joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424d03
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x424d1d
mov edx, dword [ebp + 0x10]
test edx, edx
jne 0x424d24
cmp dword [ebp + 0x18], edx
jne 0x424d24
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x3c]
mov ecx, 0x5a4d
cmp word [edi], cx
jne 0x424d1d
cmp dword [eax + edi], 0x4550
jne 0x424d1d
mov ecx, dword [eax + edi + 0x7c]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x424d1d
push ebx
push esi
mov esi, dword [eax + edi + 0x78]
mov ecx, dword [esi + edi + 0x24]
mov eax, dword [esi + edi + 0x20]
add esi, edi
add ecx, edi
mov dword [ebp - 8], ecx
mov ecx, dword [esi + 0x1c]
add eax, edi
add ecx, edi
cmp dword [ebp + 0x18], 0
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], ecx
je 0x424dd1
xor ebx, ebx
cmp dword [esi + 0x18], ebx
ja 0x424d86
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + ebx*4]
mov eax, dword [ebp + 0x18]
add edx, edi
push edx
push eax
call fcn.00424ca3
add esp, 8
test eax, eax
jne 0x424da9
inc ebx
cmp ebx, dword [esi + 0x18]
jb 0x424d83
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + ebx*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
add eax, edi
cmp eax, esi
jbe 0x424d76
add esi, dword [ebp - 4]
cmp eax, esi
jae 0x424d76
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx + ebx*4]
add ecx, edi
push ecx
jmp 0x424e60
mov ebx, edx
shr ebx, 0x10
test ebx, ebx
je 0x424e31
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jbe 0x424d74
jmp 0x424de9
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov ecx, dword [eax + ebx*4]
add ecx, edi
push ecx
push edx
call fcn.0042ca03
add esp, 8
test eax, eax
jne 0x424e09
inc ebx
cmp ebx, dword [esi + 0x18]
jb 0x424de3
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
movzx eax, word [edx + ebx*2]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax*4]
add eax, edi
cmp eax, esi
jbe 0x424d76
add esi, dword [ebp - 4]
cmp eax, esi
jae 0x424d76
mov ecx, dword [ebp + 0x10]
push ecx
jmp 0x424e60
cmp edx, dword [esi + 0x14]
jae 0x424d74
test edx, edx
je 0x424d74
mov eax, edx
sub eax, dword [esi + 0x10]
mov eax, dword [ecx + eax*4]
add eax, edi
cmp eax, esi
jbe 0x424d76
add esi, dword [ebp - 4]
cmp eax, esi
jae 0x424d76
push edx
mov edx, dword [ebp + 0x14]
push edi
push edx
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00425183
add esp, 0x14
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x425d53
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x425ea9
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x425ea9
push ebx
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x246]
push ecx
mov word [ebp - 0x248], ax
call fcn.0042bd03
push 0x80
push esi
call fcn.0042bcb3
push edi
call fcn.0042bea3
mov esi, eax
lea edx, [esi + esi]
push edx
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.0042bc83
mov ebx, dword [ebp + 8]
xor eax, eax
add esp, 0x24
mov dword [ebp - 0x40], 0x6f004c
mov dword [ebp - 0x3c], 0x610063
mov dword [ebp - 0x38], 0x20006c
mov dword [ebp - 0x34], 0x740053
mov dword [ebp - 0x30], 0x740061
mov dword [ebp - 0x2c], 0x65
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
xor edi, edi
cmp esi, 5
jbe 0x425e24
jmp 0x425e13
cmp word [ebp + esi*2 - 0x248], 0x5c
je 0x425e24
dec esi
cmp esi, 5
ja 0x425e13
lea ecx, [ebp - 0x40]
push ecx
call fcn.0042bea3
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp + esi*2 - 0x246]
push ecx
call fcn.0042bc83
push 0
push 0x15
lea edx, [ebp - 0x248]
push edx
push ebx
call fcn.00427f33
add esp, 0x20
test eax, eax
jne 0x425e72
inc edi
mov word [ebp + esi*2 - 0x248], ax
cmp edi, 3
jb 0x425e06
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x248]
xor ecx, ecx
push edx
mov word [ebp + esi*2 - 0x246], cx
call fcn.0042bea3
mov edx, dword [ebp + 0xc]
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x248]
push ecx
push edx
call fcn.0042bc83
add esp, 0x10
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42b293
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x42b2f9
cmp dword [esi + 0x18], 0
je 0x42b314
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0042ca33
add esp, 8
test eax, eax
jne 0x42b2f1
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x42b2d3
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x42b314
mov eax, dword [esi + 0x18]
test eax, eax
je 0x42b314
cmp eax, ecx
je 0x42b2f1
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x42b307
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42b323
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x42b37b
cmp dword [esi + 0x18], 0
je 0x42b37b
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0042ca33
add esp, 8
test eax, eax
jne 0x42b383
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x42b363
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42b393
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x42b3eb
cmp dword [esi + 0x18], 0
je 0x42b3eb
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0042ca33
add esp, 8
test eax, eax
jne 0x42b3f3
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x42b3d3
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42b483
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.0042bd03
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
cmp dword [esi + 0x18], 0
je 0x42b50e
mov edi, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x30]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0042c2c3
lea edx, [ebp - 0x10c]
push edx
push edi
call fcn.00424ca3
add esp, 0x10
test eax, eax
jne 0x42b516
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x42b4e3
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42b9f3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x42ba01
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42b9fd
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x42b9fd
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret
Function at 0x42ba43
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
test byte [edi + esi*8 - 0x1a5f3c45], 0xfe
mov byte [ebx - 0x56aa3e6e], ah
enter 0x10b3, 0x55
fadd dword [ecx - 0x60041984]
push esi
and al, 0x45
inc ebp
sbb ch, al
sub ah, byte [ecx + ecx*4]
adc dword ss:[edi + ebp*2], edx
salc
or dl, byte [ebx]
scasd eax, dword es:[edi]
ja 0x42ba63
sub edx, ebx
test al, 0xde
lodsd eax, dword [esi]
or dword [edx + 0x64], ebp
aaa
imul edx, dword [ecx - 0x5b90d20a], 0x75
out dx, eax
test eax, 0x3aa1c059
xor dword [ebx + 0x1faf3f14], edi
add byte [esi - 0x3e2603ed], 0x94
dec esp
aaa
aaa
add ecx, 0xffffffba
lahf
xchg edi, eax
out 0xcc, ax
sub dh, byte [ecx + 1]
mov esi, 0xb06e01a6
sbb byte [edi], ch
mov eax, 0xf51237eb
clc
jp fcn.0042bb23
dec edx
or cl, 0xb8
dec esi
mov esp, 0xa733118d
pop ecx
mov edx, 0x2b4024c3
xchg byte [esi + 0x59dc840d], cl
xchg dl, cl
ficom word [ebp + 0x37]
out 0x48, al
mov esp, 0xcbc364d9
adc eax, 0x46838968
mov esi, 0x80d69dbd
mov byte [0x21426d08], al
clc
stc
test byte [ebx + 0x3a], dh
mov eax, dword [0xe1813498]
xor dword [edi], 0xc8310d57
popal
test dword [ecx], esi
adc esi, ebp
sub dword [edi + 0x4d21752], edi
push ebp
dec edx
push esp
pop ecx
lds ecx, [eax]
cmc
dec esi
mov bl, 0x5b
lahf
mov dword es:[edx + 0x5ec68bdc], ebp
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42bb93
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x42bbb3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42bbb3
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x42bbb7
xor eax, eax
pop ebp
ret
mov eax, dword [eax + edx + 0x28]
test eax, eax
je 0x42bbb3
add eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x42c713
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x42c94f
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.0042bd03
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x42c8df
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x42c8d5
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.004180b3
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x42c900
inc eax
cmp byte [esi + eax], 0
jne 0x42c8f9
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.0042bc83
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x42c91d
inc edi
cmp byte [edi + ebx], 0
jne 0x42c916
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x42c92d
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x42c925
test esi, esi
je 0x42c942
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.0042bcd3
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ef60
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp sym.___write_memory.part.0
Function at 0x40f6d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x45b3a8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x45b3a0]
sub esp, 4
test ebx, ebx
je 0x40f725
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x40f71e
test eax, eax
jne 0x40f71e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40f700
mov dword [esp], 0x45b3a8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40f940
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x40f978
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40f96e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40f97a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40f960
xor eax, eax
pop ebx
pop esi
ret

Function at 0x40fd70
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40fdb0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x40fdd5
xor eax, eax
add esp, 0x1c
ret
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
jmp eax

Function at 0x410150
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x410184
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [global___key], eax
call dbg.__mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [0x44f37c], eax
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x410173
Function at 0x410230
Capabilities:
Set thread local storage value

Disassembly:
push ebp
push edi
mov ebp, eax
push esi
push ebx
mov ebx, edx
sub esp, 0x3c
mov esi, dword [eax + 0xc]
mov edi, dword [eax + 0x10]
mov eax, dword [edx]
mov dword [esp + 0x28], esi
jmp 0x41025c
mov dword [0x45b3c8], edx
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebx], eax
test eax, eax
je 0x410320
mov esi, dword [eax + 0x18]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov eax, dword [ebp]
mov edx, dword [ebp + 4]
mov dword [esp + 4], 0xa
mov dword [esp], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x28]
call eax
test eax, eax
jne 0x410380
test esi, esi
je 0x4102db
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov eax, dword [ebp]
mov edx, dword [ebp + 4]
mov dword [esp + 4], 0xa
mov dword [esp], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call esi
cmp eax, 7
je 0x410390
cmp eax, 8
jne 0x410380
mov eax, dword [ebx]
mov edx, dword [eax]
mov eax, dword [0x44f37c]
test eax, eax
js 0x410360
test eax, eax
je 0x410250
mov eax, dword [global___key]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x410256
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x410256
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov eax, dword [ebp]
mov edx, dword [ebp + 4]
mov esi, dword [esp + 0x28]
mov dword [esp + 4], 0x1a
mov dword [esp], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call esi
test eax, eax
jne 0x410380
add esp, 0x3c
mov al, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x2c], edx
call dbg.fc_key_init_once
mov eax, dword [0x44f37c]
mov edx, dword [esp + 0x2c]
jmp 0x4102e8
add esp, 0x3c
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x3c
mov eax, 7
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x410410
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x44f37c]
mov ebx, dword [esp + 0x30]
test eax, eax
js 0x410490
test eax, eax
jne 0x410440
mov eax, dword [0x45b3c8]
mov dword [0x45b3c8], ebx
mov dword [ebx], eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [global___key]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ebp, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [global___key]
sub esp, 4
mov dword [ebx], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x410435
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
jmp eax
call dbg.fc_key_init_once
mov eax, dword [0x44f37c]
jmp 0x410424
Function at 0x4104a0
Capabilities:
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov ebx, dword [eax]
mov eax, dword [0x44f37c]
test eax, eax
js 0x4104f0
test eax, eax
jne 0x4104c2
mov dword [0x45b3c8], ebx
add esp, 0x18
pop ebx
ret
mov eax, dword [global___key]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4104bd
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x18
pop ebx
jmp eax
call dbg.fc_key_init_once
mov eax, dword [0x44f37c]
jmp 0x4104b3

Function at 0x410600
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x44f37c]
mov edi, dword [esp + 0x50]
test eax, eax
js 0x4106ed
test eax, eax
mov esi, dword [0x45b3c8]
jne 0x410682
mov dword [esp + 0x2c], esi
mov eax, esi
lea ebp, [esp + 0x2c]
jmp 0x410671
mov edx, dword [eax + 0x18]
test edx, edx
je 0x41066b
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], edi
mov ecx, dword [edi]
mov ebx, dword [edi + 4]
mov dword [esp + 4], 1
mov dword [esp], 1
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
call edx
cmp eax, 6
je 0x4106b0
cmp eax, 8
jne 0x4106e0
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
test eax, eax
jne 0x410630
mov eax, 5
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [global___key]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x410622
mov eax, dword [esp + 0x2c]
mov dword [edi + 0xc], 0
mov edx, ebp
mov dword [esp + 0x2c], esi
mov dword [edi + 0x10], eax
mov eax, edi
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x41067a
mov eax, ebp
call sym._uw_install_context.isra.2
mov esi, esi
lea edi, [edi]
add esp, 0x3c
mov eax, 3
pop ebx
pop esi
pop edi
pop ebp
ret
call dbg.fc_key_init_once
mov eax, dword [0x44f37c]
jmp 0x410618

Function at 0x4107a0
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edx, dword [0x44f37c]
mov ebx, dword [esp + 0x30]
test edx, edx
js 0x410815
test edx, edx
mov eax, dword [0x45b3c8]
jne 0x4107ed
mov ecx, dword [ebx + 0xc]
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, ebx
mov edx, esi
test ecx, ecx
jne 0x4107df
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
je 0x4107e6
call sym._abort
call dbg._Unwind_ForcedUnwind_Phase2
jmp 0x4107d5
mov eax, esi
call sym._uw_install_context.isra.2
mov esi, dword [global___key]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
push edi
jmp 0x4107bd
call dbg.fc_key_init_once
mov edx, dword [0x44f37c]
jmp 0x4107b4
Function at 0x410830
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x410870
mov edx, dword [0x44f37c]
test edx, edx
js 0x4108c0
test edx, edx
mov eax, dword [0x45b3c8]
jne 0x410890
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x410880
call sym._abort
lea esi, [esi]
mov dword [esp], ebx
call dbg._Unwind_SjLj_RaiseException
add esp, 0x20
pop ebx
pop esi
pop edi
ret
lea eax, [esp + 0x1c]
call sym._uw_install_context.isra.2
lea esi, [esi]
mov esi, dword [global___key]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
sub esp, 4
jmp 0x410854
call dbg.fc_key_init_once
mov edx, dword [0x44f37c]
jmp 0x41084b
Function at 0x412420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [ebx - 0x50], eax
mov eax, dword [esp + 0x28]
sub ebx, 0x20
mov dword [ebx - 0x40], 1
mov dword [ebx - 0x2c], eax
call dbg.std::get_unexpected()
mov dword [ebx - 0x28], eax
call dbg.std::get_terminate()
mov dword [ebx], 0x432b2b00
mov dword [ebx - 0x24], eax
mov dword [ebx + 4], 0x474e5543
mov dword [ebx + 8], sym.__gxx_exception_cleanup__Unwind_Reason_Code___Unwind_Exception_
mov dword [esp], ebx
call dbg._Unwind_SjLj_RaiseException
mov dword [esp], ebx
call dbg.__cxa_begin_catch
call dbg.std::terminate()
nop
nop
nop
nop
nop
nop
nop
Function at 0x4012c0
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4012d8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov eax, dword [esp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [esi + 4], eax
pop esi
jne 0x4012f2
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov eax, ecx
ret 4