joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411c11
Capabilities:
Delete file

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
lea eax, [esp + 0x1c]
lea esi, [esp + 0x24]
mov dword [eax], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 8], eax
mov dword [ecx], edx
mov dword [esp + 0xc], ecx
xor edx, edx
mov ecx, 0x401907
mov dword [esp + 0x10], esi
mov dword [esi], edx
mov dword [esi + 4], 4
mov dword [esi + 8], edx
call fcn.00443e3d
test eax, eax
jne 0x411c78
call fcn.00444284
mov edi, dword [eax]
mov ecx, 0x401907
lea esi, [edi + 0x40]
call fcn.00443e3d
test eax, eax
je 0x411dc3
cmp dword [eax + 0x8c], edi
jne 0x411dd3
lea ecx, [esp + 8]
mov edx, eax
call fcn.004011dd
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov edx, ecx
mov dword [esp + 8], ebx
mov dword [esp + 0x10], eax
shl edx, 4
add edx, ebx
test ecx, ecx
mov dword [esp + 4], edx
mov dword [esp + 0x14], edx
je 0x411d9d
add ebx, 0x10
mov ebp, dword [ebx - 0x10]
cmp ebp, 0x80000000
je 0x411d9d
mov edx, dword [ebx - 0xc]
lea esi, [ebx - 0x10]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x18], edx
push dword [esi + 8]
call fcn.00450df0
add esp, 4
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
cmp eax, 0x80000000
je 0x411d19
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x30]
lea edx, [esp + 0x48]
mov dword [esp + 0x50], edi
call fcn.00456ba0
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
cmp edi, 0x80000000
jne 0x411d50
mov edi, dword [esp + 0x38]
cmp cl, 4
je 0x411d28
movzx ecx, cl
mov edx, edi
call fcn.00429aac
test ebp, ebp
je 0x411d3e
push dword [esp + 0x18]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
add esi, 0x10
add ebx, 0x10
cmp esi, dword [esp + 4]
jne 0x411cb1
jmp 0x411d99
mov dword [esp], ecx
push ecx
call dword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x411d76
mov eax, dword [esp]
test edi, edi
je 0x411d28
push eax
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x411d28
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, edi
mov edi, eax
test ecx, ecx
je 0x411d95
push dword [esp]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
xor ecx, ecx
jmp 0x411d1e
mov ebx, dword [esp + 4]
lea ecx, [esp + 8]
mov dword [ecx + 4], ebx
call fcn.00401d48
lea ecx, [esp + 0x20]
call fcn.00401e6f
lea ecx, [esp + 0x1c]
call fcn.00401fa2
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
lea edx, [esp + 8]
mov ecx, esi
call fcn.0046cec6
jmp 0x411c83
lea edi, [esp + 8]
mov ecx, esi
mov edx, eax
push edi
call fcn.0046cfee
add esp, 4
jmp 0x411c83

Function at 0x414338
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [edx], 2
movdqa xmmword [ecx], xmm0
ret
Function at 0x41b730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x41b780
cmp esi, edi
ja 0x41b7e8
cmp edi, dword [esp + 0x1c]
ja 0x41b7f6
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x41b782
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x41b770
jmp 0x41b7df
ja 0x41b788
cmp eax, edx
mov esi, edi
jne 0x41b743
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x41b7c0
mov ebp, esi
sub ecx, edx
jns 0x41b7d7
jmp 0x41b7e1
cmp esi, edi
je 0x41b806
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x41b7e1
xor al, 1
cmp ebp, edi
jne 0x41b7a0
jmp 0x41b7e1
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x475a3c
call fcn.0046ebe0
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x475a3c
call fcn.0046e9c0
mov ecx, 0x475a2c
call fcn.0046ed60
Function at 0x41ff28
Capabilities:
Set thread local storage value

Disassembly:
push edi
push esi
mov al, byte [0x48fdb4]
mov esi, ecx
xor ecx, ecx
mov edx, 0x40c
call fcn.0045a4d0
test eax, eax
je 0x41fe79
mov edi, eax
push 0x40c
push esi
push eax
call fcn.00462380
add esp, 0xc
mov eax, edi
pop esi
pop edi
ret
mov ecx, 4
mov edx, 0x40c
call fcn.0046d190
push esi
mov eax, dword [esp + 8]
mov eax, dword [eax]
mov esi, dword [eax]
mov dword [eax], 0
test esi, esi
je 0x41fea6
call 0x41feb0
mov ecx, dword [esi]
mov dword [ecx], eax
pop esi
ret
mov ecx, 0x47c168
call fcn.0046ed60
push edi
push esi
sub esp, 0x40c
mov ecx, esp
mov dword [ecx + 0x408], 0
call fcn.0041fe4a
mov esi, eax
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0x180
xor edi, edi
call fcn.0045a4d0
test eax, eax
je 0x41ff19
mov edx, eax
and edx, 0xffffffc0
mov dword [edx + 0x3c], eax
xor eax, eax
lea ecx, [edx + 0x40]
inc eax
mov dword [edx + 0x40], eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x80], esi
mov dword [edx + 0xc0], esi
mov dword [edx + 0x100], edi
mov dword [edx + 0x140], edi
mov eax, ecx
add esp, 0x40c
pop esi
pop edi
ret
mov ecx, 0x40
mov edx, 0x140
call fcn.0046d190
push edi
push esi
mov edi, dword [esp + 0xc]
mov esi, dword [edi]
mov eax, dword [esi]
test eax, eax
je 0x41ff6d
dec eax
push 1
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
call fcn.0041fa0e
push edi
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi]
test eax, eax
je 0x41ff76
dec eax
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
pop edi
ret
mov ecx, esi
call fcn.00471a40
jmp 0x41ff37
mov ecx, esi
call fcn.00471a40
jmp 0x41ff61

Function at 0x41ff7f
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x48f004]
test eax, eax
je 0x420035
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x41ffab
cmp dword [eax + 4], 0
mov edi, eax
je 0x41ffab
add edi, 8
jmp 0x420030
mov eax, dword [0x48f004]
test eax, eax
je 0x420044
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x42002e
mov esi, eax
test eax, eax
jne 0x420005
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0xc
call fcn.0045a4d0
test eax, eax
je 0x420066
mov dword [eax], 0x48f004
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x48f004]
test eax, eax
je 0x42005a
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [0x48fcb8]
cmp eax, 3
jne 0x420053
call fcn.0041f915
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov dword [esi + 4], 1
lea edi, [esi + 8]
mov dword [esi + 8], eax
call fcn.0041fa0e
jmp 0x420030
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x48f004
call fcn.00471a40
jmp 0x41ff8f
mov ecx, 0x48f004
call fcn.00471a40
jmp 0x41ffb9
call fcn.0046efc6
jmp 0x42000f
mov ecx, 0x48f004
call fcn.00471a40
jmp 0x41fffd
mov ecx, 4
mov edx, 0xc
call fcn.0046d190
Function at 0x4202d9
Capabilities:
Manipulate console buffer

Disassembly:
push ebx
push edi
push esi
sub esp, 0x48
lea esi, [esp + 0x10]
mov edi, ecx
mov ebx, edx
mov ecx, esi
call fcn.00421150
cmp byte [esi], 4
jne 0x4202f9
mov esi, dword [esp + 0x14]
jmp 0x420315
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
movzx ecx, al
cmp ecx, 4
je 0x420315
je 0x420315
mov dword [edi + 4], esi
mov dword [edi], eax
jmp 0x4203f1
movzx eax, word [esp + 0x58]
test bx, bx
mov word [esp], bx
mov word [esp + 2], ax
js 0x42036e
test ax, ax
js 0x42038f
mov ecx, dword [esi + 8]
mov word [esp + 0xc], bx
mov word [esp + 0xe], ax
mov eax, dword [esp + 0xc]
push eax
push ecx
call sub.kernel32.dll_SetConsoleCursorPosition
test eax, eax
jne 0x4203e2
mov ebx, dword [sym.imp.kernel32.dll_GetLastError]
call ebx
xor ecx, ecx
mov edx, eax
call fcn.00429aac
call ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
jmp 0x4203d3
mov eax, esp
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
lea ebx, [esp + 0x30]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 4], fcn.0041f500
mov dword [edx], str.Argument_Out_of_Range_Exception_when_setting_cursor_position_to_X:
jmp 0x4203b0
lea eax, [esp + 2]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
lea ebx, [esp + 0x3c]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 4], fcn.0041f500
mov dword [edx], str.Argument_Out_of_Range_Exception_when_setting_cursor_position_to_Y:
inc eax
mov dword [edx + 4], eax
mov dword [edx + 0x10], 0
mov dword [edx + 8], ecx
mov dword [edx + 0xc], eax
mov ecx, ebx
call fcn.004146f0
lea ecx, [esp + 4]
mov edx, ebx
call fcn.00420163
cmp byte [esp + 4], 4
je 0x4203e2
mov eax, dword [esp + 4]
cmp al, 4
jne 0x4203f8
mov byte [edi], 4
lock dec dword [esi]
jne 0x4203f1
mov ecx, esi
call fcn.0042105a
add esp, 0x48
pop esi
pop edi
pop ebx
ret
mov ecx, dword [esp + 8]
mov dword [edi], eax
mov dword [edi + 4], ecx
jmp 0x4203e5
Function at 0x4217d9
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
lea edx, [esp + 8]
mov dword [esp], ecx
xor eax, eax
mov ecx, 0x12
mov edi, edx
rep stosd dword es:[edi], eax
mov byte [edx + 0x48], 0
mov edx, 0x120
mov al, byte [0x48fdb4]
xor ecx, ecx
call fcn.0045a4d0
test eax, eax
je 0x4217ca
mov ebp, eax
push 0xc8
push 0
push eax
call fcn.00462900
add esp, 0xc
mov edi, ebp
lea eax, [esp + 4]
mov dword [ebp + 0xc8], 0x18
mov ecx, 0x13
lea edx, [esp + 8]
add edi, 0xcc
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x12
mov edi, edx
mov al, byte [eax + 0x4c]
mov byte [ebp + 0x118], al
xor eax, eax
rep stosd dword es:[edi], eax
mov byte [edx + 0x48], 0
mov edx, 0x120
mov al, byte [0x48fdb4]
xor ecx, ecx
call fcn.0045a4d0
test eax, eax
je 0x4217ca
mov ebx, eax
push 0xc8
push 0
push eax
call fcn.00462900
add esp, 0xc
mov edi, ebx
lea eax, [esp + 4]
mov dword [ebx + 0xc8], 0x18
mov ecx, 0x13
mov edx, 0x479b28
add edi, 0xcc
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov al, byte [eax + 0x4c]
mov ecx, dword [esp]
mov byte [ebx + 0x118], al
mov dword [ecx + 0xc], ebp
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], edx
mov dword [ecx], 0x80000000
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 8
mov edx, 0x120
call fcn.0046d190
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov ecx, 0x48
mov dl, byte [esi + 0x118]
mov edi, eax
lea ebx, [esi + 0xd0]
movzx ebp, dl
sub ecx, ebp
sub edi, ecx
jae 0x42181f
add ebx, ebp
push eax
push dword [esp + 0x28]
push ebx
mov edi, eax
call fcn.00462380
add esp, 0xc
add ebp, edi
mov ebx, ebp
jmp 0x4218e8
test dl, dl
mov dword [esp + 8], ebx
je 0x42186c
mov edx, dword [esp + 0x24]
mov eax, ebp
add eax, ebx
lea ebp, [edx + ecx]
push ecx
push edx
push eax
call fcn.00462380
add esp, 0xc
mov eax, 0xffffffb8
mov ecx, dword [esi + eax + 0x118]
mov edx, dword [esi + eax + 0x11c]
xor dword [esi + eax + 0x48], ecx
xor dword [esi + eax + 0x4c], edx
add eax, 8
jne 0x421842
mov edx, dword [esi + 0xc8]
mov ecx, esi
call fcn.00432dd8
jmp 0x421874
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
mov ecx, 0x38e38e39
mov eax, edi
mov ebx, edi
mul ecx
shr edx, 4
lea eax, [edx*8]
lea ecx, [eax + eax*8]
sub ebx, ecx
add ecx, ebp
cmp edi, 0x48
mov dword [esp + 4], ebx
mov dword [esp], ecx
jb 0x4218d3
lea eax, [edx + edx*8]
lea edi, [ebp + eax*8]
lea ebx, [ebp + 0x48]
mov eax, 0xffffffb8
mov ecx, dword [ebp + eax + 0x48]
mov edx, dword [ebp + eax + 0x4c]
xor dword [esi + eax + 0x48], ecx
xor dword [esi + eax + 0x4c], edx
add eax, 8
jne 0x4218ab
mov edx, dword [esi + 0xc8]
mov ecx, esi
call fcn.00432dd8
cmp ebx, edi
mov ebp, ebx
jne 0x4218a3
mov ebx, dword [esp + 4]
push ebx
push dword [esp + 4]
push dword [esp + 0x10]
call fcn.00462380
add esp, 0xc
mov byte [esi + 0x118], bl
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x421bdb
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
movzx ebp, byte [edx + 0x48]
mov ebx, dword [esp + 0x14]
mov esi, ecx
mov ecx, 0x48
mov edi, edx
lea eax, [edx + ebp]
sub ecx, ebp
push ecx
push 0
push eax
call fcn.00462900
add esp, 0xc
mov byte [edi + 0x48], 0
mov byte [edi + ebp], 6
or byte [edi + 0x47], 0x80
mov eax, 0xffffffb8
mov ecx, dword [edi + eax + 0x48]
mov edx, dword [edi + eax + 0x4c]
xor dword [esi + eax + 0x48], ecx
xor dword [esi + eax + 0x4c], edx
add eax, 8
jne 0x421c12
mov edx, dword [esi + 0xc8]
mov ecx, esi
call fcn.00432dd8
mov eax, 0xffffffc0
movsd xmm0, qword [esi + eax + 0x40]
movsd qword [ebx + eax + 0x40], xmm0
add eax, 8
jne 0x421c39
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x421c94
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov edi, dword [esp + 0x54]
mov dword [esp], ecx
test edi, edi
je 0x421d16
mov eax, dword [edx]
mov ebp, dword [esp + 0x50]
mov esi, 0x103
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
push eax
push eax
push edi
push ebp
lea ecx, [esp + 0x1c]
push ecx
push eax
push eax
push eax
push dword [esp + 0x28]
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, esi
jne 0x421ce9
push 0xffffffffffffffff
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 0xc]
cmp eax, 0xc0000011
je 0x421d32
cmp eax, 0x103
je 0x421d5d
and ebx, 0xffffff00
test eax, eax
js 0x421d1e
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x421d32
cmp edi, ecx
jb 0x421d51
or ebx, 4
add ebp, ecx
sub edi, ecx
jne 0x421cb5
mov eax, dword [esp]
mov byte [eax], 4
jmp 0x421d3f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
mov edi, eax
call fcn.00451aa0
cmp al, 0xb
jne 0x421d47
mov eax, dword [esp]
mov byte [eax], 2
mov dword [eax + 4], 0x479b70
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp]
mov dword [eax], ebx
mov dword [eax + 4], edi
jmp 0x421d3f
mov edx, edi
push 0x479bc8
call fcn.0046e900
lea edx, [esp + 0x24]
xor eax, eax
lea ecx, [esp + 0x14]
lea esi, [esp + 4]
mov dword [ecx], eax
mov dword [edx], 0x47ea3c
mov dword [edx + 4], 1
mov dword [edx + 0x10], eax
mov dword [edx + 8], esi
mov byte [ecx + 4], 0
mov dword [edx + 0xc], eax
lea esi, [esp + 0x1c]
push edx
push ecx
push esi
call fcn.0044e9d0
add esp, 0xc
mov ecx, dword [esi]
mov edx, dword [esi + 4]
call fcn.0044eb30
mov ecx, 7
int 0x29
ud2
Function at 0x440a24
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov dword [esp + 0x18], ecx
xor ecx, ecx
mov esi, edx
inc ecx
call fcn.00421515
mov byte [edx], 0x20
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], esi
movzx eax, word [esi + 6]
imul ax, word [esi + 4]
movzx edi, ax
test di, di
je 0x440af9
lea eax, [edi*8]
xor ecx, ecx
xor ebx, ebx
lea ebp, [eax + eax*2]
mov al, byte [0x48fdb4]
mov edx, ebp
call fcn.0045a4d0
test eax, eax
je 0x440b4e
mov ecx, esp
mov esi, eax
xor ebp, ebp
mov dword [ecx], edi
mov dword [ecx + 4], esi
mov dword [ecx + 8], 0
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x1c]
push 1
call fcn.00415160
add esp, 4
cmp ebp, dword [esp]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov word [esp + 0x30], 0
jne 0x440ac8
mov ecx, esp
mov edx, ebp
call fcn.00440878
mov esi, dword [esp + 4]
mov ebp, dword [esp + 8]
movsd xmm0, qword [esp + 0x2c]
lea eax, [ebp + ebp*2]
inc ebp
dec edi
movsd qword [esi + eax*8 + 0x10], xmm0
movsd xmm0, qword [esp + 0x1c]
movsd xmm1, qword [esp + 0x24]
movsd qword [esi + eax*8 + 8], xmm1
movsd qword [esi + eax*8], xmm0
mov dword [esp + 8], ebp
jne 0x440a91
jmp 0x440b0c
mov dword [esp], edi
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov ecx, dword [esp + 0x18]
movsd xmm0, qword [esp]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 8]
cmp dword [esp + 0x10], 0
movsd qword [ecx], xmm0
movsd xmm0, qword [edx]
mov dword [ecx + 8], eax
movsd qword [ecx + 0xc], xmm0
je 0x440b46
push dword [esp + 0xc]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, ebp
call fcn.0046d190
Function at 0x440fe8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov eax, dword [0x48f3d4]
mov esi, ecx
test eax, eax
je 0x44119d
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x44101d
mov ebx, eax
mov eax, dword [eax]
or eax, dword [ebx + 4]
jne 0x44118c
mov eax, dword [0x48f3d4]
test eax, eax
je 0x4411ac
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x441191
mov ebx, eax
test eax, eax
jne 0x441080
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0x38
xor edi, edi
call fcn.0045a4d0
test eax, eax
je 0x4411e8
mov dword [eax + 4], edi
mov dword [eax], edi
mov dword [eax + 0x30], 0x48f3d4
mov ebx, eax
mov eax, dword [0x48f3d4]
test eax, eax
je 0x4411bb
dec eax
push ebx
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x4410cf
mov eax, dword [esi]
xor ecx, ecx
mov dword [esi], ecx
or eax, dword [esi + 4]
mov dword [esi + 4], ecx
je 0x4410cf
movsd xmm0, qword [esi + 0x14]
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x20]
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [esi + 0xc]
mov dword [esp + 0x20], edx
mov edx, dword [esi + 0x24]
mov dword [esp + 0xc], ecx
mov ecx, dword [esi + 0x28]
mov dword [esp], eax
mov dword [esp + 8], edi
movsd qword [esp + 0x10], xmm0
mov dword [esp + 4], ecx
jmp 0x441125
call fcn.0045d7a0
test eax, eax
je 0x4411ca
mov ecx, dword [eax + 0xc]
mov edx, dword [eax]
movsd xmm0, qword [0x47bae8]
movsd xmm1, qword [0x47bae0]
mov dword [esp], 0
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov ecx, edx
mov edx, dword [eax + 4]
add ecx, 1
mov dword [eax], ecx
mov ecx, edx
adc ecx, 0
mov dword [eax + 4], ecx
movsd qword [esp + 0x1c], xmm0
movsd qword [esp + 0x14], xmm1
lea eax, [esp + 0x28]
mov ecx, 0xc
mov esi, ebx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 4], 0
mov dword [ebx], 1
mov ecx, dword [esp]
mov dword [ebx + 8], ecx
movsd xmm0, qword [esp + 0x10]
movsd xmm1, qword [esp + 0x18]
movsd qword [ebx + 0xc], xmm0
movsd qword [ebx + 0x14], xmm1
mov ecx, dword [esp + 0x20]
mov dword [ebx + 0x1c], ecx
mov ecx, dword [esp + 8]
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x20], ecx
mov ecx, dword [esp + 4]
mov dword [ebx + 0x28], ecx
mov ecx, dword [esp + 0xc]
mov dword [ebx + 0x2c], ecx
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x44118c
lea ecx, [esp + 0x38]
call fcn.0043c7d7
add ebx, 8
jmp 0x441193
xor ebx, ebx
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x48f3d4
call fcn.00471a40
jmp 0x441004
mov ecx, 0x48f3d4
call fcn.00471a40
jmp 0x44102b
mov ecx, 0x48f3d4
call fcn.00471a40
jmp 0x441078
lea eax, [esp + 0x28]
mov ecx, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction5q_Q3_U___4_xT_pq_u__4_CYh__8oR
mov edx, 0x46
push 0x47c1c8
push 0x47bb9c
push eax
call fcn.0046ece0
mov ecx, 8
mov edx, 0x38
call fcn.0046d190
Function at 0x443cce
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x48f3f4]
mov esi, ecx
test eax, eax
je 0x443d78
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x443cf7
cmp dword [eax + 4], 0
je 0x443cf7
add eax, 8
jmp 0x443d75
mov eax, dword [0x48f3f4]
test eax, eax
je 0x443d87
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x443d62
mov edi, eax
test eax, eax
jne 0x443d4d
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0xc
call fcn.0045a4d0
test eax, eax
je 0x443da2
mov dword [eax], 0x48f3f4
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x48f3f4]
test eax, eax
je 0x443d96
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x443d66
mov ecx, dword [esi]
mov dword [esi], 0
test ecx, ecx
je 0x443d68
mov ecx, dword [esi + 4]
jmp 0x443d68
xor eax, eax
jmp 0x443d75
xor ecx, ecx
lea eax, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
pop esi
pop edi
ret
mov ecx, 0x48f3f4
call fcn.00471a40
jmp 0x443ce0
mov ecx, 0x48f3f4
call fcn.00471a40
jmp 0x443d05
mov ecx, 0x48f3f4
call fcn.00471a40
jmp 0x443d45
mov ecx, 4
mov edx, 0xc
call fcn.0046d190
push edi
push esi
mov edi, dword [esp + 0xc]
mov esi, dword [edi]
mov eax, dword [esi]
test eax, eax
je 0x443deb
dec eax
push 1
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push edi
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi]
test eax, eax
je 0x443df4
dec eax
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
pop edi
ret
mov ecx, esi
call fcn.00471a40
jmp 0x443dc0
mov ecx, esi
call fcn.00471a40
jmp 0x443ddf
Function at 0x443db1
Capabilities:
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x48f3f4]
mov esi, ecx
test eax, eax
je 0x443d78
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x443cf7
cmp dword [eax + 4], 0
je 0x443cf7
add eax, 8
jmp 0x443d75
mov eax, dword [0x48f3f4]
test eax, eax
je 0x443d87
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x443d62
mov edi, eax
test eax, eax
jne 0x443d4d
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0xc
call fcn.0045a4d0
test eax, eax
je 0x443da2
mov dword [eax], 0x48f3f4
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x48f3f4]
test eax, eax
je 0x443d96
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x443d66
mov ecx, dword [esi]
mov dword [esi], 0
test ecx, ecx
je 0x443d68
mov ecx, dword [esi + 4]
jmp 0x443d68
xor eax, eax
jmp 0x443d75
xor ecx, ecx
lea eax, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
pop esi
pop edi
ret
mov ecx, 0x48f3f4
call fcn.00471a40
jmp 0x443ce0
mov ecx, 0x48f3f4
call fcn.00471a40
jmp 0x443d05
mov ecx, 0x48f3f4
call fcn.00471a40
jmp 0x443d45
mov ecx, 4
mov edx, 0xc
call fcn.0046d190
push edi
push esi
mov edi, dword [esp + 0xc]
mov esi, dword [edi]
mov eax, dword [esi]
test eax, eax
je 0x443deb
dec eax
push 1
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push edi
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi]
test eax, eax
je 0x443df4
dec eax
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
pop edi
ret
mov ecx, esi
call fcn.00471a40
jmp 0x443dc0
mov ecx, esi
call fcn.00471a40
jmp 0x443ddf
Function at 0x4459c1
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x48f3e4]
test eax, eax
je 0x445a57
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4459e7
cmp dword [eax + 4], 0
je 0x4459e7
add eax, 8
jmp 0x445a55
mov eax, dword [0x48f3e4]
test eax, eax
je 0x445a66
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x445a53
mov esi, eax
test eax, eax
jne 0x445a39
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0x14
call fcn.0045a4d0
test eax, eax
je 0x445a81
mov dword [eax], 0x48f3e4
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x48f3e4]
test eax, eax
je 0x445a75
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
lea eax, [esi + 8]
xor ecx, ecx
mov dword [esi + 4], 1
mov dword [esi + 8], ecx
mov word [esi + 0xc], 0
mov dword [esi + 0x10], ecx
jmp 0x445a55
xor eax, eax
pop esi
ret
mov ecx, 0x48f3e4
call fcn.00471a40
jmp 0x4459d0
mov ecx, 0x48f3e4
call fcn.00471a40
jmp 0x4459f1
mov ecx, 0x48f3e4
call fcn.00471a40
jmp 0x445a31
mov ecx, 4
mov edx, 0x14
call fcn.0046d190
push esi
sub esp, 8
mov eax, dword [esp + 0x10]
call 0x445a9d
pop edx
mov ecx, dword [esp + 0x14]
mov eax, dword [eax]
mov esi, dword [eax]
add edx, dword [esi*4 + 0x445b0c]
jmp edx