ec4c5fc
jmp 0x6ec4c6d2
jmp 0x6ec4c7a8
jmp 0x6ec4c87e
jmp 0x6ec4c954
jmp 0x6ec4ca2a
jmp 0x6ec4cb00
jmp 0x6ec4cbd6
jmp 0x6ec4ccac
jmp 0x6ec4cd82
jmp 0x6ec4ce58
nop
leave
ret

Function at 0x6ec4eb0b
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6f48f008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6f48f008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6ec4ec01
jmp 0x6ec4ecd7
jmp 0x6ec4edad
jmp 0x6ec4ee83
jmp 0x6ec4ef59
jmp 0x6ec4f02f
jmp 0x6ec4f105
jmp 0x6ec4f1db
jmp 0x6ec4f2b1
jmp 0x6ec4f387
jmp 0x6ec4f45d
jmp 0x6ec4f533
jmp 0x6ec4f609
jmp 0x6ec4f6df
jmp 0x6ec4f7b5
jmp 0x6ec4f88b
jmp 0x6ec4f961
mov dword [ebp - 0x14], 0
jmp 0x6ec4fa3e
jmp 0x6ec4fb14
jmp 0x6ec4fbea
jmp 0x6ec4fcc0
jmp 0x6ec4fd96
jmp 0x6ec4fe6c
jmp 0x6ec4ff42
jmp 0x6ec50018
jmp 0x6ec500ee
jmp 0x6ec501c4
jmp 0x6ec5029a
jmp 0x6ec50370
jmp 0x6ec50446
jmp 0x6ec5051c
jmp 0x6ec505f2
jmp 0x6ec506c8
jmp 0x6ec5079e
mov dword [ebp - 0x18], 0
Function at 0x6ec7f200
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x6f48e040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.6ec7f260

Function at 0x6ec7f260
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x6f48f378]
test esi, esi
jle 0x6ec7f34d
mov edi, dword [0x6f48f37c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x6ec7f294
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x6ec7f346
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x6ec7f280
mov dword [esp], eax
mov esi, eax
call fcn.6ec7fa00
test eax, eax
mov edi, eax
je 0x6ec7f38a
mov esi, dword [0x6f48f37c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.6ec7fb10
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x6f48f37c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6ec7f36a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x6ec7f33f
sub eax, 0x40
and eax, 0xffffffbf
je 0x6ec7f33f
mov eax, dword [esp + 0x20]
add ebx, dword [0x6f48f37c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x6ec7f354
add dword [0x6f48f378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x6ec7f29e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6ec7f200
mov eax, dword [0x6f48f37c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6ec7f200
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6ec7f200
lea esi, [esi]
Function at 0x6ec7f670
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6f48f388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6f48f380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x6ec7f6c5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6ec7f6be
test esi, esi
je 0x6ec7f6be
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6ec7f6a0
mov dword [esp], 0x6f48f388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404a20
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ecx, 0x104
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x25c
lea ebx, [ebp - 0x128]
mov dword [esp + 8], ecx
mov esi, dword [ebp + 8]
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
add eax, ebx
jmp 0x404a56
dec eax
cmp byte [eax], 0x5c
jne 0x404a55
mov dword [esp], ebx
inc eax
mov edi, pe_nt_image_headers32
mov dword [esp + 4], eax
call sub.KERNEL32.dll_lstrcpyA
sub esp, 8
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrlenA
mov dl, 0x74
mov cl, 0x78
sub esp, 4
mov byte [eax + ebp - 0x129], dl
mov dl, 0x74
mov byte [eax + ebp - 0x12a], cl
xor ecx, ecx
mov byte [eax + ebp - 0x12b], dl
mov edx, 2
xor eax, eax
mov dword [esp + 0x18], ecx
xor ecx, ecx
mov dword [esp + 0x14], edi
mov edi, 0x40000000
mov dword [esp + 0x10], edx
mov dword [esp + 4], edi
mov dword [esp], ebx
mov ebx, 1
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
call sub.KERNEL32.dll_CreateFileA
mov edi, eax
mov edx, dword [esi + 0x520]
sub esp, 0x1c
mov eax, dword [esi + 0x524]
imul eax, edx
dec eax
jl 0x404b92
lea esi, [esi]
lea edi, [edi]
lea edx, [ebx + 0xfa0]
mov dword [esp + 4], edx
mov eax, dword [esi + 0x6ad4]
mov dword [esp], eax
call sub.USER32.dll_GetDlgItem
sub esp, 8
lea edx, [ebp - 0x238]
mov ecx, 0x104
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.USER32.dll_GetWindowTextA
sub esp, 0xc
mov ecx, 0x40e0e0
lea eax, [ebp - 0x238]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
xor ecx, ecx
mov edx, eax
cmp byte [eax], 0
jmp 0x404b55
inc edx
inc ecx
cmp byte [edx], 0
jne 0x404b50
mov dword [esp + 8], ecx
xor edx, edx
inc ebx
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x23c]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.KERNEL32.dll_WriteFile
mov ecx, dword [esi + 0x524]
sub esp, 0x14
mov eax, dword [esi + 0x520]
imul ecx, eax
cmp ecx, ebx
jge 0x404af0
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4050d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ecx, 1
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov dword [ebp - 0x144], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x140], ebx
mov ecx, dword [eax + 0x520]
mov dword [ebp - 0x13c], eax
cmp ecx, 1
jl 0x4051d7
mov edx, dword [eax + 0x524]
lea esi, [esi]
xor esi, esi
cmp edx, 1
mov ebx, 1
jge 0x405187
jmp 0x4051b8
cmp edx, 2
je 0x4051a0
mov dword [esp + 4], edi
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.USER32.dll_GetDlgItem
sub esp, 8
lea edx, [ebp - 0x128]
mov ecx, 0xff
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.USER32.dll_GetWindowTextA
sub esp, 0xc
mov ecx, 0x40d024
lea eax, [ebp - 0x128]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
cmp eax, 1
mov eax, dword [ebp - 0x13c]
adc esi, 0
inc ebx
mov edx, dword [eax + 0x524]
cmp edx, ebx
jl 0x4051b2
cmp edx, 1
jne 0x405121
mov edi, dword [ebp - 0x144]
add edi, 0x1388
jmp 0x405126
mov edx, dword [ebp - 0x144]
lea edi, [ebx + edx*2 + 0x1386]
jmp 0x405126
mov ecx, dword [eax + 0x520]
xor ebx, ebx
cmp edx, esi
sete bl
inc dword [ebp - 0x144]
add dword [ebp - 0x140], ebx
cmp ecx, dword [ebp - 0x144]
jge 0x405110
mov dword [esp + 0xc], ecx
mov eax, str._d____d
lea ebx, [ebp - 0x138]
mov esi, dword [ebp - 0x140]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 8], esi
call sub.USER32.dll_wsprintfA
mov dword [esp + 8], ebx
mov edx, dword [ebp - 0x13c]
mov ecx, 0x20
mov dword [esp + 4], ecx
mov edi, dword [edx + 0x6b00]
mov dword [esp], edi
call sub.USER32.dll_SetDlgItemTextA
mov esi, dword [ebp - 0x140]
sub esp, 0xc
test esi, esi
je 0x40526e
mov ebx, dword [ebp - 0x140]
mov edi, 0x1e
mov edx, dword [ebp - 0x140]
mov dword [esp + 4], edi
shl ebx, 6
add ebx, edx
mov edx, dword [ebp - 0x13c]
lea ecx, [edx + ebx*4 + 0x424]
mov dword [esp + 8], ecx
mov edi, dword [edx + 0x6b00]
mov dword [esp], edi
call sub.USER32.dll_SetDlgItemTextA
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp - 0x13c]
mov esi, str.
mov eax, 0x1e
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov edi, dword [edx + 0x6b00]
mov dword [esp], edi
call sub.USER32.dll_SetDlgItemTextA
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40a6d0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40a706
mov dword [0x413480], eax
mov edx, 0x40a6b0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040af50
test eax, eax
sete al
movzx eax, al
mov dword [0x40d090], eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x40d090], eax
leave
ret

Function at 0x40a7f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], 0x408980
mov dword [ebp - 0x24], 0x40c4f8
mov dword [ebp - 0x1c], 0x40a8b0
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.0040b370
cmp dword [0x40d090], 0
mov dword [ebp - 0x44], 0x413490
je 0x40a890
jl 0x40a8d0
mov dword [ebp - 0x3c], 1
mov eax, dword [0x413480]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x40a973
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.0040b450
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4134e0]
mov eax, 0xffffffff
test edx, edx
je 0x40a8ea
mov eax, dword [0x40d094]
test eax, eax
je 0x40a92a
xor eax, eax
test eax, eax
jne 0x40a920
mov edi, dword [0x40d090]
test edi, edi
js 0x40a920
mov dword [ebp - 0x44], 0x413490
mov ebx, dword [0x40d090]
test ebx, ebx
je 0x40a890
jmp 0x40a83e
xor esi, esi
mov dword [0x40d090], esi
jmp 0x40a8f8
mov dword [esp], 0x40d098
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.dll_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x40a9b1
mov eax, dword [0x40d094]
test eax, eax
jne 0x40a8e8
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x40d094]
test eax, eax
je 0x40a94d
jmp 0x40a8e8
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x40a9a5
mov dword [esp + 4], eax
mov eax, dword [0x413480]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x40a9da
test edx, edx
je 0x40a9c5
mov dword [ebp - 0x3c], 1
call fcn.0040a250
call fcn.0040a6d0
mov eax, 1
mov dword [0x40d094], eax
jmp 0x40a8e8
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x40a886
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
jmp 0x40a9a1
Function at 0x40ac40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.0040bdc0
call fcn.0040adf0
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40ac78
jmp 0x40ad14
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x40ac77
cmp cl, 0x22
je 0x40acd0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x40acf0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x40acf0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x40acb0
jmp 0x40acf0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x40acd0
cmp cl, 0x22
je 0x40ad50
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x40ad0e
inc ebx
movzx eax, byte [ebx]
cmp al, 0x20
sete dl
cmp al, 9
sete al
or eax, edx
test al, 1
jne 0x40ad00
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x40ad32
movzx edx, word [ebp - 0x28]
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004013b0
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x40acf0

Function at 0x40b260
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x413530]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40b2a0
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.0040af50
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x40b650
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x413530]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40b72c
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x40b741
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x40b700
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x40b698
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x40b6a8
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x40b6f3
test edx, edx
jne 0x40b6e6
test ecx, ecx
je 0x40b690
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x40b750
cmp eax, 8
je 0x40b690
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40b682
call fcn.0040b020
mov eax, dword [0x413530]
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x40b674
call fcn.0040b2c0
mov eax, dword [0x413530]
jmp 0x40b674
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.0040b5c0
cmp eax, 7
jne 0x40b6eb
mov eax, dword [0x413530]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40b7a3
mov edi, dword [eax + 0x30]
test edi, edi
js 0x40b7ce
mov esi, dword [eax + 0x30]
test esi, esi
jne 0x40b7af
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.0040b020
mov eax, dword [0x413530]
jmp 0x40b781
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40b792
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40b792
call fcn.0040b2c0
mov eax, dword [0x413530]
jmp 0x40b788
Function at 0x40ba30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x413530]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40bac4
mov esi, dword [eax + 0x30]
test esi, esi
js 0x40bae0
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x40bb00
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x40bab8
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0040b5c0
cmp eax, 7
jne 0x40bb7f
mov eax, dword [0x413530]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40bb56
mov edx, dword [eax + 0x30]
test edx, edx
js 0x40bb70
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x40bb30
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0040b7e0
jmp 0x40ba75
call fcn.0040b020
mov eax, dword [0x413530]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x40ba50
lea esi, [esi]
call fcn.0040b2c0
mov eax, dword [0x413530]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x40ba5b
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40ba5e
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40baa7
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40baa7
call fcn.0040b020
mov eax, dword [0x413530]
mov edx, dword [eax + 0x30]
test edx, edx
jns 0x40ba99
nop
lea esi, [esi]
call fcn.0040b2c0
mov eax, dword [0x413530]
jmp 0x40ba99
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x40bb90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x40bc22
mov eax, dword [0x413530]
test eax, eax
je 0x40bc16
mov ebx, dword [eax + 0x30]
test ebx, ebx
js 0x40bc91
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x40bc37
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.0040b7e0
cmp eax, 7
jne 0x40bcaf
mov eax, dword [0x413530]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40bc82
mov edx, dword [eax + 0x30]
test edx, edx
js 0x40bca0
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x40bc63
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.0040b020
mov eax, dword [0x413530]
jmp 0x40bbb2
mov dword [esp], edi
call fcn.0040b650
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40bbc7
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40bc05
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40bc05
call fcn.0040b020
mov eax, dword [0x413530]
jmp 0x40bbf0
call fcn.0040b2c0
mov eax, dword [0x413530]
jmp 0x40bbbd
call fcn.0040b2c0
mov eax, dword [0x413530]
jmp 0x40bbfb
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]